c2efaad1313200d8b1e4283a596415bf745d51ab93cbc2daf2bb81ca309ce778

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FiveM (1).exe
Size

5.0MB
MD5

9f374c81fb39c9198e6443946a8d2085
SHA1

f13152da1547bcbe354d93f3ebc367af2f29b5e6
SHA256

c2efaad1313200d8b1e4283a596415bf745d51ab93cbc2daf2bb81ca309ce778
SHA512

095c2ea17a918f9048a6d1f4a6c22ce4950fd473858160e1a9abba4bacf1b411c623e74bc181787d9ca5065557afa1542168ddb1041afea919000e4c1b86e28b
SSDEEP

49152:rOjPWA2Tnq0HcKDcG1t8iv+ALmOfxFoZFZQ5rgZNR/oOoLEe+Apmex9i4n9dP+Gf:Zzrj8iaH7cPRx9+eIF175GjFp05

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

FiveM.exeFiveM_b2699_DumpServer

pid process

1532 FiveM.exe
5584 FiveM_b2699_DumpServer
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

Processes:

FiveM.exesvchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exesvchost.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Control Panel 1 IoCs
evasion

Processes:

FiveM.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\Colors FiveM.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 23 IoCs

Processes:

svchost.exeFiveM.exesvchost.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1529757233-3489015626-3409890339-1000\{360900D1-1407-4643-9A2F-95569C5CA34C}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1529757233-3489015626-3409890339-1000\{22ED7F06-E591-4E36-B0D2-AB829C3A5F30}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	FiveM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	4712	firefox.exe
Token: SeDebugPrivilege	4712	firefox.exe
Token: SeDebugPrivilege	4712	firefox.exe
Token: SeDebugPrivilege	4712	firefox.exe
Token: SeDebugPrivilege	4712	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

FiveM.exefirefox.exe

pid process

1532 FiveM.exe
4712 firefox.exe
4712 firefox.exe
4712 firefox.exe
4712 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

4712 firefox.exe
4712 firefox.exe
4712 firefox.exe

pid	process
4712	firefox.exe
4712	firefox.exe
4712	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

FiveM.exeOpenWith.exefirefox.exe

pid	process
1532	FiveM.exe
2772	OpenWith.exe
4712	firefox.exe
4712	firefox.exe
4712	firefox.exe
4712	firefox.exe
1532	FiveM.exe
1532	FiveM.exe
4712	firefox.exe
4712	firefox.exe
4712	firefox.exe
4712	firefox.exe
4712	firefox.exe
4712	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FiveM (1).exefirefox.exefirefox.exe

description	pid	process	target process
PID 5088 wrote to memory of 1532	5088	FiveM (1).exe	FiveM.exe
PID 5088 wrote to memory of 1532	5088	FiveM (1).exe	FiveM.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 3852 wrote to memory of 4712	3852	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1588	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1588	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 1468	4712	firefox.exe	firefox.exe
PID 4712 wrote to memory of 4880	4712	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FiveM (1).exe
"C:\Users\Admin\AppData\Local\Temp\FiveM (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088

C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
"C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies Control Panel
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_b2699_DumpServer
"C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_b2699_DumpServer" -dumpserver:2080 -parentpid:1532
3⤵
- Executes dropped EXE
PID:5584

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:1084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3852

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.0.1966263096\51404916" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ff18b95-98f9-4d34-b388-5466813ba9f5} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 1932 24ff8c17a58 gpu
3⤵
PID:1588

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.1.890695553\164067199" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99ab9420-730d-4318-adf8-278a7f2e1517} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 2332 24feac72b58 socket
3⤵
PID:1468

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.2.867123183\1370756546" -childID 1 -isForBrowser -prefsHandle 3416 -prefMapHandle 3412 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ef07138-aa29-4c4d-84be-95fb56395ff5} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 3428 24ffb8e9858 tab
3⤵
PID:4880

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.3.1994819334\1205767489" -childID 2 -isForBrowser -prefsHandle 2472 -prefMapHandle 2504 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d86bb5d7-c324-4383-a75f-9dc3d1a4bb53} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 3240 24feac71f58 tab
3⤵
PID:1452

