f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8

Resubmissions

08-06-2023 16:45

230608-t9fe5ahf9x 7

08-06-2023 10:12

230608-l8wfysea72 7

Analysis

max time kernel
117s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Popup.exe
Size

373KB
MD5

9c3e9e30d51489a891513e8a14d931e4
SHA1

4e5a5898389eef8f464dee04a74f3b5c217b7176
SHA256

f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8
SHA512

bf45677b7dd6c67ad350ec6ecad5bc3f04dea179fae0ff0a695c69f7de919476dd7a69c25b04c8530a35119e4933f4a8c327ed6dcef892b1114dfd7e494a19a7
SSDEEP

6144:yN6MLNACl/+9EhE/jIxlOaNpA7tRzXBWRiB6nlbKsgP5o24a4pF0ghqbjY:Kh29IEUxhiHWRIglbKsgRokTghf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 64 IoCs

Processes:

Popup.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000090000000	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\IconSize = "48"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlgLegacy\{3F98A740-839C-4AF7-8C36-5BADFB33D5FD}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\LogicalViewMode = "1"	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlgLegacy\TV_FolderType = "{3F98A740-839C-4AF7-8C36-5BADFB33D5FD}"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\1	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlgLegacy\{3F98A740-839C-4AF7-8C36-5BADFB33D5FD}\FFlags = "1092616257"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\GroupByKey:PID = "0"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\FFlags = "1"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlgLegacy	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Popup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1 = 0a050000da0481191410b004200000000060000000000000000000000000000000000000000000000000000100002900000031535053f4767d7a30b6d74b95ff37cc51a975c90d000000020000000001000000000000002d00000031535053901c6949177e1a10a91c08002b2ecda91100000003000000000300000000000000000000005401000031535053a66a63283d95d211b5d600c04fd918d0110000001900000000130000007f018070cd000000200000000011100000bc00000014001f50e04fd020ea3a6910a2d808002b30309d3a002e801cffcda87848be43b5fdf8091c1c60d0260001002600efbe1100000060ac268a6d45d9010b39d4ee7345d9010b39d4ee7345d90114006c00310000000000545611aa10004f4e454e4f547e310000540009000400efbe545611aac856b6852e0000002527020000000100000000000000000000000000000035a4b2004f006e0065004e006f007400650020004e006f007400650062006f006f006b007300000018000000250000000b000000001f0000000a0000004400690072006500630074006f007200790000003500000018000000001f000000120000004f006e0065004e006f007400650020004e006f007400650062006f006f006b0073000000000000003100000031535053b1166d44ad8d7048a748402ea43d788c15000000640000000015000000d092510e817070ff000000009c0000003153505330f125b7ef471a10a5f102608c9eebac2900000004000000001f0000000c000000460069006c006500200066006f006c006400650072000000350000000a000000001f000000120000004f006e0065004e006f007400650020004e006f007400650062006f006f006b00730000000d0000000c0000000001000000150000000e0000000040000000cbc04c9b7045d90100000000300100003153505340e83e1e2bbc6c4782372acd1a839b2211000000140000000003000000010000002500000003000000001f100000010000000700000066006f006c00640065007200000000007500000011000000001f000000310000007b00310036003800350044003400410042002d0041003500310042002d0034004100460031002d0041003400450035002d004300450045003800370030003000320034003300310044007d002e004d006500720067006500200041006e007900000000006900000008000000001f0000002b00000043003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c004f006e0065004e006f007400650020004e006f007400650062006f006f006b00730000000000000000008600000031535053aadb6f004f861c4da8e8e62772e454fe1100000003000000000300000000000000110000000d00000000130000004d018070110000000900000000130000001400000011000000050000000013000000000000001100000002000000000300000009000000150000000800000000150000000100000014000000000000002900000031535053fcb3b4b9512b424ab5d8324146afcf250d000000080000000001000000000000002d00000031535053c0e85bcf6c23d34abacecd608a2748d71100000064000000000b000000ffff00000000000029000000315350533c0af1e4e6495d408288a23bd4eeaa6c0d000000640000000001000000000000000000000000002a0000001900efbe40a7983f9c83f74a8c365badfb33d5fd8207ba827a5b6945b5d7ec83085f08cce0040000	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\MRUListEx = ffffffff	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlgLegacy\{3F98A740-839C-4AF7-8C36-5BADFB33D5FD}\GroupView = "0"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Pictures"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "5"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "3"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:PID = "0"	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlgLegacy	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\MRUListEx = 00000000ffffffff	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\1 = 