beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9

max time kernel
327s
max time network
330s
platform
windows11-21h2_x64
resource
win11-20250210-en
resource tags

arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system
submitted
12/02/2025, 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
Size

8.5MB
MD5

2d690d32e637c43a18aa8f4f2fd28e48
SHA1

f8a5f75a34d2751c0e7195cd4adabddc1ece465e
SHA256

beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
SHA512

2641192c4ebb0a66fdf6a9be16ccfc38a4cd98a32467d5b6e719c73b2893a28888b7c9c77d3db3a0d2e93d14408081bdc92238dc3a5b1479229843f354c7305e
SSDEEP

196608:exCyu9hdCjcHsm2gTEE/OBBZVaMKb0QqNnJi6lWzVYK5P6qwpxFlWavvy7:ervy

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1888	MicrosoftEdgeUpdate.exe
2496	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133838419563237287"	chrome.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e00718000000000000000000000e1a40ed25739d211a40b0c50205241530000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\Registry\User\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39050000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "287309825"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5756	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4076	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1124	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2076	chrome.exe
2076	chrome.exe
2076	chrome.exe
2076	chrome.exe
2076	chrome.exe
2076	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3652	control.exe
Token: SeCreatePagefilePrivilege	3652	control.exe
Token: SeDebugPrivilege	1124	taskmgr.exe
Token: SeSystemProfilePrivilege	1124	taskmgr.exe
Token: SeCreateGlobalPrivilege	1124	taskmgr.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe
Token: SeCreatePagefilePrivilege	2076	chrome.exe
Token: SeShutdownPrivilege	2076	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4076	explorer.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe
1124	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2252	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1124	4076	explorer.exe	92
PID 4076 wrote to memory of 1124	4076	explorer.exe	92
PID 2076 wrote to memory of 4056	2076	chrome.exe	101
PID 2076 wrote to memory of 4056	2076	chrome.exe	101
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2304	2076	chrome.exe	102
PID 2076 wrote to memory of 2384	2076	chrome.exe	103
PID 2076 wrote to memory of 2384	2076	chrome.exe	103
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104
PID 2076 wrote to memory of 4284	2076	chrome.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
1⤵
PID:2532

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1124

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3008

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTlCOTA2RkEtQUI0NS00MTlBLUFGQTktQzM0Q0Q2MzEwRTk5fSIgdXNlcmlkPSJ7NDEwODA3NTItNTNDOC00QjY5LUEyRjMtQzIwNUMxRUQzOTRCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjNFNzA2N0EtNjUzRC00RDA5LTgzN0UtODNBQ0U3MDgwNzM2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIiIGluc3RhbGxkYXRldGltZT0iMTczOTE4Mzk2NiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NjQwMTY2MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMzgxMTkyMTEiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa518ecc40,0x7ffa518ecc4c,0x7ffa518ecc58
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1788,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1908,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2140,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4448,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4428,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4432,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5236,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5316,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3668,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4456,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3316,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5596,i,6722773273732555384,12815767976868590964,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4416

