Resubmissions
15-10-2024 12:09
241015-pbyrlatbna 815-10-2024 12:06
241015-n98tsatapf 315-10-2024 11:58
241015-n5mqrasgnb 10Analysis
-
max time kernel
1343s -
max time network
2004s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15-10-2024 12:09
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher.exe
Resource
win10-20240404-en
General
-
Target
TLauncher.exe
-
Size
8.9MB
-
MD5
505731086d2f448e68c025a7003efe00
-
SHA1
e8358cf87df55712a7b6998d1816e94b57f3b7c1
-
SHA256
978dfe8f0fbb57398366e2302055b58fa641258f53db6909fca2b5a1e87ff3c5
-
SHA512
856ad2f0caa72c15b20831c7e1d8917329907381e1e95ce470ff3592755804cc17cd507c105d49fdecbc418a2c3f2b01e1be2ce15dc981aeb7f39ce2889cb4d4
-
SSDEEP
196608:vRAQAHQHWFm5kAiFWnuf6J/+Ift24xJN+vwvasDU6sU0s:LUn6nDJ/+v4xJprUB4
Malware Config
Signatures
-
Downloads MZ/PE file
-
Drops file in Drivers directory 16 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\SETDBD1.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxNetAdp6.sys MsiExec.exe File opened for modification C:\Windows\System32\drivers\SETCBC0.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxSup.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SETC9AF.tmp MsiExec.exe File opened for modification C:\Windows\System32\drivers\wireguard.sys DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxNetLwf.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SETC8C5.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SETC9AF.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SETDA97.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SETDBD1.tmp MsiExec.exe File created C:\Windows\System32\drivers\SETCBC0.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tapprotonvpn.sys DrvInst.exe File created C:\Windows\system32\DRIVERS\SETC8C5.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxUSBMon.sys MsiExec.exe File created C:\Windows\system32\DRIVERS\SETDA97.tmp MsiExec.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation ProtonVPN_v3.3.2.tmp Key value queried \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation ProtonVPN_v3.3.2.tmp Key value queried \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation ProtonVPN.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 4808 VirtualBox-7.1.2-164945-Win.exe 2128 VirtualBox.exe 720 VBoxSVC.exe 1072 VBoxSDS.exe 3108 ProtonVPN_v3.3.2.exe 5940 ProtonVPN_v3.3.2.tmp 6528 ProtonVPN_v3.3.2.exe 6560 ProtonVPN_v3.3.2.tmp 9780 ProtonVPN_win_v2.4.3(3).exe 11092 go.microsoft.com 10636 MicrosoftEdgeUpdate.exe 10584 MicrosoftEdgeUpdate.exe 12464 MicrosoftEdgeUpdate.exe 12500 MicrosoftEdgeUpdateComRegisterShell64.exe 12548 MicrosoftEdgeUpdateComRegisterShell64.exe 12580 MicrosoftEdgeUpdateComRegisterShell64.exe 12624 MicrosoftEdgeUpdate.exe 12676 MicrosoftEdgeUpdate.exe 12728 MicrosoftEdgeUpdate.exe 12780 MicrosoftEdgeUpdate.exe 11204 MicrosoftEdge_X64_129.0.2792.89.exe 11304 setup.exe 11428 setup.exe 12268 MicrosoftEdgeUpdate.exe 4040 VirtualBoxVM.exe 13076 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 5892 VirtualBoxVM.exe 13124 MicrosoftEdgeUpdate.exe 13272 MicrosoftEdgeUpdate.exe 6856 MicrosoftEdgeUpdate.exe 4984 VirtualBoxVM.exe 7124 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 5608 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 7380 VirtualBoxVM.exe 7628 ProtonVPN_win_v2.4.3(3).exe 8512 ProtonVPN_win_v2.4.3(3).exe 8576 ProtonVPNTap_1.1.4.exe 9548 tapinstall.exe 9600 tapinstall.exe 10472 tapinstall.exe 10348 ProtonVPNTun_0.13.1.exe 10712 ProtonVPN_win_v2.4.3(3).exe 12328 MSIE4F3.tmp 10636 ProtonVPN.exe 7028 ProtonVPNService.exe 8620 ProtonVPN.WireGuardService.exe 12468 ProtonVPN.WireGuardService.exe 4808 VirtualBox-7.1.2-164945-Win.exe 2128 VirtualBox.exe 720 VBoxSVC.exe 1072 VBoxSDS.exe 3108 ProtonVPN_v3.3.2.exe 5940 ProtonVPN_v3.3.2.tmp 6528 ProtonVPN_v3.3.2.exe 6560 ProtonVPN_v3.3.2.tmp 9780 ProtonVPN_win_v2.4.3(3).exe 11092 go.microsoft.com 10636 MicrosoftEdgeUpdate.exe 10584 MicrosoftEdgeUpdate.exe 12464 MicrosoftEdgeUpdate.exe 12500 MicrosoftEdgeUpdateComRegisterShell64.exe -
Loads dropped DLL 64 IoCs
pid Process 1128 MsiExec.exe 1128 MsiExec.exe 1128 MsiExec.exe 1128 MsiExec.exe 1128 MsiExec.exe 1128 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 1116 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 200 MsiExec.exe 200 MsiExec.exe 200 MsiExec.exe 200 MsiExec.exe 200 MsiExec.exe 200 MsiExec.exe 200 MsiExec.exe 200 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 720 VBoxSVC.exe 720 VBoxSVC.exe 1072 VBoxSDS.exe 1072 VBoxSDS.exe 720 VBoxSVC.exe 5940 ProtonVPN_v3.3.2.tmp 6560 ProtonVPN_v3.3.2.tmp 9780 ProtonVPN_win_v2.4.3(3).exe 9780 ProtonVPN_win_v2.4.3(3).exe 10496 MsiExec.exe 10496 MsiExec.exe 10636 MicrosoftEdgeUpdate.exe 12500 MicrosoftEdgeUpdateComRegisterShell64.exe 12464 MicrosoftEdgeUpdate.exe 12548 MicrosoftEdgeUpdateComRegisterShell64.exe 12464 MicrosoftEdgeUpdate.exe 12580 MicrosoftEdgeUpdateComRegisterShell64.exe 12464 MicrosoftEdgeUpdate.exe 12728 MicrosoftEdgeUpdate.exe 12676 MicrosoftEdgeUpdate.exe 6552 MsiExec.exe 6552 MsiExec.exe 6552 MsiExec.exe 6552 MsiExec.exe 6552 MsiExec.exe 6552 MsiExec.exe 6552 MsiExec.exe 6552 MsiExec.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2828 icacls.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{5D0F40C5-4278-4AA0-A06C-7BD24B088624} = "\"C:\\Users\\Admin\\Downloads\\ProtonVPN_win_v2.4.3(3).exe\" /cmdloc \"HKCU\\Software\\Proton Technologies AG AiTemp\\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\"" ProtonVPN_win_v2.4.3(3).exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProtonVPN = "C:\\Program Files (x86)\\Proton Technologies\\ProtonVPN\\ProtonVPN.exe" ProtonVPN.exe -
Blocklisted process makes network request 39 IoCs
flow pid Process 799 8904 msiexec.exe 800 8904 msiexec.exe 801 10112 msiexec.exe 802 10112 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 810 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 802 10112 msiexec.exe 801 10112 msiexec.exe 799 8904 msiexec.exe 800 8904 msiexec.exe 801 10112 msiexec.exe 802 10112 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 810 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 802 10112 msiexec.exe 801 10112 msiexec.exe 799 8904 msiexec.exe 800 8904 msiexec.exe 801 10112 msiexec.exe 802 10112 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 810 8492 msiexec.exe 809 8492 msiexec.exe 809 8492 msiexec.exe 802 10112 msiexec.exe 801 10112 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ProtonVPN.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: VirtualBox-7.1.2-164945-Win.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\X: VirtualBox-7.1.2-164945-Win.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\A: VirtualBox-7.1.2-164945-Win.exe File opened (read-only) \??\H: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\W: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: VirtualBox-7.1.2-164945-Win.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: VirtualBox-7.1.2-164945-Win.exe File opened (read-only) \??\X: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\X: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\G: VirtualBox-7.1.2-164945-Win.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\H: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\Q: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\R: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\Q: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\R: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\O: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\U: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: ProtonVPN_win_v2.4.3(3).exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: VirtualBox-7.1.2-164945-Win.exe -
Checks system information in the registry 2 TTPs 14 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\DRVSTORE\VBoxSup_BF9A0567BB6CBF830D0DC10D2354765A1B0EEF0C\VBoxSup.sys MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{682427b6-8cc3-f844-8887-43eed6f998f8}\SETDB04.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{682427b6-8cc3-f844-8887-43eed6f998f8}\VBoxNetAdp6.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{682427b6-8cc3-f844-8887-43eed6f998f8} DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91d4ba8d-8168-204c-ba11-ac9d8612ede8}\SETCB71.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e517442f-2e7f-8a47-bce4-54809cf66db8}\SETD93F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{682427b6-8cc3-f844-8887-43eed6f998f8}\SETDB04.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91d4ba8d-8168-204c-ba11-ac9d8612ede8}\SETCB72.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f4c5b0a-30a3-0b44-8e48-ea3e33baf0c4}\SETB94D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_30dfe63a970b4eed\VBoxNetLwf.sys DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies MicrosoftEdgeUpdate.exe File created C:\Windows\System32\DriverStore\Temp\{91d4ba8d-8168-204c-ba11-ac9d8612ede8}\SETCB72.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f4c5b0a-30a3-0b44-8e48-ea3e33baf0c4}\wireguard.cat DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f4c5b0a-30a3-0b44-8e48-ea3e33baf0c4} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{31ba0a38-a7dd-be48-a80a-269014cf4aac} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_30dfe63a970b4eed\VBoxNetLwf.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_56290c9e296b5be9\netpacer.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba4c0fa2d195a7ca\oemvista.PNF DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4f4c5b0a-30a3-0b44-8e48-ea3e33baf0c4}\SETB94C.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_6eeae9a694adb180\VBoxUSB.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e517442f-2e7f-8a47-bce4-54809cf66db8} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_286311b3ad406c73\netrass.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{91d4ba8d-8168-204c-ba11-ac9d8612ede8}\SETCB71.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRVSTORE\VBoxSup_BF9A0567BB6CBF830D0DC10D2354765A1B0EEF0C\VBoxSup.inf MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{31ba0a38-a7dd-be48-a80a-269014cf4aac}\VBoxUSB.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_30dfe63a970b4eed\VBoxNetLwf.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91d4ba8d-8168-204c-ba11-ac9d8612ede8} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4f4c5b0a-30a3-0b44-8e48-ea3e33baf0c4}\SETB94E.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f\wireguard.PNF DrvInst.exe File created C:\Windows\system32\DRVSTORE\VBoxUSBMon_AAF35A803ED066E13FF7F850DE8BABF216AF9062\VBoxUSBMon.cat MsiExec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_23069e5b67ce90a4\c_netservice.PNF MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{31ba0a38-a7dd-be48-a80a-269014cf4aac}\VBoxUSB.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_e610f6f65afdc230\netnb.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_30dfe63a970b4eed\vboxnetlwf.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91d4ba8d-8168-204c-ba11-ac9d8612ede8}\tapprotonvpn.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f\wireguard.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e517442f-2e7f-8a47-bce4-54809cf66db8}\SETD941.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{682427b6-8cc3-f844-8887-43eed6f998f8}\SETDB06.tmp DrvInst.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\VirtualBox\VBoxSDS.log VBoxSDS.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91d4ba8d-8168-204c-ba11-ac9d8612ede8}\tapprotonvpn.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba4c0fa2d195a7ca\tapprotonvpn.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba4c0fa2d195a7ca\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_6eeae9a694adb180\VBoxUSB.inf DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_739e9ec110147b31\netbrdg.PNF MsiExec.exe File created C:\Windows\system32\DRVSTORE\VBoxSup_BF9A0567BB6CBF830D0DC10D2354765A1B0EEF0C\VBoxSup.cat MsiExec.exe File created C:\Windows\system32\DRVSTORE\VBoxUSBMon_AAF35A803ED066E13FF7F850DE8BABF216AF9062\VBoxUSBMon.inf MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{e517442f-2e7f-8a47-bce4-54809cf66db8}\SETD941.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f\wireguard.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91d4ba8d-8168-204c-ba11-ac9d8612ede8}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f4c5b0a-30a3-0b44-8e48-ea3e33baf0c4}\SETB94C.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_6eeae9a694adb180\VBoxUSB.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_9b48be32f09b1fb6\netnwifi.PNF MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 45 IoCs
pid Process 4040 VirtualBoxVM.exe 4040 VirtualBoxVM.exe 13076 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 5892 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 7124 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 5608 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 7380 VirtualBoxVM.exe 4040 VirtualBoxVM.exe 4040 VirtualBoxVM.exe 13076 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 5892 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 7124 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 5608 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 7380 VirtualBoxVM.exe 4040 VirtualBoxVM.exe 4040 VirtualBoxVM.exe 13076 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 5892 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 7124 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 5608 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 7380 VirtualBoxVM.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\identity_proxy\win10\identity_helper.Sparse.Internal.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\msedge_200_percent.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\Locales\ms.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\7za.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_eu.qm msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\mspdf.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\msedge_elf.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\th.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\Locales\sl.pak setup.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ka.qm msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\identity_proxy\beta.identity_helper.exe.manifest setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\sr.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\nl-NL\ProtonVPN.Translations.resources.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxDD.dll msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\fr.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\Locales\fil.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\Locales\id.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD4EE.tmp\msedgeupdateres_mk.dll go.microsoft.com File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\el.pak setup.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\fi.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\identity_proxy\win11\identity_helper.Sparse.Dev.msix setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.WireGuardService.exe msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\Temp\EUD4EE.tmp\MicrosoftEdgeUpdateSetup.exe go.microsoft.com File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\nn.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\x86\ProtonVPN.NetworkUtil.dll msiexec.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\BouncyCastle.Crypto.dll msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\VisualElements\LogoDev.png setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.Service.Contract.dll msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\Locales\ka.pak setup.exe File created C:\Program Files\Oracle\VirtualBox\VBoxWebSrv.exe msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD4EE.tmp\psuser_64.dll go.microsoft.com File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\el.