floxif | 3a8f7f5e947198ba6d98d53efcb475d87816b045ef9e9f9e4d0281e8d600aad7

Analysis

max time kernel
303s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot 2024-10-23 184148.png
Size

7KB
MD5

b159ea6d4c0f037a7bf97cfea6f7f25f
SHA1

24ea5f47e967a74c36172fb30bd544114415d6aa
SHA256

3a8f7f5e947198ba6d98d53efcb475d87816b045ef9e9f9e4d0281e8d600aad7
SHA512

f67d33771adea3635aa1d2b64a3ee2d34743821336fbbf1d4ae30f2ac3d74614cb28ac92c2dac1fee94c2d0f9efd0a4eac1c9dffb7d7e45369b61c1cef50a04b
SSDEEP

192:0babDvQCoCJHYOvT0u9lPMp/OrLGyfR8YQeUWWK90nxDLx:0aFoCJHYOvR0tuLGyRrQsA5x

Score

10^/10

floxif backdoor discovery persistence trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000500000001da75-1209.dat	floxif

Downloads MZ/PE file

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000500000001da75-1209.dat	acprotect

Executes dropped EXE 25 IoCs

pid	Process
5592	Floxif.exe
5924	Floxif.exe
5884	Floxif.exe
3956	Alerta.exe
2692	Floxif.exe
4788	ColorBug.exe
6048	ColorBug.exe
6004	ColorBug.exe
3616	ColorBug.exe
616	ColorBug.exe
3968	ColorBug.exe
6024	ColorBug.exe
3548	ColorBug.exe
1712	ColorBug.exe
5480	ColorBug.exe
6004	ColorBug.exe
1948	ColorBug.exe
5756	ColorBug.exe
856	ColorBug.exe
5944	ColorBug.exe
2216	ColorBug.exe
5016	ColorBug.exe
5220	ColorBug.exe
2016	ColorBug.exe
404	ColorBug.exe

Loads dropped DLL 13 IoCs

pid	Process
1472	MsiExec.exe
1472	MsiExec.exe
1472	MsiExec.exe
1472	MsiExec.exe
1472	MsiExec.exe
1472	MsiExec.exe
1472	MsiExec.exe
1472	MsiExec.exe
5592	Floxif.exe
5924	Floxif.exe
5884	Floxif.exe
1472	MsiExec.exe
2692	Floxif.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe"	ColorBug.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
224	raw.githubusercontent.com
225	raw.githubusercontent.com

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5592-1212-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x000500000001da75-1209.dat	upx
behavioral2/memory/5592-1216-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5924-1241-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5924-1244-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5884-1249-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5884-1252-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2692-1358-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2692-1361-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5860	5592	WerFault.exe	165
404	5924	WerFault.exe	172
5860	5884	WerFault.exe	177
5096	2692	WerFault.exe	188

