Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
368s -
max time network
368s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 16:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://storage-prod-do-blr1-c.transfernow.net/files/2025-01-18%2F50881acb09bfe9169b09851e682d9750%2F20250118d1daVVAq%2FSfkyIv%2FR%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip?fileName=R%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip&bucketName=tnow-prod-apac&bucketId=6713bc8a-6b2c-4105-a432-4ff791c2ab89&size=12460685&singleFile=true&storageCache=true&x-amz-server-side-encryption-customer-algorithm=AES256&x-amz-server-side-encryption-customer-key=qX8L58lkXHtloqHC2VoqtciGSfMgTJBrZYdYl%2BafW3Y%3D&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoiL2ZpbGVzLzIwMjUtMDEtMTglMkY1MDg4MWFjYjA5YmZlOTE2OWIwOTg1MWU2ODJkOTc1MCUyRjIwMjUwMTE4ZDFkYVZWQXElMkZTZmt5SXYlMkZSJUQwJUI1bGUlRDAlQjBzJUQwJUI1JUQwJTkyLXg2NC56aXAiLCJpYXQiOjE3Mzc1NjE4NzAsImV4cCI6MTczNzU2MTk5MH0.VfVxchBVaNcA5E4sYgslQ-LyozAYQsOCdeX8R4tUEE0
Resource
win10v2004-20241007-en
General
-
Target
https://storage-prod-do-blr1-c.transfernow.net/files/2025-01-18%2F50881acb09bfe9169b09851e682d9750%2F20250118d1daVVAq%2FSfkyIv%2FR%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip?fileName=R%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip&bucketName=tnow-prod-apac&bucketId=6713bc8a-6b2c-4105-a432-4ff791c2ab89&size=12460685&singleFile=true&storageCache=true&x-amz-server-side-encryption-customer-algorithm=AES256&x-amz-server-side-encryption-customer-key=qX8L58lkXHtloqHC2VoqtciGSfMgTJBrZYdYl%2BafW3Y%3D&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoiL2ZpbGVzLzIwMjUtMDEtMTglMkY1MDg4MWFjYjA5YmZlOTE2OWIwOTg1MWU2ODJkOTc1MCUyRjIwMjUwMTE4ZDFkYVZWQXElMkZTZmt5SXYlMkZSJUQwJUI1bGUlRDAlQjBzJUQwJUI1JUQwJTkyLXg2NC56aXAiLCJpYXQiOjE3Mzc1NjE4NzAsImV4cCI6MTczNzU2MTk5MH0.VfVxchBVaNcA5E4sYgslQ-LyozAYQsOCdeX8R4tUEE0
Malware Config
Extracted
lumma
https://tradersneez.click/api
https://impolitewearr.biz/api
https://toppyneedus.biz/api
https://lightdeerysua.biz/api
https://suggestyuoz.biz/api
https://hoursuhouy.biz/api
https://mixedrecipew.biz/api
https://affordtempyo.biz/api
https://pleasedcfrown.biz/api
Signatures
-
Lumma family
-
Executes dropped EXE 1 IoCs
pid Process 2884 Disposal.com -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 4984 tasklist.exe 1472 tasklist.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\RecipientSale BootstrapperGUI.exe File opened for modification C:\Windows\ItalicExpress BootstrapperGUI.exe File opened for modification C:\Windows\OverheadScore BootstrapperGUI.exe File opened for modification C:\Windows\SuggestionBanner BootstrapperGUI.exe File opened for modification C:\Windows\NeuralPk BootstrapperGUI.exe File opened for modification C:\Windows\ReflectSupports BootstrapperGUI.exe -
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language extrac32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Disposal.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperGUI.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags = "1" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\MRUListEx = 00000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\0 = 660032007c20be00365aaf8e210052656c65617365422e7a697000004a0009000400efbe365aaf8e365a60812e000000df06000000000400000000000000000000000000000000000000520065006c00650061007300650042002e007a006900700000001c000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\MRUListEx = 00000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\0 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000050ef5e839818db01ff387caf9e18db01868ee979e86cdb0114000000 msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupView = "0" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0 = 4e00310000000000365a8081100054656d7000003a0009000400efbe47591749365a9b812e0000007de10100000001000000000000000000000000000000a5fe0001540065006d007000000014000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\0\MRUListEx = ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9} msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "4" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode = "1" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:PID = "0" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0 = 50003100000000004759104b10004c6f63616c003c0009000400efbe47591749365a02812e0000007ce10100000001000000000000000000000000000000fff029004c006f00630061006c00000014000000 msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\IconSize = "16" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByDirection = "1" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\MRUListEx = 00000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\0\NodeSlot = "5" msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\MRUListEx = 00000000ffffffff msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1 = 56003100000000004759174912004170704461746100400009000400efbe47591749365a01812e00000069e10100000001000000000000000000000000000000fec635004100700070004400610074006100000016000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 0100000000000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0 = 7a00310000000000365a6081100054454d50315f7e312e5a495000005e0009000400efbe365a5981365a60812e000000421901000000110000000000000000000000000000003d211001540065006d00700031005f00520035046c00650030047300350412042d007800360034002e007a006900700000001c000000 msedge.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0 msedge.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 2632 msedge.exe 2632 msedge.exe 2908 msedge.exe 2908 msedge.exe 1856 identity_helper.exe 1856 identity_helper.exe 4760 msedge.exe 4760 msedge.exe 4204 msedge.exe 4204 msedge.exe 4204 msedge.exe 4204 msedge.exe 2884 Disposal.com 2884 Disposal.com 2884 Disposal.com 2884 Disposal.com 2884 Disposal.com 2884 Disposal.com 2052 msedge.exe 2052 msedge.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
pid Process 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4984 tasklist.exe Token: SeDebugPrivilege 1472 tasklist.exe Token: SeDebugPrivilege 3768 firefox.exe Token: SeDebugPrivilege 3768 firefox.exe Token: SeDebugPrivilege 5564 taskmgr.exe Token: SeSystemProfilePrivilege 5564 taskmgr.exe Token: SeCreateGlobalPrivilege 5564 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2884 Disposal.com 2884 Disposal.com 2884 Disposal.com 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2052 msedge.exe 3768 firefox.exe 3768 firefox.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2884 Disposal.com 2884 Disposal.com 2884 Disposal.com 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 3768 firefox.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe 5564 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2052 msedge.exe 2052 msedge.exe 3768 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 4860 2908 msedge.exe 85 PID 2908 wrote to memory of 4860 2908 msedge.exe 85 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2684 2908 msedge.exe 86 PID 2908 wrote to memory of 2632 2908 msedge.exe 87 PID 2908 wrote to memory of 2632 2908 msedge.exe 87 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 PID 2908 wrote to memory of 3604 2908 msedge.