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\Caliburn.Micro.dll msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\edge_feedback\camera_mf_trace.wprp setup.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_da.qm msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\eu.pak setup.exe File created C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\x86.d msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\gu.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.HumanVerification.dll msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\onnxruntime.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\VisualElements\SmallLogoBeta.png setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\identity_helper.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\et.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\msedge_wer.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\cs.pak setup.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_it.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_pt.qm msiexec.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\OxyPlot.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\doc\UserManual.pdf msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD4EE.tmp\msedgeupdateres_nn.dll go.microsoft.com File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_TW.qm msiexec.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.Announcements.Contracts.dll msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\Locales\ko.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\Polly.Contrib.WaitAndRetry.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\Qt6WidgetsVBox.dll msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Trust Protection Lists\Mu\Entities setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\6222d487-daba-440e-8e5e-07770166cdba.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\learning_tools.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.89\Trust Protection Lists\Sigma\Fingerprinting setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows10\x86\tapprotonvpn.Sys msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD4EE.tmp\msedgeupdateres_hi.dll go.microsoft.com File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.89\Locales\mt.pak setup.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\e59b80d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID8B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID7C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE441.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID857.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID899.tmp msiexec.exe File created C:\Windows\INF\oem3.PNF MsiExec.exe File opened for modification C:\Windows\Installer\MSIE095.tmp msiexec.exe File opened for modification C:\Windows\Installer\e6ac6af.msi msiexec.exe File opened for modification C:\Windows\Installer\e6ac6b4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID878.tmp msiexec.exe File created C:\Windows\INF\oem7.PNF DrvInst.exe File created C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSID1F6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID1A6.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIDE1B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC9E3.tmp-\TapInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSICC74.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBB1A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBF84.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC331.tmp msiexec.exe File created C:\Windows\Installer\e6ac6af.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC8E3.tmp msiexec.exe File created C:\Windows\Installer\e6ac6b3.msi msiexec.exe File created C:\Windows\Installer\{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA}\protonvpn.exe msiexec.exe File opened for modification C:\Windows\Installer\{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA}\protonvpn.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIDEAA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDFD6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE4B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID1D5.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA} msiexec.exe File created C:\Windows\Installer\e6ac6b8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBD02.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIC982.tmp msiexec.exe File created C:\Windows\inf\oem7.inf DrvInst.exe File created C:\Windows\Installer\e59b80b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC2F2.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{87BDF456-9882-44E6-8FFC-F73B83E42EAD} msiexec.exe File opened for modification C:\Windows\Installer\MSIBBA8.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{708E52B5-CAE0-4474-ABCF-7FCD4B203ACE} msiexec.exe File created C:\Windows\INF\oem4.PNF MsiExec.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIBC36.tmp msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIDB05.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE0E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID889.tmp msiexec.exe File opened for modification C:\Windows\inf\oem6.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIBB69.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE140.tmp msiexec.exe File created C:\Windows\Installer\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\protonvpn.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(1).exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(2).exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\VirtualBox-7.1.2-164945-Win.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\ProtonVPN_v3.3.2.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3.exe:Zone.Identifier firefox.exe -
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
pid Process 12328 MSIE4F3.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPN_win_v2.4.3(3).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPN_win_v2.4.3(3).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPN_v3.3.2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language go.microsoft.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPNTun_0.13.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPN_win_v2.4.3(3).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIE4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VirtualBox-7.1.2-164945-Win.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPN_v3.3.2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPN_win_v2.4.3(3).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPN_v3.3.2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPN_v3.3.2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtonVPNTap_1.1.4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 12624 MicrosoftEdgeUpdate.exe 12780 MicrosoftEdgeUpdate.exe 12268 MicrosoftEdgeUpdate.exe 6856 MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A ProtonVPN.WireGuardService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 ProtonVPN.WireGuardService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe -
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Interface\{11BE93C7-A862-4DC9-8C89-BF4BA74A886A} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D23A9CA3-42DA-C94B-8AEC-21968E08355D}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C4B1B5F4-8CDF-4923-9EF6-B92476A84109}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{147816C8-17E0-11EB-81FA-87CEA6263E1A}\NumMethods\ = "55" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A88033D-82DB-4AC2-97B5-E786C839420E}\ = "IUpdateAgentErrorEvent" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4DA2DEC7-71B2-4817-9A64-4ED12C17388E}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{9DB3A9E6-7F29-4AAE-A627-5A282C83092C}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{93BADC0C-61D9-4940-A084-E6BB29AF3D83}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{739160a6-53ea-465b-bb6b-5326c20a3c0c} VirtualBox.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff VirtualBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F529A14-ACE3-407C-9C49-066E8E8027F0}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1D978B8-F7B7-4B05-900E-2A9253C00F51}\NumMethods\ = "28" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D7B98D2B-30E8-447E-99CB-E31BECAE6AE4}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B25E8070EAC4744BAFCF7DCB402A3EC\VBoxNetworkFlt = "VBoxNetwork" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BEA3EF5C-DE2F-4B74-AA3A-15D6249371A0}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{52F40B16-520E-473F-9428-3E69B0D915C3}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D3D5F1EE-BCB2-4905-A7AB-CC85448A742B}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{6A5E65BA-EEB9-11EA-AE38-73242BC0F172}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{6F302674-C927-11E7-B788-33C248E71FC7}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{A5BBDB7D-8CE7-469F-A4C2-6476F581FF72}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59A235AC-2F1A-4D6C-81FC-E3FA843F49AE}\NumMethods VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1474BB3A-F096-4CD7-A857-8D8E3CEA7331}\TypeLib VirtualBox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" VirtualBox.exe Key created \REGISTRY\MACHINE\Software\Classes\progId_VirtualBox.Shell.ova\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40C2B86-73A5-46CC-8227-93FE57D006A6}\NumMethods VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F529A14-ACE3-407C-9C49-066E8E8027F0}\TypeLib VirtualBox.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8F79A21-1207-4179-94CF-CA250036308F}\TypeLib VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6B2F98F8-9641-4397-854A-040439D0114B}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FDEBBF0-BE30-49C0-B315-E9749E1BDED1}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{B66349B5-3534-4239-B2DE-8E1535D94C0B} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EB5DE7D-9A67-4FDE-83BE-F768084D03B5}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{714A3EEF-799A-4489-86CD-FE8E45B2FF8E}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\050FBE1BE3CC0B54D95E33C926143FAD\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{50C97996-9CF8-417F-BD79-1E0471367CD3}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45587218-4289-EF4E-8E6A-E5B07816B631}\ = "IUSBDeviceFilter" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5748F794-48DF-438D-85EB-98FFD70D18C9}\NumMethods\ = "14" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{B79DE686-EABD-4FA6-960A-F1756C99EA1C}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{48C7F4C0-C9D6-4742-957C-A6FD52E8C4AE}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6620DB85-44E0-CA69-E9E0-D4907CECCBE5}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E36A5081-A82A-40BD-9E4E-42A44D6CE50F}\TypeLib VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A85BBA40-1B93-47BB-B125-DEC708C30FC0}\ProxyStubClsid32 VirtualBox.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{01ADB2D6-AEDF-461C-BE2C-99E91BDAD8A1}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{08E25756-08A2-41AF-A05F-D7C661ABAEBE}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5587D0F6-A227-4F23-8278-2F675EEA1BB2}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{41304F1B-7E72-4F34-B8F6-682785620C57} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4F529A14-ACE3-407C-9C49-066E8E8027F0}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7191CF38-3E8A-11E9-825C-AB7B2CABCE23}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF398A9A-6B76-4805-8FAB-00A9DCF4732B}\ = "IFramebufferOverlay" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF398A9A-6B76-4805-8FAB-00A9DCF4732B}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" MicrosoftEdgeUpdateComRegisterShell64.exe -
NTFS ADS 8 IoCs
description ioc Process File created C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(1).exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(2).exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\Oracle_VirtualBox_Extension_Pack-7.1.2.vbox-extpack:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\VirtualBox-7.1.2-164945-Win.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\ProtonVPN_v3.3.2.exe:Zone.Identifier firefox.exe File opened for modification C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_v3.3.2.exe.9d1nq02.partial:Zone.Identifier browser_broker.exe File created C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3.exe:Zone.Identifier firefox.exe -
Suspicious behavior: AddClipboardFormatListener 18 IoCs
pid Process 2128 VirtualBox.exe 4040 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 2128 VirtualBox.exe 4040 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 7364 VirtualBoxVM.exe 2128 VirtualBox.exe 4040 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 7364 VirtualBoxVM.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2828 msiexec.exe 2828 msiexec.exe 10496 MsiExec.exe 10496 MsiExec.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 6552 MsiExec.exe 6552 MsiExec.exe 13124 MicrosoftEdgeUpdate.exe 13124 MicrosoftEdgeUpdate.exe 13124 MicrosoftEdgeUpdate.exe 13124 MicrosoftEdgeUpdate.exe 13272 MicrosoftEdgeUpdate.exe 13272 MicrosoftEdgeUpdate.exe 7956 MsiExec.exe 7956 MsiExec.exe 7956 MsiExec.exe 7956 MsiExec.exe 10112 msiexec.exe 10112 msiexec.exe 9484 rundll32.exe 9484 rundll32.exe 9484 rundll32.exe 9484 rundll32.exe 10112 msiexec.exe 10112 msiexec.exe 4828 MsiExec.exe 4828 MsiExec.exe 10112 msiexec.exe 10112 msiexec.exe 2828 msiexec.exe 2828 msiexec.exe 10496 MsiExec.exe 10496 MsiExec.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 10636 MicrosoftEdgeUpdate.exe 6552 MsiExec.exe 6552 MsiExec.exe 13124 MicrosoftEdgeUpdate.exe 13124 MicrosoftEdgeUpdate.exe 13124 MicrosoftEdgeUpdate.exe 13124 MicrosoftEdgeUpdate.exe 13272 MicrosoftEdgeUpdate.exe 13272 MicrosoftEdgeUpdate.exe 7956 MsiExec.exe 7956 MsiExec.exe 7956 MsiExec.exe 7956 MsiExec.exe 10112 msiexec.exe 10112 msiexec.exe 9484 rundll32.exe 9484 rundll32.exe 9484 rundll32.exe 9484 rundll32.exe 10112 msiexec.exe 10112 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 9 IoCs
pid Process 2128 VirtualBox.exe 4040 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 2128 VirtualBox.exe 4040 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 2128 VirtualBox.exe 4040 VirtualBoxVM.exe 6368 VirtualBoxVM.exe -
Suspicious behavior: LoadsDriver 30 IoCs
pid Process 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found 624 Process not Found -
Suspicious behavior: MapViewOfSection 33 IoCs
pid Process 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1384 firefox.exe Token: SeDebugPrivilege 1384 firefox.exe Token: SeDebugPrivilege 1384 firefox.exe Token: SeShutdownPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeIncreaseQuotaPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSecurityPrivilege 2828 msiexec.exe Token: SeCreateTokenPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeAssignPrimaryTokenPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeLockMemoryPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeIncreaseQuotaPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeMachineAccountPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeTcbPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSecurityPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeTakeOwnershipPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeLoadDriverPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSystemProfilePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSystemtimePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeProfSingleProcessPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeIncBasePriorityPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeCreatePagefilePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeCreatePermanentPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeBackupPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeRestorePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeShutdownPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeDebugPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeAuditPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSystemEnvironmentPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeChangeNotifyPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeRemoteShutdownPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeUndockPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSyncAgentPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeEnableDelegationPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeManageVolumePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeImpersonatePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeCreateGlobalPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeCreateTokenPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeAssignPrimaryTokenPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeLockMemoryPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeIncreaseQuotaPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeMachineAccountPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeTcbPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSecurityPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeTakeOwnershipPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeLoadDriverPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSystemProfilePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSystemtimePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeProfSingleProcessPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeIncBasePriorityPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeCreatePagefilePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeCreatePermanentPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeBackupPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeRestorePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeShutdownPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeDebugPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeAuditPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSystemEnvironmentPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeChangeNotifyPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeRemoteShutdownPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeUndockPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeSyncAgentPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeEnableDelegationPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeManageVolumePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeImpersonatePrivilege 4808 VirtualBox-7.1.2-164945-Win.exe Token: SeCreateGlobalPrivilege 4808 VirtualBox-7.1.2-164945-Win.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 4808 VirtualBox-7.1.2-164945-Win.exe 2128 VirtualBox.exe 4808 VirtualBox-7.1.2-164945-Win.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 9780 ProtonVPN_win_v2.4.3(3).exe 9780 ProtonVPN_win_v2.4.3(3).exe 2128 VirtualBox.exe 2128 VirtualBox.exe 4040 VirtualBoxVM.exe 6064 VirtualBoxVM.exe 4984 VirtualBoxVM.exe 6368 VirtualBoxVM.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 7364 VirtualBoxVM.exe 7628 ProtonVPN_win_v2.4.3(3).exe 7628 ProtonVPN_win_v2.4.3(3).exe 8904 msiexec.exe 8904 msiexec.exe 8492 msiexec.exe 8492 msiexec.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 10636 ProtonVPN.exe 1384 firefox.exe 1384 firefox.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 10636 ProtonVPN.exe 1384 firefox.exe 1384 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 10636 ProtonVPN.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 3668 firefox.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1004 javaw.exe 1004 javaw.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 5692 MicrosoftEdge.exe 2828 MicrosoftEdgeCP.exe 5320 MicrosoftEdgeCP.exe 2828 MicrosoftEdgeCP.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 11092 go.microsoft.com 10636 MicrosoftEdgeUpdate.exe 10584 MicrosoftEdgeUpdate.exe 12464 MicrosoftEdgeUpdate.exe 12624 MicrosoftEdgeUpdate.exe 12676 MicrosoftEdgeUpdate.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 2128 VirtualBox.exe 3668 firefox.exe 3668 firefox.exe 3668 firefox.exe 1004 javaw.exe 1004 javaw.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe 1384 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4144 wrote to memory of 1004 4144 TLauncher.exe 74 PID 4144 wrote to memory of 1004 4144 TLauncher.exe 74 PID 1004 wrote to memory of 2828 1004 javaw.exe 75 PID 1004 wrote to memory of 2828 1004 javaw.exe 75 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 2900 wrote to memory of 1384 2900 firefox.exe 79 PID 1384 wrote to memory of 5088 1384 firefox.exe 80 PID 1384 wrote to memory of 5088 1384 firefox.exe 80 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 PID 1384 wrote to memory of 4552 1384 firefox.exe 81 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\TLauncher.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
PID:2828
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.0.635414996\2111842147" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1688 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c3afcb7-cc4c-4ccf-870d-d4e511822f2b} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 1776 1d45bdd8a58 gpu3⤵PID:5088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.1.135455311\640410134" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77a2cede-1531-4a9b-9c4d-927f0ee466d3} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 2128 1d449771f58 socket3⤵
- Checks processor information in registry
PID:4552
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.2.1656237059\2073261464" -childID 1 -isForBrowser -prefsHandle 2740 -prefMapHandle 2736 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {655e8b8c-123f-44c2-be51-448917a7172b} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 2888 1d45fc99058 tab3⤵PID:3432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.3.887396702\1490651412" -childID 2 -isForBrowser -prefsHandle 3324 -prefMapHandle 3332 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e26b6839-fe16-43f7-85ef-172512207a8b} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 3652 1d449762858 tab3⤵PID:5016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.4.792014631\654686614" -childID 3 -isForBrowser -prefsHandle 3808 -prefMapHandle 3812 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {500145a6-8482-4c7b-b4fa-5b002d42fc9e} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 3968 1d461ceeb58 tab3⤵PID:3448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.5.1208612745\2000324170" -childID 4 -isForBrowser -prefsHandle 4880 -prefMapHandle 4868 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f36c0c4-7dde-4371-b49b-c1d2ca18a37d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 1540 1d4624ce758 tab3⤵PID:3568
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.6.2033304839\1276893664" -childID 5 -isForBrowser -prefsHandle 2644 -prefMapHandle 4912 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87db3366-0346-44fb-a9e7-59f07631be17} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 4948 1d4624cf358 tab3⤵PID:348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.7.761063826\1201179083" -childID 6 -isForBrowser -prefsHandle 5076 -prefMapHandle 4880 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f51e0e03-a6a0-4391-82cd-bb63dbeec450} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5324 1d4624d0b58 tab3⤵PID:3592
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.8.1616886590\1535442660" -childID 7 -isForBrowser -prefsHandle 5624 -prefMapHandle 5620 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c66a6ab-94dd-4ea4-85d3-01f38ad3ec9d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5632 1d462491858 tab3⤵PID:596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.9.444525523\1878786949" -childID 8 -isForBrowser -prefsHandle 5044 -prefMapHandle 5040 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a8c46ab-004f-4dc2-970e-feb170bdba3d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5032 1d45e50e458 tab3⤵PID:488
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4824
-
C:\Users\Admin\Downloads\VirtualBox-7.1.2-164945-Win.exe"C:\Users\Admin\Downloads\VirtualBox-7.1.2-164945-Win.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4808 -
C:\Program Files\Oracle\VirtualBox\VirtualBox.exe"C:\Program Files\Oracle\VirtualBox\VirtualBox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2128
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0EE3DDF621BEEA9EF00B57CA88E470B8 C2⤵
- Loads dropped DLL
PID:1128
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4632
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 510401B5BDAAF1F743E68CDE25559C5C2⤵
- Loads dropped DLL
PID:2500
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4DC5311C1FAB8F2429A7781BD2DF51F22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1116
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F1137181115C69440C378EF05EBEAA50 E Global\MSI00002⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:200
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EAF7908838E84AF0DFB48E60F68E873B M Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3432
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:4908
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf" "9" "48f6bcb47" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:872
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf" "9" "431e52bcb" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3592
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf" "9" "473b17b7b" "000000000000017C" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3848
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:2440
-
C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe"C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:720 -
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe"C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" --comment "windows 10" --startvm 8ab28263-912f-491c-b67d-1d752ac1650c --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows 10\Logs\VBoxHardening.log"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4040 -
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe60eaff78-4bdd-042d-2e72-669728efd737-suplib-2ndchild --comment "windows 10" --startvm 8ab28263-912f-491c-b67d-1d752ac1650c --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows 10\Logs\VBoxHardening.log"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:13076
-
-
-
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe"C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" --comment "windows 10" --startvm 8ab28263-912f-491c-b67d-1d752ac1650c --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows 10\Logs\VBoxHardening.log"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:6064 -
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe60eaff78-4bdd-042d-2e72-669728efd737-suplib-2ndchild --comment "windows 10" --startvm 8ab28263-912f-491c-b67d-1d752ac1650c --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows 10\Logs\VBoxHardening.log"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5892
-
-
-
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe"C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" --comment windows --startvm 1c3597c1-2a5e-43d6-b9f2-b52e39813d57 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows\Logs\VBoxHardening.log"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:4984 -
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe60eaff78-4bdd-042d-2e72-669728efd737-suplib-2ndchild --comment windows --startvm 1c3597c1-2a5e-43d6-b9f2-b52e39813d57 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows\Logs\VBoxHardening.log"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7124
-
-
-
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe"C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" --comment windows --startvm 1c3597c1-2a5e-43d6-b9f2-b52e39813d57 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows\Logs\VBoxHardening.log"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:6368 -
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe60eaff78-4bdd-042d-2e72-669728efd737-suplib-2ndchild --comment windows --startvm 1c3597c1-2a5e-43d6-b9f2-b52e39813d57 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows\Logs\VBoxHardening.log"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5608
-
-
-
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe"C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" --comment windows --startvm 1c3597c1-2a5e-43d6-b9f2-b52e39813d57 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows\Logs\VBoxHardening.log"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:7364 -
C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe60eaff78-4bdd-042d-2e72-669728efd737-suplib-2ndchild --comment windows --startvm 1c3597c1-2a5e-43d6-b9f2-b52e39813d57 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\windows\Logs\VBoxHardening.log"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7380
-
-
-
C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe"C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1072
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:1568
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:2900
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3668 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.0.423914009\1729246206" -parentBuildID 20221007134813 -prefsHandle 1604 -prefMapHandle 1552 -prefsLen 21136 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3f628a7-c803-4bce-ac01-924f9e178e88} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 1684 17292efb958 gpu3⤵PID:4348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.1.1077271612\1559899729" -parentBuildID 20221007134813 -prefsHandle 1980 -prefMapHandle 1976 -prefsLen 21181 -prefMapSize 233583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7b49919-8285-468c-9c45-5d65047a64bc} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 2004 17287ee1758 socket3⤵
- Checks processor information in registry
PID:3744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.2.750113819\1039022792" -childID 1 -isForBrowser -prefsHandle 2556 -prefMapHandle 2604 -prefsLen 21642 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76052709-b6f7-4ed9-8168-09d9a1aa10eb} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 2768 17292f5a958 tab3⤵PID:4132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.3.1377838398\122903191" -childID 2 -isForBrowser -prefsHandle 3368 -prefMapHandle 3364 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b16f9153-f5c2-4c0b-be84-d757c773c1c8} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 3380 17297c57558 tab3⤵PID:4056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.4.1869948932\1466946161" -childID 3 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81498ea9-967f-4afe-b601-80f15edd36d3} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 3780 17297c56f58 tab3⤵PID:2236
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.5.109897575\625615279" -childID 4 -isForBrowser -prefsHandle 4488 -prefMapHandle 4472 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b17f26a4-a611-44f9-ba0d-8d0fd2b4294d} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 4500 17295655e58 tab3⤵PID:3228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.6.842218880\112157446" -childID 5 -isForBrowser -prefsHandle 4652 -prefMapHandle 4656 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {386bf53d-65b9-4502-9a13-4f165469172e} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 4644 17299170858 tab3⤵PID:1980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.7.1861454825\1008207880" -childID 6 -isForBrowser -prefsHandle 4840 -prefMapHandle 4844 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {865a91b0-06c5-4956-8be7-ebd76b77e523} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 4832 1729916d858 tab3⤵PID:5056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.8.1905122844\185267537" -childID 7 -isForBrowser -prefsHandle 3860 -prefMapHandle 5308 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe4c2b9d-9d0b-48a1-a046-01a63fede388} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 3832 17295625e58 tab3⤵PID:3960