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alerta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 64 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\TitleText = "82 209 211"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\InactiveTitleText = "61 195 234"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowText = "14 9 199"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Menu = "30 171 195"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ActiveTitle = "3 90 166"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\HilightText = "122 121 108"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\TitleText = "189 93 159"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowFrame = "41 78 196"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowText = "138 108 20"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ActiveBorder = "79 96 155"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ActiveTitle = "3 90 166"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\InactiveTitle = "247 68 47"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\InactiveBorder = "248 231 39"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Scrollbar = "138 61 163"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Window = "95 165 74"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\MenuText = "181 226 214"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\TitleText = "231 76 26"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ButtonFace = "21 107 125"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Hilight = "123 212 136"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Scrollbar = "99 164 219"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\MenuText = "84 239 21"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowFrame = "69 12 15"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ButtonFace = "41 223 87"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\AppWorkspace = "234 33 213"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ActiveBorder = "98 42 125"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Background = "179 17 163"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\GrayText = "141 95 226"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\AppWorkspace = "15 32 241"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\HilightText = "155 149 239"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Scrollbar = "137 120 152"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\InactiveBorder = "71 10 2"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowFrame = "226 111 64"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\HilightText = "138 230 173"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Menu = "21 29 19"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\TitleText = "236 23 169"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ActiveTitle = "239 24 80"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Menu = "155 236 94"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\InactiveTitle = "27 136 236"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Hilight = "3 28 74"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ButtonFace = "141 170 64"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Window = "210 192 152"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\InactiveTitleText = "26 1 127"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowFrame = "41 78 196"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\HilightText = "127 193 215"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Scrollbar = "82 251 44"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Window = "51 76 48"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ButtonText = "109 133 172"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Scrollbar = "156 161 185"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Window = "38 98 139"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\AppWorkspace = "78 5 194"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ButtonShadow = "130 16 5"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Window = "35 48 168"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowFrame = "226 199 161"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ButtonShadow = "2 173 116"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\InactiveBorder = "100 241 222"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\InactiveTitle = "176 65 212"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowFrame = "28 154 251"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Hilight = "96 238 111"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\Scrollbar = "186 241 248"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\AppWorkspace = "52 30 13"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\WindowText = "66 42 13"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Colors\ButtonFace = "231 195 117"	ColorBug.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 6c003100000000004759664a10004f4e454e4f547e310000540009000400efbe4759664a47596b4a2e0000000b29020000000100000000000000000000000000000015fe56004f006e0065004e006f007400650020004e006f007400650062006f006f006b007300000018000000	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "4"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	MsiExec.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 71760.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 797954.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 752053.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 513581.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 993798.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5136	msedge.exe
5136	msedge.exe
4660	msedge.exe
4660	msedge.exe
5804	identity_helper.exe
5804	identity_helper.exe
5376	msedge.exe
5376	msedge.exe
4344	msedge.exe
4344	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
6104	msedge.exe
6104	msedge.exe
5364	msedge.exe
5364	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	firefox.exe
Token: SeDebugPrivilege	1440	firefox.exe
Token: SeDebugPrivilege	1440	firefox.exe
Token: SeDebugPrivilege	1440	firefox.exe
Token: SeDebugPrivilege	1440	firefox.exe
Token: SeShutdownPrivilege	4888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4888	msiexec.exe
Token: SeSecurityPrivilege	5384	msiexec.exe
Token: SeCreateTokenPrivilege	4888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4888	msiexec.exe
Token: SeLockMemoryPrivilege	4888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4888	msiexec.exe
Token: SeMachineAccountPrivilege	4888	msiexec.exe
Token: SeTcbPrivilege	4888	msiexec.exe
Token: SeSecurityPrivilege	4888	msiexec.exe
Token: SeTakeOwnershipPrivilege	4888	msiexec.exe
Token: SeLoadDriverPrivilege	4888	msiexec.exe
Token: SeSystemProfilePrivilege	4888	msiexec.exe
Token: SeSystemtimePrivilege	4888	msiexec.exe
Token: SeProfSingleProcessPrivilege	4888	msiexec.exe
Token: SeIncBasePriorityPrivilege	4888	msiexec.exe
Token: SeCreatePagefilePrivilege	4888	msiexec.exe
Token: SeCreatePermanentPrivilege	4888	msiexec.exe
Token: SeBackupPrivilege	4888	msiexec.exe
Token: SeRestorePrivilege	4888	msiexec.exe
Token: SeShutdownPrivilege	4888	msiexec.exe
Token: SeDebugPrivilege	4888	msiexec.exe
Token: SeAuditPrivilege	4888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4888	msiexec.exe
Token: SeChangeNotifyPrivilege	4888	msiexec.exe
Token: SeRemoteShutdownPrivilege	4888	msiexec.exe
Token: SeUndockPrivilege	4888	msiexec.exe
Token: SeSyncAgentPrivilege	4888	msiexec.exe
Token: SeEnableDelegationPrivilege	4888	msiexec.exe
Token: SeManageVolumePrivilege	4888	msiexec.exe
Token: SeImpersonatePrivilege	4888	msiexec.exe
Token: SeCreateGlobalPrivilege	4888	msiexec.exe
Token: SeCreateTokenPrivilege	4888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4888	msiexec.exe
Token: SeLockMemoryPrivilege	4888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4888	msiexec.exe
Token: SeMachineAccountPrivilege	4888	msiexec.exe
Token: SeTcbPrivilege	4888	msiexec.exe
Token: SeSecurityPrivilege	4888	msiexec.exe
Token: SeTakeOwnershipPrivilege	4888	msiexec.exe
Token: SeLoadDriverPrivilege	4888	msiexec.exe
Token: SeSystemProfilePrivilege	4888	msiexec.exe
Token: SeSystemtimePrivilege	4888	msiexec.exe
Token: SeProfSingleProcessPrivilege	4888	msiexec.exe
Token: SeIncBasePriorityPrivilege	4888	msiexec.exe
Token: SeCreatePagefilePrivilege	4888	msiexec.exe
Token: SeCreatePermanentPrivilege	4888	msiexec.exe
Token: SeBackupPrivilege	4888	msiexec.exe
Token: SeRestorePrivilege	4888	msiexec.exe
Token: SeShutdownPrivilege	4888	msiexec.exe
Token: SeDebugPrivilege	4888	msiexec.exe
Token: SeAuditPrivilege	4888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4888	msiexec.exe
Token: SeChangeNotifyPrivilege	4888	msiexec.exe
Token: SeRemoteShutdownPrivilege	4888	msiexec.exe
Token: SeUndockPrivilege	4888	msiexec.exe
Token: SeSyncAgentPrivilege	4888	msiexec.exe
Token: SeEnableDelegationPrivilege	4888	msiexec.exe
Token: SeManageVolumePrivilege	4888	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
1440	firefox.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1440	firefox.exe
4660	msedge.exe
4660	msedge.exe
1472	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 2624 wrote to memory of 1440	2624	firefox.exe	98
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 440	1440	firefox.exe	99
PID 1440 wrote to memory of 2892	1440	firefox.exe	100
PID 1440 wrote to memory of 2892	1440	firefox.exe	100
PID 1440 wrote to memory of 2892	1440	firefox.exe	100
PID 1440 wrote to memory of 2892	1440	firefox.exe	100
PID 1440 wrote to memory of 2892	1440	firefox.exe	100
PID 1440 wrote to memory of 2892	1440	firefox.exe	100
PID 1440 wrote to memory of 2892	1440	firefox.exe	100
PID 1440 wrote to memory of 2892	1440	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-10-23 184148.png"
1⤵
PID:4316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1936 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c27b7264-61c0-4bcf-8896-e8b869808bae} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" gpu
    3⤵
    PID:440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2420 -prefMapHandle 2416 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9132e8f2-7022-44ff-8f80-b5400d696524} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" socket
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3032 -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 3124 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3b76303-a230-4095-b60a-530702d5615a} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" tab
    3⤵
    PID:2000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4340 -childID 2 -isForBrowser -prefsHandle 4332 -prefMapHandle 4328 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3efa8c38-98ba-486b-95a0-d5959a98f86a} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" tab
    3⤵
    PID:2368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4864 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4856 -prefMapHandle 4848 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7082166-f816-4a6f-b34f-d0d2fa1b605b} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" utility
    3⤵
    - Checks processor information in registry
    PID:656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5208 -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 5200 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {577eb39b-a5f3-4ff2-975b-a0dba3ca9a83} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" tab
    3⤵
    PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5384 -childID 4 -isForBrowser -prefsHandle 5464 -prefMapHandle 5460 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05d183b5-2eb9-4ad8-96f1-0a6182e14511} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" tab
    3⤵
    PID:860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 5 -isForBrowser -prefsHandle 5664 -prefMapHandle 5660 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aff0a823-e821-4bec-94ad-d8fc50a3db9a} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" tab
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 6 -isForBrowser -prefsHandle 5168 -prefMapHandle 5164 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd8cd29a-de09-4e49-83c1-794015a11973} 1440 "\\.\pipe\gecko-crash-server-pipe.1440" tab
    3⤵
    PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbc15146f8,0x7ffbc1514708,0x7ffbc1514718
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1428 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\BabylonClient12.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6104
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 436
    3⤵
    - Program crash
    PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5364
- C:\Users\Admin\Downloads\Alerta.exe
  "C:\Users\Admin\Downloads\Alerta.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3956
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 432
    3⤵
    - Program crash
    PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:4788
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:6048
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:6004
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:3616
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:616
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:3968
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:6024
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:2216
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:3548
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:1712
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:5480
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:6004
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:1948
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:5756
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:856
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:5220
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:5944
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:5016
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:2016
- C:\Users\Admin\Downloads\ColorBug.exe
  "C:\Users\Admin\Downloads\ColorBug.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:6548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:7084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13055268013716607851,3889374655563444893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:6156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5536

