hxxps://dn3[.]freedownloadmanager[.]org/6/latest/fdm_x64_setup[.]exe

Analysis

max time kernel
94s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dn3.freedownloadmanager.org/6/latest/fdm_x64_setup.exe

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 58 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\fdm_x64_setup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1632	firefox.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 4464 wrote to memory of 1632	4464	firefox.exe	83
PID 1632 wrote to memory of 2900	1632	firefox.exe	84
PID 1632 wrote to memory of 2900	1632	firefox.exe	84
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 4776	1632	firefox.exe	85
PID 1632 wrote to memory of 2892	1632	firefox.exe	86
PID 1632 wrote to memory of 2892	1632	firefox.exe	86
PID 1632 wrote to memory of 2892	1632	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://dn3.freedownloadmanager.org/6/latest/fdm_x64_setup.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://dn3.freedownloadmanager.org/6/latest/fdm_x64_setup.exe
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.0.1783400228\5003436" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e58506c7-9192-4756-9dcc-fbb4824052d8} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 1932 176e3ecc258 gpu
    3⤵
    PID:2900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.1.1252229533\1224049876" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4faf030-8f41-47f2-9022-815d1aedc407} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 2440 176d7073558 socket
    3⤵
    PID:4776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.2.1667160473\749948054" -childID 1 -isForBrowser -prefsHandle 3124 -prefMapHandle 3120 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {114cebb7-8b4a-4ed6-a780-8913a63f4e0e} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 3136 176e7cf7b58 tab
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.3.465385470\899412819" -childID 2 -isForBrowser -prefsHandle 4084 -prefMapHandle 4080 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41ddaffd-2af2-4b81-b21c-ccd5b529f3ba} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 4100 176d705d758 tab
    3⤵
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.4.1106898848\1942709756" -childID 3 -isForBrowser -prefsHandle 4596 -prefMapHandle 4584 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c5583dc-7bb2-4db4-8a25-f798b223fe76} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 4604 176e82de358 tab
    3⤵
    PID:1736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.5.229692445\1647624371" -childID 4 -isForBrowser -prefsHandle 5032 -prefMapHandle 5036 -prefsLen 26874 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f338ab5b-35dc-4792-9647-739432b09e68} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 5024 176ea7e0758 tab
    3⤵
    PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.6.543465882\1136238336" -childID 5 -isForBrowser -prefsHandle 5244 -prefMapHandle 5240 -prefsLen 26874 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04698237-fdcc-4f32-bc80-391c284cb51a} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 5160 176ea7e1058 tab
    3⤵
    PID:1828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.7.785527791\2072150527" -childID 6 -isForBrowser -prefsHandle 3004 -prefMapHandle 3056 -prefsLen 26953 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e488361c-7bc5-4d24-89fb-b5c444cacf21} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 6108 176d7066658 tab
    3⤵
    PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.8.44954086\896682511" -childID 7 -isForBrowser -prefsHandle 6212 -prefMapHandle 1636 -prefsLen 27026 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6044758-3e5b-4ecc-8035-a70c76f73203} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 3004 176ebf36e58 tab
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.9.1008050891\2117975902" -childID 8 -isForBrowser -prefsHandle 2216 -prefMapHandle 2212 -prefsLen 27291 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50c28bd2-d8fe-43e4-a825-a7cb74790732} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 2228 176d706d158 tab
    3⤵
    PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.10.154952664\2017332276" -childID 9 -isForBrowser -prefsHandle 4652 -prefMapHandle 4636 -prefsLen 27291 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6b40632-92d5-44dd-89db-ab3c208e0947} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 4664 176d705fe58 tab
    3⤵
    PID:3472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.11.1540974780\1852379648" -childID 10 -isForBrowser -prefsHandle 3204 -prefMapHandle 4652 -prefsLen 27291 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f592793-77e1-41c0-a021-e12b5a3ffad4} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 3424 176eca19d58 tab
    3⤵
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.12.177808847\123812326" -childID 11 -isForBrowser -prefsHandle 9324 -prefMapHandle 7120 -prefsLen 27291 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fe12bc1-71b3-415b-8bff-8c389051ed4b} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 9316 176ed01fe58 tab
    3⤵
    PID:5220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.13.220614999\756024768" -childID 12 -isForBrowser -prefsHandle 9224 -prefMapHandle 9228 -prefsLen 27291 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da4592e6-9bec-46e8-b78f-2ca1209590ac} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 9212 176ed547e58 tab
    3⤵
    PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.14.309338352\1663060348" -parentBuildID 20221007134813 -prefsHandle 9012 -prefMapHandle 9064 -prefsLen 27291 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {75d537ab-153e-4d5e-9a3f-7f9778b67d78} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 11008 176ed6e9558 rdd
    3⤵
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.15.1852427869\1555001792" -childID 13 -isForBrowser -prefsHandle 10784 -prefMapHandle 10780 -prefsLen 27291 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5686f0fd-5cbe-4d33-b24b-b935ac40e2c6} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 10752 176e82df558 tab
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.16.994138606\1808553243" -childID 14 -isForBrowser -prefsHandle 3164 -prefMapHandle 6852 -prefsLen 27427 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5b6a383-ea19-4483-9733-9d4ea5c899ff} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 10084 176e76d5558 tab
    3⤵
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.17.784786995\97012507" -childID 15 -isForBrowser -prefsHandle 10272 -prefMapHandle 9868 -prefsLen 27427 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b0e1911-2dea-4609-92e8-b036414b789d} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 4068 176ebf33558 tab
    3⤵
    PID:4916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5356