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://storage-prod-do-blr1-c.transfernow.net/files/2025-01-18%2F50881acb09bfe9169b09851e682d9750%2F20250118d1daVVAq%2FSfkyIv%2FR%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip?fileName=R%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip&bucketName=tnow-prod-apac&bucketId=6713bc8a-6b2c-4105-a432-4ff791c2ab89&size=12460685&singleFile=true&storageCache=true&x-amz-server-side-encryption-customer-algorithm=AES256&x-amz-server-side-encryption-customer-key=qX8L58lkXHtloqHC2VoqtciGSfMgTJBrZYdYl%2BafW3Y%3D&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoiL2ZpbGVzLzIwMjUtMDEtMTglMkY1MDg4MWFjYjA5YmZlOTE2OWIwOTg1MWU2ODJkOTc1MCUyRjIwMjUwMTE4ZDFkYVZWQXElMkZTZmt5SXYlMkZSJUQwJUI1bGUlRDAlQjBzJUQwJUI1JUQwJTkyLXg2NC56aXAiLCJpYXQiOjE3Mzc1NjE4NzAsImV4cCI6MTczNzU2MTk5MH0.VfVxchBVaNcA5E4sYgslQ-LyozAYQsOCdeX8R4tUEE01⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1efb46f8,0x7ffc1efb4708,0x7ffc1efb47182⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3400 /prefetch:82⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5144 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:12⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:12⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:12⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:12⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:12⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6128 /prefetch:82⤵PID:3020
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3012
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2344
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1812
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_RеleаsеВ-x64.zip\README.txt1⤵PID:2700
-
C:\Users\Admin\Documents\ReleaseB\BootstrapperGUI.exe"C:\Users\Admin\Documents\ReleaseB\BootstrapperGUI.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Re Re.cmd & Re.cmd2⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "opssvc wrsa"3⤵
- System Location Discovery: System Language Discovery
PID:1396
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
C:\Windows\SysWOW64\findstr.exefindstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"3⤵
- System Location Discovery: System Language Discovery
PID:2216
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 3409173⤵
- System Location Discovery: System Language Discovery
PID:1972
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y /E Claimed3⤵
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "Regarded" Biodiversity3⤵
- System Location Discovery: System Language Discovery
PID:464
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b 340917\Disposal.com + Violence + Above + Purse + Porcelain + Imaging + Zdnet + Photo + Facts + Ipod + Selling + Johnson 340917\Disposal.com3⤵
- System Location Discovery: System Language Discovery
PID:2724
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Single + ..\Certification + ..\Wikipedia + ..\Usgs + ..\Loving + ..\Prophet + ..\Registered D3⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\340917\Disposal.comDisposal.com D3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2884
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 53⤵
- System Location Discovery: System Language Discovery
PID:208
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:844
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3768 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f4c3fee-fe73-4eb9-840f-1fa004ceecd7} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" gpu3⤵PID:516
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2356 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc7fbf1b-7978-4dda-b769-492de75006e1} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" socket3⤵