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5384
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 785A36923C0DE411120CE7D885FA9EF6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5592 -ip 5592
1⤵
PID:5864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1464

C:\Users\Admin\Downloads\Floxif.exe
"C:\Users\Admin\Downloads\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 432
  2⤵
  - Program crash
  PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5924 -ip 5924
1⤵
PID:2044

C:\Users\Admin\Downloads\Floxif.exe
"C:\Users\Admin\Downloads\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 400
  2⤵
  - Program crash
  PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5884 -ip 5884
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2692 -ip 2692
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
2550cbdc2698c71e413a665f770dfd28

SHA1
f8f8c425a742d9c31d3b18af4cf03955a654bbdb

SHA256
780e0393310881cbe926a93da89427db72fcc2f8291dc820906dd246b87eba79

SHA512
fe40ecab0264fa6c99aab9a92a27bbabe1cefdb61244ca7bcf353006da925e65d2545fd69a71fb6e51f88296b5d25abefcbd0314415698fc2cce3f99d8dd4bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1EBE14305C1CD982CC3D154951EA37D2

Filesize
727B

MD5
f86277cf763e468fe3d5289c237482e8

SHA1
129fc887057913abceed824f01b45ff4fff54162

SHA256
5b030f1f3bd52898cad02ff07d253fd9594f908a30b44a3fc7a1c0c289652956

SHA512
d5878218f3d6fb7fa06596fbc2f76bb550b824d80065286bc9f712edb5e3e0338638b593df85ed69c47c918f6d1d09e2eac91706ca8f8952d4be915bdd9c41c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
c8d51e22ed71c880760e47ebf72fe42e

SHA1
6cd318ddaffcf78f07ee5a7cc433e215f3d68251

SHA256
2bf401ec02ddef8f8841c1d9e15801b1073c9f254b00ed79f254978b840624fb

SHA512
d8e49648e971c40bdbf538e0c633336dc7a3ee247edcace34a846f97b87a6b99b60d70741493286a32f08df32e115784366270be17702298a2371d79078bad68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
eb9c83597f2891c456b72e7c63a57639

SHA1
8ff84aed06a68eee2ad2873af0de7e302b18573c

SHA256
0d095ba6ac272993bedf47d9ff4c5680b06e1ebc732feba26f9b0e7b72f3b98d

SHA512
4f1c81b74346f190f0958e8d22f6c673cf60fd1419fd4f90df4725b6bfceced154a0ef3af9c2ef5daf47a5a346cde0c77df8e22f85cb9508f52c812d26eec439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1EBE14305C1CD982CC3D154951EA37D2

Filesize
404B

MD5
904cc5318496c5f2b42108c30952096a

SHA1
a48f0871816538ecd9e32fdae50a509ecde704b2

SHA256
2f2e6e70cc51741df3742a0bfd61f4cff274700e47dfc4f6945f947a79c4443a

SHA512
29d013a69514e58c669d415da6f65880d4e82b3da0727e64c015373b4fdf50f2dfa4fea87e7f67316c1e54a1f0a596551c496d636ac38af4b232f626e1a065bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
576054507b734217c4fd822cab48c7e9