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.4.1376755068\1957939018" -childID 3 -isForBrowser -prefsHandle 4072 -prefMapHandle 4068 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84727142-abc9-4c9c-a651-6907d25958c1} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 4080 24ffcdc5a58 tab
3⤵
PID:3048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.7.1931967238\781866908" -childID 6 -isForBrowser -prefsHandle 4880 -prefMapHandle 5020 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90581a5e-7808-45ae-9290-5d482fc92ad3} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 5200 24ff7b3f558 tab
3⤵
PID:220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.6.976011067\1544911440" -childID 5 -isForBrowser -prefsHandle 4892 -prefMapHandle 4860 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47357d32-f1d6-41d8-9059-47b70a95619d} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 5020 24ff7b3e358 tab
3⤵
PID:5024

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.5.1307215333\531879261" -childID 4 -isForBrowser -prefsHandle 4948 -prefMapHandle 4952 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e47a438-a5d2-4957-ab1c-7ed71750f5ed} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 4868 24ff7b3d458 tab
3⤵
PID:1688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.8.939490923\821914932" -childID 7 -isForBrowser -prefsHandle 3020 -prefMapHandle 4264 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1950b8e6-705e-4bf8-a8a1-87c53b01de4d} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 5772 24fff26d858 tab
3⤵
PID:5192

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.9.2122433616\1147647869" -childID 8 -isForBrowser -prefsHandle 5876 -prefMapHandle 6028 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78e43b90-22f4-4412-aa2b-668b57ccdde1} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 6032 24fff2ac258 tab
3⤵
PID:5860

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.10.1952981895\1347498695" -childID 9 -isForBrowser -prefsHandle 3092 -prefMapHandle 3944 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77eeb2d9-f3e1-4863-bb3f-83bf97b8524f} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 3936 250000e2d58 tab
3⤵
PID:4996

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.11.560202090\1228214489" -childID 10 -isForBrowser -prefsHandle 1500 -prefMapHandle 4052 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4729c8a2-64e3-4a5a-8aa4-ca25a11295bf} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 6212 2500036f858 tab
3⤵
PID:2196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.12.1459160141\1812893827" -parentBuildID 20221007134813 -prefsHandle 6408 -prefMapHandle 6448 -prefsLen 27331 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {576dd612-c2f4-4add-911c-8aee6b052b40} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 6416 25000491158 rdd
3⤵
PID:3672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.13.1944877489\1177441490" -childID 11 -isForBrowser -prefsHandle 2964 -prefMapHandle 6440 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fbc67f1-597f-4a19-82da-57b68070ec1a} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 4272 250001a7b58 tab
3⤵
PID:388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.14.2128578421\1676771022" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5420 -prefMapHandle 6572 -prefsLen 27331 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59bc6efa-9c4b-4c19-a04f-f5f74ac7a606} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 6696 24ffffc0b58 utility
3⤵
PID:2064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4712.15.1787850286\1331306914" -childID 12 -isForBrowser -prefsHandle 6064 -prefMapHandle 4496 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faba2a91-4e29-43c6-900f-5fc4e9fcbcfa} 4712 "\\.\pipe\gecko-crash-server-pipe.4712" 1224 24fff2aec58 tab
3⤵
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2372\data\control\settings.meta.tmp
Filesize
37KB

MD5
3656c6636cd9dbceaf83230c3c9a2be9

SHA1
989f27c6736a943fd4690091fed26f7c17e3c17f

SHA256
f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6

SHA512
52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Filesize
6B

MD5
dd0181d5ec789010765568fb14453d3a

SHA1
eb6d3ae6f17bfc7912a0f5b235e94b647d0a6ace

SHA256
cd2c6c74c98f7102b321510989beffd0446f9c727fb69c1f3c50adb42f2e5418

SHA512
d542f66de2a27a0b8573530ce7cafef329633259fa3cf76576f1e0aebefb26264450ef105cca5cca8e4a903d4f57b2961f46932893181bbc7edf2407cdc97ca9