22050000f20481191410c804200000000060000000000000000000000000000000000000000000000000000100002900000031535053f4767d7a30b6d74b95ff37cc51a975c90d000000020000000001000000000000002d00000031535053901c6949177e1a10a91c08002b2ecda9110000000300000000030000000000000000000000a801000031535053a66a63283d95d211b5d600c04fd918d0110000001900000000130000007f0180702d0100002000000000111000001c01000014001f50e04fd020ea3a6910a2d808002b30309d3a002e801cffcda87848be43b5fdf8091c1c60d0260001002600efbe1100000060ac268a6d45d9010b39d4ee7345d9010b39d4ee7345d90114006c00310000000000545611aa10004f4e454e4f547e310000540009000400efbe545611aac856b6852e0000002527020000000100000000000000000000000000000035a4b2004f006e0065004e006f007400650020004e006f007400650062006f006f006b007300000018006000310000000000545612aa10004d594e4f54457e310000480009000400efbe545611aac856b6852e00000026270200000001000000000000000000000000000000c31d6b004d00790020004e006f007400650062006f006f006b00000018000000250000000b000000001f0000000a0000004400690072006500630074006f007200790000002900000018000000001f0000000c0000004d00790020004e006f007400650062006f006f006b000000000000003100000031535053b1166d44ad8d7048a748402ea43d788c150000006400000000150000003b93df91e7a4b39400000000900000003153505330f125b7ef471a10a5f102608c9eebac2900000004000000001f0000000c000000460069006c006500200066006f006c006400650072000000290000000a000000001f0000000c0000004d00790020004e006f007400650062006f006f006b0000000d0000000c0000000001000000150000000e00000000400000003d74c59c7045d90100000000480100003153505340e83e1e2bbc6c4782372acd1a839b2211000000140000000003000000010000002500000003000000001f100000010000000700000066006f006c00640065007200000000007500000011000000001f000000310000007b00310036003800350044003400410042002d0041003500310042002d0034004100460031002d0041003400450035002d004300450045003800370030003000320034003300310044007d002e004d006500720067006500200041006e007900000000008100000008000000001f0000003700000043003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c004f006e0065004e006f007400650020004e006f007400650062006f006f006b0073005c004d00790020004e006f007400650062006f006f006b0000000000000000003e00000031535053aadb6f004f861c4da8e8e62772e454fe110000000b000000000300000003000000110000000d00000000130000006f018070000000002900000031535053fcb3b4b9512b424ab5d8324146afcf250d000000080000000001000000000000002d00000031535053c0e85bcf6c23d34abacecd608a2748d71100000064000000000b000000ffff00000000000029000000315350533c0af1e4e6495d408288a23bd4eeaa6c0d000000640000000001000000000000000000000000002a0000001900efbe40a7983f9c83f74a8c365badfb33d5fd8207ba827a5b6945b5d7ec83085f08ccf8040000	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{3F98A740-839C-4AF7-8C36-5BADFB33D5FD}\GroupByKey:PID = "0"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\NodeSlot = "10"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe1100000060ac268a6d45d9012fd207f67345d9012fd207f67345d90114000000	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 0100000000000000ffffffff	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\1\MRUListEx = ffffffff	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{3F98A740-839C-4AF7-8C36-5BADFB33D5FD}\IconSize = "16"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0 = 22050000f20481191410c804200000000060000000000000000000000000000000000000000000000000000100002900000031535053f4767d7a30b6d74b95ff37cc51a975c90d000000020000000001000000000000002d00000031535053901c6949177e1a10a91c08002b2ecda9110000000300000000030000000000000000000000a801000031535053a66a63283d95d211b5d600c04fd918d0110000001900000000130000007f0180702d0100002000000000111000001c01000014001f50e04fd020ea3a6910a2d808002b30309d3a002e801cffcda87848be43b5fdf8091c1c60d0260001002600efbe1100000060ac268a6d45d9010b39d4ee7345d9010b39d4ee7345d90114006c00310000000000545611aa10004f4e454e4f547e310000540009000400efbe545611aac856b6852e0000002527020000000100000000000000000000000000000035a4b2004f006e0065004e006f007400650020004e006f007400650062006f006f006b007300000018006000310000000000545612aa10004d594e4f54457e310000480009000400efbe545611aac856b6852e00000026270200000001000000000000000000000000000000c31d6b004d00790020004e006f007400650062006f006f006b00000018000000250000000b000000001f0000000a0000004400690072006500630074006f007200790000002900000018000000001f0000000c0000004d00790020004e006f007400650062006f006f006b000000000000003100000031535053b1166d44ad8d7048a748402ea43d788c150000006400000000150000003b93df91e7a4b39400000000900000003153505330f125b7ef471a10a5f102608c9eebac2900000004000000001f0000000c000000460069006c006500200066006f006c006400650072000000290000000a000000001f0000000c0000004d00790020004e006f007400650062006f006f006b0000000d0000000c0000000001000000150000000e00000000400000003d74c59c7045d90100000000480100003153505340e83e1e2bbc6c4782372acd1a839b2211000000140000000003000000010000002500000003000000001f100000010000000700000066006f006c00640065007200000000007500000011000000001f000000310000007b00310036003800350044003400410042002d0041003500310042002d0034004100460031002d0041003400450035002d004300450045003800370030003000320034003300310044007d002e004d006500720067006500200041006e007900000000008100000008000000001f0000003700000043003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c004f006e0065004e006f007400650020004e006f007400650062006f006f006b0073005c004d00790020004e006f007400650062006f006f006b0000000000000000003e00000031535053aadb6f004f861c4da8e8e62772e454fe110000000b000000000300000003000000110000000d00000000130000006f018070000000002900000031535053fcb3b4b9512b424ab5d8324146afcf250d000000080000000001000000000000002d00000031535053c0e85bcf6c23d34abacecd608a2748d71100000064000000000b000000ffff00000000000029000000315350533c0af1e4e6495d408288a23bd4eeaa6c0d000000640000000001000000000000000000000000002a0000000000efbe40a7983f9c83f74a8c365badfb33d5fd8207ba827a5b6945b5d7ec83085f08ccf8040000	Popup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Popup.exe