C:\Users\Admin\Downloads\fdm_x64_setup.exe
"C:\Users\Admin\Downloads\fdm_x64_setup.exe"
1⤵
PID:4380
- C:\Users\Admin\AppData\Local\Temp\is-IVPIV.tmp\fdm_x64_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IVPIV.tmp\fdm_x64_setup.tmp" /SL5="$30286,35090893,780288,C:\Users\Admin\Downloads\fdm_x64_setup.exe"
  2⤵
  PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
151KB

MD5
60234944e4dcc4b6a5d37825e3d1168e

SHA1
2b17f9417c4af2c43860a98852dd6bb76a6c6c9d

SHA256
3775eb1cba1bf712c0d44c8a9bdc751b9755c6cda3c244af8dbe111cabbd7913

SHA512
5751f2081238122149cbc0aa3c3494b3ea44d9781048a4a2f758c3baaad468f822b59dbdb687ef420675ae34250668b676bda65e6b2aa1488e6e4aedaf950499

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\10631

Filesize
9KB

MD5
bbb6933396545a223a8575f5c83913d7

SHA1
1e63df96b746be5c4d96c0d4fe7f81977e8a838f

SHA256
23359ee59608f1ae99f98c946004431f12bf867e685612cfcfb8945ce0ded574

SHA512
621385369d69e36a35a7ddf6d4b65465a94b99a6f79e78c52d1f590379e13ff4513e6847351163779aeead46017f2bd87c4664cadc12499751cfce2ffa107dd2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\15726

Filesize
14KB

MD5
c1576ef58fd8191f41651677a5307897

SHA1
4b41261f60a910d3ed19909f8d40e4f2d81235e6

SHA256
af04dad97725ea41b359bd4beff469de59c9e130d8e45e936a2394284664f109

SHA512
cb29a49175f2240b7d2e75c338d24159dfaaf3c8ca7b0c848f20a7d7bf36ef41311c5400a6fe591b77b4e75fc8c61990a645579ddf163d5e15aa3e0020baec2d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\17504

Filesize
10KB

MD5
5ebedc71887387b75321f97b4425892f

SHA1
0a3ff5e55fab7088dc6469d4c84c6a8cf76b4091

SHA256
29cdda83735e0f936269b5dab34979dd901376057a6b36529d52d4f025cbc884

SHA512
2ff794bae0c5d6bfba9bd5deed01cb922be2aa3c78a353d08ccb341924e2d06e107bcae8732b728e01d9fad7602e8ec022227d12ff2943c1edf83afa346476c4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\18735

Filesize
9KB

MD5
83a66b1f991acace47cc85e085b7809e

SHA1
409463e327fcc613a09d024474609305abd36776

SHA256
abb7829a5d9ab029fbe1fe40678281962ad1d0e0d81f308ac41419436ee40318

SHA512
24e4cf45d1ae67bb773b4ef06dc1dd625d06f4cc37a3e889d3622d98d6cd5d7af1d25573d67cb4bfc3bed8478a610fb13dfb9c82c44657a4251860edaf359aea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\18814

Filesize
10KB

MD5
dbc05723f40f5518e0f745b7d596f2d4

SHA1
2b8d3cc9e0cbde1c97b4fbf052c5b9309714323d

SHA256
cc4fdb1e956385a5c9c1df925b2a28cc3ce24746e5bec8473b8db321ddfb647f

SHA512
bf0a03b4d582d147baaa9c86013f00445ed185c85b04146da5a0cc4451e00f41e3d9316a70a7b00654ac52527921921c5cd746e0dbd78a70ad289401fa3b820e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\27272

Filesize
15KB

MD5
85c1c6e108b6e88f5429db229953f2a5

SHA1
9bd828eeccd60f89cf7f789b8302fbf8e357449a

SHA256
027ae15df6c18c8e3842b9d5b50cb54fadec209275fa1dcde340b04c00152688

SHA512
055981a011c487c78f01be17af55f7607278526638b48dd9656a67caf36628ed59c3e5b531979bf9fb711adb1d77de63a697aa1fe3726d7f7b69dbf4c8c77b6a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\30297

Filesize
10KB

MD5
0c5a389b9ac513b82d47c19e4a0fbeec

SHA1
a7126b7453f273c0f4c60923c22473216deb2546

SHA256
9e2da3f2e8a8b1d42d6022b90c8fc07b6c35430f3523317bb4da4c0dbb798493

SHA512
a6fdca8f4956c300da2397a02354925882f53d472576d78914b32552127d90648a68bc2037ebeadad395c1ed45d67e05515728189907ee9d6427a27caa1bc511

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\30734

Filesize
9KB

MD5
74c800e591c90880f783e4e137ba3dc5

SHA1
3ca4733b6a90720f6a411e7307c958005e580fd1

SHA256
49f1fe1c388294c2c8486eccee4d4af9293f28514fd67b2f0e5f3667b9bd4937

SHA512
7793983b7564e38e1a943262ab3a84766834acdaeb7ff6c5db298412b842ee610d7a752b1bdf680cee54733cd4685dec9c90f6dd814f7c947fc0cf132fd1f51a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\32423

Filesize
10KB

MD5
5d9c9b3786b57f0a234702c14b399075

SHA1
fad5f0942e12c88fbc4a9f8de4a4d9593bbc9971

SHA256
8abefff68c58c8438f3972b099f4cad12764f690e9a61e6b6452d0ce4c446487

SHA512
c3724edb320439d44daeb4ff6543cbb7aad02d0fbe6673ed0791f269c3843c169a4afc077d8deaa6174c5e9f0a07bbbecb2ee9316bc19705d617989772b77f53

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\6095

Filesize
17KB

MD5
52bb31aeccf3bd0a12c412d37dc3632b

SHA1
ae011140ab260875eb2ccaa6f391c454c90075ed

SHA256
bf460c35cd8d0d5cc4a5996b071b74e91973ad1ddac96f06182bed74479c7c66

SHA512
8cb9fef1d9b3c5bd12187c50a83a35707f9aab3313681e2ac8dd906f0c3f7f8d6728c6e3910ee72b36fdac411c732e75886294d38995bd2f6c301cc7e1f3ee40

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\821

Filesize
9KB

MD5
886230904ba2a9985a54673600dfc414

SHA1
0db94e40b18399d76aa9903fb72ae99c24653929

SHA256
ed48252e03705b3cda5d72a013ce9e925d8db61aa7aed860cec67bd4135746d2

SHA512
59657fb64777609e9ed770d45480c00df381c15d845d89991ee7c8b652b0dc64fd98ed0c5b2ab4727096e91708db4ac627cdf16c9eaccb8581044a7230c9a53d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\13CBCECD4FEB7EC3EC6B113E6E1ABCB3AF8D18CB

Filesize
172KB

MD5
5a651154f8ae6212b5a0d89157326807

SHA1
ee2c3592d058498d04d0692429185ef0b1cff449

SHA256
21b1f563ea5cbf15c3358e775be7a8bcef7fd4e2b4b979f26777f3bbcecb053e

SHA512
abde2cce7661bdaa427fa4a8b2b516fb52820127f492dd35625fcb31725ff9d7405b6134bf000957b619b10ad4c4e7fc0498cd6fb425e4eb657202526a13fa5b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\EA3ED6E170C77CE72595D618A02F5BD206B21F76

Filesize
16KB

MD5
add43342f498dc6953bee8d20f8a475e

SHA1
91009126285bb59461124277d1ad2a2b6674a31a

SHA256
95734579d6db470d71ae318dd54be9d927d98ecbef2f43349647c3319d4899b7

SHA512
2614865cbd10b37721469c99da9356d70d4fb47d2b0b64c9aedb6c1fe724170a6a1bd805867f49fb923ca00a2b4c9c7a5a611d61dfea5c3a422d418df3c1b565

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IVPIV.tmp\fdm_x64_setup.tmp

Filesize
2.5MB

MD5
b96349ffc7ad5fb0a58febf7c66e513a

SHA1
4d9311004fccca776eec25c6d05d8116fc248bc9

SHA256
5c446fa371a56437e7002e19b0de020a57a15d6cc33147f15d0e2a952088796c

SHA512
8bfcee786b088eaf46a77cc225515102b0ccc0f07b1b0bfa783b6bdab0f0167a7c2773e94f875e86b131ff68c07f307ca57a8285c013d2d64f83f61d4ff46f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IVPIV.tmp\fdm_x64_setup.tmp

Filesize
2.5MB

MD5
b96349ffc7ad5fb0a58febf7c66e513a

SHA1
4d9311004fccca776eec25c6d05d8116fc248bc9

SHA256
5c446fa371a56437e7002e19b0de020a57a15d6cc33147f15d0e2a952088796c

SHA512
8bfcee786b088eaf46a77cc225515102b0ccc0f07b1b0bfa783b6bdab0f0167a7c2773e94f875e86b131ff68c07f307ca57a8285c013d2d64f83f61d4ff46f90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
7KB

MD5
61d6edda12e30e689556d029ec6f34d8

SHA1
7d5d1042d9c018bd0b24e82fcfc9bfc7dca14058

SHA256
2332cdb3a7a6909a316b836890c56d4efd783cff34430253f261cf99311cba22

SHA512
86711e5e9faea43864aea90e47fb5c100dbc0163da7a8d56aee0c51a0a3c4f8d867524e73cf9ec43c9cdb2c1464dd5924bee196f42331f065bde20a1e22bebf0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
7KB

MD5
07bd2f78e11052bd6cba5c690fcb2032

SHA1
3653e50f3d324a62d05c5c18c68e4c6db5f04181

SHA256
8d6380e14aaf306ba885d67c0e6264ec787477822ec3f5f29bc01b586df5d560

SHA512
b208f6b138884f20a99e5d9a72190d8c4c5370e09d7f35b011c47b781b38664bf324bb33686e41968c03d7a23e91bec73e3d8305a7588ee62694170e6074a4fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
84237c89ee2798104ad2335333f8ad3a

SHA1
10543236a85952bc4828a3464c8fb5e179280ad6

SHA256
e9d284d2037ae7008d26851626ef7857474f6846fb7465c2066a4450723fbeb7

SHA512
a5fed02883331cf6b9afb1508f4f55f843bba89b02821a59c29d644a9cf02e814134baf6ce444698894e54aaeca6053b971ef35f1fba62cf176cf7bff6b94b3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
b281927008b5e2d68163567cfbec3edd

SHA1
c5cd3e44c42c98ab74b7b0f20c3dd34fa1395208

SHA256
735efca1b82504c2b1aa0ec3713e684830174da99fac84ff19cfa076189d5f83

SHA512
bd476db895c48ac856575b24744abb0ab88f690e3d410f40e850954ce4625d150d71fceb98b4ac17b7cb6162e78d97f074aa292c3ba52ffc4817532d08c818e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs.js

Filesize
6KB

MD5
f73e52d124620d05267ba934f3b312d3

SHA1
34121aa291d9f88b3e8e3a2fa37cb1c06cac2d30

SHA256
fc898a91ae8ce9d241c586f5dee2e60450dcdc5a31f1a7015d6dc2f4fefe4ac7

SHA512
4ef67626a2ba584817d707c71ddf7e7ce75a780921c3fcdfa8a03de0de9303c4b548ce3c3b493f1c4876d511271978bcd3cdbc2d1003b23c2459847180045d46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
5396ae6c218ef16c05073036395f8b7e

SHA1
64fb38f7441c7b7b84dae5b25619397e1985ec41

SHA256
86526155349a6b0ebaf54ea69637cabde68bafaccbe20428a07c41610367f9b1

SHA512
6a912edeaa71930de24cfe47843c7b017844af4c684cc9ed39dd2a59cf8b8d9edf373f007367e6434b6d7ab1921b57e4821053c62e03e0d9b9d73591403da90e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
54495fda483fc50715ceca065e2ee6c1

SHA1
de7265daed0261f8e4c12b97b79fef2926363177

SHA256
7f8abf376409055b8115f4a335fd657b4c4cb869c11a65242935334fc49865fe

SHA512
4fe542219f04f9b492e9e6acd98d50cf3a2e97f6882a0e8e65214a5805cc632fbe495a3f7f2ceadae7750312c9ef250c35004a6fb14ea795e9e682a89e099378

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\default\https+++www.virustotal.com\cache\morgue\248\{1e06b0ab-9d43-4b7d-b87c-23a9275e6cf8}.final

Filesize
41KB

MD5
77af6c0c75b16977728d8ca6c748e43f

SHA1
047826503a9523c6244430593d92e7f7f6caf366

SHA256
5c9e589d46b6b4f0d5d0bc2b3653b77a1bc5a82d30589cbcb0542fe0970d3b02

SHA512
04bc4f17d3e8d9f8cbeb7912936e2a9455ad88cdbee3b42e1f0286fe0fad3a445246f49a7886ed6a37f743ed4069b82348d102f3d4de4d38f1ac8c45163d0822

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\2171031483YattIedMb.sqlite

Filesize
48KB

MD5
9c928539beb6b7e4209bbf74e6c152ca

SHA1
0a3f0084d45c666ae632fbf1201b9010bf386408

SHA256
84ab0d6e0297f2c6055cef916d9c751cd812192f415d37c0f175d443a1abf8c5

SHA512
aad9675d21fe886aeaa7da0763195c169b2732bb8cd315c41b5e93d1aac757c8fd644c7807e58be418aea95365926a456e34f439989f00b2c4163bd87921f29f

Download Submit
C:\Users\Admin\Downloads\fdm_x64_setup.8MdJpiYE.exe.part

Filesize
34.2MB

MD5
aa5ca03d7cda9f8b7b6466ff18075ac3

SHA1
eb4e2144198dd56ba12199357a5ebcae884048d0

SHA256
1338b9e17a93713f381de59f57d1898706131521b482fa1b05a938866838e973

SHA512
da405fb58c3d67f7b6806b3c85ac1fd07e2cc2219013c567dd4f87f9f07e572b683a6c4ba487b694edcb45819ebbc9dd0f6fae4d6d99d2200671eab5612b8135

Download Submit
C:\Users\Admin\Downloads\fdm_x64_setup.exe

Filesize
25.4MB

MD5
d4b31fdcb2542f1259b2a0faf0d38140

SHA1
3507b3ec21c348c1dda2b9cddaf2f427913a7718

SHA256
e814d72365fbd3b36ae3789cf828e8369992c6acfa024f93876e9b248ca90e2d

SHA512
0ddd9709577129e8d4fc37f0264568e049bb6e569a1b375ec0e23f4d4e090a7c6df92248199aa9773c106cad9ccdb3bd3702dd244d8176f6ceb5ca5b5c4f04e9

Download Submit
C:\Users\Admin\Downloads\fdm_x64_setup.exe

Filesize
25.4MB

MD5
fb39420bfcaeaa4ec74a13e97134f754

SHA1
7c933060ee84cbc39c283a99dd052a3e94583280

SHA256
6517331de5a58e987506f4d2528ff9e808275fcdb223fb3b8fbbb7e59059b82a

SHA512
bdc3d3659789c06094e0d53a2263cb2b5772bb3e3593e09de8eafe78e419333bebf8616ce18cc436a0d58473628919aed756efd6f9ee92efb4c6c58ac3ba704a

Download Submit
memory/1428-2288-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4380-2261-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download