- Checks processor information in registry
PID:208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3204 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a986e2a-54fd-40df-b939-66f0056a249b} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab3⤵PID:3480
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4140 -childID 2 -isForBrowser -prefsHandle 1164 -prefMapHandle 880 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9d323a8-886d-47f5-9fd0-36525482a289} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab3⤵PID:3640
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4916 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4908 -prefMapHandle 4904 -prefsLen 32348 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c5d9187-1936-4390-b877-acb212464808} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" utility3⤵
- Checks processor information in registry
PID:5572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5052 -childID 3 -isForBrowser -prefsHandle 5092 -prefMapHandle 4144 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c2921e1-9006-4d35-93e2-e6ff26f4e84b} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab3⤵PID:5904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5060 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf305d17-417d-4a94-bc54-7685a07c6ab1} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab3⤵PID:5916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 5 -isForBrowser -prefsHandle 5560 -prefMapHandle 5568 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccf6e42a-0838-4834-b278-74f40d63c213} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab3⤵PID:5928
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
504B
MD572672a734333e61780ac6b578f78adad
SHA13a7d5dbe3653969105f109bee9c925aa2a73ff7a
SHA256924caa2b89b7184bea7d8a40a9f616a6bfe5798d240e7f1dc20de6a486824a02
SHA5127649865074b7ab97753ed445f4c3c37587eb9b8ff49707b7f3bcd80317c8e18e115547eaad170e11a749295fab76822791f90857796940765cb86b2b059b32c1
-
Filesize
206B
MD501c773943215504d3c9aea332c78b3d2
SHA1f9c05c87d0a1326417549c2a272c569b3a24b001
SHA2565e6fba68910f4691120cc0713b80afaff3515ee0a26c891d5f9c9ce2960331a7
SHA51271b180472a03b9e03f6b3f064407d88b957904a0fa2abf5efd9d16705187c9a0526483eb90f96b9090b979d9f38d717dbb2042bd19234e54f61341191984d57b
-
Filesize
1KB
MD5666cf8b3e41404ca80f3a8e111a175c6
SHA1f00fb03079ad03085e4e11f8564d3a9f0023257e
SHA256f322224a8dce830b116c150f315ef8baf5baa99a42facd9d721ab7c93f40e88a
SHA512839a3aef3d8475fcfd8df509995366b8e2fa7f93365111fedb07caa67c3ede38065cf283eca4795d277fdb0167376d0b08edff59b138d8e3040a521437386e00
-
Filesize
1KB
MD52b4f28dca9a5ed57d7626008ccea72fd
SHA1acca102bd1eb0eaf83227e372805a6ec4b3b8cca
SHA256299ef11afbe405f2a7a43e4bb52de4141478e79439df4e1b09930544e5878138
SHA512f9965a3ca8c60cfc568a44831b4f6ad120679b9bdbef77d7f855c1f51e1c111c05087d2ea3097683250ce64212a2e972c22e13579f0d005f6706cde9102bd254
-
Filesize
6KB
MD5b556b4faef0e173baf7af52ddf558932
SHA17044d809033457b16ae99e29a28306a0621b5766
SHA256e6b40e793de576149eda2c2971ad9ac070068bbafb6f13f2b0e71d2c9f7da214
SHA512eb4678b98fb7a59304f49ef91b4fd5a70e379d7e477edad040a56c7c734ea5dd698fd84368d79a7a9aff025a458a433e519f696e5edc7667d5d7e1cf3d78295e
-
Filesize
7KB
MD514069d671f3421157fe15f73afe8329b
SHA1efdd0897b5b4a4f2b7ab9713d6f146a1560cd15a
SHA2560fd85b4b473887689d94dcc6a54fd2e7fe6dcdc9428df29beebbf92d92d96330
SHA512cc415476fee7fdbbbfc2c40a6f3dcd1f6994f35a58b9f4b06e37ce85a694e864cf9af6d4432d9d98a0e9493d1b17deafbc17824fc532edc141fc333f054d6731
-
Filesize
5KB
MD56d44d5b4f2f1423c80974d2256d26895
SHA1a9e4a449883cd968278a99d9be0c85c297d285f1