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3128
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 27114 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57ec78df-2e55-49d5-936b-8ba9711e4ef6} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" gpu
    3⤵
    PID:1496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2328 -prefsLen 26992 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b682555-49aa-444c-bf90-682ab41fa536} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" socket
    3⤵
    - Checks processor information in registry
    PID:856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3220 -childID 1 -isForBrowser -prefsHandle 3252 -prefMapHandle 2916 -prefsLen 22636 -prefMapSize 244628 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e50f01f0-87e7-4260-843b-5b908e390bed} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" tab
    3⤵
    PID:4032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3676 -childID 2 -isForBrowser -prefsHandle 3704 -prefMapHandle 3700 -prefsLen 32366 -prefMapSize 244628 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b31abf20-4163-4fd0-8a3b-38b62ae8e0da} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" tab
    3⤵
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4484 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4504 -prefMapHandle 4500 -prefsLen 32366 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2cf4a91-dfa6-44d9-a8ff-e09eb6e5f51e} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" utility
    3⤵
    - Checks processor information in registry
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5232 -childID 3 -isForBrowser -prefsHandle 5224 -prefMapHandle 5188 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c90f70db-8488-4118-b688-7b7f17995b42} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" tab
    3⤵
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 4 -isForBrowser -prefsHandle 5392 -prefMapHandle 5396 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2adec67d-5a35-4f1a-809b-47a60067f50a} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" tab
    3⤵
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5656 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c121358b-6491-4c91-b509-424971094b86} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" tab
    3⤵
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 6 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 27114 -prefMapSize 244628 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04c5fc9d-642c-4b0e-8b35-a30fdc17542a} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" tab
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6168 -childID 7 -isForBrowser -prefsHandle 6152 -prefMapHandle 6160 -prefsLen 27114 -prefMapSize 244628 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c932d464-f050-4656-afcb-33ef5e2a422f} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" tab
    3⤵
    PID:5200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6352 -childID 8 -isForBrowser -prefsHandle 4320 -prefMapHandle 4432 -prefsLen 27823 -prefMapSize 244628 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca2bc9e6-07c1-4d68-91c5-f40c03200b8f} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" tab
    3⤵
    PID:1184

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTlCOTA2RkEtQUI0NS00MTlBLUFGQTktQzM0Q0Q2MzEwRTk5fSIgdXNlcmlkPSJ7NDEwODA3NTItNTNDOC00QjY5LUEyRjMtQzIwNUMxRUQzOTRCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntBOENDQjMwQy02MkRCLTQ5QUEtQkYyOS00OUVBMkVGMEU2NUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMiIgY29ob3J0PSJycmZAMC41OSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIyIiByZD0iNjYxNSIgcGluZ19mcmVzaG5lc3M9Ins3ODFEN0EzNy05ODZDLTQ3NjItOTU2NC03MTdDQzBFODkzMDh9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjIiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM4MzY1OTQ5MzIwMDI0NjAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIyIiByPSIyIiBhZD0iNjYxNSIgcmQ9IjY2MTUiIHBpbmdfZnJlc2huZXNzPSJ7NDI1N0VFOUUtRTJEOS00QzI2LUFFRjEtNDEzQzI5NTA4QzFGfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIiIGNvaG9ydD0icnJmQDAuNDkiIHVwZGF0ZV9jb3VudD0iMSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIyIiByZD0iNjYxNSIgcGluZ19mcmVzaG5lc3M9IntEMDZFQzRGRi0zQjEwLTQ2MjgtQUFBMi02NDU3MERDMDM4MkN9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1888

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9.msi"
1⤵
PID:5244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9.bat"
1⤵
PID:3912

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004C4
1⤵
PID:5056

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:5756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9.bat" "
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
617KB

MD5
ed79c8a8367786ae58ce92b7959431b8

SHA1
2cd64ed3068fdc8ece264bc73f859a10017840e0

SHA256
5311b2af756fceabd5bf7446c2332cd19c2c23936c2eb4a6f2687f49dc4766da

SHA512
af6d4d62ffee0a8f1415b3b3bc6381c24e01dadaa7dbfc335414c739a209b871987ed51a1331de7843a39ad7b673d8ddea20d40edac47415d293aa170fb25ac5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7d54c81ca3242fc52ddb9aa62ffedf30

SHA1
5b259193ba323d5f0b04f3cf9e5c277e80aafcb2

SHA256
dcf09f029757c9312841771ba231464d2299b439075c154ed017bcb72e400598

SHA512
4f988a151ca1d07ff9113607fbb62fa6d79a3a4a709d9adee17a41c68a3c1395be44ed3780e1bc9723f9f58bf34782db4e4a966f7f365332019a3969efa11ec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
519B

MD5
09f22ebc43787c1e639c6df4f8bf717d

SHA1
22cc86fa314608bb4b75b38023621224340e69d0

SHA256
d2b4715f81e5bcb171c8dcea51c7d05cbdca63ab0ce1db1d1330689f050ed344

SHA512
cb83e779387efec4c69aeddc3bda6232f8ec0a5de11d3afd3666a0c152210d47b1806f941894b0aa5117936b95529f237b0441f1788795fcb4c29ff779e2a4d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
071398d843ba2524402b9c341c5f6d85

SHA1
91f265e9b494409a9690d1aa728213382fc6f6e4

SHA256
59b1c5841d3c512dc4ed3ffcfcadd3c6c0f42429ead9f233568a6befd5a42708

SHA512
664309986794850ce421fda12cf8128d5f71e444a40158f76cd0200f8b1ead72e07114e233707cda69085e75189691a1e00f4b9e42365e9b42f034d22e356afd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f68873df035b269e71d1d02284b44610

SHA1
02b5db77f49a5f06eaf26660d5ea14a421b71f4c

SHA256
ebb1e0b77bd35433161fd45d34298afc6f6aa7c4f5416b5fd39a86d2681cc867

SHA512
42ecf08c5a89a820a48dafa957a45b93cbbdf34f595d216ab618fec922696fc7a3f7db5df183cd4669f812348c3ae257cf53d835831a6704a11e209eb21baa78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
8ffc967c805b75931641eec1f3567138

SHA1
36ae84c39cff4e08efdacc8f3d6de8b3276c3225

SHA256
4aee0b2536d7b0df9c4affb87efc60c91968376869a256c5fc6c88e121011c6b

SHA512
b1789d3e9edef2930ff788a75f4405240147fc5eec5ab713fb645336bc91854b779824413bb196b7d041f60ea1a0dc825b5eb12fe777c931e63616b74cfffb06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
71af03e15c9ea8aa93cad6010121e19b

SHA1
1b5015e58c7146e2369f16bb26f02f4a85262653

SHA256
0cf83b9b81296a78c128c5d0d0f9cd21f9f0e6b637d13937fdd51c96e4c56c64

SHA512
5d5e67f45e766de234cc3fd3797bc3da56c681e0c22532d5a3234395ce8e352c0f23523e5a46a7069473a227ac850fdf68d9eb20dc62d264a3a8a8473891095d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c297c2a9fc563714b689c924350ec141

SHA1
6fa992c198a1b47f7866cef292b607bfbc393243

SHA256
281afcfc02addf8407e59c4b5a389107c37dfc6ba497cbf88753f99c54b160b2

SHA512
9ac2ac03b0b35fa12bb5a1ce08db5cdedd807111b37fb2c4497ca35ccfc054f16c8fa7c10cabecfee148369354ff8953358b93ccf61880de9f7c467521f63d41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
246KB

MD5
5c922148e49c52586bd0540289ded189

SHA1
db2de1239c14169c3a7728c344aab7d5b3efdacf

SHA256
6a7d3d30bdcb6525dd4b2f541864538ded495c880d6b32a005652deadfddc158

SHA512
9c635dd7535d79788b5c434786e3fae8ad9e458f409ef71447deeb71d357d64c250c4487579dfa8631beb70611c71040eae1ac22442cc1dc2c6e83c89a72f407

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
246KB

MD5
ae0af5b2108b2f6ae5a4346946f7b790

SHA1
20224549d8932f337cd26e18453a11ab07a866fc

SHA256
1d8b582f0d83e17307569fe85cc0e1aa1bbdae75163cf6ae5ca9af59cc93bb91

SHA512
c3079978d643e726505d954a7a2015b2a0f0a7a2caed4a806c738873fcb3eab8ba6d5543434601db0301ab1ffc454b7aab3638d32c7a88cfe9983379d1d9ff76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
246KB

MD5
519ac883ee29ece319937189f5946a39

SHA1
54095de71da6fc925f5ade7a260bd887fe1f3272

SHA256
b356b6450cabffd9a77f120fa3091349e2fdba4fa66fd71e54d5b817da3fbf9e

SHA512
2ff751b9c7aa6fef11facd992e20dd51627c03e15d7f29387868935b925ba4a73bccd78022c6ddd324572cff1b1bc5937d2214a5c6f965d192d880dac9ecc92a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
0850e8efaa4fd488a92a411f495f1eea

SHA1
153553d8bdf20b04c6d59b7179c1630167735445

SHA256
02b266243ed08eb54674b521b838c80d507c2be33d72a9a541368ce14faaadf8

SHA512
0ea3a476c4c9015aedafe703ec8cb638f2d756e0845b49005bf04530006934a046fbe5339ca6ebea41a59d6afd002f604c359d6b2998313f6846b0ea3e7cb4fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
1d2e28211229c47e8a8b875e42ccc917

SHA1
edc62240b103ef9354b584455e321f16cc132d28

SHA256
92a83871bb40750dd26b917537c9e6e42ac1d3e1b1b0b6da55aee06a29cf5711

SHA512
64c819ff45bfcb15f8a722ba5f37dd783131a04b5a5c7c23d5319296ec948a881dbeac3aae2912be07f1fcdc555efc444884c1c3adbe8b7e9d4e899d94e8613a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
0a83c4b6707c6bdda6782500d1da08d9

SHA1
079bef8aba73c8ec48fc3296b3a2be9db3ad2cf4

SHA256
4a65e00b14d8625ff2a792a92850baf2bbfba48b1293facdd292784b5a8a46e1

SHA512
2b3d55e2eaeb75ca35f819ca7f0cc84823e9eeea01e32e0fdd92684d7da0b5e1bca8ae364eaee620c8e11e711c09509e68fbba77c91478733c20285d310b2920

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
65c8f22f29d7779eae3c89777e83f0d4

SHA1
b9cd6ba713cc66f3e342eaf08bd5e7b570bc22ff

SHA256
670d4013ce5c12ea200a6f59fe9e9c697b8994b5b34ba3df978627aea0feae5d

SHA512
767ff81be824729b9542481ba23e2152bd2b19ea4907492333115fe5da42c1e0a6b1089bc1bf3165e90787912527704a56777dd6e3f76b06183352cfc21e857e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\cache2\doomed\22535

Filesize
14KB

MD5
69cc8b9ec316eed8132a092172ae35f5

SHA1
95b490cde6c4c7e51f3caff6ba6f4282d80eed84

SHA256
2779f9578dc89f83e7bdd67c2e27908f924cbd7cce21297a23f4f878e862e9d5

SHA512
33bb0943fe5ac4f48d74d311a71b871f196f65802e74ec8fd7bbad402e5768395d1b7e5a3795fe255280b345ecaa5758882c68e54430c253906155e11da42348

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\8cc7e842-0802-42b7-a29f-4ca43ff8b8a7.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\AlternateServices.bin

Filesize
10KB

MD5
9f46cb33af9ef086b5b92e040fb3cc0e

SHA1
a42de19e7df10771269bad433e0c507ff6eaf6b2

SHA256
f6bc08f8744c62eb0e6f2f157cc432974ddfda5ddad1872a9db396d6a07a152e

SHA512
6ca781db9e2709e75b1c2398b2e84d270f36856ab117bc51986aa3baf49465519c487acac53ff5b0d0523dfd9abcb078f5b96600190e753977917f1f68101708

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\AlternateServices.bin

Filesize
17KB

MD5
039548db901241ce282bc5a655047fce

SHA1
1a616f25366fd366941658904a89875490b03127

SHA256
f0282b218eef96722aeabb3708f60695d055d84c7fd43baa164c746a6712e89c

SHA512
25aa535e0a9cf43b9eb565908a8277aae141093ff6141e666d6eb22a502d89bafa12c27a05ab59ec4a3a7bc4d2bf3d34bdac7eeffaee65bc0012e384c6e61457

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
878b53be7be5ec6b2c1361e4fc6d952a

SHA1
693cacb68bb1351b1b02ffe728b01a21c61a641b

SHA256
b78744a02ae61510e0a346b74d30623be1aa29c8ac1f8f1b19b9911d7b0043ad

SHA512
cacc53597ed928c198d2da6f5a658f31694965f75ac02cf679a1315c98d507640f654d34eeeea7ca400100589fef6f0158b6c778a2d93de8cc08b050fd3830e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
c0caf6b87e87a3bd3d63cc96fb6f9fc4

SHA1
00d2fcabcfaf6dda6bc8ad6b8d0d3401e3cad2fd

SHA256
d2dda55652be4bc236fa7df6a6c9bd828377fff72b3da2dd2ad78637e3365efb

SHA512
671d21918aa91213e423cc7977e4172ace76a69d479b04f11da02f9ae66c1dd7b25f953b17b8413d081430ef7280aeeed7f736e18d7c0cc271b20acc9955c77b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a8649c4059adeeb8679e1156e50e6a49

SHA1
85c92f8ca9998b02e01274d429c95c818cf5efaa

SHA256
53039b99e27649909a279e3d6fbdffc0c32a4fc283734a81515afb2a8ceb74ca

SHA512
0350c9ca1faadbeee6b1d1fbbd82b823ffad48b3154a01e5c998b6fbbe239117d4b946b5fec42b6cd6d035133d7bd24bd37539197339f47b1e4918b3d2e84a9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
7ddab069c296e8ecaf131a7d9ebd7a54

SHA1
dd32aa4ddabcb004bb2fbd8eb693141449e9d91d

SHA256
e34f6f07c6ced28fa5b7e796acc294437b3d617ce5a3b31ac80f2e7aea4d177e

SHA512
10041776d0b869f2c043eeb96a62df2d6d846b980610cbb25ffb22932fa91590786a355e8326162717a8699ac0b7112ae3a14e26722d37b10287f5ef79e56f1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\datareporting\glean\pending_pings\0f12bd50-7a3d-4321-bd88-2a961a55a1b4

Filesize
982B

MD5
421da95c36ff0bd9043f6461698944d7

SHA1
23519bf714039b0e298d8075e7c191f627a52763

SHA256
8034d497d686fba435820aee294d564c6fc230a9690f8fa671be66d5f2c5fdb3

SHA512
f6aa8045486570a6c7ae2092711ea85aba03501c7f1c592e808e9f2cafb5850f8a2da32e1d19742778c67816e365269e033f584ac2f86914a0372d9e267d9465

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\datareporting\glean\pending_pings\2cad5da4-a502-416f-9393-50370d49dd06

Filesize
27KB

MD5
4c9d11d41fd4fa398c479658159cdd64

SHA1
ca9b8e0fcf1e9a98ff4ddd251363704c9447304c

SHA256
7b55b384ceebfa9bd42ccc69c22328d8bda8acc61a5a2c48719b2eff56ee6392

SHA512
bcacf0234b36afaa95f9094134bf4fa2f25c381cbd4c367e7f1564863b4b80a2fe4a487ab40ed7d2dc383228f298b856fe78aa562e707fef442b538f25d1c336

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\datareporting\glean\pending_pings\c3ddb9c0-497c-4190-bb2a-fe2c5f9201b4

Filesize
671B

MD5
c712e4a8f3dbf4a1bbb2acc5a62d0b5a

SHA1
a3b858e538fc675a8210aa5c2cba6df2126654e0

SHA256
5995e09cba1d83da1106ae3bcf26ec9bc4b5b2906d950cfe370aebb7bdd66f80

SHA512
3260c0019b4747220067e5dbe4de92cfbdfe0307bfccff40f24a6049d4e830dfe4b6aa3cb1abe271652e4b0987a6bea173234c1485a5a75f491a1150a5aa8d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\prefs-1.js

Filesize
9KB

MD5
b68e4e17099c22ae819a91f83e0b3c85

SHA1
64f484ba0ecb98aff86c433a445258eaa7874733

SHA256
235339a2bd7c9fa99da4569c6bc453a3cfb59d8da3f54893911d024464a3dff7

SHA512
80ef45260d0d39f26b0bc5b619105e31e922d811ae6827b189f0d82d65096dc3d97c86de59a12cf033dc7bb4d31be1c87bc4fec2dc2c10092f52d8a84c89a7e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\prefs-1.js

Filesize
10KB

MD5
364ea97276f1349957dbdbfa941ea173

SHA1
7c12db7310491aa38760aa008a0e5d64ec945c3f

SHA256
76eea327be7db46a1a02bcbe455099577d10ac5c90df645ca09359bb38b4c16d

SHA512
16bf1e0a13c92c6330db005be1cfb6f7afa4a1100de7a86cc214b503edb83c88d0a459b91b6300a4499929eb561ee678016cdf65ee6b577a8b207e1ea97a63b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\prefs-1.js

Filesize
9KB

MD5
b4c2eb4a9b06cf6406e74dbf1a9f627d

SHA1
c6b799a9c85d8ff4ef75dbd9413e9c593672da9a

SHA256
15b6d1a02465b5bd0a574741fc9c3fbac46076ea51079f8af69967458ac28654

SHA512
5621281a9bf2fac7196a167c4a417e9e971109037668a3d6d8b6cc8bf2c146d37280e12d4b905e76b3c822c1edbb93821c79dcb79fc35b661d69f208e58bec3b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
ba258664c717df249700133b18c2be08

SHA1
4c5e45b3b7efa086fe3d99917a4949db9e3032b9

SHA256
2045defe27fbb0862d9163266dfe15359478321c9bdde428742244b4acaa784c

SHA512
f59428ddc03ffc431ebcb992c8806472e3dc93380c6d96e93774348e6ec6f6dbf15e18bb41a538f5cbb6a0199815dd78a360d4ca57427148485345c14903b4e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
730191bf40234f7722327641598a96c7

SHA1
96e29d72f4ffe15f584068784b9ea5e19d248c28

SHA256
e6b082a8322c022e7a42cd2e92ec20caa0c1e5807ccd6769c7f3042855e7c03c

SHA512
df59a4abdac3b3d316a279bd73f178ce07c97423bb9cba9c99beaa5e697fa14a58b1784b63dfe6ce490c200c4ea68312852fd0570841f0c2ef814be267fd0fec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
82e32876fde8b6a7b2f397b844faf5dc

SHA1
df0361faaac7ba7e97b206fc3ede504648dbf462

SHA256
3abe3b5d08c09f939e4d2a88584657c740449074ac40984b2e6f14a32da4a967

SHA512
a1d9ceb8a68370e99a7ccc2b4e96d7de2406ffd91fb5b16702a192e362384d1920f248ecc6e318f5e9e95432eb780d79f016b0d25591115465ccf60178115d66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zwpn5a1m.default-release\storage\default\https+++www.virustotal.com\cache\morgue\230\{889acde6-c75f-4f33-bbee-a4139fe5b6e6}.final

Filesize
50KB

MD5
c15e39272e3c138a2635caf0c99bfc3e

SHA1
04c56603844708655d532bee76ce67c159a0295d

SHA256
0541706f00d03c46e09c79fc9e9bd552e0f5f568f3f39675a6966870b6915ac9

SHA512
31def97b2abe95553c8f6e9817be77c24428b477a1f7c74cac12aa576b53bf97aa9ba84110653b37f1139d9e133350397b52c878c70ac0fbe7651adfcd461d69

Download Submit
memory/1124-7-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-3-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-2-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-1-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-8-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-10-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-9-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-13-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-12-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download
memory/1124-11-0x00000281D51C0000-0x00000281D51C1000-memory.dmp

Filesize
4KB

Download