SHA1
bb2d5b63cfa15d76c9aeaa2037014fb15fd55772

SHA256
0cc1fa9df154cf6d99b03a455f8c78f8db4988fe64760c96bbe04ade28068fec

SHA512
bbad81113e716b7f1530b3f6f82cef1bc93f8aee425655327f98c431ec40c892b64d291f103d24d25956c2a2fa750946af8fabdf1aa00b84170acefee21f3abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c27c78fa1bc81e1ca4bbc8d08cb371af

SHA1
a32fc03ef7b54920705dde183595e316cdb265f0

SHA256
695f8c190cae7bc845ebed23e5e3821f6679fe3db62442745dc5ebb86f160621

SHA512
dc7a03804a89d72bc79e03caf4f438b0e68004a158c348f8d435bcc92402e0c860ac85334b945700fc605bf568476983ece710a1491097f591fd13b9ede3e74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
86a8fdac2d9c69cf5a3f924209690234

SHA1
e46ff86dcc20ed78a04ad1fac7f61ab764816b0a

SHA256
ed9e2781fdadb64247de0a693bc608346891404b31036985ed3d07dd1a8c99b2

SHA512
2d3572cd96f9396f2d089e4cf2f5db33cc27bda6d0776c3412e29c9c2a9a5133f96d5d45c938901e57a448deefcd96430bdb9048e29a131c1a0fb2196ab76dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
90b3615ed417d4c698da7f36d2ee4896

SHA1
bb7918e2ab52bc723eae9c0fcd20eb1975c07ee2

SHA256
d931bce102a90894ad6834be9b3f70cf634ab326f0d4e16313e4ef7e92fdef9a

SHA512
870bc9f723c63bdb4e464b1e8fda924c4b51d9c1e2650c0de8a2eb7156093a43b875f472746ca2a3ff131081fcc740d7ee7a79d12ebe9855fe458e0d23389d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5405b78b1d7f5e1b7b3f19083a7a1ca2

SHA1
fd9ca048e72dc9818da76d15d13adf49edccfc5b

SHA256
ac6d224939408070843bb9dda790a52f53076dd84b3530b738eea83aeb4bdc02

SHA512
e966bde8446397b61c66c8364efecb98c9b93aab8d1ac82516ae707177790fdf6000f6502f1081156bfa39289ca7d6fa1e102d5d835b3eaad5d5fc642eb5a147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
610632fe33dde0605b6c676d64604a37

SHA1
f7f3d4c443d44a63d1f33dc7d871784664634843

SHA256
a1cffc6c1ecde9f54d45f0ccb9604c6b5b9c728527c82237f04d9aed5400ee92

SHA512
a8a971bfd1a434a1af9fe1cc54935e6c9049812b098ade878c28f298c41cc96905edf633e112bcc08fdc84117df63f1cc3632cba7a5f72e21b481ac2b0122852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8c1105d98277488d8d8aa059d449718a

SHA1
82a8c266f29ceeb7fffd533141563b5d0e14344d

SHA256
bf829818fe18cb4b4d9a84c77261a08e73697165b8f68fd4940cd35803ec1d34

SHA512
57d3dd7bf756df82705762518d4192a968c371e817058105e289115fbe98d1fc5525e7b19f39a0b4095a47912917384d1ff3b0ad47d0fdad9ebfc55e63ca7c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c22c4c1bca02155d30e66a9492dcdb77

SHA1
d02b807f93ae154b7aead8713edeba848c8a8ae6

SHA256
27bb87098755290a3259969d549858109c07577aa3bf69748c75b10929343da9

SHA512
ff1109b77537fa448191b1855b3135c02c6c53708b391ee938c60efa2df161b83461243ffb7636e021f632aa11e07ccc0e8e1a0ad2ba9c456414db137823e7a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
626e2c12179820a8b2d37ae4c2855781

SHA1
431cb95424003f27020e566115ff94f712869f4c

SHA256
f11bea86c94a3aaa64909361d733c2b768e37637cae7da201ba05839d2a70ae7

SHA512
768e931ffba46deae0371a18479bda18ee9413f16e0f0d5c411fe2542a525d8abf1bf89baef868f3cece1aef0331815f4076d372e219b7a35b645db9c4d88299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e43b56c934cb3169e57b824ae87ba551

SHA1
a4dc613c02493e96eccb8dd0c7ba97aa6fdb51e7

SHA256
966a0fa36e226a26cf99a0e257c00ca4ab78482977c2e79af10fe74f1ae361d8

SHA512
af232654a229492381697e3917da0fcf1adfa2e7362d65888ce5e122cc549d18ac912dc779d12b095745e3b6456b3c2fd920466b10584dbf431b10e33edb4d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c443fc1094cc85788e1fde6b5e1f51b

SHA1
1fa212d0147bf6ad22c0c9b9d00c6f8867381c43

SHA256
7677d7cfc381835764de297f36eaf74d2bcdeb5a7af0d2a8a8e7f52bb91cb5b8

SHA512
cff80131599b7845805bbca7818884418823177f9c58615f806a6a0c6ffe90d3b9a025b3a40e90a4c7677694b78de057d07151a197315a0e25da95399b42925d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e1bee24e2d335fa4edb5855b77c4a596

SHA1
1b6aae47ccad74c0b5846f10effe84e2f7f7f575

SHA256
a2fd0f4ff4be7d273af885a1688264bced974cacb79cede26e79709e4c06bd97

SHA512
3c04408338ffed5f38a229df21e881147fe595342f8765bcc0dea8b0ab3552c5010a48b04031979377b18e33f7e63e9d5c03a4ccd0832d48bab60d0cd79b63f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab4cbc2ea68943bda858598d79fd0a49

SHA1
e694dcdcdbaf8ad77940bac6b1e20d80fdfe4990

SHA256
00b80dcde8f8d9c4b3856ee20dab564ea54bb3ab030cf60d71564783732e8465

SHA512
e6811c4df987c1014069b72a9b1c022c0eac79f811b227a89d415ce6ddfc5862ab37ec137056c1b3966b36cb64d12995d03af7ec9a2f53b3dd37b957dcb7a8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
db71b4b1bc4e8142348388c7c5dc7e81

SHA1
a441abb0de9cb0a96869385c3f91e38d3e06bcc9

SHA256
22ddc6dc83f16199d615f3cb3651e76f1301a79b42c95cb0c200e18c308b5a06

SHA512
ef35a17b2292953334b79002c017f431c72c7a241af485dcf46a2df9c1389243077da2bb8a4315be8cc7e713e2f6f5f76a60f27fd3e9073e455512690b4fe830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e2fe47b94fd4960398bb6736ff13d02a

SHA1
d1491639d18c287ea7035deb82e9ff8059339cae

SHA256
342d9850a8937f0e49d0d3f872df4d44a8e673d71679cf3b6facdc17b367b735

SHA512
c15a94d0f16c81440e7fff709b6f85b0ad4eafaa71588b1e635151c701d53fdd67e348dcc7ba55e0da01350e9af62a8e99ae26b27ca3f2a6115491f86c7c9cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
395e3429878a9feb46422cf98b56982e

SHA1
c8643e160cd1d1c348d712d2bb79394533fdf19f

SHA256
fc5a94b4473003d6ed08322491d1603dabac66f5837d470f19ccfdc1c1aa2a44

SHA512
8007b8746d9538dab105093a838a0830c9bb92e60aa184db393d7476121a6d7d3862bd4e4a2ceab75cbedace980700c52f1d5f4a3d60c604a416ad60ef4fa3b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0328c2a928f0a59367c36629533225c0

SHA1
0272b04e2b6ad6922fe963251275efa618db1ce4

SHA256
e62a3a1152b11d61f34fc7b99d4083ffa94fab41f23bbfe79c8d1f0e2c968faf

SHA512
59f0c3066b55fec6009324f1f084983bb0c921c72afd60062b66403ba7ba3ed03376f621077ecc65551cf557422083dc0265d258a9c8b45a1372533b8b60d811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4ff7291fa5154184cbabd1ccd4fe14cf

SHA1
767c2f6b5e5e1d6680d0445828537c095fd10289

SHA256
7f5d307759ea34864a9a48191b762ca06e9910b6de7113e69a1239675085ea50

SHA512
a6d6fdd83bfa40d736fed45d41769a45c0849a6c621c2c821bf81ca3ab57e0579bf00b94dcd3e01b7280691949e6474769a89d4a2d071c96aa1602cdc7976732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4150980e3c61582140767883aef2907b

SHA1
dee8cde27994bd22c02218acdb0fa3aa5cdcba4e

SHA256
7b8c0781556c1428d8aefca51de96af64886b568baf8c5e62300a0e482729ff1

SHA512
f23e4d21c5b4b6190c8731a2dc27cc3dd993cb2648b7cfa930c0fcbb95845873002d1988b91273904d0eb9eacd966a6fc71fbd823fc479fc025537a2beca2b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587b74.TMP

Filesize
1KB

MD5
40fff909d9cce81d749fa39456a08066

SHA1
eeb6da5815ddc6877b87032da8e1d7b53ce1153e

SHA256
65471a1d6900490e5939738d0a1b86647bd2b94176bdd924bcf4ef3ffc34676d

SHA512
f337841e406324e963b2914919774abd87b512687a418416ebdd4c7eba68eb39267ff0e06e09ea111ba42e1dbd477fae59b3b61220f4b810726edb580717f424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83f6f7d472f5bbf0f6d2893a19df09c1

SHA1
31fc49d65a5a08a1ad6051ec3e3b1ab729f2cea5

SHA256
578417e3d4e32144461e5fdc06171b24524ad4ac4b30c287d7fa7042d2fabea5

SHA512
1d1ac787b73741a7795316cb9d5462e72f16351e882122a12ed2035fef8bf4b9e281138c898de479dc3267f002a54ef88c1540e7d3bc6d2ccd8129e97a612ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5895f3bc1e2182abbc729363ed961c6d

SHA1
9ec8a322d1af76b223bb48649f21381e950dcc26

SHA256
6253ebf875822dbd09bf19e386917f262bcea2d12fed2b9c43e10f08e6fc79fb

SHA512
4c094f4c76ad29b9c33ea633826fb890c4fdfcfd4dc1be1a2fcf790234e4c671b5c4368c2f4fc429bce48f9f5ad9851784615942c8cd75bc12803eaf0a38a033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
277c090cfe3dfcfe81e88cb5e9d31200

SHA1
e1be072cf6dea9cb6b5e0e11c8e81a1db59dd07a

SHA256
1c648a53d233f386bbae8f181d860cbdb6192843982c72abf5988b27f9485722

SHA512
0d8e3f99ce148cfe3101914b9db665158ee81d69e99722c9c9d2e595fea30d6086bc60ecece8b3abb4a550a5f98a504fb226dee70eb2090ba529b60948bcbc2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
59a774c073b724d53a464877fbc307b4

SHA1
0eb14a242a0cad3386499f713c14ed5b7a1f00df

SHA256
a2ec5821d383ce77ecb58948355a6f214d0c165713483b008b4c0cbb25502431

SHA512
77d8ba020ddf76ae4d69f11fe42a3423f98b98e9238fb58975fc72443f13ebed0ca4654a2edb150bca1dcfe3a807b9f9be32bfc47855983b04ccf7f04aabaa8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
3c08320d735ab8614e94b64c3c3a8a5f

SHA1
e9f3ffa856e1aaa9eeb41b9cad2a1ea35e2dd276

SHA256
9fb23dfe7179cd94f12ec7fd76384343fe0f25cb730f339bb81cfd2a7a9a0d53

SHA512
ad7460983249a9b93100c87455ed71cae9ce448f02bd63f3d1e06fc5a38796c637a42e1ecc908629d1d41b8ae3b1859aa7fcb2ab0b34291767ed9b60fb557ef1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI908E.tmp

Filesize
421KB

MD5
6480fcba16736e3403d6c0ad769ffe25

SHA1
dbbe89051854351bab03bf4e62c2f863d1fe0be8

SHA256
3b53053d5fa16cf295c6c802b6994dfebf476e7675a475af02ea0d30a1a5498e

SHA512
bd5bd6de378968da6bf7a163052273aa21c12ad369ff39d7095bec0dc5d97d3fceb721d113c682d7b0e7c3c91a15cd0d7abd27acf7348357b02beb90f38ec037

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{09EAD19A-804B-444F-B17C-15F8C5837E63}\BException.dll

Filesize
142KB

MD5
d7c8a5e488306d17b368b3edd6c92fff

SHA1
d5e3d2f00a17c8e7d9b067fa3aef56d1c8e59902

SHA256
02c5e8e8541645d16d68cb986b895b75d83f135aa8da4a8177e5534b9a86b7c9

SHA512
d44eff21b9559d972e459e47d49d788e11d75e30517ba1a6c8e07f08d1bd24ffd76fdb73232024db33a590cb8717079e7af8aa848768963a98a4fbb4a20e0d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{09EAD19A-804B-444F-B17C-15F8C5837E63}\BabyServices.dll

Filesize
922KB

MD5
a80876290a9ddbb9b24ad6b17ac805b8

SHA1
a748e945053c8358654bf72f4f1bfeb5326440e2

SHA256
8b614ae0babdaea704e2a6aca233333132a23ae463fe9390d769ba4110e5be4e

SHA512
7d05b15be914dac1115a66f6092cb160d54ff4dbafc185fc7f9f52408d0c2c45700132385109f2e2c47caf0ea3032f28ce8b259b434f129db9b46bcd4aa1562e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A68RAYHTCFPLC7EQ0QL2.temp

Filesize
8KB

MD5
90e5517938aac4629278a650e4e89293

SHA1
dd472046d70870c77a75cad32a6616a10b3821b0

SHA256
4f606bcf17e511927aa9c59f7453a545e16950a1ede5a4417e4c7642aca55ae9

SHA512
8d1e687b36fde8f70432323bb2fe19699ce5c5b18987448c0654c8a79980b990cd65f43605b9ec3b48e912651fba5eb9cd728276a6468d0ab901e567e06f24aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

Filesize
6KB

MD5
b2cedbf2c94fa1567545c74f0eb619f5

SHA1
457f8485abacb2d20272a151612502d33bf29473

SHA256
37f0594b061fa8028d02dbf55acf40f6ee18ac25308fc1bf69b752576648ea0c

SHA512
63a92bf8f9e53cc0be214bbad38129bf613a7ec91c83bcde12ff851f7fba458b7ab2c87dea1efd198f48b2f724ca46e6302d38edec17307e160cbc971f110265

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

Filesize
12KB

MD5
75645ee929ffc9691f4aacfedd05aec5

SHA1
57367850ea246cb2d3bd4b1ee72e9af404fe7a9b

SHA256
83d83fb248737cb8b9a4fc1f0f874aad74d87ef4aacbf9cbda450a814acb047f

SHA512
4d5d30851cddac6b59edc6ad3ac85d0ab49401eaf141ad08d2d51ebe224bd963f33e5f2a66a413b81d800e8e7cf27d1a0a94ce8a03e339b55afc6f40e1593bc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
3567cfbada348e0ec205a061e0f4d5b1