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_universal.lua.tmp
Filesize
1.7MB

MD5
9a9fddbfe45be941f5b0e2a83af3be90

SHA1
824612ea23ec417bb48ab7195fdd472f6c13b726

SHA256
48361c12d67095089f6d26e569b39c67f6744dbd3b5234882ba556747f60bdb4

SHA512
032a50594103f36458cbb0fd32c2986923350760be297ec2a36481b65de2b0184b94981074a832a4f9fb29df9bab99ab805a43523f2b51bc69936fb1afaa63b1

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.d.ts.tmp
Filesize
1.9MB

MD5
dc171af5536dbfe466d9d0c7e08f7248

SHA1
d46c384b3424bed11127e0f90f900b589357c3b6

SHA256
a845a496ad73d4ff98e31f45ab6fcbf460b7fd5093d40710621f20ee0b3fd2b9

SHA512
674ca14adb9d4fa82d89bd76ad9f4612c4026bb820b3e939c228072e33fea88bfbbdd9807916b630503d2d208eb4730d7863537cd9513f07768b24f239753c9a

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.js.tmp
Filesize
1.8MB

MD5
cab296237984e7d1109e92de341dd8da

SHA1
294aa444dfe0e65f4510f3a0fffb7356f402b4a4

SHA256
2a5f3f19295ca741f8c30e2a4264fef14730a3d9f511102b242e37c48aeb5c9e

SHA512
71690d49e7f1a49f5ed6ea74d82151a5c9c9669001bcdb5e9d0e7ca69bc08099257e625ad0a55b07319d7ad84a77251a2891b7f5ec8e78da8f71b3028c5b736e

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_b2699_DumpServer
Filesize
5.0MB

MD5
9f374c81fb39c9198e6443946a8d2085

SHA1
f13152da1547bcbe354d93f3ebc367af2f29b5e6

SHA256
c2efaad1313200d8b1e4283a596415bf745d51ab93cbc2daf2bb81ca309ce778

SHA512
095c2ea17a918f9048a6d1f4a6c22ce4950fd473858160e1a9abba4bacf1b411c623e74bc181787d9ca5065557afa1542168ddb1041afea919000e4c1b86e28b

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Filesize
157B

MD5
f9d948aa9426cb1a2a82e651b81a1912

SHA1
2d496caeef3b0bff6b91b99e58736cea51366348

SHA256
b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a

SHA512
a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Filesize
157B

MD5
f9d948aa9426cb1a2a82e651b81a1912

SHA1
2d496caeef3b0bff6b91b99e58736cea51366348

SHA256
b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a

SHA512
a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Filesize
5.0MB

MD5
9f374c81fb39c9198e6443946a8d2085

SHA1
f13152da1547bcbe354d93f3ebc367af2f29b5e6

SHA256
c2efaad1313200d8b1e4283a596415bf745d51ab93cbc2daf2bb81ca309ce778

SHA512
095c2ea17a918f9048a6d1f4a6c22ce4950fd473858160e1a9abba4bacf1b411c623e74bc181787d9ca5065557afa1542168ddb1041afea919000e4c1b86e28b

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Filesize
5.0MB

MD5
9f374c81fb39c9198e6443946a8d2085

SHA1
f13152da1547bcbe354d93f3ebc367af2f29b5e6

SHA256
c2efaad1313200d8b1e4283a596415bf745d51ab93cbc2daf2bb81ca309ce778

SHA512
095c2ea17a918f9048a6d1f4a6c22ce4950fd473858160e1a9abba4bacf1b411c623e74bc181787d9ca5065557afa1542168ddb1041afea919000e4c1b86e28b

Download Submit
C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Filesize
5.0MB

MD5
9f374c81fb39c9198e6443946a8d2085

SHA1
f13152da1547bcbe354d93f3ebc367af2f29b5e6

SHA256
c2efaad1313200d8b1e4283a596415bf745d51ab93cbc2daf2bb81ca309ce778

SHA512
095c2ea17a918f9048a6d1f4a6c22ce4950fd473858160e1a9abba4bacf1b411c623e74bc181787d9ca5065557afa1542168ddb1041afea919000e4c1b86e28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
28KB