SHA256e5e6f8f859622257f266ea9b8b482d6436aa07d1f1e9a7ea02d069152cd895df
SHA5126014b5db4a12b464c6cdc9cfdbff14983133f296d90f6c68024a82c854b2531b328bfed5510c27773a945005a3abf037422fb58a9d3fc40d42f0f23701f80a55
-
Filesize
6KB
MD5d39286c2a085eb167bc5487df4264178
SHA18cad183c90fba00d5fa53b20a211b9db9cb70cc6
SHA25683f37160574548cbaefa6202d4658863be688b790505c41b23c361809ec0e319
SHA512bb5342ae5fde6e757ac006818fe37a8aaeefd136d3576112a63d91a2c35521f98f5f712b0933780c53d50bf8fd2698eb1eb79bf6b6962e4500003921f2bb80d5
-
Filesize
7KB
MD51a183ba15ebf19425089be78ee5ce4b3
SHA1ed59f521fc1084f83d7aedc4b29cadf6fc805e2a
SHA25645af109f0242508a0b36461d22c18f8d0da17393a252e4b546836c88ffa09eb3
SHA51219e846c21150b73dfa969d9b360696e0b0dd37a1658e3bc7fc3e6838ad5bd301ffa285d2de23d71abdeabe63de9fe6a640793946118dd58011c8cb45d7de1ee2
-
Filesize
7KB
MD589f65b545cc9c9e4127ff27dec46fb6a
SHA1ef175e5cc2396729c573ee77bdd402789573eaf6
SHA25649f98c4ed5eb9543455ab8779b9cd89f2f86bf2bd551683bb40a900f9d4576da
SHA5126f869edcf3a2a0f484e0331033574e6b14db0385b4c5f7a6f7a66644212e8663be4d3a7a985b68519da5924ac9bbd3607f71a5f0ea7608a545ba6bc2f971f388
-
Filesize
368B
MD511df15ca4e9e78d5035071c4cdad8121
SHA179b26450baf3837e50d14f4546dcbc4eec232ad8
SHA256231c609ef84174b2bd4426332fd1a2a19525124e967bb9ba6f22dde9eb8844d6
SHA51259aca5cfd7c9c134a0fd84b511cdb913432c9e6cc6f4e64ac96673f80523632028b134d18eca1fa812cd1a90f196d2664615b6a4d2871a45bb88e0b61e961008
-
Filesize
201B
MD5bab6b5a40d3436c0d60b0398cfdd5873
SHA1f32e63af0d3269d01e796dbae995469f6f9ff794
SHA2565f0738b6b0b8059efd2b59149bf047cdf6c204969fd7e398b0ce79dc63a708c0
SHA512ed5fd7e7840e5db11dd10e65bdeaba8a7f5c118ab0fdbdfa7e43f37fe85d1cdf5da1dc19685853bcf7288988c50f8d9e434a92b8ce4c1d81b836148568c9e54c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a824347e47fda05cd602a7fa23c7f716
SHA134758ca7bfd290ce830a8b538c738a6850fbd860
SHA25691d8a03900185b7bb49bf329e43a897496158528b15eb7e9b308851b4c255bc3
SHA5122df07a3a47297287401ce2aec3472f5c7513a22e1324ad784b77c155c11af06982123a291d2d457ddfe3504dca790ffc04b0d4e4361c7a7ff8ba8b3931c7ece9
-
Filesize
10KB
MD58f9756294ca1365cc86c88cc375cfee2
SHA1d4a0f7ca9bffca56ffb60350f69280292aec5841
SHA256feff9264ddc7cb17b41c29dc9780f5ac04b636b909f40ce53f2e5561b7c50116
SHA5125c6e10c5bcf59a966c14c2dabb30923e2b3fbae1f0228f857630afa4819edd50709f8d51eee3c5d74f28bcd8fd60a204315be914b4a39db80ec70be44ad4b77f
-
Filesize
11KB
MD5988a8a5f3aeb2f4801d0b967720dc62f
SHA16bdca66ea809b8eb9d0537e6bb19e214624d1e71
SHA256ff53c8265d5d0cddb8693925b144a986e075a9bdcbb1fe0d0333edecd5d9522c
SHA5126d705c3985e2a5bb9f2df2e80b31e892ddf015624ed983aabd509bf092dc827e1fc2aa1ea28e94e22f4e0b1057f787acb3cd8eaec06ffb1d48b104412ce30aa8
-
Filesize
11KB
MD5b0253b845bf6accd779915135ebcd761
SHA161cbe21b2f14f84c22de4a0edc739e45d867fcf4
SHA25607722af8cc90476a782821f20e80a7bb066f1cc7c6c17a1e7ddf69c879c4ab41
SHA5129be37045dd7c735a6d8b808345fdcff1644a6da320fc8f4d4125984c53f83381364c283f504c23d5e3ff6e333ceca17c69b72237d4c8695e40d10b4117344f8e
-
Filesize
11KB
MD58e9f83dbe413b19ab5931f3a907e16ec
SHA168f9493060f5f18d7d5c2288662cea9ebb56127e
SHA256e9b10f31bdde25beb6ffcfe8dafa039120531243eb0145c1a72b70ec8593f63f
SHA512f1192341bc030cc1023eecce4716db418efa60b725317265d7e18a51386c792afc3f074ca5280c0bc22caaafbc5211a60979141d246711e4767156a6b463eef8
-
Filesize
11KB
MD50939bbae62c4f290ba7a8861f8be39bd
SHA15d2c66e20c2a662caa3a70e53451d11759b749c7
SHA256a5fe60038050e657370336fe02d3b6827fa4b183c69ae64a4d6ce059a18f8469
SHA51221a1e121f482f77abce4f592e06837e4c30dbc55ed735d2bea0d41a6210212d0434165a1962fc2252c6d4a6e14b24136ee44baac6727a9f8d17ff42037a7b37d
-
Filesize
11KB
MD517224f4a22b3790e63f5d748b07233be
SHA197737dd0242b714c1908a8b1e66b832697dab2f5
SHA256e0df78fbba0644c6adf77fd492b21a2488f84e8c28da4b1ded562759af838e18
SHA512fc784ba16fabae1f568d82a25e22970bd5e305e011bdc5064f75ecfb0c5b44ff74fc7faa8384676ca4ee91ee34a865b0e81933228cfbf212f24fd8f4d6c23500
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json
Filesize21KB
MD5a21efe74e34e451fe8c9dff7da62b14c
SHA1f21dbba3afce381ca790f997369f7970a27662c2
SHA256d9e20b30006f181c0d2fb0d85f340c66a6259e92a0b4aa66e5a356b8ef5df376
SHA512a7158f03fd7f6356bf8a8278fd3e121c9d7e7e308e894db0e050d54a36816cf2047962c9ef7240deadc79d41bb653b177bce6a714b97fbba40293b5d5030026c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
496KB
MD517dd7466297f02a8dfd1b1d3b1446531
SHA1f24b5d9ac103fe1d6ac109c7b374401ec042771a
SHA256e5d5315fc8dc081dbe78f185682759ca7c8493885d892131942f49e5ab411f14
SHA51201f5483f5505776031a332283c70f1e24742048e1b9164b6f63e6b7adef5802a879782c766acc7c145c89620152779edb3b7ef9f47ed83e1503bae313d1e389f
-
Filesize
145KB
MD51e0d955fb192084c15c3e53ef296f1e2
SHA1e2f545ba5fbbb4cd18363dca6f8007521afefea9
SHA2563e06d95d13ac2415fab7eed85b22eda677af960bffbd31850274840bd2d91955
SHA5123267d139915eacd335056c9e0a7e6c5810fd51a0e64a9c615a9699f58fcabc82a6917ab8e5b4be56c8b42c7c205c3d5fe4df7ead2aabf48fae7b5cf043dd07a7
-
Filesize
925KB
MD562d09f076e6e0240548c2f837536a46a
SHA126bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA2561300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
SHA51232de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
-
Filesize
59KB
MD5d88e04f7a23e77ad1be7d45352d1991b
SHA1c187f58ee4ee55f86cc9e9fb884e4648621ac9c3
SHA256ea7713f92c5e61dce396c08c527bc0820033e9344e4f21ecd8f0455da1a9de12
SHA5126ec1db2eb816f5ecb823f3044a1c8e990b8654f0cb132c91508a68f45cf78cda89e64cff8c3c61daf05f53e55c9272b360d9ca170378808cb296611f499d9ad2
-
Filesize
1KB
MD54fe6f5461c7c40db33d910a12fec2a79
SHA1aa2ee0de4e71001550a3945081882d4a8a1c2d59
SHA256b004161a9eda8d8aa733a38062146c9bceafc32ba621a758718605506010aedf
SHA512e41e3b7cac3c86b17ed5c535709b62ac2889f8326f2478e70ebae80d75566e1516ce2e603461cb550b1ad226894a7f96d946c42ec0c571627cfbc88accb4b557
-
Filesize
91KB
MD5abb21134a4f9211d2f28a8d2ba0b1fe1
SHA1a40a8360efea23fcd9af117f26768cb3d7265ada
SHA256b44e36ed9ff6a88adfdaadbfdb8691bc40606d33f15799810962e2619f80c466
SHA512e48e7efd94916867f8707f3a6b69b3de8373664ad6e31bd25b4ffc639df3fee5bcf9653018a65fc7f74e4342a73721ad2617f12abe9ab4a8ae37ed37b9ad3337
-
Filesize
476KB
MD520fc38827d4eb4452035cfcfee2d8c14
SHA1aa4ec6a834a732dabfe1e068b05bf8b5ac9412b5
SHA256f2f03b313f4007bdfac6dd5bb15eddeeeeff5c40553acc31d0906fe08a9c275a
SHA5120ea8b707989dd684944b3f83f94eb5479414323f2177d888bebc2b104238f9f0f353718b714737667bcd9ec00cce52aa248e9f639b0fbd1ac4bd3b9b5e8236a0
-
Filesize
57KB
MD560ffad7f702c52c0335984fba06dca2d
SHA111100fc0104616b4c79fe10e71694d5fad766a58
SHA256e7bbd8738ebde9f732b70120304516a70e75ae8448fd7b135941888c435dab28
SHA512632a5660ea545994a17f4643bc74beac19509676a16ce38f31cbc9defd0f4987b64a13fa3b25265c586c6added16c6d7c6a46bcd9238514d916d902e958284fe
-
Filesize
135KB
MD5561abfe4a979b2713e00849ef7b5750f
SHA17894820d54b3bd0d0cea927da161e65d408abbb2
SHA256ef840c0c3741162a4055f501a50535dc9f1ab3f1a2adc3ea363aebf3fd0a5834
SHA512bcf4670f8889b25c4e7e9b5e2dc567cd952874abb53ca7b481cd90216254a0a80d5107f3317962440f461b0fbd6bb89d4d3c4d562e6bc6270d8cd0fe51fcc8ee
-
Filesize
75KB
MD52eafff2ca929d25609899da5168732ce
SHA1ee838b4a882cb68de828bfdd31013bebbcddca3c
SHA25618757fe406aec7ed2c45e2e380ce3f1bf409fba01ae4a1a195958ff69718e1eb
SHA5126b471e93d739b46e2bb42b24dcc22b71d43b6ddf0e4761c23d451647bd9a39c2be37cb35690e446391c045724459db5a62d29c0c6b42ab8797a02784581ee1b2
-
Filesize
43KB
MD5e254802b09d9b8bd3847a0df8a078325
SHA144490d529dcf461b0d6c6418a2059b0cc6557afd
SHA256bb046cff9ed9fc400735abf70c05ef8a1971dd4df24b6fad7995d98881de5ed2
SHA512128736e13f9311cdbf2d2aa2e5b65a8117ab04a40550c232be60b424c608980bfb337730cc29153db18fe06eaca48b6e3085439588568545c27c3848f67f03b9
-
Filesize
74KB
MD5f31b4023aa01fb113405a331278ab9a9
SHA1393714a5765d77cf96b8642410eb2bba0cda5313
SHA256169d4ad56c587292db439bea272a5f0f212a509c0ea3946136cd82d3a4512cc0
SHA5120b28dd7e7f6718993453df48c712e34cc9ec0bff5eda9d152052015861f9cec0acb72b34715bb2d6601683f0fcef3ecf8563032b6cf8dd9b96e5b01992456fca
-
Filesize
65KB
MD51f34b509444ddafdc5db392355d6030c
SHA10eb74a71e7f9d032202907e53a5eca616f0854eb
SHA256c3aac528b8ce09f7fa8a8f093bba53a5f931c057fff82703cdb85dd93df2d07b
SHA51221255d420fe6d5dec4bcf880e208df1a39875b3d404c8892f07c228edc6d20431a95ab05c63418f9b2cd15a9eaac74991b758d5869345b86abed69dfd12772a6
-
Filesize
55KB
MD589ea696be802aaf4204fc6c0b76afcc6
SHA19ede6af57ea48370afc71afaa3adbfef5208eab2
SHA256899437f29213e6649b4c000ee9827e3cac3bd8028c7a2eff28627ab9d88e827a
SHA512748097e7f81658cda377b09559e82d00ffbdbed057188336aedfff156c172604b2d9138309b7d127ecaa706f1373ada29f491ff0a3e6ed9ee87bf44717172edd
-
Filesize
67KB
MD5cd937d6d4d1cebc84b5150d1a3d4db6d
SHA17bbef6be5454bf941127e3d0762247e3f918b2f0
SHA25666a998c2b5862f22b098f00ce1ae1e08e9b7298a9ec57aa8db3bf2db253a3a81
SHA5121f939a423cd0e731db0d9f88fe3cbe28c5de067403fe6d9b8f5036fe36f97bbce712e4fa0d68196b712fe4d5d5a73d6ee9624ada0598b81effe7178f7b213d49
-
Filesize
141KB
MD5fcf10aef7e06666b64bd2166f710a8f4
SHA14168d616038689401e6aec4d7918245ea7e95652
SHA256ac89bff5c9d9af8fe4506382fd7772e1e464f7904a554e75f34963516a848bd3
SHA512295269e5123347ddf10cc2212e569a7cb389d2a33b3fad2dc7327ab8bdb8f956a7ac7f6592489a47889f95b2126bd63e664f28ca72a3c68e52481905e55e796f
-
Filesize
27KB
MD5e4b460462746b77bca3afe76fdbf0810
SHA138e685630a8ef761db8bb8d0fc269dc7ef878dbf
SHA256eb37f2aee73e6060a6eb96c88b08af0b4f273f731b72e99b31e075d4418ce0b5
SHA512f6f8692a053203434cf30e6f8b8d20a1e56c83112775a160d90ea47beaa3b8cccedcb09b51f1b9fb28a4d048d46c59fe6d88d883ef9a0133ce9f7359ff5e6557
-
Filesize
57KB
MD55ae9352835d7e57259848104d413748e
SHA1565c5865e233cbb15201eb36fcecf0f1b9f1fc51
SHA256ea1ec57ce0147188b91ae6346063e60dabce991f09f968ca86e98437b9fbdd2c
SHA5121aa9781503f7a7f5f3504096e5dcdf00f3ca2ad702e93eec9147aa92a09f1e955ffc41ba4a6dddac73332433b35853d492a6abcf20aa1980ad5f81f2579487c6
-
Filesize
120KB
MD5ef6c0c4a03942b898c1345fc5e2923d1
SHA1802a01cee96e04725ecd527c5f9426fca7edbd35
SHA256fc4c66f7e940be137583a37a40c71ddece824dcb2c945049c56d377f869c8266
SHA51298cd652ec23a7acac03c5097e6e9cc41003eb7146e7eaf21db7ae36de30d1cd6e8cfaceb1978f18e3e446944d776080481eb45e71a1ffd1c52cfe2cb1641ccaa
-
Filesize
67KB
MD55349a477a2081ab09b1f1aca6ca572dc
SHA157968a903f92ccacc6e7d577e6488d2894e3877c
SHA256b129d35e0906df8b0e81844992d7a663073110a1f60d51e7c1e8995aff9f6cd3
SHA5125806e022a63ea9586d3fc3243793b6a604103b856ff92bd31a396334756df9641dfadacca7b62562f531110715a3b8ec28aaa0c5f0309dec33ad6cb8357bcc1c
-
Filesize
70KB
MD59152d897abfc11e7f47f4dcffa4e1dcb
SHA1bac18a4e2819d4ecf18dd70d5e36638a58387ed0
SHA256a5ef2e4a4553670780a5d4fbac1f4ff7ad2232b5eefb343f6548a1b68912138a
SHA5125f23307e7c29ec2d9cfd0063b9dfa6552433e90575958a860c76f11302a5397e37723f65d906d7f3c92ef9843587fee4b4f98a96adf5d6dabd4dfc80afc351ba
-
Filesize
85KB
MD598624849254fb1f0653da5db882e1560
SHA15c7967add2247827f8d8fcc4f7311a66a4a36204
SHA2560656568395a1b68f778098b6d3519bdfd86dd9f5a39da10a5850b2b17545f139
SHA51227dc9d10e8c3113f62028435ddc51b9402a8d507ea1f43a88a300374a722ad20fba8c7877bc483a0f55deb0cee25e3bb64d54c32cc032e4d1384a1626d8e2fe1
-
Filesize
70KB
MD5070190137c2a7ee0e964e261ebd9e25e
SHA13e5230f125ada287e1ccd9e52733539762cdac7e
SHA2565cc23023cf6ea445764a4b39ffc0a4ef3ba9099254eee86b1ad51db63bcd5233
SHA512547daf63266a12833e5e370eb606814a01b89c266fa3fce9ab47c686a0929e91d9b515ab3d7cf41954ccfceffbeac22e9756f298aad4710d01c0ab747bab9e1e
-
Filesize
88KB
MD5ad758f1e2bc2c34ec6c8a23df9236746
SHA148807f2ec69dc2cd96f78a7809d99f63853acb81
SHA256c806b7ae24975aa2b7c4635d4c75781a97092e820946c0405630d7441985f3c2
SHA512b17ba342403e16ecfde952dc5f482ad31c011375d3791046fc056170001073c169101e2cd37939c95cdbd19ee785b9ae53b572daec7a4628f013136c163f73dc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
Filesize6KB
MD54885864c3762cbd96d84e67a143dd505
SHA17a9339dccbcac55c1ecb8d9a630bb9692156a995
SHA256bf6381fd7c9b2882329dd88d6af77bcff51999e1438008f4050613b6e2da90bb
SHA512900f830646588f2f4679265e2978aebef414aa5219b5c7a6012896ee954fd54c3373f8a54fd28246b2ef0f943b475f4e43e0cd23d596744b31c6c9075c59402c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5adc5772bba059e959937ca150999593f
SHA12ee3a3c14820e3355edf7c35a6458be17200bc73
SHA256559238ec2a35925d129ea012f649964c3e4aebfb68be87bda8bd336ffdb49a68
SHA512f50d51c9b6b78187f2422ee1e1131531753346eed8ff6e32b1218742ee66d606d4c6b37fb6bc16e7f5ac160f543d346941dbb7543c96de4286f4741eceded788
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD59e10921ac140af7d36b1c24a55309091
SHA1f0611356e8e00fa4ddfc07871b42c9c944b2f7f8
SHA256b743a2851844d260e1663de5ec11adadabc82f97831080186b2d1e332618aced
SHA512a96ec9400d3f7a7668703b8c5c88bab15a4b798e567987224b37bb8b3522551777765911fb401c4ddb378e5a5721e479c2b9b1f3d11692c05cccb0b0cb22d151
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\0697120e-ccc0-4094-a84c-01d6e4fa15ab
Filesize26KB
MD55a9c4e107b8b68fb5862bd1fda3a6cd9
SHA116b281961bef25fe7ca3147133616658294946b4
SHA256f8044d7d7a22868a25e20e6493491b05c59eebfeac3f79bd152618db06b2d0d7
SHA512fb16bdfa53b1931a660a59848310615f022fa6ea0ad9ca47e873492eebec4ff64a3e1d9cc399360fcedca46faa7dfae732ea1985398c071a6bacb36fe431f887
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\3d4ab05e-37e9-42aa-ac39-706d4353eac1
Filesize982B
MD59b339a5063028b57d3f15de1ce847dcc
SHA1dd57805825f4046012daf3777ee4a0130da8b64a
SHA2568a60d618e3555544dd7682026af72c1b895cae5c10d6544c980edf4b5f869056
SHA512c8934d011c07f4fc5a971e2c410799147d870b6f6692059dfd138a76dcc76eb43cb18709ca44c3b7364b9d2291453c6c6bfa03584da895a038c5769892e728a8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\ff39d860-296b-49ec-b473-19cb004c2791
Filesize671B
MD592ca65e90589c7a65b823acdbcee17d0
SHA1c4534adb9bee1e474717230473511b38ed68602e
SHA2563279d745368705e294deb762594cda1154a4af0195705cdc25a4b4b82125c355
SHA5121647ef5f40f8616b3ba0363791639a875e8554732e71eacd38eff61050101fe12b3261ef2a22ab4347268ca66bc7dc4e5590ced0ed65d7983242c5a14ff72a4e
-
Filesize
9KB
MD591f0dce209c3105e37a1131ff867b9e0
SHA1af709a486f11d6606cb3a3379b85c54d1f6ce35a
SHA256aa0787e989455f351c921efa9231df92738d0df392cc1fb272d5408393acef95
SHA51226548e746ecb30d4fca60bbe3e36d32fc1fcc9376054c1987b84c91ee4393b43631b7dcbf17fdc9442bf614e45c6fa3b5ae16d1314e87aed202ecd31922bd388
-
Filesize
10KB
MD529c2c66067a76b512a04b4469393d1ee
SHA1d4d3a7c2db83ba5fc75e1f68ab4dd50f51adcb69
SHA256d937e06e62e484c3cd81f81f3027e68f42b262474a95bf6aa4a1e36da7561930
SHA512fde646556a42f734a5cb0fbebbe6f1890931abbb819812c8182388d33bfff3df6bd554ea5e6f295119eacefbb32c5c5263ee776dafa3e3bf4bf556456fed38e5
-
Filesize
11.9MB
MD57f5139bf0b495a08e171c0d353513463
SHA1c51a1ac3db02c2d09800b33c907fde749a306343
SHA256322e197be9a437de2ba07ec69b49c164d8c3121f1ceb161e983788407cf760fb
SHA5129476ad6b0db052a320874dcde162d99e38e89ce6df41833a1426c7304d1a95adcffc34ec847c8afb7a5895130a8693b398bfcb1a372fa7ebd87babb432277459