SHA1
0ff6b0734962a1385354f3841a1aae23aaee9284

SHA256
5458be8ac81f2ca14c1333b389008a97f3500c12e6c1ef20126341e2ecd8ff6f

SHA512
5edd47894d516d36400deaf207549283f1e31deac1316b2899d65f243807f1dfa87563bf2f90966c7d48e97e1df5bbed28a866e98f62f0cc9fcd6204ead9b3d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
ce52b82ce970eee65456eff4777dab5a

SHA1
d76cf9d70bd7f3cabe7bdf34f8601f161cf0e5c8

SHA256
e593ae0201b5346532c2476dcf953e1349e40d1cff91e7c13ac6b7684fe11a34

SHA512
452d0969301064041fe5cfca124273c8be2ea89e0fe329f10181c3c10913e4b20bddaa0975ed2491a73078d47ff10d9929b30d8cc8738e9f99798db75c265e20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
0db197d312a0ac777695a07d2197a576

SHA1
1dc28425ca846e5c76faf18d0aaf6f2ccf97c9f1

SHA256
745a31d08bf3313d0c288743d01ee1fe4dd3a4531fc5ff44cf1694b76504b84e

SHA512
b6db26e3db3cec76050a7fdb425053ffe2815195bc46f8ca96ac7f621cfda566a54297774815d49754949097ab35fef65e2ebb148fcd31a8710204d3fe2a9234

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
93ecec2059d8a1ae5691c1300eafb48f

SHA1
c5357a7813d1101fdc392d9802ab0fbf4b61a8e8

SHA256
f66bcdd74a29826668a71c6327add7a6c8384f5c8307ec46924430ed4aa76b03

SHA512
ad5ec290ee17e6e6023998bb6c48a63ace2b581546855d86295d10d3dfa3307f4df38672cd5fb13738cf35f14de5a37fabc5bbf9a5f8742ed9744c7e298311f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
35KB

MD5
02c0ed3bd1a6daf47f4c7e769abad82a

SHA1
8e894baacc36fd027745fac53111ec14474a335e

SHA256
3365ae837762b80ee9088f798b76b8de9bfbb49e685ca21348716861a1a9901b

SHA512
39d82d9c4986f160a6a201a243021d1128bb8223f482d529079ba079b974626c1611189996b58d1997ae6645c86a8a9b2aac5672d74a50fdaae51b89d0a9c935

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\abad594f-a71f-46dc-9267-7dd81b3b649d

Filesize
659B

MD5
363f5eecf411eb09863bb7f2b89539b0

SHA1
f87f1877c6eedac90989513c7218bdb9d634a607

SHA256
6f6708bd29fe0e380acedc98b08f4a326827f7727f19756ad78839090abd83d8

SHA512
81df6e6f223f58fcd15fea7c2abc5b758b005e7810b82bd36281ca7f44534f86001872f4e4ccfb4c787db1fecfadc9066b5ab7c44ce768a81bd4bb0f3238e897

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\acefa1ce-c35c-4f36-ad03-b3f5ad688679

Filesize
982B

MD5
4378d95a613b42d44bc80580fca03035

SHA1
4cff1bd7800cc4e251c3d7d2917c5e21ede86da7

SHA256
e2d5d5490e1950915ed98376cdda2fe92f7987ed6b41498e9b400e0148714f71

SHA512
6700c04bbdc36b53ca9574e6b07a95a0ad51dce5520cfe5ab3ee9bc4ee439f411e544cfeeaa97867633f9722a43534a1b38909494c74a95f72d11c08bc1a80bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
11KB

MD5
9174635e519a07b8c0e6cc81143de023

SHA1
129ab98b4e0a0845f7fbe1028a45eda3643be1af

SHA256
3093c852a436d9c1ca2c0becf29382fbea8a17faa68f5bef95287177172783d7

SHA512
668ba4682e42b1e723a5a2ec16331968cc9bd180df5b64aa7235e5eb0debd64394104cc994ce10cf47601a4580bf4df3f7bc894084a94c589c92b56a696decf1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
10KB

MD5
977d72abb45f76bc2b8a8de9e151062b

SHA1
8f1abc786f490749b5d4d1ca6f570ff40e0cfca2

SHA256
d408f4bc604ad07a1efc0166fd714af4ebfca576f8564e5490c7e43ae1278ab8

SHA512
0641b78781d2473bc1a1a8d4605b91117bd338abad152aab6c8ea5cc6e932da42e12917660077131520425a8a6c1315f7766b96a56b1b60c1412d33c88f7696f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js

Filesize
10KB

MD5
b6a49de2582f9018fae1995069e45d5e

SHA1
9ed5c96313ea5197e4b56c1b19e6af030c9fdb37

SHA256
39046353b06da1e162887f6c613a264139ac5b7ae7d47cb88750c7d401b85e81

SHA512
880d6dd391969b40ee09b266ecc73d04bf16e155bf662feae11f3df1a91bd32228010ed9b4193ab2e4f78f168fbf9a0430a67061cb0945e1f0a2e33697c13c87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
b389dc66b7f4759fe542937ccea0e85b