MD5
6ccc8c4946c7d73e7d7b446b123b1d17

SHA1
1ce650e2d1ff401ce71db696e80e0f729e91f5a7

SHA256
4d47ef25b333a0d388f2354f13957db137516749c79b52489f43fadbe0d1e559

SHA512
e20cdb34989c86169fbed4614037866be74e381d6073ae221a1f01108ec46646971150f16f46e1749b03095be53158e36a55d9752b6a0739b3faf1534c0e3ef3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\activity-stream.discovery_stream.json.tmp
Filesize
147KB

MD5
7c242ae2ef2a28e7333c55c462eb40ab

SHA1
f667dad5020044ec793ed461c75d37288e3813d5

SHA256
2c4010dbd493627447b72610039f4c1e1ab1f9e15c6dc323323017ecb52f052f

SHA512
94434b01b3d4f8e5df3b5d51000782c27eb9c1c9cabee44a388571f7a5d3f36a33e3bc46985bc8dfed6d485775b8974e0898abd717b13b69cb4aef50e3c23ea5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\14792
Filesize
85KB

MD5
43af374818c8f4ea5ef2c46ca42f3115

SHA1
d8b0a5716793f94fdaf97c580fc7a7efb2907ad0

SHA256
d087ed4dd38436cc98aee68fb946139ba7f93db107975bc328ee9de9d8c10dcb

SHA512
3ba7f37e090a425064cccbf03c06f83489333f2b5fa3b0e2e45e788045b401709bee85d35af1a82c054c794a1e253b0adcff5ab4f439ed183e8a28f99b0485d1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\1741
Filesize
10KB

MD5
c58b252c972d3d868626f7b89df2fa45

SHA1
0a46a5f99bff7885e027b55a6da45b282bf72564

SHA256
b34b334e9f1346c7973b19ef58ed97eb8e9411733fc11e1719d0c702dfe4760c

SHA512
5dba425cf370f58d138e85c080f341554470cf7d2830118cf06255d774cc0a7ba1f58b046cb85eb54f5b0ac74e26182aa5767692f5922e1e854048c6547f59b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\20068
Filesize
15KB

MD5
419fda4c4322e3ec48d6ca6f96762aa6

SHA1
489d60aded7901b08a75479dc94255431977c669

SHA256
62bc364aeea57f75e2a8ebbbad53559f8a6254db2c3510de22276dabeaca0f14

SHA512
42868be91d5f35ff67dd284c397263b3ee3eb58434ddc5c43e959fe3e2b5286ae98e1c77345d9e4e529c1d1ec81cd1a28257adec2a8e2ed9af95c5817adb719b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\24320
Filesize
10KB

MD5
e7f6f39977675f9a5f1055f02c5d64e3

SHA1
0fe950f094737f8ffdf16d23fc82580e289799f8

SHA256
9f76a5c625037ec157bb442cf5ccfa40d780fbdb10216dfc14d1593e3260e96f

SHA512
67d4c79469d8a0bec386f8e99e3a737f32bd9373f59ca87f33dafdef28d17b1c28a590593ec9c127b624fcfcebeecf8c7d0ae2ccd0988afc994834ddff0723ec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\25030
Filesize
1.2MB

MD5
56cebd30238ceb1bffbbbb4ad9e05425

SHA1
9044de88e03148cdc8d9a5d228965b147405316f

SHA256
82495f8f3b0d0b12f61cc878c9039abdb77e755478fdaa33d60c336b5bab2ba2

SHA512
b972e920b5499345e2405849095dd586dbd0df94bf40fc7f69c2475596ffebbd0742c98bb4f4559452e0bde454d03a8690cf923479fb86d17d88674bd43821b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\27224
Filesize
11KB