pid process

2248 Popup.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 1868 firefox.exe
Token: SeDebugPrivilege 1868 firefox.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

1868 firefox.exe
1868 firefox.exe
1868 firefox.exe
1868 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1868 firefox.exe
1868 firefox.exe
1868 firefox.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Popup.exefirefox.exe

pid process

2248 Popup.exe
1868 firefox.exe

pid	process
2248	Popup.exe

description	pid	process
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	1868	firefox.exe

pid	process
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe

pid	process
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe

pid	process
2248	Popup.exe
1868	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 4628 wrote to memory of 1868	4628	firefox.exe	firefox.exe
PID 1868 wrote to memory of 384	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 384	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1760	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1440	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1440	1868	firefox.exe	firefox.exe
PID 1868 wrote to memory of 1440	1868	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Popup.exe
"C:\Users\Admin\AppData\Local\Temp\Popup.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2248

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:760

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2116

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.0.1509523994\868027402" -parentBuildID 20221007134813 -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 20812 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b65fb119-4d85-4ace-8446-bec4fa1c2392} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 1900 1823397f858 gpu
3⤵
PID:384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.1.2104127885\1170028075" -parentBuildID 20221007134813 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 20848 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcec6bb6-0483-4239-882f-b222690ec99b} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 2300 18225972e58 socket
3⤵
PID:1760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.2.284540567\240694647" -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3108 -prefsLen 20931 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87e9aebc-2336-45a0-b0e9-063a74dbbc39} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 3120 182365cda58 tab
3⤵
PID:1440

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.3.1252513671\295238254" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3472 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a0314e6-1861-4de5-99a0-3cb5e32144b7} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 1440 1822592e158 tab
3⤵
PID:3804

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.4.1051025098\1106431637" -childID 3 -isForBrowser -prefsHandle 3972 -prefMapHandle 3968 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {010db754-d31d-4d36-a669-01738424f2e3} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 3984 1823775d258 tab
3⤵
PID:4824

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.6.107235390\1832688317" -childID 5 -isForBrowser -prefsHandle 4920 -prefMapHandle 4924 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a95ec689-63da-4fdd-b734-843f38f8c0c4} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5024 18238a06558 tab
3⤵
PID:5000

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.7.1662666485\1069342862" -childID 6 -isForBrowser -prefsHandle 5392 -prefMapHandle 5016 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {019c2d92-2d45-4888-b201-5231b152fda9} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5232 18238a08958 tab
3⤵
PID:4224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.5.1361337700\2051151744" -childID 4 -isForBrowser -prefsHandle 4648 -prefMapHandle 4832 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3490311a-5b5e-44a8-be07-1d799a95255d} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5008 18235279e58 tab
3⤵
PID:4720

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.8.180253436\913839382" -childID 7 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4fabcdb-f8fe-4499-8721-92ac90dd3271} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5552 1823919c658 tab
3⤵
PID:1324

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.9.398967445\511514059" -childID 8 -isForBrowser -prefsHandle 5912 -prefMapHandle 6000 -prefsLen 26517 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e148855-697c-4cc6-9852-7a2d7d1a449a} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5988 18239e51258 tab
3⤵
PID:5344

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.10.1243996169\1458815025" -childID 9 -isForBrowser -prefsHandle 3764 -prefMapHandle 4396 -prefsLen 26692 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99c0693d-111c-4f3b-b586-62f969ab61e1} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 6388 1822592e158 tab
3⤵
PID:5948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.11.882937408\1141846725" -childID 10 -isForBrowser -prefsHandle 3592 -prefMapHandle 3596 -prefsLen 26692 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d2233e8-d1dc-486a-b01b-2a093f9740ec} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 6492 18225969658 tab
3⤵
PID:5964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.12.296834883\405187735" -childID 11 -isForBrowser -prefsHandle 9616 -prefMapHandle 9620 -prefsLen 26692 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0831f825-0ace-416c-86b1-dc21478280b4} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 9608 1823654fe58 tab
3⤵
PID:5564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.13.1849386188\1180657350" -childID 12 -isForBrowser -prefsHandle 9592 -prefMapHandle 9580 -prefsLen 26692 -prefMapSize 232645 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a0f6400-c351-4b77-acc6-4cdb82f77030} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 10248 1823b940d58 tab
3⤵
PID:5516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
28KB

MD5
df0c738da0232e00d3f766efff2b3fa7

SHA1
5f0973d25023e8e516ff09a2c9ae4d6fcfccdb5a

SHA256
f8166938557596280d497f890d721671b2ed0366e33757169b659a473cddb517

SHA512
f13f8e13580b262b660e2dd57fa5ac9e6286b5a16eba8b2b9eac0df6d27b8035c1fad9f6147ec46968acb4691175f45f4d1c70873380ca72d3001d3a372a06c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\activity-stream.discovery_stream.json.tmp
Filesize
141KB

MD5
6d1a82d56cd27f0a1d12e32636e16e44

SHA1
0b29291cd0c8d4812ed254f1c4e1fdd5556c59af

SHA256
f6be2dc52b3f81c08fd11f6717c425133af06028518dd67023d4e0a2e24c01f6

SHA512
0006bf2ca737ce8e910843af5d4210f861084a2dadd2dc6ef05e8ca3415c59ce19e20f79aea9734deceebbaa6e06322c6e796d919a6f83de0ddf455e5d198dee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\14745
Filesize
43KB

MD5
b0d3017f65a07d572be45fb9ec728ebd

SHA1
f17ab411fc41faf60a2dad03935450d53807bc06

SHA256
7732acad5d8d72e96622853c7891da22bf265c33f22ea767d3eb15adb964c24e

SHA512
e98853afd33a6f421f48c0972254b0a08ec3bc77b549c3cd9d27f4d1b9053f344338c139d79f83e00c7cdff6dd63d1db6a6a8d0406a08d170bcb3850b4485baa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\15070
Filesize
11KB

MD5
1640ef1e165719da890183fc91b5b8e6

SHA1
4536cc28959563bc1d85bdc4884b4563cbbf7ff8

SHA256
3756e091c1f567663065b82234b2433477937ba41ca619cb8d0fbab855d1eeb0

SHA512
04b06e9ae27d4a5de510b175ec4e571fa05d9815e1690372a5a506b9f4c856827febd460b078dbe8f62cbddd4be2a04ef4e713b323f3b1dda1c46fe9fdb6119e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\1561
Filesize
11KB

MD5
3abb76e6bc70fc08ab64a3cae10ef877

SHA1
d67d3322187c5b48c631ce11aeb6e01dfb4e6888

SHA256
05455a17d0f55d78b3d6d116f5fb8751a56b24b8bedcb21c855e0d100ae0a800

SHA512
f39bdd8c9aa1d859a8e7883debbe384809d66ff01f6f660b06161d5747fe676b047450e697f3c03b94dcfbc678af13eb2b60e45c29a23d81821f74917bddec90

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\18012
Filesize
8KB

MD5
0f39a40d5b963e13422365bf6b485c4c

SHA1
dca08af9281f97bd136981d7015e06165ccabe05

SHA256
660c874f86f7c5639a7f3229cb829d8b14f27eee2cf20ca296a6390481f61477

SHA512
3a879ed5ef27441fc998d087b70166b8f2a5c627d9da524ae7efc510b8f12a71d740c763ef7fd33dd816f11634852a75d6721b15ca9c3a71fc032e803ad120e2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\22438
Filesize
20KB

MD5
7cb106adfaca164cbe8ab5afb31ffdd4

SHA1
32d6273ce457851a0208a55e888bb7bc22d0e320

SHA256
ec2c793bb34f9cacc5248459bc1e49a527cc60f1a3beed7cca8c56774833fd4d

SHA512
e528db8a7eaf7f5a44881eaffd576d31fa437284bb25b564a16da57969a2e29145266954598fd37ea0e82eae1ed49a65bab692627313c177480ab04bd5906f08

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\31231
Filesize
20KB

MD5
2cfe82253a0db574276e6289d432c66c

SHA1
a3bea82492e55e17c872b17865b7ec8484c7a90d

SHA256
71616c5e93df17e285a916285eb1206dc8fe82fb75b2ce9b93d276638cec0932

SHA512
1e4d1419af4a00196345da8e0e322a1c4d8fce0db1673b1d2d688bfa586de69504ce7b18954ebd68852e7fe28baa7b848d5467ec717098510533375db2a11b4e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\0E0FB333D3ECD60AD61E39793806574934924DD7
Filesize
64KB

MD5
57ef27333c3ac85e8b96831dce401584

SHA1
00f5063a4fa1d72fcfbaed6663dd77b3515034e5

SHA256
d744ec73bb64f70f8441441a8925c996a791c5f0513543c791adbef83b762f1d

SHA512
49c521ecb64cc4e9132a4314cd26c5ac7b7912a02b01209b6a20ba30f465a597b694f99ab0e738f31cb7b441766b4883480b09638d07a9ff0be9f13634c97fea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\18D4EAEA3700BF2DA39E45F076F951DC9232160B
Filesize
22KB

MD5
217bb9e452b14fc55920aedae37537f1

SHA1
3fc30896b6b1a4e656ec4fdb737620ede9f1a4cd

SHA256
012fc14e77053579c5ebd6dc1a4a690a3d1bf6a4acb423f641320a55db31a652

SHA512
b2a41b5ccfbcb901fefd71f4612263072ae31fe9087bad9a5ab8e3484283cd08b49a6ac85f983a8947108568ca3d0817dd1919e0b316bb28ef25cb03c516784c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\77A29284A02A1F6C121956CCBA865A1FCA2550D3
Filesize
18KB

MD5
0a4216f09691acee2c6cdaa1cd738c34

SHA1
b175b2db81f776d0f8e23dd71646cf5c89111a09

SHA256
da98aac74cc7425c939c9783f27dacfe174d2852c36ebcbcdf3cffd35fca5cf9

SHA512
2fa817b20644764d8aa764ebd4e8e24c3e776c02b21992384092418d0c53a36573f184241267e2e1c378b199fd0e83b6a09dc8770233bbe4d64b609261c37626

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\A1981C78E204DDDEC51262E310A26C39767B4FB3
Filesize
17KB

MD5
b502e18fdf835c901324769bfbcd9cc8

SHA1
40f8be8584802cac6496be334e02bc90bf3c9620

SHA256
ebec47ff370c273fe01423911f84fe2f4b0ad3a372192439131f53bb8c1a21d6

SHA512
41aedd6a480f6e8898ea4025928c1f808b9837905e44d92df2d975211340fadb18f7860532b05a7000b972ee0afdf430e26e4df59b0efb14595668d5918d6c32

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\B6F3B34B07469CF75F84DE79DFC7D41D78660571
Filesize
13KB

MD5
aec051595c9d11c0fd68f4aa276d8a85

SHA1
49202a967323d725c73bbf19be079d156b224ca3

SHA256
a5df1923e778a69e201f442294b1cc30a8d15db4bb737a7dac6e136d56426a83

SHA512
62d7d845fa5f85b918c0ac8e109fbdee9d1b3ea28f00e0df5170b7b9f8920dbf51378f61bc1321ddbd2e0cf55498f13ea3242f8742c638390f245c81c022e258

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\D074D5982B9868725109ADC67ECC364679FF02B6
Filesize
14KB

MD5
5f28f241ebb55cb36be2eae6e90ce730

SHA1
323d9211f6171c8e46cba19f55686cf45943de9e

SHA256
3bff5e67ab0115264b3953c98e4dccf6b1dbca1729e2cfb8e45c20a1608a9341

SHA512
83f6dba7db04b7ea41a118dccc8a18202654b6bef9ad7d0e6f5a1b797b7aab8956a1f1b312080fad25c3dc49c554959555b556db55081603179415c9a3ebf0e8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\F6E23FD615A32C99105C06DC40EB0B1701D8BB75
Filesize
101KB

MD5
863eeaeed6aca3a402dab1d3d20ac58d

SHA1
e59d1bedf3ac8993fa23d6e122dcfed38f45946e

SHA256
ec8c5ec0cbbd75048e16fa30de09760f25474fc6478e2a7231cbd7b4f53c6431

SHA512
9748a52cfacf35f4e98413b7cdf71682def634a16ebcee5627bcc0b495ef092f73f1c2fd1bbcad1c5b638dbfcbc3f62223c65a36507bdf2ca9c83f60a8f481fa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\thumbnails\eaf6212fba3666d8dead4c8003c0eaea.png
Filesize
25KB

MD5
40e4246ee16733b270c3969ac3a014bb

SHA1
974b1840d363c52257da8f78590556af74fbdcdb

SHA256
59cdb50ab9b27cc2b9f5bbe95e082430380248d15c029bfc338ce584fbee315e

SHA512
33839621e42b80fb7e4b06b374160a4e2855b387d63a1909db079eb75c57fcfffd03bc43ab3ac449327361181ecc2a42b16e143ad9c0f8bf28e04a417e7d50bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
Filesize
2KB

MD5
baaedd9d22d0bf67f034fb1c560e5733

SHA1
da749ab46f892891d10954a5ec659c7163e42d4b

SHA256
06a0f9820d0627eb5dae8cf09b660c1b6f1ccbd16501761148d69bcbbfc97f22

SHA512
e920b3b5dd9dcf2012c1ab8e8ee56c97c34f0e1c870a2c9d7d4d68aa91409a8b18f00a4410410571ccba998c15a3675d3c2e22648bb6acc808bb8ae3d73a08be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
Filesize
2KB

MD5
f7e2bffece2a657e11d96e5c547535f6

SHA1
8275efd45a1c4153d1b141162ac4c87352328bb3

SHA256
62bf0cf4feed1d5909ebc77a3201adcb003a5a2beeecbcffd5f24b803d6cb4bf

SHA512
677305bd737549aaefcce9ba9d635f4126adef3d4a9f639e27eca13865771b9c3aa17077b20ba5694d9c8cb1d0bfe1fb930840ba952f8ec32d18444606950273

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
Filesize
2KB

MD5
3ab64af1c81e24de53f738991a8498f0

SHA1
01429676477689d3cf036da28040bf02fafab6fc

SHA256
a9edbb45ead9a706d613452f9cf82dde7aeec8c7a9dd1da4b9af9f01fc06d176

SHA512
daa761e7863b17f5802d757ee05d63439284c350c0b2c16267912b75da672660e6606fb2ba5f44df4bd912ee322812350516f7881db05f0240af888d094d04d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
9212884f91ca9bf1bf4fe746ca2cd697

SHA1
7bfa1565030f513af6c4611926c41f966b93b2fe

SHA256
b425521941a1d2a26c0a68ed75eda3ca6fd3fa6a7a3b24d4a47fddc0c61bdc1a

SHA512
b9f14a1de5c4ba010a0a04c4e116ae74cf830324a838e884d42430fe3c8726f79226f138e6a40d9af7e89c0ef59d55874e1375b4d931d0d4029854f166c9f585

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
b1eaac3fd2abccf8cfec2d54d0bea15e

SHA1
a81bc96a99f715180213e7a0a28e49f6eac9d40d

SHA256
048824a502a8bebda492b553e694af3eb1c08f61f83b754d2630148182643a1e

SHA512
a734a55a52c4836a8e54b182969d4c9e0f9d955f2bec6856f21780d986b4b2c0a8c074c54e4c867edfe64d35d57a86dfbb1a78272643edf9735720901fc9b899

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
ce5c68962288a23af9e85b57c8696ef1

SHA1
6528f2931a555d09d51cb2d18736c29bfee4f0e4

SHA256
6251858e1c020585190ecf8931c0a23b83e890cf756778eb7c99241bfab8279a

SHA512
86d020e3453ba4e5e327e8d83fe611d9aad692d226c2900a986f5f1932da5fb7d4b2cbc1ffb1cedc18d6694bdef7be83918b437bf38700eb5f7bba715866edda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
ab577d9fd36c7ad69ecd2f72b4eff043

SHA1
46d2275fe0a02a47448164a08e6470ce6db3d955

SHA256
d021e8e074b9358ceeb7a7a853625e8778974900b166a56e8c03aa7d73c25f22

SHA512
6d9370a8011b1146c343ab7baa7447c5d74f8d2097368dfb56b486d615b49666877c4878f076b78be0a196c67119be650b9b3b9ba5a8ae8c282164d8b413db98

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js
Filesize
6KB

MD5
b4ed3d1ac1ec04aa9c4eac7b6c984187

SHA1
93d0879a23e1c2610fb55a434f6e5706a992181f

SHA256
8b63350d31167588e0ac8a3bcabc048e30fbe7fb3d8bbea3d04c89f530ba72c2

SHA512
5ba806d80e8fe6270f7194f1ab0b1bde8b1572a851584a6515796cec784f1837da68b699f2863cc05f87eff14f327840cc7b64c239e1a37c7911f2c5350c21bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs.js
Filesize
6KB

MD5
9971fa8fa89a208685d3e30835832fb5

SHA1
5d9972a3bdbd4c18b3648597d2fd9f9fd6e30300

SHA256
13417a67a65fecc73ad5acc94d17d8a6fac3b0a343daf12d1cd2d126b9198084

SHA512
02b107e0d9449fa2d4d3655a880fbdeea4477205fa6c21aaf641c3d358353aa437cf040ec842107f973253bef767e48b9a0267dea5ed2d331aa192ef540e3b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
fa581e59266e8377cb551ae443699376

SHA1
88e00572eeb53425eec8bc471cdb3b15a0ed0c89

SHA256
bd79cd9a2fb3d764a0e7333dfa78a17bc2157f0996cc55bc84d4b2978a540622

SHA512
c078e1cef1838e13e660789872dd7d99df40933c10498be3a23fed355c58677509bba11f67f52f9e3712095bc8cd491a7e8c9b4f99eb114011d8445e545e3fd7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
20f4243fc0b782f7cae3498d277af6d2

SHA1
2d1f5cd9166f20bb03664fdfe074a587790f8813

SHA256
62a444e739a74b9b0074c2333717933632381572df30950936830c0bd45bebc6

SHA512
c213458685536f32609d01b8c4ebf193d12f0ff2834f654860de9c16fda4491dce171a074c3d1ae243e3b2464c41b1c3b705686fcda2407e974e1b3967bec231

Download Submit
memory/2248-133-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/2248-358-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2248-184-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2248-183-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2248-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2248-135-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/2248-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download