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.9.1192021703\1365524208" -parentBuildID 20221007134813 -prefsHandle 5532 -prefMapHandle 4316 -prefsLen 26820 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cc9f2f6-4418-4903-b088-36091e6bdcaf} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 5548 1729b41b558 rdd3⤵PID:1316
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.10.1335908842\1187045686" -childID 8 -isForBrowser -prefsHandle 5724 -prefMapHandle 5564 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18361c4c-c8f0-45b0-9344-ce658c4561ab} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 5368 17297adf958 tab3⤵PID:4844
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.11.1972441025\68931780" -childID 9 -isForBrowser -prefsHandle 5888 -prefMapHandle 5892 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b237a9c5-d45a-4f77-8e67-97cf8a0fcbf4} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 5876 172995bc258 tab3⤵PID:4008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.12.59372701\501901500" -childID 10 -isForBrowser -prefsHandle 7012 -prefMapHandle 7000 -prefsLen 26820 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fab73a9-a52e-4f40-8c42-facc6b1fa4ad} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 6084 17299551458 tab3⤵PID:2664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.13.1101081455\1879529752" -childID 11 -isForBrowser -prefsHandle 5472 -prefMapHandle 3836 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4893650b-7769-4c5f-942c-19dd2532f565} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 3828 1729b777e58 tab3⤵PID:4456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.14.444657701\67740314" -childID 12 -isForBrowser -prefsHandle 5360 -prefMapHandle 3780 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {585151b6-cec0-4e89-8d4d-84537acd8d63} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 6060 1729ad57458 tab3⤵PID:872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.15.2023729321\1415448478" -childID 13 -isForBrowser -prefsHandle 5704 -prefMapHandle 5844 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8527bd3d-6875-45ea-b7a0-bf45721d31fa} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 9544 17299cd5c58 tab3⤵PID:5556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.16.1343169599\1721329583" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 9384 -prefMapHandle 9364 -prefsLen 26829 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfd99ec6-fffe-43d7-98d1-8af351c15aa8} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 9280 1729ad4dd58 utility3⤵PID:5840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.17.755042696\389162757" -childID 14 -isForBrowser -prefsHandle 6988 -prefMapHandle 9724 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12706de6-8efb-4f70-a2e1-10cba4e5bc64} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 5388 1729ab21958 tab3⤵PID:6032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.18.548709391\352916190" -childID 15 -isForBrowser -prefsHandle 9692 -prefMapHandle 6992 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83068fb5-f4ef-4f7a-97c1-5eac55b0c17f} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 5944 1729abbba58 tab3⤵PID:6040
-
-
C:\Users\Admin\Downloads\ProtonVPN_v3.3.2.exe"C:\Users\Admin\Downloads\ProtonVPN_v3.3.2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\is-D96MT.tmp\ProtonVPN_v3.3.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-D96MT.tmp\ProtonVPN_v3.3.2.tmp" /SL5="$12007E,83693934,1033216,C:\Users\Admin\Downloads\ProtonVPN_v3.3.2.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5940
-
-
-
C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe"C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:9780 -
C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\WebView2 Runtime\go.microsoft.com"C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\WebView2 Runtime\go.microsoft.com" /silent /install4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:11092 -
C:\Program Files (x86)\Microsoft\Temp\EUD4EE.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUD4EE.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"5⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:10636 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:10584
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:12464 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.25\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.25\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:12500
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.25\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.25\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:12548
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.25\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.25\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:12580
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzU4MTQwRTctMTM4MC00NjU1LUE5NzItQTZEODg2NEMxRUYzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFQjdBRjU3QS0yRjg1LTRBRTUtODIyMi05NzFCRDc5MERBOEJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjI1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjEzODE0MzcwMCIgaW5zdGFsbF90aW1lX21zPSIyNDgiLz48L2FwcD48L3JlcXVlc3Q-6⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:12624
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{758140E7-1380-4655-A972-A6D8864C1EF3}" /silent6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:12676
-
-
-
-
-
C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe"C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:7628 -
C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap_1.1.4.exe"C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap_1.1.4.exe"4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:8576 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{87BDF456-9882-44E6-8FFC-F73B83E42EAD}\3E42EAD\ProtonVPNTap_1.1.4.msi AI_SETUPEXEPATH="C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap_1.1.4.exe" SETUPEXEDIR="C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1728753600 " AI_EUIMSI=""5⤵
- Blocklisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:8904
-
-
-
C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTun\ProtonVPNTun_0.13.1.exe"C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTun\ProtonVPNTun_0.13.1.exe"4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:10348 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA}\241F3DA\ProtonVPNTun_0.13.1.msi AI_SETUPEXEPATH="C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTun\ProtonVPNTun_0.13.1.exe" SETUPEXEDIR="C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTun\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1728753600 " AI_EUIMSI=""5⤵
- Blocklisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:8492
-
-
-
C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe"C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe" /i C:\Users\Admin\AppData\Local\Temp\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\B088624\ProtonVPN_win_v2.4.3.msi AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Proton Technologies\ProtonVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="7628" AI_MORE_CMD_LINE=14⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:10712
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5692
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- NTFS ADS
PID:6116 -
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_v3.3.2.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_v3.3.2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6528 -
C:\Users\Admin\AppData\Local\Temp\is-489NV.tmp\ProtonVPN_v3.3.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-489NV.tmp\ProtonVPN_v3.3.2.tmp" /SL5="$5042E,83693934,1033216,C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_v3.3.2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6560
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2828
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5320
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:5436
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5796
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:5428
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:2920
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6356
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:6232
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6864
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:10112 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 49841FCFE7585FA1861E9E631ECEA356 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:10496
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C35C0BD6AB49D5CA995B23DF8ECD54A8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6552
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B8A5666F62F214C63F30B4813123B6F3 C2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:7956 -
C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe"C:\Users\Admin\Downloads\ProtonVPN_win_v2.4.3(3).exe" /groupsextract:100;101; /out:"C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites" /callbackid:79563⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8512
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A2557688D00274B93EC513B3B611BBB1 C2⤵
- System Location Discovery: System Language Discovery
PID:8868
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8104158FC4FD4267BF44E5603CD6772D2⤵
- System Location Discovery: System Language Discovery
PID:9156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIC9E3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241879515 15 TapInstaller!TapInstaller.CustomActions.InstallTapAdapter3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:9484 -
C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" hwids tapprotonvpn4⤵
- Executes dropped EXE
PID:9548
-
-
C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" install OemVista.inf tapprotonvpn4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:9600
-
-
C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" status tapprotonvpn4⤵
- Executes dropped EXE
PID:10472
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BCCD24E19D26ECFDCB1976A5488157E4 C2⤵
- System Location Discovery: System Language Discovery
PID:10464
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D5FE970C6655AFF9BDD7C7AF675D13172⤵
- System Location Discovery: System Language Discovery
PID:11008
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B9650833CEFD8122483E21678C26C5E62⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4828
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BD4BC11F5A04D17900AE0C46F87DD3CD E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:10212
-
-
C:\Windows\Installer\MSIE4F3.tmp"C:\Windows\Installer\MSIE4F3.tmp" /EnforcedRunAsAdmin /DontWait /dir "C:\Program Files (x86)\Proton Technologies\ProtonVPN\" "C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe" /lang "en-US"2⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
PID:12328
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:12728 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzU4MTQwRTctMTM4MC00NjU1LUE5NzItQTZEODg2NEMxRUYzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MjE0OEQ0RTMtMDY1MC00RjhCLUFCNTgtRTlEOUMzMDk5ODYzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlFFTVUiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjE5MyIgaW5zdGFsbGRhdGV0aW1lPSIxNzEyMjMzNzA4IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTY3MDY1ODUxNDYwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIxNDA0NTczNjQiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies data under HKEY_USERS
PID:12780
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B73FE63B-EE17-402C-B943-233D1AA83CF0}\MicrosoftEdge_X64_129.0.2792.89.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B73FE63B-EE17-402C-B943-233D1AA83CF0}\MicrosoftEdge_X64_129.0.2792.89.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:11204 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B73FE63B-EE17-402C-B943-233D1AA83CF0}\EDGEMITMP_A852D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B73FE63B-EE17-402C-B943-233D1AA83CF0}\EDGEMITMP_A852D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B73FE63B-EE17-402C-B943-233D1AA83CF0}\MicrosoftEdge_X64_129.0.2792.89.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
PID:11304 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B73FE63B-EE17-402C-B943-233D1AA83CF0}\EDGEMITMP_A852D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B73FE63B-EE17-402C-B943-233D1AA83CF0}\EDGEMITMP_A852D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.101 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B73FE63B-EE17-402C-B943-233D1AA83CF0}\EDGEMITMP_A852D.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.89 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff6ec3276f0,0x7ff6ec3276fc,0x7ff6ec3277084⤵
- Executes dropped EXE
PID:11428
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzU4MTQwRTctMTM4MC00NjU1LUE5NzItQTZEODg2NEMxRUYzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEQTlFMEY2NS04MTQ0LTRGODQtODNCQS03QThBRDc1OTM0MTN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyOS4wLjI3OTIuODkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyMTc1OTE5ODE2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIxNzU5MTk4MTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzk1NTQ5MTgzMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYjUzZmEyMTctNmY0NC00NTg1LWE0ZWMtNzBlZDM1ZjJhYTczP1AxPTE3Mjk1OTk3NjQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SWhFckk2JTJiYyUyZlRDVW1hU0V3JTJmekRlUnNPVFNUJTJmanA4TFolMmJ0Z2pISnZrU01sbFVMcGRaRGdNMXZ2UjkzMWo1dU9TYkE0UGVKME5GZFYlMmZIbFBlVjVHaUElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM5MDM5NTIiIHRvdGFsPSIxNzM5MDM5NTIiIGRvd25sb2FkX3RpbWVfbXM9IjE3MzcyNCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzOTU1NTUxOTAzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM5NzAwNTYxMTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0NTYzNDIzMjA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzQ4IiBkb3dubG9hZF90aW1lX21zPSIxNzc5NjQiIGRvd25sb2FkZWQ9IjE3MzkwMzk1MiIgdG90YWw9IjE3MzkwMzk1MiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNTkzMzYiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies data under HKEY_USERS
PID:12268
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:13124
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:13272 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0U2OUYzMUUtMjg4OS00N0UyLTlGMzMtN0RERkU5ODBCQzkwfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins3RUU4N0NBQy1BQTA4LTQ0MTgtQUQ2RS1ERTZENzkwMzNENzJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O2RsNHhKM2NKU1RNRHVuM0pkTC80WnhHOWpKTEJuQ1Z2K3NMZkhWNnVTWTQ9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuMjUiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC4wNSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIi8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyOS4wLjI3OTIuODkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjY0OTYiIGNvaG9ydD0icnJmQDAuNjgiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9IntDRjk1QjdBNy04Q0E5LTQ2ODUtQjAwMS00REJCOTIyRjc2OEJ9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies data under HKEY_USERS
PID:6856
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -s DeviceInstall1⤵
- Checks SCSI registry key(s)
PID:9676 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{555bd1cb-cfcf-944c-9af4-19abaab43d53}\oemvista.inf" "9" "4334ff507" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\proton technologies\protonvpntap\windows10\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:9724