MD5
d627cc4096b840da1738b232d3123948

SHA1
f1cd6844a7baeeb8cc38066993e8ff261c9c4967

SHA256
f71060fb1d71aca2447ed04856b00199d8a6f2ebd1b0b2835aaefb5ad2c4e003

SHA512
2b25e4f0495fa93536424653f610c49e9b33dfd35104211e71e58255d86559dda56ce01686bd5d74d94268207a644010f2eebebd87ec58ec08e51395689569d1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\30554
Filesize
15KB

MD5
09a6b7f851a84b85cc049edc5a31f35e

SHA1
b6ba9aef1e557eb7b72db57fcd414f5a9039ea9e

SHA256
3c89c45baa4f20c5cad74e0e206c113affe231bd2edd76ec88b490b78c01a289

SHA512
c246e128e8eb35c7d86c155fa3f0c0ac8218377e6bebce6751695eccbde4bda26adcdb2a0277e0ce8615474d3c645e224c1def404ea758d6d01185d331ea6a11

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\32276
Filesize
11KB

MD5
f40255fd42122c0bb7b29b36079d7bf6

SHA1
46dc498ca8c1f512fae923eb95cf7d544d033e4d

SHA256
2d59b07729eb098580c68c612ebbd5d78d67075f8c4fba30ee56027c40afff0f

SHA512
3d35a4e99cc72ac8f64765eaeee8d485c1678aa90c75bea8a1c6cd10c0b5cfc284fe1a1f18de552d46f58590b681aef586ab1792c46b686a3a276eb7457005f7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\685
Filesize
29KB

MD5
7f81ecec146553aea49e9999dae76c5a

SHA1
89ff6e593529579e4b47b80425dc07e4c76ea0a2

SHA256
242dccf86f21e76462b769e13e5fab7514ba83ab7aa611c78d57ab10efa2462a

SHA512
214eac877214f6c5acdb074077887b0ad9f16fc2695c9e74ba9f09578f4302da6550362c9119b91981b52adfacc8292c6916c2bee25c4458ff092a3f91618c7b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\6E97343BD764F8228FF4ED57304BCDCDCB55280B
Filesize
15KB

MD5
3dc3ddd27b55ca0d9b012abce1037693

SHA1
e1522da3d2d8ff34e3d6fb433f5b6f79a850c127

SHA256
91423fdc20da7f7baeb0fdb1f0ca2b00efef70eadeb47c8720d7909ac2cbac6e

SHA512
9b9124855117c36f871c4b56433c7b7ccd43cd77a50d754344df37978c4aafdeff0439079ebdd74a26b1da8403b6b8ba695166c8ac151ff5e5c3355491469d4e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\CFB99D49EF2C1CFE7558BFB9614540451C0C7F77
Filesize
295KB

MD5
ec01874f826f5310b1c72cd6de4de88d

SHA1
0c06ea08084d99a02e050c948e4ad82f64976841

SHA256
db72b0f7fcc1909e1e9b0b9eee1b7aca4dc71d6091876287ebc67d3414220e71

SHA512
2179507b766b50d8888e799c5f67122813fa59b6f81087b8e449f11052f57e09e8bb4d636c7583c3c1887f41e407ce897ab8fb7147c716ae2dd46820caa08c8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Filesize
2KB

MD5
c4f8ee1bebacf769de1b1ba5cfcee694

SHA1
9ecc010f82b1b2e1504eb3c2815b25725d48a817

SHA256
904892e951db47a47d0b227b72e93b177a240578aab60ed5c057ff244b5023c3

SHA512
c944a52d569c612886082f918988ce27276bb2d3f125ea5b03f1bd252578f11d23db4183b3cca18438b0e3d5eb57ad1cc339e652371b27d29c0434e8132199f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
68c05508722cfc606eb70aefab1ee21e

SHA1
0d739688c8238280add5a0a31a2fcce0000be44a

SHA256
a54d5cb14a1a907bfa32d299da22abd03b6119f22ef5b3c2eed2b80ab4660c2c

SHA512
2d9a75dbe50ef4b45561a7c01c0e17a74a49676ca555d9afca9222134c7dc1d33a26306b8439aee5ff938e2a4acb220d66e1d36c5ce4c010be0d4834796fea82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
9e26ae1712c70384bb370ea271b63011