SHA1
08b1b70b2292d3a23eaaac89ef1d07a67114f387

SHA256
6c540114efa0916b386c73de77fbad7abf29172d7945be63e6e3cafadb52e381

SHA512
d43d3302f18998059304630e6dc7b3ec70b303eff50bc84b3f73bd86f5621237a131d541efc5746e86f76bc6e2f89ebcbaab457ee9368195975178c0f4fad4d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
e530097b010afca7144468f293c0d3ce

SHA1
1449440aee43bc567d6fe507ca7be179581c1d66

SHA256
27a30ef49124316d1922dcd0736d3fdb150c5bc522c0313e01c005f09713aa1b

SHA512
f0176d61caf0c08d6d43ac3f70be5f7936c0bd714d79a3b497e59935c8c848ad8cf972b58c180f4b85e52faafccc67be61445e62badb72e201bead928e96943b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
d85437846c3da04eb7da85242598f5a5

SHA1
cf84c28b0ce304403bc11b605012eafff94f6d73

SHA256
ae9b1a4cab12d32a8e99622489f1ce4ce3553d3a5686d101b676c4378dd3fb9a

SHA512
2256007220a38855832ed20a97913acf6e5483d62e1f20022f5f55c3e092cb4e993ea3b8f512dd18c579348c438c1ab788eac9c04922ebfdfd5fb34dd624340e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
bde0613d2be1fc77a5a772160f77e80b

SHA1
d4831c2f3d404560769f88ebeea4dc33ded0eb01

SHA256
246471dbdc8769625e84e1988aa8e3e7bb0c68a9d4b1868d038aa97d519f468c

SHA512
024dd313da35cc106902dc19ded0ed0051fea01df4d49c3494efa3b8efbf490604e36933ef7cc884c288ef64c4fe3b37d07ff13dab1d3a8d3152651aca08cc4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
1f6dd5d2bcace91c71ab49ed894280b9

SHA1
80a3c7d5c18fd1da2f5be947ea58220428bab340

SHA256
9e15ac596c892bf43635bef880c22b81434361f1dae7acb7c6334814a912f244

SHA512
3c93d10f74e8b2d148f6986e303bbaeb037e558e82e0db9e7ed61021571aa32c1b2564d32434ada26f1ecf9a64b1eaac9e8158e73a7725f7df6a40a24f69ee56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
b44c4245342ca2634edac99f26e36b2c

SHA1
4562fe00cdfeaac1a82ce7d9bff068385a262ccd

SHA256
e171d0f762f56b0215c958fc171d80097d06a7988cffbc6d51d7b47bc8f6fb66

SHA512
2a44533a23531cac13704b634181fd9b927dbc0099b30017bb608acbe79dd90b0576d27b775fb8d5ae0a97e5959bcebbed5eac8e35ad2d8aad5e95ec07b9a525

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
d73bbe45896171c325b635c8b68e72c0

SHA1
49d2b6ecf20e31f717449bce02afbc45b11e00a3

SHA256
843d5cc6c77c377eb771c305c0856f91e80ae3793ac2afccd30aa5f33ba9f4d1

SHA512
b4f449799622bff5d759231dd75d45474b684f52ac07cb492360e73efa516dc9888779ce5c8e317971e9fffc43a3905c95d9fd639929f6eaed56b5ae1698cb07

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
384KB

MD5
1726eabccbb40bb062002ab7d3dd21bc

SHA1
33474adfa14a18ab71c61e0c458720aac1f9504b

SHA256
78f0fccee34083643e00ea5d44acfcf922e356bd6446330109eca684d523ad22

SHA512
abd16cfa4a48e72e4b05c3650b23a4c3f51344c283d43a7add4761eff2e76d4b1bb62c9a2a9d6afdc39456711cf222a777578016da843141f8e5815f1296329a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 513581.crdownload

Filesize
111KB

MD5
e8ed8aaf35e6059ba28504c19ff50bab

SHA1
01412235baf64c5b928252639369eea4e2ba5192

SHA256
2d2a22db20a44474afbd7b0e6488690bad584dcae9789a5db776cc1a00b98728

SHA512
d007c96b2fad26763d27be8447ca65e0ab890deb6388b90cf83c0b3431e09b225f7424098927b54f15fe34eae953b61b45371b0df4b2d89c60be9c006ffe9034

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 71760.crdownload

Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 752053.crdownload

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 993798.crdownload

Filesize
53KB

MD5
6536b10e5a713803d034c607d2de19e3

SHA1
a6000c05f565a36d2250bdab2ce78f505ca624b7

SHA256
775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de

SHA512
61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 993798.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
memory/404-1464-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/616-1440-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/856-1454-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1472-1093-0x00000000034A0000-0x00000000034C7000-memory.dmp

Filesize
156KB

Download
memory/1712-1456-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1948-1451-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2016-1458-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2216-1453-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2692-1359-0x0000000000070000-0x00000000000E5000-memory.dmp

Filesize
468KB

Download
memory/2692-1358-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2692-1361-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3548-1460-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3616-1439-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3968-1441-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4788-1427-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5016-1452-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5220-1459-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5480-1463-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5592-1212-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5592-1216-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5592-1214-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/5756-1457-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5884-1249-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5884-1252-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5924-1241-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5924-1242-0x0000000000070000-0x00000000000E5000-memory.dmp

Filesize
468KB

Download
memory/5924-1244-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5944-1455-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6004-1438-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6004-1462-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6024-1461-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6048-1437-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download