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0001" "C:\Windows\INF\oem6.inf" "oemvista.inf:3beb73aff103cc24:tapprotonvpn.ndi:9.24.6.601:tapprotonvpn," "4334ff507" "0000000000000174"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:9980
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Windows\Temp\3598907d6e1eb1e49d7cdcfd6c40a72f741c76a3a62617954c6eed9e7cb015ae\wireguard.inf" "9" "43a59b543" "0000000000000140" "Service-0x0-3e7$\Default" "0000000000000180" "208" "C:\Windows\Temp\3598907d6e1eb1e49d7cdcfd6c40a72f741c76a3a62617954c6eed9e7cb015ae"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:10252
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "SWD\WireGuard\{EAB2262D-9AB1-5975-7D92-334D06F4972B}" "" "" "4bfae609f" "0000000000000000"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:10956
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "SWD\WireGuard\{EAB2262D-9AB1-5975-7D92-334D06F4972B}" "" "" "4bfae609f" "0000000000000000"2⤵
- Drops file in Windows directory
PID:6924
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:10036
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:10056
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:12632
-
C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe" /lang "en-US"1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:10636
-
C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPNService.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPNService.exe"1⤵
- Executes dropped EXE
PID:7028
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:9088
-
C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.WireGuardService.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.WireGuardService.exe" "C:\ProgramData\ProtonVPN\WireGuard\ProtonVPN.conf"1⤵
- Executes dropped EXE
PID:8620 -
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
- Modifies data under HKEY_USERS
PID:10760
-
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4304
-
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:10640
-
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:12504
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
PID:10960
-
C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.WireGuardService.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.WireGuardService.exe" "C:\ProgramData\ProtonVPN\WireGuard\ProtonVPN.conf"1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:12468 -
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe2⤵PID:12808
-
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe2⤵PID:5444
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:10048
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Privilege Escalation
Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Access Token Manipulation
1Create Process with Token
1File and Directory Permissions Modification
1Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5f9c839f9c41497032de021cee0f68c30
SHA1b98c1754fbde72c829f4f4cd1187d2eca04381fe
SHA256215853eaaaeb1b1d17bc0d70aa5f93f2c26ab5ca5b5e936fad9596537f40d4b1
SHA512a34817b86e8c0d8ddff20ce039b627d7c7f039985fce6f5fb660eea0c1546f37ddadb2e2d72e0b9a01d5eed5944747ccbb5a228144ae9863c40efe3d995cbd2f
-
Filesize
11KB
MD52f3233e2983aa35c026331e3cbbfa550
SHA1c8f8b5461d724a2b51b1f742aa7dea6f65316c35
SHA256ad7799ee025f4e27f23b65f3ab9780daccb9f039aa87f91909f1783d48782da3
SHA512d057e9d6a2067eca255e9ced8061ffba85e9906f8a88c9a1d6aea3c57521478561b89d5210b601471d4ad9f083e6e6b9ede9f53d401d129db7686acf29682a5b
-
Filesize
9KB
MD524910951c937b499e2027e7ce09d7245
SHA1ededfdb8591a9d73481097f3bc5e70dec0c0349b
SHA2561add17998c94487b94c0b115fcd51feaea81af4d9c6262cac53386132404434d
SHA512fe1a66758a39d130dde2009ac1c0c46f9083baa77363f557d2969d75393f4727062d82929030f8694b6b9b61dbeed8d31fc4267b431b032cffe19bd767277f16
-
Filesize
3.6MB
MD5d0facfa3ec36fa834eb3e7be0349557f
SHA106966f35428abd6c3f063be9069e90844cdedc74
SHA256f96bc2c46f8afad1e1e6a72af848c9331b66a55435312df88626ba7d4c27e4d5
SHA512abda63d0a981aa80eb5054b24e870cd887923dd2c730495a1ca8d900068fad0f77f7dc9d4ca747120861a3bb956dfc367368574a94ea27a990f95664b38f7eed
-
Filesize
11KB
MD5eb0d3dc34fe9aa32c23982701718dd54
SHA1bd35ea97b9bff94809d8add9fe570a5cba8d11e8
SHA25658912850af6f88ad91648f80bc63aa62e9c728a25cc53ee3e21d80ba6b418636
SHA5124d672eb6571f40496f8f1047654e45384dd69d388b388fa1295d5cac499f16655cc01674cc1e1425236c45f49de2ade4b8edd9f2baf110eb5fe69e5974f880c9
-
Filesize
176KB
MD51225dbd0101de5561b70df497bbb8313
SHA1334dab9e423c3959e1fdeda26e197a6c23d3a522
SHA256286c7044d357da24a84ecf31e27ef99598595d53449b7e71dbeede6f7b80ebe4
SHA512583fd72dbde2a06c6b977b411bb0ad027a3f7afd052e03a02c9198a13f3d3e8115b5bd0ade9d0b1cd1948a5970547845952d28873e19f3c4c754752079d7c6a5
-
Filesize
6.6MB
MD5b2b8b59239badeaed5735309a8ee41f6
SHA174517558c67543cc43205fa5a3103983acc6695d
SHA256b835fc75b2cafd3860b419eb711697e15aa30c7912fd989312253e19ff0b8a50
SHA51267a90661cb5f8923062a5364a5c3461a928d8425e9b5c3a260431f91be55343aeca0387b8f374468dd0ec46c52b46c2f2e12f5c9c5a4b9ce72889ee159d0bc61
-
Filesize
201KB
MD51509ed11b3781e023e9c0a491bfdac80
SHA12183e8228f0596d6c80927c0df49ddc1101a1219
SHA256f626890b39920d9fa35ebcc31d448b75df05fe4a7a424c2b5ceb95c7d61e5d71
SHA5121a9c53ff6906251cba2133d8907401c5f9e8f4f0ac918ae8466c4d21b2f5468bc86a08dbd01527bc0150cebf55737ac3023d564a6d032ac8d526648815662047
-
Filesize
1.6MB
MD5a05c87dd1c5bef14c7c75f48bf4d01ea
SHA1d71f4a29ba67dc5f5a6cf99091613771d664ee0e
SHA256274e12d01e0cae083202df4a809c1c153b02cb3ca121c19c43b0aaa1c3a53a40
SHA512f64864193ff892be86462aaea9a019a9085e937d199161536d163bf183f4ba08100d17f2cf962818b106b2c797d1f22b92933e9711273d85d7d08f0d18400222
-
Filesize
8.5MB
MD51f210fe15f81c021ac24b3c71eefb3a8
SHA101c2d67d65753ec06c13f452a11e01574ed37fbe
SHA25616e5b27bc049406d0b67429d220194bb3b5c669954740fb27ffa81be1740f394
SHA512ec2aecd9f9f1106a752a7e17ae6e6ee0ffc8d0f1437775feb0be0ae2df27bedffb47ed7f71bf85f4109592a261ce77b1754d84e5a4f6b3d62c8d27b4306699d1
-
Filesize
280B
MD5fbf032a77e2ca51868570a9b8a708270
SHA1bda79e758b8e14de17674ef27166b032a9dace06
SHA2561253d1a909719f0fff93130f9cc998516047661e0a79cd2f886eafe1b0d84ce2
SHA5122624d2db4d4a116bede2888228fc8cfebb02df058407bb230b0126317107ba9fe0caf8625cfb8df7f0941d0a621d1c2670eaa9a23966578e9de5cee89be1b433
-
Filesize
918KB
MD53ad913f9e815012fc890de3b7cc22dad
SHA158337d0adbafab3bc3328c8fe45cd1d15790b232
SHA2561cd10b7eff3cbfd89aafe78c80118ad7a3327962a1584f2a05bbd3e92dd663f8
SHA512e87ad453d579612a4bc52f7333de5930d52c5a09415c3a543ac1efb05412296f1bd8cef5fe56f1ca3de52ece235b07e52299eaaccf6593a7c4364a2a69b7435e
-
Filesize
2.7MB
MD53f8aa4d1504430e9fed7dd662200a082
SHA12a81df26b045280a2b683c28bf7538f64acd100c
SHA25600debbf314aaf8838783b86909fceb200c9be5de7b27a56565032872ff49eca2
SHA512d0da9713feb4aa05395de37b7942aa5af5cb33b31e172b30fd2a65160917d5759e01eace3d49349648526a65ed620395dacd510ee23bae65adeddc4af0bcc5b9
-
Filesize
2KB
MD5831fc24e4c533e527d79fbf55b559737
SHA1b54eef5d4421d842d92de29c7ce8e71630f583a5
SHA2560961fd5a8005921f711001065d40fa83403bdfa3e1acc2112ca46e2f4e53ba19
SHA51265b5df9f8358e4a08e5416c517d3cffc434b4e4e57c0723d433155f0403de3efc6c17823cd78f6e049630eca58ba97cb4405e63e56323789829586bf5190fb10
-
Filesize
11KB
MD5e501938e8a37eb9cac433b7390131a55
SHA1aaf35a803ed066e13ff7f850de8babf216af9062
SHA256c0124bb67a8c0fdcc472dd1aa3061bf02a945974bae708482f5d9076681f6ba2
SHA512edf83be4ddb1002a4f0588c9e27078aeef6bfd9df6bf5da5198e6bdf015634f0960c94d6cd8bd71168420850e825242d217ac1dea05d13b0c52d82421403d74d
-
Filesize
3KB
MD541a8246e9ee0e4d716522fe2ab85cfd7
SHA1b96248e54529665ee1141a269cf7fb009ffaaeec
SHA256a4c234eea770c2afe7a743750263d94a9c5956ac446c95d4fa2f84ba0c305e25
SHA512be8855de15307df07043416437ea3d32a11cc2d55f7a87de9c4fa2b19e4701d7647eb7696dc4601b60066b405a1e625ccdba5bfbdd6abce18a0e307e20d7ea09
-
Filesize
11KB
MD565454f1b8a27788fe0fec75a6b36a2fa
SHA1bf9a0567bb6cbf830d0dc10d2354765a1b0eef0c
SHA256395187b50e45b8b78489462091aa8e3c2c99ac56c928623a4f1aab3cca05b324
SHA512cf518e9827d798bec6a8bbb82401df700f28f74de61b076432208923804b0b083d3d0ca02aae78b313f9698ae81043522c67455de39a550318e7495d8f988f46
-
Filesize
3KB
MD5448fe9de28d1885a0254f9765daa76a6
SHA1a773d575bd76f02a78fe1f733b0e2c694a4de9ef
SHA25677b2f4f99a8573a83ad3a98880320cebf5a8600d513b89f718d78cd69bad4038
SHA512ae957b967a613a3316fe195a907f2d26093fd87d6ced1986d8d73a2b0973c13b26964be5ed5e22f3203977c4c594d22f245625b2b42ace66ab062ef20821de8f
-
Filesize
1.0MB
MD55aa9ea0d0c8bd21323a6c33e62dfeb06
SHA1593210ac9abff4d987ec7872bfd60cf8bd5db66f
SHA25601bba196c2d58b75bf168c148d28ca207a72ff033dbf80ec5efb83b49dd9c9aa
SHA512808476759f4a9465ca90f2be5bd7d6fe769a222a231c7ad67dbb37f8ed4815e3421c696f8fd3d673162449d519bd7b7ff479cd1ebf0771e931c684e55488a87e
-
Filesize
684KB
MD5730cf4cb399bc885e041c67e0b516bd8
SHA176ff243921aef709d7c3ce684092d5029412833f
SHA2567d5472312f42aa2f6c7d411362f12ba190644ea6cec2287eeb711e4a82e382ee
SHA512fedff6e26d3c1dce5efea92c98d1bd75800ecaff7b076dad57c96cf0fd8bda5e634af35409cd7c4332385c0bd4f8c15b73ac1f5f06edb7ed44f84a42170aea5a
-
Filesize
15KB
MD59aea264f5caa3d0b8c232ff1dd7688ab
SHA1e8f9f07925bd5e92a8103d63e3a3c4deb6e13260
SHA256affd24336adee66b367920dd21f4061c1845c36e8f78db1940878f5d57108d4f
SHA5129c36739ceed538b93035db04c4e99eb39576a495069bcd534160cb0e278f2a23372b808acfb8e5945b32d735bdcf4e7e4b8b32b529e413674311ac6373ab42a3
-
Filesize
46B
MD524edad928ed457adfc9a9341bc84d07c
SHA1fca4d97ca6c5a8fb2bf6e3954ee9b7d9013a8021
SHA256dde97b4793f6fde0dd55d04f444063da8f4f6accc9ef5dded15734fe1812629a
SHA5123ee63fa59e4e69de9aad89ebc91cbd38575e9a2a4daccf117dcd24732f6455bb92163e3bacfa98a142de68ba480c09ffae1844abfa0f5d6e2b9943fdfe3cf9b2
-
Filesize
235B
MD59a81c5145eda4f8954fa41c34a86cf83
SHA12cfd3b33d5099e47889787ca6473398fc9b42c6b
SHA256c24da8d653bcf3e27634127568256b491d4516acafaa0da54985437a324849ed
SHA512312c70a7aef778cbdfa83104603b4d4522d037cb8e88862b3a592b866eaac7cb5c1a2bea92f4fb4f4dca49ccc6ababbe103d7dcf448e3dca54384989f46f50b7
-
Filesize
1KB
MD5d9d28bd2ef7192fb0efb99607d7a0807
SHA17fb6f32f1c0f227118613dd7779e1bf0a6e2ce4a
SHA256dad710b076d96b3de34a58363a3241935bfe205b7240ce57f9d85bf2058e6dd5
SHA512e058987d5fd8ea6cd3c3081c7ac45ce1e3719c4a38b46390133b19539fad35a0d8ad699023a3d934d18e3356cb6def62bd197b5a32ad496b620469c55d9efb13
-
Filesize
4KB
MD594bf0bf032ce32469dd74f4f1f5320e6
SHA186bff704a2f82816f346a6a374250f35743de3b0
SHA25654f08bfd73dd3477610059c4a1d92723e698def0efa7ad4661584a51d9aab79b
SHA512ac62c42bfe02a35739dfed5df012bb3ef1f7bdbde1f4d9dce9448812bb6d25891dbacc2591e859f644c95151bdb7179f4f8e355b81a2a38ca7afce4980a79901
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD501363b7b85b0b86c5e73b38d87f9c472
SHA17c8974ebd3564cbcf5e1616186ed0fcce77894c2
SHA2565305c647bc3d28e992b261f78d1b68f83544f457f65c79add92fc2bf43011902
SHA51246efd06e0eedfdc2a51324ec144a5f57465cf8e8bab701506b82997f3a0c90f54014e743c78636a7c7262a9918b05455f98ab65b904c693f3a0b4f4410c84e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD
Filesize727B
MD59671fb385631cdeb4df4bbd721d1e9f7
SHA1c422fcef967737ee90f2580fff530a3145f73cd2
SHA256acc16dcd5152dbffb629d04f563bac0f5a42f621fe1ea11d1cd0694b6e5f711c
SHA5124ef15f5a5c6c376f0ee3c42725966430f8e28eb1c338cc669435f53d5b6b36793a370a434a43a2f64ff5578324859670f6e4113070cf066be6052a58875f2cf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD527384bc1734a675a87f8a8576a040dd5
SHA18ad8ae0dbd5a473e30bf84e007c3471b7ed54fbd
SHA256bdf7496a9792c4eaf8a1f045430d2618b7e45189e6691186c34a2e5cc182dbe9
SHA5120443147b62566a541b5a0c9767d6571eb8390a4d911984cc6119e672c301a78e58561b62ff255c38a15e182bb6defd576ba71d9002d1e1e7056949b07f113cbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF8D319B9741B9E1EBE906AACEA5CBBA_7ADA6CFC1EB4DE6E30830D7E0CFD46F6
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD56e4d58a6488afeecbae258b31abffdd9
SHA14a0abaad137c680137591db14e261a572dc49313
SHA2561c3c1aadee3f8ba804be3ff7c7b3a19d88aba8dad34af512deedd501d7bd36d7
SHA51233a9bdcccea075d1100ca4527d7f8addc2e14bb5ba860fc5a12589f8d7c8ab03d91d86a521c4edd70a96c900a9b6c58bbc9474b3ac8042989315f3b1671400ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD
Filesize412B
MD53a1d58144132250055ba83ec18d9498c
SHA1de38808048d42037fb60599e3a024f816a259565
SHA25699e19bda87d4a8c2dc1a4b89055c6f8df41e7de3ccb1f69c75831cb4f748a740
SHA512b4d3ed158c6dd6c60029915a945bddb9278a986776f2b701aa2a5c3e1217a93df9daf0f140c42747529d2bf7c3c5fd97160fa08971cff0477883e845e696c333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5802342f6ff8ca10893e79681b1a9b47b
SHA1e18257fe6a7fcdd2d35d7defe6563d55eef3c69a
SHA2560e016684d6e63738c39012fd878a0c0a7c9fb8608fcfada46a2fcd817f231941
SHA512983886b247505042e8df31af776b3496484854f88a0ee748e4ecb008af471a9fef2493b821cc93e9d88b12e7c4aa5766558f825c31687cbc25cef9b50f8542c7
-
Filesize
14KB
MD5948b251a4bb052c67b4045b31e2f096b
SHA1ffb05707014fdb70cabaa1db1f86454219bd221c
SHA2565ba9e5b99945431afb644d9ab72e14d2f54d1a58c1fce5ec3e42e4591201c147
SHA512548e5e32d623ce4912b8d43009d3ba3fdf6e61022932b28e25cf81913bf68962f7ff345c69e8845dc6dda9a1b035ee69acfcde8fe067b03b0aff655e74be9bcf
-
Filesize
14KB
MD50f51366cf6b95012d857f57efcf71dc1
SHA13573f73f287cfab3830f49a79b3b18ebd92bf5c5
SHA256d5e85c1618b7967955803f7e1234177429d2a380deca1a95c7fc13691a97882c
SHA512ad29ea346a43672c5daea1e5a310415612d385e9935c8cf6778c3719cb4634088dac2e24096fb8bfa3a3a646080282a5caf8c5e556b11106b2098e835980c824
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
Filesize
9KB
MD58fb405fa0243c9cc5484039b8eb9f885
SHA13f38791d72d3d67c93812409e270f6b6295dd2d3
SHA256e9919d752a545ef0726445b32984617267b66f6647ee55b35422ddfa0edec1c9
SHA51283eb922bfddc57654b24f3d2b4d8cb045d079e79649d6e989a9790c69c0f3c1cab0930a9eeb90ca1190f20f002c87d7fb153112191344e03dc9ce11931a323ab
-
Filesize
10KB
MD5f1477bc21f9676f09dd4a4002aef86df
SHA1a7bc27508edfc9aa7353cb38857e474668e90f0e
SHA256c8c1ca87e22c5e9675c4a3a7d1eeb7ea0b720419628d82fac0c1c071b9cc46f8
SHA512dd9cf86fc742e47d6e24c9999734e9a541f82e3ea4a32bd83e2f564fee625cc80fedc999bf4e4ab55fc9f2977218930ed290088314f94d1b850e7e68883add88
-
Filesize
15KB
MD5fab89b94a39cad36494147003ee0540a
SHA1875428831bc022388d904b0864fb312567ad96e0
SHA25696d733f505788ceea4813cf21c0d950f7c09eea194558b5877f7d825603d0d86
SHA512646148259bf25d0adf5e21516d045632413628b9cc55dd468a97c3abeaf97fa7ef049b350754bf7389ea6188a1f83fceb110bf8700a230c2954989b0381a144d
-
Filesize
16KB
MD5250f20fa9b5c8112dc7deac3e1b40ee6
SHA1f6e5606de998c1b05b3a4d5338f2864f4b5e1efe
SHA2564b15f424a09dd8408e64eb7bed7730c2dcd8f248c5d052f3feaa18a67bb5df69
SHA512ce4b18530c636011687a0c8609fb80b263c0af91dac96860dcc5ee61a8919be888da8c87a4686fda442cf215543a30d3bd04fd67f978cf87eea9b7bec4a033e7
-
Filesize
10KB
MD564d48388c37d8b11416dfa4978bd842a
SHA10df2383f9c5c398b60964e2b7fff0a40a16523f2
SHA256c35da6e6d0d279b110ac72636396e949503bc5d2e161053ab8ef75adf706875d
SHA51292b7a602dbc7678fd2d7c399250ab72cdd1939cad5f4e1c36b0f3789ac682959cae623b13bfe4a275a06438a661ad4fc4fd812c2db9b508e6e6eb07185e482a9
-
Filesize
9KB
MD50f1c19f51ea3e19f0be1f8525de2f93a
SHA1f6a28741d363951517ea5b4389103730e0b9308c
SHA256eb7b679b33a55db684fbbc417cbb9a65cadd2138700b2e31fcf509bff982bd3b
SHA512d6ab4fb01e1e751540eef5807bc2865f03ff267e97fd97296f2234104462b33a23d3a7d7ec42a29c02930bedcd2cf38a930f4d853df956cbf3a6fba9e1b12d43
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD
Filesize32KB
MD554ee3db66e635e61e4b87472ce5167ef
SHA18d4a0d795a0ca004919918609f29975d5a35dd53
SHA256eabd96070b5fa763816982dcc9db47ae24eb0f02f5f7e1184056a2978e417fe1
SHA512dcb5630f77ca62146ad29b03c5b685e0dcaac90a02ec05651e01ab8b5a2da7a90747d6cebd22c0791fb5e8b313e43fc6c5a9a7859f8d1407c1c827f7c7581a7e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\A9W5OG95\KFOlCnqEu92Fr1MmEU9fBBc4[1].woff2
Filesize15KB
MD5285467176f7fe6bb6a9c6873b3dad2cc
SHA1ea04e4ff5142ddd69307c183def721a160e0a64e
SHA2565a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
SHA5125f9bb763406ea8ce978ec675bd51a0263e9547021ea71188dbd62f0212eb00c1421b750d3b94550b50425bebff5f881c41299f6a33bbfa12fb1ff18c12bc7ff1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\UJN8AL3S\KFOmCnqEu92Fr1Mu4mxK[1].woff2
Filesize14KB
MD55d4aeb4e5f5ef754e307d7ffaef688bd
SHA106db651cdf354c64a7383ea9c77024ef4fb4cef8
SHA2563e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
SHA5127eb7c301df79d35a6a521fae9d3dccc0a695d3480b4d34c7d262dd0c67abec8437ed40e2920625e98aaeafba1d908dec69c3b07494ec7c29307de49e91c2ef48
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z9GXRM4K\cb=gapi[3].js
Filesize80KB
MD5e08fa1d1755c4f8570b123c010325195
SHA1c496ddd8cbc293564e5fdf2d987833332f554660
SHA25673c96e90b9c6a8e44aa7fa57f5a84a765ab2d1452e11b7b41882f2056b4bc393
SHA512369b54ab94a768d44216962936d3dd948eaa688488d9c279ffceec2a2cbd4243fefb2eadabb6c9d53243c3803efbb5dc7e234cfc17ec5a9ca549ad4de4141700
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0NGE19MV\favicon-32x32[1].png
Filesize1KB
MD5b8684628a5f9315b401be18ecdcc2de5
SHA13714b4f80009181d5d425a3db3699c1138c04625
SHA256fa4a10f905a99db0708bde22da4cd969df05b51362673ccecaa02f6ab693dee9
SHA512c227551d4d8599de6a0b119b142047905eb4a0e706204de062d5aa94b9ef42e44d9e4d02b37bd6ff1826e9261f31bec3aba4e50f7204bf1462f9d17e9e1f6f7d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\KAD4R23F\favicon[1].ico
Filesize14KB
MD5d9acbd4d72777f5ce75584190bcc1400
SHA1190052bd389aa65e9403b40658a13f3e1f130f11
SHA2567ef39ff01af633a71160fa9d81cab8407215a2dd9b48187ae9f3dcce11629d8c
SHA512eb42935ae956402e467b66630e268b8ef7649169b72785ab03bc37b49abcc9a1cbc6d3e48a6f6ac080f4e925ee3ed4041cf33c7de34d9178a4beb2a3e748b6a5
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Q4YBHMWK\UAX03XAK.htm
Filesize174KB
MD53ddc1aec414e5355eb5e0e2fdd626fe6
SHA19fc1f6ca85b29eed8ce9f422b20fb2b747d2ac05
SHA256da1ef6a74aadbd7b1bc398db17ab4378abe65f2dfc92974230ab9917fcc46914
SHA51272dcade80aa0bd83d0991b8a6ffbe94b0e92ce18510acd8cd2dd074b6bec0fa442c40b7ec026836c36771bbf4ed0e8fd7fb0a448e5308b96ed4744157c80651e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Q4YBHMWK\icon_48px[1].png
Filesize1KB
MD575d78a3233b5e0672f48247200decdb0
SHA1da7e8b9db98a6950d1637b4dd5e098fa2ec3a02a
SHA256e136ae509e08ac00fb264cb82cfa1081982ddcf775ee058b201fabbcc59b7c8a
SHA51278101831843340d55a22de928677fcdbc20a66fabb7cf8bc9961ee7ad334286e0c2ff3a10b09785bd84854ed511c6931a2a7cd0e0810c18adf526ef3619697f0
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XRD5VLQ4\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\uzo86om\imagestore.dat
Filesize27KB
MD53af275ac89b7d4fa6a1b6d8c38f235dd
SHA135d6a400f5eb01fd1788c2ce5087770951215a30
SHA256f8b293a77a7460affae71b38836639a7b6613f3eb2945b5f97d7fdd827fcfff6
SHA5125fde9476dd9f892ba96b5b47d81273c5a35944bb42060115585ed5e0da3bd413336c5812fdc48c5a900d36edd75aa47f1bc13ddc884920ac6bffcc6f06024b6d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFBAE57EECA2DA936A.TMP
Filesize16KB
MD5d63ac3f4c0f2457a64ddb8344de00f00
SHA13743493ed469f91bbd5441ac4554d4c14c57640a
SHA256a1001b5d8f287eda274ea2d011ee21fb88e51975974ebebd9fbf4ba124e91fe3
SHA5129094a2980aa1b346e33a10dc3fa1fed14e7df98dc0b66c95fab58feb31a2237d20ccdbb1a89353c98202ad8d173fc4ea43b26e6f4c3f7da606e339f70b13f4b8
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\13vkkir5.newcfg
Filesize954B
MD5911ae1b974427ff106bfbac317a76d06
SHA19a7af66457524c30e3f7f2e63353a10e34244006
SHA25682b6972a2ffe97218994ab337ca104da62a45f9e3808775e7fcb129bce548e5d
SHA51258a054d2d1442995f6c713bc36c1591a25f678faa22a4aca8288d0c243a29e9603b04b466ac775c5038498edf1c3d801ba2375476bd2ef5154c60a76b09627fb
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\2tlwljok.newcfg
Filesize954B
MD53df0517ad6547054d56ddf4381b7cdd5
SHA198c454738b0a274cf248bb38e84213a490f618f6
SHA256637b39c149bbc713154fbe80b4d74ae71868b00ccf512b9e4952092364e6867e
SHA51266c4e7f276383a3c05e948b3ee09679a89146f4016f659bba57b44e67fc97edf8d78046cc3844bccef1b42c3f409afffacf37cb6fa6957d9682f0be7708b5e5a
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\3i2pmalx.newcfg
Filesize4KB
MD5d985c7a533ec7021db62dfa94ee146a2
SHA1271a9079e2a53b6e05b6794143060af69cd47355
SHA2567cd5eb298cb5fdc4b45e67d6a2d5d60eaf28e98574cf1eda85e8f8dabd4e1bb4
SHA5125eddb7c7bfcc2d31556ced2ee2adeea304a32ffc938c0b090c4a059a5e130367daa77e64d521afd5a6103ed6484e6216b5d3bc6f1a57cef935afefc9b7e02e98
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\3pa2ez1s.newcfg
Filesize4KB
MD50ff4988c8ec073a44ebc20017bc5ac88
SHA14a69b38515d2daf1e2cd06ee76521be8c0c69572
SHA256a1b73c22ab5d51b9ac42410d414cd9b9dcf8ae42411a6bb7c177a256a15d083e
SHA512ad90065dc9d2dc8745308561b44ae850158d631e46edb18a1d21905546f0853fafdc889bf2e9baef8b7ba18dd76fc0277ae942d7a9ce172f02b580474149d6f1
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\4e0331yg.newcfg
Filesize5KB
MD5d859926f5ee1000fde3226d03df946ce
SHA11187890408c610144e21b075b096fe768bfad813
SHA2563802dd18d6ddad53f91fb9303078583951f5df13db0a0042834c7649934d2267
SHA512abef95040e7b2df9bead25ec25e1955829f2cb3e1b48e5732f783e3fbe4bbbf2af733e985ba958c8b458db34cee99414d3cbe120d7844b542f549ad3a6bc3f1c
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\4eg3gjua.newcfg
Filesize4KB
MD5a907bc6ad5e7f64e4d77eed7e4c89434
SHA152e7155a5eceaf93ce1447bc71c7cd3e81ebac0d
SHA256b3f5471fbec6f16ed95ade89b7d36bc9149c84d5fbd2370a09f6b095d4cf9345
SHA512fe905a69c9eb667558ed167db3cc1c10e1ebbe4e62c68dc015abc037c259e1c43c45a7208c53358d4d8e0baec696a784c8c6851bc3edbb2e9cc6dae016897db5
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\ckv1rui2.newcfg
Filesize830B
MD5ef2401102065353c3dc507a3d09ef171
SHA1944ea2120dd41f338011d5dadb352033f65da08a
SHA2569fd966f38da63f11aff9ca1a883249eb0f2ca3e938f709c5ca4ac580e9b4d40d
SHA512010b455bc0b7d901d04914900af194ce723c71a5cef23455294d968768816f4d61ed46e8d43cb992618b7498fbfa1875128ea7c6d3ca16ca929e502201d90bb0
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\cvctvyd1.newcfg
Filesize2KB
MD5413b276cff02bbd0be0ab7de9ff560e6
SHA12e34916a6eb93f601483768d1f7cc2c2ba62dc9a
SHA256ca5d93828e35f8b41022f74f1d30382d4d37b59d0f21b9fe2965331a907dbebe
SHA512e59b05349a2f8d627ede8b88b64df92fe2af80310c75f3c9fc13c059b163ff7dc9bd873b10b24989c220d56e9fb32034de1c842997a7966f653621c8e378f415
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\dy5tvwxa.newcfg
Filesize1KB
MD55071ad7312d8d442023a1cc33b9972f8
SHA1863115376dff8e17d5c3876fe1a9b75bd4318197
SHA2564f4ae850fc303e87a6638fd536f5fbea425b5ece973d7460356109ab0e9176a3
SHA51233379892975a20234d3649ca24868722cd44f89f9f1f681bd103fc78e31143eb523c672161a4762e2a87618f6edf584b35c5456f0c93fe789464ce8eb17e2cd7
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\iuufia1h.newcfg
Filesize4KB
MD5177bf7ce1cc703eb7a6c235ebc4bd4eb
SHA1a56331d06a2fb761593d1e439fffc4b9dde5b54b
SHA2569f99fdddc538cc663635ef0f3c51e08cce7f2e73db71e99e232301df6c2cd400
SHA512064affc08969f1d33182eaa98c18f24915e462f39ab14b0ec1a7fc57b67906288ed3e3cf28eaf4d6728590e64d5c6f96739b86c31c6187b9bc9efc5e06539a55
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\jzktsokg.newcfg
Filesize3KB
MD5b937c355ac0c1c7877d3d25c723c8c8a
SHA1a465e779dc77ae6f64b10999e7a641198a7fabb6
SHA25633a52a2361ec6fdf9e9252df3db19b7d1fa293c0659754fab3ade6ac348e125c
SHA512a620c7a13c31a5b9026fb0c04c1becba63f7c4ecf43aaae7781b99b084c70714dcaf31c288f5a2e980707d9188ac6f7db2c21d24980b2fda38fe440c7d472d72
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\lehs1yey.newcfg
Filesize4KB
MD5a79a014a21a1ce7c7707b654f12286e3
SHA141e8a7f92f4e3ad6ea345cc31bba8c9c5d5a2e23
SHA2563db4f4d8d8779755926186627a1a5c8231827d108ffb9dfc6a67e808ad58d7a1
SHA5124e6c8f565af376d7060522ce378198b5095aa6fce51296aa7817f4fae924f6aa36563b05bf25150378bbcca6f534dcae2fac51916dde33d3cdb58abba961d899
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\mbqprjwm.newcfg
Filesize1KB
MD5a294813d0388390b82f63ea7493a370a
SHA163e6b451d4d8a510897c1f1b5dcf367a3b0fa048
SHA256bb52b2f395429a7390e16930803060d33d65f6837e414d1cbf8850bc611d1e3f
SHA512408d03eff6781704f8d6f976840178d3e21812d96d55b884684f97d0f28f2c9a9476b3130905a05dbe94cf392c180fbfd23b57c725ea65f35e91608b75ac8bf4
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\mjo21a4f.newcfg
Filesize9KB
MD5545d15c283e5dc0ae0193e78705e3d21
SHA13d2484ed274f3e2659931a0b0db7b4b52167fe06
SHA2566a7c1f8e142eede3a8b4e7e311d7473a4172e20654123b8b315afa36a02871eb
SHA5126050101da843cc606f5c1946884002089b9534f61a25f3da82d2073c6248625e257028578b18e5afa63288678e4cc31b9789c37044e8074e2910c10034833bb8
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\mmwwgsyu.newcfg
Filesize3KB
MD5c1c662e45cc1607037ed7e536b32ddff
SHA104bc4702bc16a2eb225ae371183c09cdd82e30e0
SHA256a2761502c743f75c4f05357c0bfb9cf8414ff2c072f847c6d739a70f6b9b150a
SHA512d44932c4e7e2bf9a7a574a2caedb90930e1a81f8a35a7ec87ac3a9d2f72df5a978a5efb9e4cdc3f91c95c34529ae99a214f1dbed95abcb05a1b0d3fb0b2c5e22
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\mp4t2oco.newcfg
Filesize704B
MD5025af161a3632db6e2660c031f5cc121
SHA134398ed16c6885d78443dbae71b000dbf19eae49
SHA2561fa499ccf933773c66bedd7f58f4b7c87c3a78e1f9e2f951ddb85934feaf73c8
SHA512cf2b19ee26b6a1c1b2cbea8b4d1f377ad50191eb396a458c6aa8507355c492813229437da681f845c9d9d79387b414ad135a038dd14fb8b8258b684aef37d36b
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\pk0ano5i.newcfg
Filesize4KB
MD5ada5adb11f776c633fce0487a8e6acd1
SHA1d3d3b9ce1d240d37390352f7db791a1d0b7db5d9
SHA2566bd182ae8a5e597e971257c5fd18543d45411ceb61729b8763fe825500eb263b
SHA5122a4d814315c805178217f2c68729597b2a027bc35540e22285a45c9602081c24abd6e4bf52fb49d010c4c1318ad0361bef6e19d3a95f2607f88c898fdc0ec330
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\pndsty1o.newcfg
Filesize4KB
MD54f9941d4751bffbb1e98230f09171276
SHA136a920155227c8db865c5f157eb336b294ed00d7
SHA25623003147eeaeef20032d8ca5f4c3e17c7d32b34bef615e728d37bee38d8bdc70
SHA5126657a7ff593626ff4f37d3e8fddd0edcaf7b545e588f99c20f9942bb32c4726f959e74a62e5356ae186614910476b2002983b2d771b6b0363efb398b9ad1ff46
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\shph1n1n.newcfg
Filesize11KB
MD5d32e69ca59d62ccf729f060c8676ec20
SHA165be8d0fed9783d037f23139dcba9991a5857a10
SHA256028214beea113247383e12b73b31fa757d1f48e9db08b8f77e86922d40082ecc
SHA5123c9fe9fdd89560d738f487a949ed735a8f8eadc1342904b5d85f95f0005e1f835654c3b6964c565c5c773a926aff7b3791881c970726953b6236e2b55ad4d2ab
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\t3asf2is.newcfg
Filesize3KB
MD5b232cfacde1cfb6765892d33c5507be7
SHA1a0b626a934672178ddb3053ec34b5208098a95e6
SHA25652bf82e519ec1499d93e99b989ce07754faa5e7820e7c203ca950d4b4619ce2b
SHA512df76a480cc649e0b83aa2e01a3dcadd65d4f89e7b34df4b37b49fdd4529923b52b4a63a78c14b99f83438e48b65e116b68ee085c25126cdad6e1df8fd1ecf74e
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\tvt3gy03.newcfg
Filesize2KB
MD56c62baf105226f312b4da5798d9ab8e5
SHA1dbab8c4b3d47439e0c13e8c84cf41c74a5336104
SHA256350afa8a568feedc45735f092b7e433b866a2745e8550244bb53e3e3bf92d023
SHA512ed0c599509e4c55b5dab216698903eb6d9ad4cd79b9901fa8567312ca3212a074c3f72ba7e3c6a1ed133e0867338b27442301752fbce5e44ab72995bf49a91db
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize1KB
MD507091263a8c1dcf725dcc6a59388e5b2
SHA1d76b3d0971f6fe085dfb54407fefe7d20ad686d3
SHA25610606133c86b6f9b1d021d519879b8a29511ff2effb74a10bbb2e8719a6e3b76
SHA512afb1ae3306c56f3becdfb1025914937a10fe53ad0f4e09b205c4c4fcb1c98a1b460e8191d0c32b588f806c23fe29852a612d89e07b9234538ac62f44b3a04601
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize580B
MD5a0852e14f6e6b6c86ad09586c7835353
SHA17dd81d0d285a6b2f047e7b0b1e1f9593efafb48f
SHA25697143a124d70256d8d033fb574b2de5905087ef3cbfcb3bb2f6a72967ef2fc73
SHA5123dbe05bc01b3583871e38f3d6616e92141f9afb45db5096d1c47585b0b74181e7b49cb5763c1b8a9672df999105db8ebe0212bbdd370c91effc96a133383955a
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize704B
MD5e0948b7a5c0f5667226b71ff0eb8f1a2
SHA146b102d33ff0bc138a6c65093402756bf5ab0ed3
SHA256dd80528cd5d54331a37d81e4e76f3088deaaeeb798e8ff6b58c40f29e1510bd7
SHA512adaa89718d6b6a01e6d88d8f4e507381ded59757676aa2ba92e645ee457033438fe39768aa20218fa40f6bca233ea6c534bdaa9066b6da38374b39308118ae93
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize1KB
MD5fcabc1d8896fe9a94fcd01b39b203dce
SHA11470e4ea4ad13f0eaed26f60b2409b8995ff8295
SHA256335b50b5be8abdfef7d1c94523df3b80ce9e16447ae9fd241b92fc90ca8646ae
SHA5129650d972cde6e691a4244484a7a6c49d61ea84bff9763e3795888b47b8e9eb2d605b1d1e33c00c88b61199a441d0d454be7f0f8564481f15697ca2c7ff0b950f
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize704B
MD51cf857e3ce906c5a7814a5ef421c0aa9
SHA14e3324d593f33c974bd5a83719266565ce97e70f
SHA2567fde2f50e6061de07b0291a0c5b10b8f0ed457eccc7fa08175a2c47c5b835abe
SHA51291c1ef28f0f23c461381c1f998c54c14f1726e5a29d6dd01b75fc17a211b627ce32333c0afe962bba3fa636666b7c05278694e6ac9e228ef5ba2ad72101fc4ed
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize829B
MD59384df4e880b229f12796c541238b9ba
SHA1a8c7f7983012bcc75e3e9d5dfc15e697693702bf
SHA256f76697d7213acee379041b65d76988a6d4423038e29003a64857b7ad2154c6cb
SHA51263977d4354a087de41f27c1594406209b9665eb2dee6f19d28c035d49e462b839c48777934a1c7bf15fc7df191abc332db699291fe241014174df87aa1536ca3
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize954B
MD56f38c3aa38e1f8cd229f10c5dea90293
SHA10e278cbbbcab14600f93a7ca71469a5e046878ff
SHA256c62c1401304eeef15a37a897a606da61be263259baa2f3cba0ba75628f6c35f0
SHA5125746c036e118466fc0b4591da4a40ee06a84e07ee1af93b726c55e3e3f03dfc662b235f2719121f7192676ad31e59a664771d65aad61d71674a2eb8e9a901f9c
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize1KB
MD59215973a5c46e2212db487bcf316775c
SHA1a9464eccef0f74fb74e871b2e03df2fc714853c2
SHA2567c24bd109ac59d428fce84724962e7ac1067ee6f8bf9a2da11d324d73f21a634
SHA512b4179cf5ef9f4033678faa1374350629f4aa492f29d1b29772dd8553e20f5d6c6803f9983ac5e61efeabc59bd64454d5228076b245420aa83d40717b58b57d3c
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize1KB
MD5b56922ffc38fddca2f2e5539484e7d78
SHA19e04e9f23475bb677d60b41c98616783c42a7e83
SHA2567dc23133853e83f1c8f9366e83616db31807339a1129c2f68464a04555485b00
SHA5126a08fb05c9bde9cc946d431b6be98ee94ad49d2a9fc77309a8cd8ee7e32b102219a06244f8c720520d19783f600a9e47405b7ee50b9f88e4a7a1e47d9cb4c41a
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize1KB
MD550f4a0804ca15b7fdef2fe619705af1a
SHA1e9b2d80aa6c6cee5d758cd2b52bc6dc4106d66b6
SHA256eb08bdad0da77f69e1908213d8776b53b730bb4aaeff8974fe86b53418ac44f2
SHA512bebe06dab53180384c547ea50cf6ff915498f835f4d9f11fec1d3b056fc1bbd776b7e8f67376e5d6a6012ab20ed64863ad3668f5c51e7dc32dd5ca96dbe241cb
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize10KB
MD5d9cf33959e3ef35a5b0df4b746a133eb
SHA170ee0f80d6baa748595a7dca78e12621faa2cb05
SHA25672f857fd6bd1ec0ba97a45fcee02b394a783b3d43f4a6a57d5ed1ad5022eaabb
SHA512e632fd7c4cecaf5db92213b4c198542b1fc464581f0a091cc3f947e0ebf37cbbb03620d93151d79bb72a20c0025932365a73b02ac5862c26cd6a6f371b1f3dcc
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize9KB
MD54a15922df1d99b6c7fb9e03f6cfdf256
SHA18201071279931f01375d9c6781b3c46e37bbc92d
SHA256655d7b55ab42b9844a9ba305ec81d992b383ff2918912bc9ac630ff989f3fdd8
SHA512ca892c538e34226d009bf479152ab5fa590527996121f0c0911e67f6099001ca57f6aa738461c8010a2edcf3f5fb8a029ff7050a87bcbc656e7511793fa89524
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\wxmuzhkm.newcfg
Filesize5KB
MD52f44163b586ba9823faec15a602782b3
SHA17680125df8cf22694c08d71e3789fafb04cbcd70
SHA2562b074f044f2617cf793c51b249b96251ee62a0a772cfd8c6ac726f63a3fbc017
SHA5127f042023dd63977190f43abb6f616e92799501c70116fd96c13a3bbd50fa9558684b438d360eb132c443abdc5982b1786d145c14a4dd6ea2c4f2b6d569882ecd
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\y0hcj5x1.newcfg
Filesize1KB
MD502d4522e3f62802280e3d8bf4941fddd
SHA1f5b8fe6458d38d8e836907b21fb52ddc896caeb4
SHA256ad561555c027ac409cf58e073059fd8ed8091ebb9033f071d0b41a36acd2060d
SHA5127eeb3556cf9da2d4a28533c3542186fc816fd37c63502637dfe8e26486c545ac9be58e2350c79e092f9939117a0e615360b3130ee8bc8bcdd99f2c704d5ab446
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\ydcudecc.newcfg
Filesize1KB
MD55be021f5e9ff6d3149f1fc564ce58a85
SHA15fbd2210f7398023f3dc1a7ca59033638f935a35
SHA256230e0c5fe0f1fda4e13af89bcf1f6774c9b3879b589197390f79d408e1af7102
SHA512458cc338b0a3e4e0c6344c03e37930d7bb2899c95a08dee2adaf207e9fb52b8f30279770a916125560210b36a4185ed6e447d24db046369c669741c829c74f17
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\zagxmcvb.newcfg
Filesize954B
MD5106b27f42c9c8df864622efe55220b7d
SHA1453c12f5de1ec17365fb5b0b8138811552e867e6
SHA256e8877501ef06e53cd9bc0a5f30c45abeb8e686beaa2ac267a17c1c7bd931346b
SHA512919ef3ba15de7060ef1180455b8767cd1e878b92ff7e947f4059ba8be8867f4232e5eb5096eddb46ecb1965eb084d72a3bae0df728f29525003f17071d7efbd2
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\zaj4r51d.newcfg
Filesize2KB
MD5f914976413887776b300909981c1f91c
SHA1eca9c9d934b715a2f6a841bd29959a82d190d8db
SHA256f274d48efeed7ff9a460b66b78f2d08f17b50f46b8db8e73027efc4f7e553cf1
SHA512bb784f664d3cd1b3cc811e10f2b5d90f5e0bcf8cc8ac56f0999d06c86522b1fdb4000b5486a450c1980678320139bb66db4495c7c2629f86fece6f1378e9b38e
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\zawmzvkg.newcfg
Filesize12KB
MD5f70c42f0245530ffc7f57f39a8952d4d
SHA1d7436835cacbdcade1ccfe01f8775a0554e04599
SHA256ef128d510064f2bb951594b44d2e5799bc22bd006f63348abfd5cadcd76cb240
SHA51237d6d182dc9048fd3a2f83dba2b1954a885c132d8ce2290f42d595f6a790c34d87db6d09e62b8f7dc89344f09ab0afeba057752cbe05643a0f765afcb9c0f475
-
Filesize
29KB
MD56ec754fca420b9e088e7b906e63d22a9
SHA1913a8c7cc9203eca2b311aa21aa6c5fe144b43e0
SHA25661899173fbfff0f8023731913390545ba8fad6dd42cdc7dc89b5c3c4f61272fd
SHA512ed20cc879dc6f51934b75948b0f543012e9cc7894eb906946ba87451b3bc4b1c8c83d4f7afcab4644fdd14151776c2b5fb9eb67f13c0e1964ad06e771634ab8b
-
Filesize
152KB
MD519e61f2dfd494cd64a9cfba3d4afe964
SHA11ba29dafa629be32ac85dd68a4c5bac261c46a88
SHA256f7c03fa72a65dd9f9fd2abce0510d75933db3355ada0733f71ecaf7caae74f97
SHA512392aeda85bbc0a5c69178cd44866408fda2bc4607348b6779124473a7099446359eaf8b2ee1e8121dfd0b7a0da6e8cf6f383729da94fb1a3ed3767dc3a6e15eb
-
Filesize
554KB
MD53b171ce087bb799aafcbbd93bab27f71
SHA17bd69efbc7797bdff5510830ca2cc817c8b86d08
SHA256bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4
SHA5127700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38
-
Filesize
901KB
MD586f4d2107a89ad15997bb76e811492ad
SHA1ced352714d3440f139f1d51bed7c7142d23695cd
SHA256592a16681950b95fadb1693c6d6fbca2ca7969a49a8b3f786b6782e91935015d
SHA51266da29f3303bc029e0d0ce880ffa887e7de10b8b0a7844991056988c7a7af64bd2b9bdc05b8457e388bc93f6cbc9b3ebef8e3b9ef5fc8df453f6be706b674aff
-
Filesize
945KB
MD5a6f0a2eac5b934fac5d1d9e445d277df
SHA1219870701fc2014f5a00b29116570b69f4f8045f
SHA256f31f648f39602e725161eafe87d3bb41355d835740e7e2c972bef8ec29122cab
SHA512b380977f18fcb677622707362c3309d37ecd7a4fd90e269157f7aa958aabcb5164318b0b455e2f7f5b5a4451aa71ae9bb0a6a07da1d79a75b7f9ab02a47b1c63
-
Filesize
294KB
MD55f6aa4c4ca0a4da6ff7c3a1c88066f1c
SHA19d527b0de0a8032ae1b987fa445c8b279cb12d25
SHA2566dc28873da754babbad5898ef88e1f7786bdec2afd91384e2cf225daebab65b6
SHA5124180d46eba452e6c7e2776cdadb43603a31fdf58c42d47b5b2a3ee83e9cf0f5bd8c1c67a503e52a3bde9ddec941972c0e816be8190dd90c3abcd1328b79776f2
-
Filesize
634KB
MD56df981ff5fc51df9a7a2608ebfac9b23
SHA11928f3f21de9855b5c50c058dd2a602f323a7b01
SHA2567e8a898aa81d2a1b54832686ef545e37bdcd9e61a1157fc92a81997d9ee104ef
SHA5121176baa1ec8903b9df5f5b226f27aae7733c946624c5e4d37c8034f6a04ba31891e96d1b6da1de552ac0760fe861b5042a1576397647a494d29018f1b1905438
-
Filesize
330KB
MD52afff209dbb812e376684c8a5073b591
SHA18aa66ee043d35c4dfd0cf4600ee46e42dc5eebab
SHA256a9c1af93d957e363d33a53985ccf96efcb1d630b9a5aa1593b8fdf050a5e73e1
SHA51248ef335f70f335c021d85ae041e0c0eab179b8e87b00f3b39a0358dc4b745ea3bea8210313704ababaaab24bf57825d982adf2024f5e36fd423b6af6eaa7d250
-
Filesize
226KB
MD52464cd177de86cf7e67ff423461c4470
SHA19b8e94387075eec99bbb4763701c6207a95bc3de
SHA256809ec8751b56351d66d024feed26e03f50703ab84ce3a56b1d21a2e25f893d31
SHA512cc31e7590fe832e0b30d518faf89f37e6d8f6ccb4c9db391a28bf57d99addd0dc9cd6d7ad5805f95ff4fa7401f780f60802da4bebb01f707332168e1b42c7be7
-
Filesize
565KB
MD55372cfad6f664b137cc29caa9c1f11e8
SHA10d0e26840f872366aba319c84cfa3b66f75cd744
SHA2569feea50330e6ecc2a0dd8e38313801ca8e43033a15c54a72cbde672c06cd6dd9
SHA5121e564bef1101ce24f203e38e2df66ead5515e782b160ac4f21bdc1f70a52bc1762e75cb20112f0e850a760d6a06ad9861e780131748c8ac95169bf97a6df4ff6
-
Filesize
2.7MB
MD5ebec631150e28e8edeade557a1150fbd
SHA184da8f7380f63920351a1ac734b226e44007da66
SHA2569e217bd4c7122882fe9ddb70809a251de285d79c5367894f1dadc625012fce46
SHA51293bc6e318f5262d56c5690ab05c7e1c248a8ceae05d0e5946de6e81719243a4776cd1a9e56a5170b37e7eeb2fea3d8d4e797aada1fb44214572a54d754ee041f
-
Filesize
969KB
MD58daa0843654de0cc1d40325747ac9f3e
SHA10727d9e78a371b59499b2a0754956d4a1378b8a7
SHA256d41f00ae17e1e1dbc56826584db3332a33d9b6f25462255404eb9ec37fec45e1
SHA5128381386d9df7a619ab4d188ae45f4415587d55ad74b49d4ce7680d08a3f1702dd750b2ddbc2e03d507b29ef06541fea5d822a2c3968d857d13c2354793f2fa73
-
Filesize
3.2MB
MD5032bb369103dac02606fb919f6658f3c
SHA160b39428ab3493aab7babf3a1c5f2a951ae853bd
SHA256daa61c42d53be45c7709a0b0f66a51a0a47ca84eab787e0627f6da255c96ddff
SHA5120f1fb9bb34e699ee6d4a1dc58f99514fb1df81ad0cf37b3ffe938295a70d832a5702cec3df16d30d400c77014d09228e6d02d3e65d5d6d0f1c5e34f39d55e313
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
Filesize
7KB
MD5739b5009fbbf4101f3a2caadcb06ee88
SHA171a35d1b1de4beb544c6f15acb2d49976f2b07f5
SHA256f0e80af20d1635e2a5aaf51c0894844a90ea4d8be7420e20360cb5e1849e6c03
SHA5120acf97f5d229c7d5dd518154484aa7a320875ffc16b1529a51c400a249e107cf406561208e653e517c3c73fd8dc50726026af95d5c7fde141bcca7fa8063a4ea
-
Filesize
19KB
MD564423201fa94a71110f3835b40b2e3b0
SHA1783d7c1cbb549c0517020f85307a8408782c95ff
SHA256d2748c7aa414bbba5738f6a7cd003e086ecbd515fbfd52dc2baa68d870cfc9d3
SHA5129d3328bc1e3414bb162f6bd905c0a195f2d0130fd037f84e6e0894ea548b8cab3b204aa83b876cd3df50fac7b52cebc7c95f967f8fb54c30a7ca90c5b57c22c3
-
Filesize
47KB
MD52a15171185d6981175a8e0be7e256420
SHA137d39aa4a47941757aa20e95a7eb4446a2cd3649
SHA2566aef37ca89e2f0f74cc5acf988c910a6e22d56850b0ff8aefd442562ff770b24
SHA51237c73de8081eb0f56d6d58c569de44d5bc978553e72968de593e9ea3292b0805b46169c52f062b138da56d8d72f0bef011a1c82d628266847d7696a165f4f72b
-
Filesize
350KB
MD5c771f73e9f7e107ca6778693741ba0ed
SHA1a8e92c0f97b61fafdd622744f379fb612c17c82c
SHA256cdb282858f6d0333e708ce8ad3e998215003c29950040121709f1d1bb51e3cef
SHA51220175f6a7cd7af6552fc1fac8c2faeedb2325d1eed2e79285e43fab4544ec4c79964c333a54dbb568f633da8a54c80d60c44636d1d16ced786e05bd56d1cf16b
-
C:\Users\Admin\AppData\Local\Temp\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\B088624\ProtonVPN_win_v2.4.3.msi
Filesize20.2MB
MD5718551cb789dc50d7f2c6317d709d122
SHA18c26f156c33b246b68c80467bb74cac9712dd6cf
SHA25602ee18cc11bcf4d37ce52d80b509566bb29e2b2b78260bde37ba6987e72aa1d3
SHA51276217a323782b02f4385bf068970f84978095a4cdd9716b22dd0574ba3e2618a5262a4df0670d4813369047176f77d21e124a663cd7fbee2695e0bf6742b00e8
-
Filesize
215KB
MD57117e33f9b1dc041b477060f8f8c3a0c
SHA197fbcb6676bfb43d36701805c86eac3567f61bca
SHA256a350f06808b517dd2b7f363dca6119c072d08d1677e379ce48267bc7d95f1517
SHA51231f484d210e575dc8f522d1b3c16d2a77601be172287d8f7ff009a5700820e028c9c1366d543872edaec002a7e2e5fe5880ad303cde8d28a60fe0359db4307fe
-
C:\Users\Admin\AppData\Local\Temp\{87BDF456-9882-44E6-8FFC-F73B83E42EAD}\3E42EAD\ProtonVPNTap_1.1.4.msi
Filesize2.5MB
MD58ab9d61eb819c285ab08e347c26b9d58
SHA1a1cb0e6ed4017cef37dcfbc1cc71e356f5fd2f29
SHA25610128139c58042889684c254b1e35087d31fa46eddf86997c7ca0efe5b97e04a
SHA51294d0c2dddcac0042e8b2ae1ac6ee296a8e2f3ef0a36cd69e5e37a4aec15b4161e5eb6f0674667e25904660828b2cc47054fb0cfc445c37dd08ecc006166143e1
-
C:\Users\Admin\AppData\Local\Temp\{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA}\241F3DA\ProtonVPNTun_0.13.1.msi
Filesize2.3MB
MD524b7a945bbb1693e2498759a8a4b246d
SHA19de1ea92af8e62c8ddb41e4d062c85e2945b5e5c
SHA25643625b2eb327f4aa0fa3a5c8f39358c0fc410ff505334b53ad6f42917d16ab3c
SHA5125b08b63ba46c2bc5337af4c8f6ed847636ebe074d59c476b7c83ca8a3569fd4cfb6e0a4386714f5032d0e346234c65abe6e7897329071af42a17c31ddbd1f02a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize18KB
MD5c135129ff3378bb6979debeb1f1a91e6
SHA1509679344e697cdd49cca2dd1f68290a8760a5a8
SHA25647641ecdc678348bd29f0583f16e9cfd51bcfaae6035aa0ca574987b6f8b5d3c
SHA51290659bd703f3be95cab427ac655bfebbaf7d5296b5e4b865b9b130eaa8487af51233cf9a56dfad11ea3de0f073ead2090b9e5a9fbdae567679c2766c4bc69323
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize19KB
MD5a6ce10a9503390cfb745e4a0ea1a004c
SHA112dfc98ef7929415c1d73ede90cbc5e4590c7036
SHA256db0f8605ad12d2347fbb4fd0d87dee00f7c1e9ef354f0a80fc91269fabc58558
SHA5124920f979bdb7417fe86e9772c2fc54fe051cddd3dc9ee7b03251dcdd6fb4ec91da19311af58a45f0a9b852ca7b383dba32420ad411efd83fe901acbb97500694
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\crashes\store.json.mozlz4.tmp
Filesize66B
MD5a6338865eb252d0ef8fcf11fa9af3f0d
SHA1cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA256078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
SHA512d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize5KB
MD55629996e5316b7330f595dcb5ea876f7
SHA1a9f6603b3b3ed0f12c3473441b4fa6ec4ba5de18
SHA2560019c74cc72001b8da2cd0b4d0e01eeca6bc398c33d89f511dbc6875cc42a0dd
SHA5125e231e86253384525598589ff0e3e5f7f810632f021632908f23d680eb4b79a67b9a0ca94160faa1f98010721860979483d8820330294c3c200b604237e21a58
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize6KB
MD5a804a856907aa347a1f67afac3ac3cc8
SHA1d153821a759aa263bf7479349f3351b471aa8b19
SHA256383480e94a568826f5dd2dc49d059c8de90c899fb62cbb5397c797cf32c9a206
SHA5125709843755ea0337bcd6d9f8d628f957542e172c4aa6fe3a384d9d66abd654cec1d59e816bdf4e5cebf93db9f4dec8edb050fc0c681bdb3965aeb14777d32f9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD59bb681245ddbf1961dbf20bbf3ac6ea0
SHA1cd52d77d26f11d8ade2f2ce7ad84e8050963edae
SHA25691d963b78b880361bd45d7b73df3016036443975de6326ce4d5afd01fada494f
SHA512fa505285c52167c27a30315ffe982572ca480c7531e1f4002e9af8be8ec1d8c170880f89feffdd59b87cfacd6afd45ae9a7ebbf45ea398d9429e22618574049c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\02572ddb-3347-4860-a0cf-af1e9ec5ec21
Filesize1KB
MD545a32cfb4386806bdfb14474293f6410
SHA15bf7cab3f8bd58c4777674fd9089638901814905
SHA256e01d378c48ce8678ce252ada67c3d662ff2f53064a4125587adbc0d54fbbe4d6
SHA5126f4a99d37f2623cdacbc8b5eeb5943f177d16c409e606665fd2510d4f47e4e48460c7b00168869fefc35ba8a07ce42931f6913fb14c008fc8864cd541f9ea3d9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\1f987674-9b07-4e1d-835b-0417e0c55b43
Filesize10KB
MD52b939ea4ab1ce9271823990593ae564a
SHA1247f462de4b3187b3b3270cd8f97587c6264d599
SHA256038433ad369f94e2a42e87496c301801e0d44a781c7f2d73feedb67bc6dcc26a
SHA512247f806833a035328896ed4a68f3d411ebca2dc267fcb66acff841cd0f303ccbfa47dfd96ebfaeba85c0429e3ec9c2737a629d6b76822c301a18703e61a04982
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\984e9506-7417-42ab-84f1-a78e327c7093
Filesize779B
MD5a3f6834c113d5a065b2849da7281c034
SHA13e4dd1287afb19a543c5db6432408b9e600384b9
SHA256dde9a2f436cbd1d123fad0fad5a03b22fbca8b00719e5975b205ac9dccd48e34
SHA5125ff396573309c086459dad3504c904549037806189d3099e3eba76ef4251c48034fde0c04b3209e7f2dbdce1b26313143442a99de1784d188e5e587ca650a661
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\be5520cd-239a-4975-8728-0f37c3b13e5c
Filesize746B
MD5167454b9ed671412463b23a566479d21
SHA1ce182202fff3e178f08fd8b00bf3a1021a6ecb94
SHA25674ec823128c6031b3b8fcecdfaf9f9ddb2e2bd33bb081caebda1ac50772e5d09
SHA5126350797c94d5ca7837843edf2986df02a4d133444a2390e96f81615b5fb0b0fcf51318c6748250babb598a131fb5084bc717ab9e5a0553b226ef82d74a2e3561
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\d6d7eefa-e50b-4f01-b2d0-c834b44fe898
Filesize790B
MD5c45fbcc2a649c9a992b7e7526497aff6
SHA102771218c5bdcfe5c29ca66dc7a54f0ccc8f54b1
SHA256e2001e9264dcb7d48f28ff598517c20a722e5c4c53c542e5d57585393d0c1365
SHA51232811264c5b9a259c1e77c9d7586a6b1efa386383e3219959abb175445f2398d7ffd9a27400e45e1e8a404f358cd7ef0ea21c8d81cc532431e2ce971b326d052
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\d7518aff-9725-4fde-b61e-4e003ecf4be9
Filesize1KB
MD51ca58796144ba3fc2fabac1b569fe47c
SHA1f8878262c3310f3e4ff9bc3ebe36e1f53e470307
SHA256f1694042c03f54a9b94bea68d37bcd6ed9a218d4d7ce367a4005571753e3e039
SHA512b0d23b0a57f951b997e80158039f22a00c3c39c1db99c4aa77d6ca24310a4506a4276bb8deea30c4aed5e99842659eb2c2863130f6f20cc92f12805cf3f00cb9
-
Filesize
873B
MD547e4de51ca7efae190905fd2a683e484
SHA1790567f5d6e2e1449fcc67ad8874dec9611cf8ab
SHA25609f7c3e0042a399c1924c0d75e08bf05ca00010cb499023c96c674098ce3faf7
SHA512a4c1efb7e5ca3b23db16c6cb15b5f0794b5f660652fff229c7b01b891c92fd55745fab2a997fe7bf381d802c16b5be7922f4f069634f75809f5bf393da3c4232
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
5.0MB
MD5ae6b7a12d6156fd9a000453e78bbac22
SHA194177bae2823606381445a77f233712e863bdf0f
SHA25615274417aa5f380ba5d3153da910b2d4d4eb6759e54900544f5a6886a71c0582
SHA512db6b0c7a86c801a1eda87047f9cda13b4a0ca732496b4b4419b3bdee0d7d79262afe499bdec77a036e03d594450e0cf7c140f80628f7740926eb932301b6d40d
-
Filesize
6KB
MD52170fb268601651938d97f1f712d7732
SHA105b3b06ff5535f1a198f10830cc49d362af720da
SHA2565b07c9d6c2d9e2c3ea3acf23d30e0ff4328b0ab28ed8f913a823ad81f0a1bb04
SHA512448e02fbf0ec050a5f8590caf10dcb9a7bdb81c9a310563b73ab2c0bebcf434ddfd1ff871c5c78924b57058f84fd0038048bd808f74b5da1b95afbbe47f9c231
-
Filesize
6KB
MD559fa83964374f0919344ca06bc33651d
SHA1a3f3ccf63ba6381618da20a95c3032a66f861df9
SHA256820e4ce7db2e171ba43ea2b25e5aa75f4626cbd1a946f7e6f9bf9b6122837cba
SHA512d63118cd6ff4962e94b0f298d89a525bc409330a16dac6290cfbe651395ac752f155ac26a9dc1b3853a3461fc5ec28d74c5503dbc80416967fd22a10b0f16f06
-
Filesize
7KB
MD52931be7ece25967f64ebcd1fdf5a10d0
SHA1b5e34faf999e1ed64ad39130cb90b5f8d2c92afc
SHA256dc41b07442dd3afc3024bb778b71361614120136871f5e42f28979a493ccde8c
SHA512f9de70039abd3850c7c47cca017631a0ae787df14b917028a8cb2e1785fe5d9123df0b3e9c774cf1573f663eba20b6c88b97436d40a82d6ee316a08879945b94
-
Filesize
6KB
MD564264351fabf3d98ccdd3391c06c5ffb
SHA1337cb1037d4cc9c4a768896fa1b4a445530f1a07
SHA256021120d521d27752751e88338cfa66a7ab8c824aa0572db59a214d9faf74926d
SHA512eba9ff3622f26ebbb18409a7977632467767994fb1d20ad4f4c6f1fd9201a220c537b72a7881ecfa09708cbcf47b527e7bd28455d5e9eb0d9d9a344e55331d22
-
Filesize
7KB
MD5641ef090df4021483b9aee3dda12f990
SHA1acd4d42acf41fb5ec6f8594880b7e309a00ee81a
SHA25621986dc8e1926b80193d105febf6ee7920f2186d1c03e3dabc9432ed55b561cc
SHA51278ec6a96335b5e80675434c04e465b2e79baec8f9a28f3fa23703c84b1632f2bda1cb42ef68a93f479832cac01a1155a831389080ab7bd92ce5fa6499f8d6222
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
Filesize288B
MD5948a7403e323297c6bb8a5c791b42866
SHA188a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA2562fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
SHA51217e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
Filesize146B
MD565690c43c42921410ec8043e34f09079
SHA1362add4dbd0c978ae222a354a4e8d35563da14b4
SHA2567343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
SHA512c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
Filesize193B
MD52ad4fe43dc84c6adbdfd90aaba12703f
SHA128a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA256ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
SHA5122ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
Filesize122B
MD599601438ae1349b653fcd00278943f90
SHA18958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA25672d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
SHA512ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
Filesize259B
MD5e6c20f53d6714067f2b49d0e9ba8030e
SHA1f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA25650a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
SHA512462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize38KB
MD58c57f7918a308269377364d460ae01ca
SHA14c223bea257e8aee4468d115646eff491a64773a
SHA2565ab938d39c730960ca4b87957d3ff3b44b970c8342428e6ec2b8bbf64e3ec093
SHA51290d7f1f7d83c58ca9e722c82f525e45f951b1d6fee77912793b8a15a7c0a34bb9b86d64eeb37b78d35c6956e017cb276d9da5008e23c54aaebfbf3656344c913
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize11KB
MD59d036726c600eb2b8c5838096e3e4ac7
SHA197cc93d7645d74d99eec33515f7a1315e0679e2c
SHA256833f9739afaef2b2bf09807a78612b08a80662da66e6fb044c93985717ec3282
SHA512b7f49f478b029710bc8fb45357f9ec41d075da0f50abad7bc401a38f940a5af6e7575ad9c8226dfbb8ea2d3de59fa11d1c6ad677dfe3aaef0822468878502c2e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize11KB
MD529fc8a5283f0a1e7bb34d15f02dc038a
SHA10c70950253497ac73699852c8749089610c9d7fb
SHA256784ecbb8bdbd35c50f038bb9539ec00bb948d341e5600c3e131a00888dda1bd1
SHA5120e3d9f05b236738abc08401085d4afd8662a71e737e909b727dfcff5918a17d33803f8bfe834344c1350ebf9d8bc79c1371b0e24e8b2512540d391b3cce601e7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize41KB
MD55d1089222cca6f1cd0589e78666ea0f1
SHA1a6b743dabbe201afc2b96d11bb71e8a5eaf8a5fd
SHA256bcc31b658dae3f095ed45f37582b4bc977d211bcb08e9da35455cd21c792bc16
SHA5129e8cb33103a7484a41aa889c52b3d0ebafb038d9a2c669a4110bef4d4a74cdc0f949b7c0b6f0590ed945489043d16034ad18083f1f61faa285a9263aaaad526b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5085912538f5bae55018858a46e7164ca
SHA12538dace6a851dcd500fc0595891d692a3238c19
SHA2569393b1da1a5f319e2fa9ba457b5e12b36d59ebbb2d3f7b7d0fde4542643d97ff
SHA512dfb781639675fc148fe0d7bbbf0ec2539de2a5e373e068a35345d126ebd8b4a8676520c428fc6f6e968205915d4af1838f137885fded0bbf73d1472935e7682e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize42KB
MD50377d4de740108023c68cb1c32142aaf
SHA17bedd79a0ce44254e735e8eca7147175f448cc4f
SHA256b325551135875cbace0446d6120eaae49ebcc99dea18133169bd95ac4e119162
SHA512d68b2e8d50f25d2c6ae7c7501363f4a6ebe7dbb43f64562f79830855d45f0e686a59ec81fc78cf430cdb745af15e9cce74aca83d46375696f0d7d66095602bd7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize10KB
MD5ed473675f4d9d2de32b1bbe2a9944ff0
SHA1e08f58d4fe9f9c66b5b23417decfdc5e40b03662
SHA2561f675e43142fb299eb94b9d341b18a34a94a054f6067d8fa6bd70f223e3ab09b
SHA51238837d4bf368c4a55af66a0b42c60d8de2651278a155e44db73b5b170da31fe7e099febc40a4c3a16db0f22a5bf8f4c9fc58e4e6491058040a7b41c5fe171636
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize38KB
MD59a8906fbd62c28f6a592791804186402
SHA1b23d78db122a2d4eeb13caa395a046ff3834fb37
SHA256788caf29414d1aba580ecf2998ba78555f8557264d2283093ef13088cc2f632f
SHA51273ca7d066d01f0fdc08448ce440c5e20853b287b4382efba6fac38902cd275b6c555d38b640a1b50675b5c6175ab8fdaf493daa27716b2e011c75e6911adca01
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize13KB
MD50e310e92abb08825552271aaa67d2a2f
SHA13bb68e72fcf6584f7d8534869c6c7c6621e8d7c1
SHA25672db983878281bb200e34f7558457c71a99abb6e6e0b8242452b0a3cec4adcd1
SHA5125794f030851fe5092c36a365cb8dfe71438542240230c9b5749ee65a58a19d62484c9f3448140bec561c84347d956a07aa08175fad9092a2bee6c947cbeb1d6b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize15KB
MD5d5544d0617150e272a019a41b6de2936
SHA1a806f6c6439933a0c1fcb3609216323f3ab12cea
SHA256d1f2865f6ddad548519ad9ea18c6f8215b8e8311fd6d548bdaedaa991c9e72eb
SHA512a44f6bd8226d230bced78c0586e7e82f13a38033deae68e06be8472ff3b084b5c4f659e40a7e0690c0c883ce0ddb7af1f48b12a5e5250254c0dad8700a21c132
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize38KB
MD56d60560ba648f556c55ee680a980b09a
SHA1e5432112c3a4d0f74456f10808524799358482c8
SHA2568d3452377bd8e06cb9cec6621b98f52075f8cc8cdef2f6b424f86c0859afdff7
SHA51270890b74b02dae6f76d1f5b97ccd0d3932fe800a38b0f3f77d23dde75b7dcc30eaceb1964225318e297247e89450abb959812c5cc7be5e4fb88422787a7de964
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize16KB
MD5c9265074a9d5cd7a15de1311f718102e
SHA169c32756284cf89afecf78dfc6db22c0163fae64
SHA256e977ec71e77e85138fb0a9396dfef451e635786663697b08cc09610886c44be2
SHA5124e1369b84810db7b956d55e1c724fab6708fe9f62f35c275eb18bfd0a7ebc91623c6b79609c8e89ed776dadd511e203396882df073f3d8c782bed031be2b6e54
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD53b4d57a3a15bf6501aa825533d783810
SHA1ba7652233447f9a19b2f5441cd2ddeca96bdb29f
SHA256bbb073f0f639558749f6f7fa7e2bbd83df2b33371f6444b026b9468276608fa7
SHA5125fe21cbec5aa3733c379b4318e17a555f4385ce6630972679ec08990361843787675ddd7d7d5e3b620379cc5171eb15b2277f99d646cbdc2b992e151c54a281e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize18KB
MD5eccc3256064accbad949d81c6ee8dbfa
SHA1cb51836a1b3b1e9eb198e4cfa7af03c7773ec760
SHA256751548f67ad9f61b405f4058405b3d123c92bac305704a84e9bc094df1fa677b
SHA512fe0834608593491826c95fb060fa0cec4ab8754db39add17d1f904a06f96a8d45e6c126d5dc72a676e8cd6b7f265c03e90fbd9f77297e7d69be89547fa57fc2c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize41KB
MD5af6e67f6eb7625ec0a9da8e6ca197d2c
SHA14da1e63d413a1da17c9227112f28b320ce7cfa14
SHA256588ec6a36c2558bc472aa927494c3985361722fbdfafa92cb19f793a75dfed7e
SHA51206c6873ec8a5bb4ac4f28870314210ea638f093410246be6daea92527b9e233b6dc80f50832a0182c548ba6dc099092d67454b3bfd13e88af1c2ef037555c57c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize18KB
MD540fce524e8eec80c190e646a6bfd8184
SHA1542141ccaec656dae2f3456d17b2627051a3d03c
SHA256ff2f260fc24c0d11325989c766a7f3241fc6e03bf304deff7a8bf6e2712c581c
SHA5127e625d81f3448adcf4e89f2fd5b4905999f9925b56162321d337959d8ab2876c4b2037e29bad9bf0cd896b8d88f688c64b6b9940f19a3900f4e0207bf3c19184
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize19KB
MD50cafab0c403e0ed46aeea81f9be5305b
SHA17ba209de90c7b7533069ed8c4595ad41a22ee7d8
SHA25696f89d4a37e3beb3583174743abb74bd5f3a47ced4b86a618bbbb1ffba6bab82
SHA512f5e49fdee539a5097b45018a936d21052733ef3ce564615ef0c577feca2e7212c5090abc04c80d56f7dadd99517c2b2ce62a8f57ca48530a8edc7729dc11d8f2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize37KB
MD583064b191f705ffe320aecb382a9ea67
SHA1244762c3be2aecf9dba648d0a0c5141131c23c12
SHA2563280724dd4f19af0fc1b0cc609986bc8d870d49385857e6398d33406e99073df
SHA512184bbf836325a7276d39b6e2977023abba6846fa64af6ef1f201c5f3637aaac8ca19d6b1ea5bad0325f79e787475106b13d18878b56f046f2512b774b6857e19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize38KB
MD58904e6e1674145ab1cdc413ad9a87e3c
SHA1b988e49976d4674db4abab92cd88497dcf575096
SHA256f78b3174b97c11405a6aed6ca7f6c1e4cb442008667baceb53ac0170d2b10577
SHA512bd6b08eb61562344c438d950cd03b31d14d3c988c9d2fe5b2c3f1b27c84d18795eeb621806b513eae8d9e7e03e802b41a11a2c278f2b89edf58a27e9481ee39a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4
Filesize10KB
MD55369fdf99b6e5a2fc8328d87d50b225c
SHA1f104d468b3033c9b8d8c637f7efd5a3a48aa7192
SHA25603bff333ab7846bd1c198ff0a54572892eec9b7b22335a8a6bd4f06fe01003a5
SHA5120828f1eea0bb52b9ee5655df79b6cfa4d3d9fd964df590c7f7808b0ac527866ed5efda9f2b88345f805ac9dc00437073b16fc17832c16073a31bb8ccb98680e2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4
Filesize32KB
MD5c612f7a18dbf4b5493c06d7e1bd32220
SHA129ad447e5c381f6e983a7f5aa06d5fa6bc172440
SHA256371a62b5bb2249df58f6bf661e75feb087136317c8c3322414ceab04333f426f
SHA512b22d08885efff1bb40bedfb1fa7a11b39629e524e405ffcbf8420cc60adff20aba2588346458a5e7fd3b79b09a07e9e4fb1423ff23c1a3131e01cd24b366c67e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\950216798LCo7g%sCD7a%t3a0b7a0s.sqlite
Filesize48KB
MD5add7e33429cb10b0b83901e818746f4c
SHA1be0b9d1b7d11d4a029229b9afc507baa0586a3ed
SHA256c4871d9e0d4ac22e372d56be5e595531eb726bf34f7684de3deff5c171f0dcdc
SHA5125df1a2d4c579dc9329247cf0f530944a7db0863dfe441ef098ce40d275aee3f51cabc59aa60df88223194e77dd13194327086a58c54a7b9f788fe4bc034e72cc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD57f868e557b098795d645df9ea302427f
SHA1001f3306144559b4049a8ab139b4139f51e59c0e
SHA256b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5
SHA51256fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a
-
Filesize
15KB
MD55e7f13f5c03bc5c2376d19820da3006b
SHA107264dc2290863095961fa9749beee5c03a967c1
SHA256b55b54c5eb935c62909537190c58cb7867089c16a199f0ff2c91549c26a28fee
SHA5122f864a7f9db49a0c02a6380253baee9bd8c1a0656c59dc25e7eb29c6dc162ddc59b4ba6637c05fe31c85bda7f58c98d955b2c1a42ec64d59fa5ce6cf22592f0a
-
Filesize
108KB
MD5a226d90f58d3980fb5be4997f4606b19
SHA1b2dc757d027162f5d417ce447a545a18716b96c4
SHA2567a64cb39055bed377aac1baa93c2107c9bfe3ea383dfc849752aec48f90d7056
SHA512b31d2af84c1e1f88fbc084d81f4a8a598a8f492b0e8368010380e03649c5ca01ae90fba359426f51cf6f91da81d2667164815a23e0d13edbc006fa86c63306ad
-
Filesize
3.7MB
MD5b35201b5d57b236a0b86c5a0a1f9c7e4
SHA1b3a6b3f5006c587011421f0fe8442cfcfc5a8b37
SHA256913fa66660b843ddb87de573bef4139473de5c29ab4674b2368d8c4a70b0a508
SHA512b0bd2006ab8188acb66fbc581aef656a8d2e768f40e155a174dc2578180bf2b3f35c08cf28b4a40e34e35ae63c8de20c70750d564e9614f3f4b851265efa5021
-
Filesize
136B
MD5b178ae2ca6722f08f8c74b158d628183
SHA19675a623f1b6b737b164290e572487e9e7abc35c
SHA2568601e82a0f4a21a02ea57c98070b80629202108e31148a878624181098e567f6
SHA512cd097bff4a07dddda17878ebce15be3b4c1c05e62a334f5a2539cffb61982689d9f36cd02b9a95ce474038ac10e9b9edd93386ccec9942fb7e32a195ffe5b900
-
Filesize
99KB
MD5be058aa9d48ae634abfbbb6d1191614e
SHA174259cc9157614e1982538f89c5dec230c360a85
SHA256e73f9dedd9b5a999fac468f05380bb51e4144dac2e471e9eb04afbb3b12be5ba
SHA512560a75caa10461c2e26045435b0ddd982aa71329cd8b7424d4f9d0109525a2793b9af66de838d4ba4b97d9be0b819ee32d0e06f5e1b78b04e204f53b69d0a869
-
Filesize
2KB
MD5c0024b907009fd81bafa195688ed681d
SHA1f186b8d07b5b8b30eb4a3d1436807fa42e4d7f27
SHA2567c29cacdacf46033cf11b1acd277bfb27821027cba8abf46fbcd1ee3f48e8e79
SHA51249e02432cd4f40f3b9a241a0b9f867b8e61261c8189bd4fec48e49e3f5f29f1f2c2adf22e563da6f4a08b0f74335005a6ffbf9fb2829583cbf90852a64e9073d
-
Filesize
2.0MB
MD51b2e8670d3925e6927b1240088fab8be
SHA18d849d8677c465a770610a51575ff51d999f0e93
SHA25658e2c74b4ff2c1d969d8324b047d22efe40f9958ec6c80f672be90989f8158f4
SHA51278a5425398c20406fd29678252be74fe017ef967e2bc1bdee497b51dce905fded0e1e77859f8fefe8fe3e56e6883f5534b3acaf98bad6a19a1cc0bbdd8c4d099
-
Filesize
149KB
MD5418322f7be2b68e88a93a048ac75a757
SHA109739792ff1c30f73dacafbe503630615922b561
SHA256ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
SHA512253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef
-
Filesize
690KB
MD58deb7d2f91c7392925718b3ba0aade22
SHA1fc8e9b10c83e16eb0af1b6f10128f5c37b389682
SHA256cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4
SHA51237f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c
-
Filesize
717KB
MD5c58bd81d42172a400ae138342da3e526
SHA115812f329f28d0c7f0a18bae6f93302b950267d9
SHA25657e11062cc1a2b08277f463bf1f6e352cfd0e74675c695c52a0cdc3c0b61abb8
SHA512c00ed1e41f5b104be4d34a1c81c36e3058fd4b20055cbe5dcd208645dd9b5413e6ff583fe4c2ccf0f8011e590d2ebdb51fb79cf1e0f7e8fac83e8065cecd4cff
-
Filesize
418KB
MD532fc66b494dc28ade41ccc2d21e6f973
SHA1545a5699b249ef6eda4e9d034c9e1a1f510f4f63
SHA256a453a304482050a10c288c6158cef38bfe2039aa4d0ecebfad77637468548e5c
SHA512879037cc6da964032c3220a0bc5513314849f4a5d671ffdce63a419583cc657496546240147f52e23dfb22b4715ff63a6f0f7f2b140373ed75afad5dace8fff1
-
Filesize
419KB
MD59a0696ba635299fef01371289ad6a4aa
SHA16b865faecc47c6f48b10672295011679f4bf80e5
SHA256a3566ead9e9b4e69d047d9047d4cc3284cda6dab9d05c7928aafb2b8dfc0526c
SHA51207d1503e5ba8c094fc78534e96db680699ab0c891edc5ca188e0d06bca4912a7388a02175fa7cc3adb0e1619703d4dc8590ef4990bfeb11f5e07b99ef671dedb
-
Filesize
305KB
MD5fb6c354fee1f04a3ea0ea3d5371da341
SHA1fd3fd10b399fb2fc98a588f99ed243bf3b2b667f
SHA25673e632fdb7cd7cfaf5bd6e388f891b573700c5ba93e7813ac70c959267779ee2
SHA5129a50f2922da654642470edbe2229e0ac1d5bc47d1e31a2b473c49ba6a03ca6e7464a121ebf3ea07419eaef0e245b9c927e85835c442c411c2304e097c36a7722
-
Filesize
93KB
MD5180dbfed09642a704388a90f13ed39f7
SHA1f1915959eceb1a28028a88948a170285f58498cf
SHA25603d061017270a1e8f6dd8c1af88e7425d1967f4f45a6755bc971e17d866551b8
SHA51229fc66e8d335810bb2c02904e0c56270f78a66df30a24abacb2912915a7974b7df4439aa251da359bfaaec6f17518ae92a196cca2ab9a03431dae12f891ce59d
-
Filesize
93KB
MD5efdeb2e1ef90725f319085f5d627d576
SHA1f528d986c38c66b546eb1af39c63b0a866f99ddb
SHA256484e4d455046a3eb33ea9b790ddbf0fc2fb4a328dc8560efe0db585620cc73bf
SHA512304b42b236754c25f64d1e59a1c38ad08507d2f123a020e1c0c6a54d8cc9942426ae46ea0b6a7c2d04489e5ca41c2d6ef79dbb4e6b5a3523b95806d2cdb2b9fc
-
Filesize
190KB
MD5fcfe24fefcfcd5cdc796309de5fad919
SHA1d400211474f7d5d06e4826c084ef2ccb8e7ae00d
SHA2566e7ab5f8381e3238f2f6cabbdf073ac100c1b1f5ede4a4fbbf5d8185aea8c043
SHA512700f63a53f45d65b457d56d131e05b74bdc37f5d10817429b57d6d0cb0e5a0832d000b5397f258581757a7824c87ae60c342cbfe557a34501b7fd191d069eb41
-
Filesize
2KB
MD5945faa0eff8b1a73afd3255e1f28aa3a
SHA1cfde5c7ce0f79fece868606bf68493949a35d38b
SHA256079e58e9b00de894557bae8feb40cc578070376a52971bd733d74e8955b3b126
SHA5123f0850e254679e98769de5339a0114e44697108ef079bb3fdc1698d1a27fb63aec240ca17ecc72026a4c9d0f85b54ae1b31625691b656cbc962c15b4c78de213
-
Filesize
9KB
MD5be8c17a323efda06d86df34119ebe1c9
SHA1e0ea2dfe6bd5ae19c6ed07ce674421ee7a26fcc0
SHA2566beb0344558df571234365d925c9d1ff0661b4806d87a3a7ed10f86cbe1e16a4
SHA5124462c25d2a710a5bbd1a35057e395e6f678b7845cb7ac4232886b8f5a65aa15d56a3ba064ded20a21b1a42fe4fa722e444c3fd2d5ce6646684bdc4d07c4b38b3
-
Filesize
477KB
MD5f6092ec8f7abdb3c2c089bfb3279b65f
SHA1432d2cdd982ee82fb0cfe2df025327c3692ef1a0
SHA25694def0c6290dbc32ebb9a6e72d2f76d0ffe66365606efeef952834768e47f1d8
SHA5126b62a0ce9f4bcc7c07afe2fe8c632f3a6bcdff73c3f1eeb5a4a8aebc2823f6f7edcd6d5ffd6c2d0b1adca486889b508271862217b553e5f2ee7eb9ba8e88b57f
-
Filesize
11KB
MD5fd0f86789289629d7ca824fb3b408d16
SHA1bf9adfcc899ce139600ce6c1590c0f17ccbb1ebb
SHA256b397f5edc1721e8462b63abdd76d827775329cc67b7b8369043c82d960a1a7af
SHA5120ce93d89d009545a9b6c55c08de2df691e7ec9fff2ada01a9d8e116d82e769af614b13cdb830d11b186e87b942ec8cea92962a59777cf1fdbd724ec181c0ca6d
-
Filesize
3KB
MD5aeb93168cddaf8924de824e3a1b0ac62
SHA1f728db7d6a7c552f36041575e0e9d6772aae23d8
SHA2564dd2e59e771e411b47d7fd836374c6e386bc2ac1d70578dda8a9a395605bcad0
SHA51208ec2617a49c915e301bcca97027461af37b6f8a2b0e04fbc2c83eeac33fd71a542b94e3b049fc54cd0fe1f9445fc1d5dc11c281a0851308cd6224fbe49ce1ca
-
Filesize
240KB
MD5200d84f7ddbf56eb37c564e9efceb637
SHA131fbcd6a73af012613f9a7899e4d8f96fc0eb23a
SHA256266d198f9be4b4a2efe608e39c4160602b909db4b16da04eb1f2dbc3108b4a1a
SHA5127a55a2eea25a40b50d05693166f8748d6530d4b2674c8dd170c1fc7ed994366338a8ae495f1b7ca9111bb2b95bfc7c4366fba311c95142f33a08cc35ce06088e
-
Filesize
11KB
MD53b27d01b8e8fbfe27b1a5cb1a6f8f655
SHA1f8db093eb7218e03de2e599308fab3f17e332cd8
SHA256d18ca7e98c9fee8eadb21a77df743d5ac2025e947c7631ad32d9149fb6c835b2
SHA512047d87134cd500ceb7aa0d815bd2dc8ad7aa4fd5acde3e9204bac1dba26e32fea0527514204f6a6de474973aa28c35a2b681a601200156608b595b754247346b
-
Filesize
4KB
MD53f567be24e3c7545123eb38a7a6970fa
SHA17e564b427bbe2c845aa281eec87838fc1e39cd46
SHA256d16a0676877b77b9d806c484cbc2acc48df8c51f8e434c71893fc5fff60ffaae
SHA512f4a2bd02054de83703c57aa580f68029091be951a028c36d87a8db46451115691d55bac8fe0b1601a485b614fe8f7de05d90d9bcbc6bc71281dc6a977232313b
-
Filesize
250KB
MD512e05ca73aaaaa56b6083354f32b1df9
SHA107a3d148743fe85d5d62e70491ca89b6e8588399
SHA2568aea86f4e9e507c8fe2858bb7ba0517b45130be784c2a28a174c5b3b8d9830b5
SHA5121cd7f67c388216cafc03960c60d419881004619c6e9214542a243249116f25955ac4250553c611fa204e15e308d4191868d44e52bebf13b073116500cb6b854e
-
Filesize
93KB
MD5b0d9cf4be164833555ed1a6ccb7d39e9
SHA1183c9f7f9c5e2f4589f542d08794b17cfb474e1c
SHA256df20843948e04748efbf0183b677ca0188965ce9eac817368439fcbd0e3273ec
SHA512e41d70a8c4d5012c1a5d3deebe882733cf425b4ddc7b05c41058e862bae16885127d8b166a248ef3846b9db34ff7332ea5bbbcb4fa8f5167a67d585021c3260d
-
Filesize
26.0MB
MD57f5eca78baa4955818fad998e641b009
SHA150493a5dba7497608f6130de6fe47e2ac784947b
SHA256e1be9bcc70c1d0a3750aa8e9f864260387932b0fea36fad024f8461b915bee11
SHA51281bd7d4f32ad9750265389284923e51092a5b4365ade1a3c9dc02026d5e0d9210bc0b3eb9a8860d0e3facce0243dbec29f9897e4455fe5a205fe14635b146bf9
-
\??\Volume{38fd360b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b5066554-0116-49e6-aa54-a0c16e7937ef}_OnDiskSnapshotProp
Filesize5KB
MD518d914ea7303f1a90ebc610924a8e8aa
SHA16f8bc315a7980b64a662061557b615eeecbdfec7
SHA2565c4ebfe004c3510f3ac6d58119c75931531a07b33f30a3976e7c7a53899215c6
SHA5121afdec457a66fb891e609f5453234f46c0286db630391df51e84f79f6b5c156ddaa495530d548d155c4c5262bd19cb898c42421b734f2d01475aef99725cbd84
-
Filesize
330KB
MD5ac831c25bc16a05ee60aea5d79517434
SHA14946133e7fac34315a0ccaa30ca8ad383d5f0140
SHA256947f8fd98efb1986df32a9c179eccf720376721798cc15d4cf9e31cdb8324869
SHA51272f625386a7af35b58bdb70f35b8a29cd06c091f04e4cc2f9c7ec1c1ec194e4fb120b5528b55ed589c9daa890c1bdf8762dce1e17dd69a77ec7a002d2685ba5b