SHA1
18078311331a4f24213ca74f6d9f5a26feeabb68

SHA256
dfa98462c3f4f55207bc386d7e012ee1dc3a78c2d77731ee12071d070f69b6bd

SHA512
bdfeff31ea7b1a87f8bffc6e7996656f7c47ee032dc722dc746d4946f09f20892625545a41920e676104136c285bb244447e68bc7f28d29c7f94c2eaf468ea47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
7KB

MD5
a8213c23924d18f00cb4acea648a4759

SHA1
3694956f48e9c37f2ad88c13308322c9466ae91f

SHA256
23414fb4a714ec4fa2bd5857a66b58ee7e69ae21bf0023ed6a03d9a6106094e7

SHA512
278216d403a12d7949316f46babe74ccbff45a9861adfde20f855cf7cb2f7f1bfc289238885ab14c75f9ffeaf6b5d43fce2f0457f15e161c5fdf8cf80b3392bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
fac8068847229635d8930a0e3418d769

SHA1
a9ec17f513518fab319c2d999b04432cc0f182e0

SHA256
65e98ad94db6d9ad7331097da27d79c7d5d71849ae181cc62222606d2a74f754

SHA512
f2cde6d165cee6dd0a365507b579533a4a87c4c607084bd06355ab6f8954ad88a9584b88e00dbc90fdcafcac7b9ca7d727c837c8857efc51de683093d2da00b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
e24a2a7217b79810cfcaeeeccd4ba368

SHA1
74be3fec6df2b83a27d0b2dd8f11325f77d1c8fd

SHA256
7b11c1c998b364dfdc86d1df1e780d36c1459a94ec02c6742ad0a0a9e4a9c111

SHA512
312bfcc5a4d75a1b9836caafd60950733989288229d72fce31f2f5de9b2c83e0adca31d84d6445db268cade80d27b123647fb850a21d77d8cb0f3791e73c0445

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js
Filesize
6KB

MD5
207077fed406e49d74fa19116d2712aa

SHA1
3ce60cb9b4fbd6b00a9ae26c599b9fdbe2b6c5ee

SHA256
b02701ad3c4478f891a550eac65f0a8c183999aa22a1dd171bd698b990124c58

SHA512
0c6398230b3eb103a0ce280f127515d998a6c9ea8908b8b248b132782f8166141ba8e1faabc7ace4b80e9c925bc5d7885f0fba8c16cb2e7798055727dc66190e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
49d542168dfe2c6787975c9e874c162c

SHA1
d0edb2647a38f0d2b37896aa4767dfcedc87ac40

SHA256
baa1fbfeb820228c9dfe71597769c9ee3e835d0920cea02ebf869284d05efca6

SHA512
c932034261369c94267236cdc2727cc61ac13dfe2ce84f0f4df3be0f7d7369a621b2e69ec974681902e8f1d030a6681edf566723609f4647655b8a8e3c25edc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
085c1e2af1a76e6e7f909ffb1cf13afc

SHA1
9b7c2e554b60a61c85d47b48a47cd8561bd6f5f0

SHA256
f877df3acf62920495876186d12715143dc69ae4aff327b1a7cc1d0a881812b1

SHA512
37aea66428586c4102bed4195ac22e610c9935bd584788f2322a6b6fc0de80780401cb38f5a31935bdb20a82335c7a013e9532355d9431a506ce0694b3d3a077

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\default\https+++www.reddit.com\cache\morgue\160\{05de1f74-1c21-4bf1-899e-556a12d43fa0}.final
Filesize
3KB

MD5
3bb4a1da4f5540f331ab94001255b437

SHA1
65c532d38655a2889c0b0a62005e2d2ba871e8a4

SHA256
e4a0e7412a33b9f02806e18940eafeb5e45131eee18f78b0068292be5a6e55be

SHA512
fefc7c48726c9a2253af8274f588697bc60e18a05d8b08bf8424cfdbb3c702b7fa96ba29776baf2560da5c1bfb5f1bcb5c19e5a72d15ad5533b8f69a0078e8c5

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini
Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit