agenttesla | hxxps://atelierzolotas[.]com/work/83461806[.]img

Analysis

max time kernel
236s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2023, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://atelierzolotas.com/work/83461806.img

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.atelierzolotas.gr
Port:
21
Username:
[email protected]
Password:
alibaba.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msedge.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
126	api.ipify.org
119	api.ipify.org
120	api.ipify.org
125	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3464 set thread context of 3960	3464	83461806.exe	123
PID 4696 set thread context of 3712	4696	83461806.exe	129

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4612	3960	WerFault.exe	123
4484	3712	WerFault.exe	129

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
2772	msedge.exe
2772	msedge.exe
4232	identity_helper.exe
4232	identity_helper.exe
556	msedge.exe
556	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
3464	83461806.exe
3464	83461806.exe
3464	83461806.exe
3464	83461806.exe
3960	RegSvcs.exe
3960	RegSvcs.exe
3712	RegSvcs.exe
3712	RegSvcs.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2772	msedge.exe
Token: SeManageVolumePrivilege	2772	msedge.exe
Token: SeDebugPrivilege	3464	83461806.exe
Token: SeDebugPrivilege	3960	RegSvcs.exe
Token: SeDebugPrivilege	3712	RegSvcs.exe
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2100	taskmgr.exe
Token: SeSystemProfilePrivilege	2100	taskmgr.exe
Token: SeCreateGlobalPrivilege	2100	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe
2100	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4312	2772	msedge.exe	66
PID 2772 wrote to memory of 4312	2772	msedge.exe	66
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 4976	2772	msedge.exe	88
PID 2772 wrote to memory of 5064	2772	msedge.exe	87
PID 2772 wrote to memory of 5064	2772	msedge.exe	87
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89
PID 2772 wrote to memory of 2496	2772	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://atelierzolotas.com/work/83461806.img
1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8371546f8,0x7ff837154708,0x7ff837154718
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4048 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,8824191259715128654,8795015653992083234,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

\??\E:\83461806.exe
"E:\83461806.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 2008
    3⤵
    - Program crash
    PID:4612

\??\E:\83461806.exe
"E:\83461806.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 1972
    3⤵
    - Program crash
    PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3960 -ip 3960
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3712 -ip 3712
1⤵
PID:4876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3352
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.0.1148212511\1294943225" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1872 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ece9b15-b82e-4b00-990d-eebe85b72c4b} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 1976 219afbd4a58 gpu
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.1.1069025468\981828375" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eabf9897-ad23-402c-8036-fc94a57490e0} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 2376 219af330e58 socket
    3⤵
    - Checks processor information in registry
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.2.2086478722\1863807250" -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 3196 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f266d50-4766-4c45-a9b7-307143779468} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 3272 219b38b9658 tab
    3⤵
    PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.3.926466124\909261234" -childID 2 -isForBrowser -prefsHandle 3116 -prefMapHandle 3140 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c0ddd87-5dcd-4dcf-a525-0d9cd86a4a3a} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 3740 219b2079558 tab
    3⤵
    PID:1688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.4.268314132\306440617" -childID 3 -isForBrowser -prefsHandle 4060 -prefMapHandle 4056 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c11b23b0-6315-49f2-8bcd-5479ad5fefd3} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 4068 219b4b9a558 tab
    3⤵
    PID:824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.6.1423109767\167006360" -childID 5 -isForBrowser -prefsHandle 5104 -prefMapHandle 5108 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15a76485-496d-49c3-b686-3ee18ffb9bfd} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 5092 219a2f6dc58 tab
    3⤵
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.5.465971099\1828752789" -childID 4 -isForBrowser -prefsHandle 3124 -prefMapHandle 4672 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83e4eeb6-5868-4d00-a77b-d300b8081606} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 3924 219a2f68458 tab
    3⤵
    PID:3228

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\83461806.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
c0cabb0a02a394e27908c73ab32956d5

SHA1
cbde19c24cd43eea7aaed33863c74b065c896a85

SHA256
7e526210bac6edd5a2aded34c2ad73c498dc13fc2f805bcc2d9bd9d180a40a14

SHA512
a6d845f432707fb9e9fb2439d683a137d200bcb682846239e7c93ef38760fb791d38ea2c95e22b29321188ae80fb2c602138e062b2fad7103bf965dd4a92ae26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
c52e4c475ce0d3d098b9ac7558f35360

SHA1
3800376490e21d6295aa1ed2c62d198d81e21447

SHA256
8e4ecec158f6b1078957bab96369ee095b068bd7d8447678b7fc44ea8f3dd41a

SHA512
c97003bda7398c5eb9f003febb2dbc531541d3d7a62581b5daafd9fca3e63e4dd4f04c13d8231c6aa05a8221048624c10856d40468e95dd7b6f273169b104623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7a9a9f93cfba9541844e0238667d73ea

SHA1
628d2af9027be948cbb261cc6a088e6f59049779

SHA256
3e2a1716b01d0bde3730d176a41faaa01bdf1055bbd33be463ee6062f225ea46

SHA512
948880f490922d2701d480c5869d176e98b57f17d22c27d95e55457f30d23e150c8470fe09247c54f0d7dcdb1fa714d2e342b3f7d2d96192261266777c3b6176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d0785f3bfbf826147529efe621d31464

SHA1
a9996253a8d0aaa04216fbb6772bcffcb5a0cf86

SHA256
61a8611cf5573e677fa8ad6d9e498ff5c1dded2d54fd0bf0a06bcc8808c89e63

SHA512
98abf00fd7203fe3f6273dcedab63a2398a37c2da2aa5353919908773dbbd01a82cbbd05291506eddfc439a159d7dbb0b0db53013b09b19744dff24a9ffc45e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
39bf203cd0f9e823b62cb0d274adc620

SHA1
d75fc70acbecd5817b636cc72d36da474c302524

SHA256
18f3f2128a95020badae82c8192afe05ef6f17779ba9451caacab8f7000a0c64

SHA512
ccc861028716049b57cac59e51f4318e20f5d07159341a63f651d475b5be2f5596df0b001b5436e120d8bc47a030c5b719ef36d8b7e0e61b2b951bf6829d093c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
abbfbf84dbbac967acafe34818abad12

SHA1
6ec425440145f73f1d5e01605f990e2a5bd3b84e

SHA256
637554289532ae3675eafacb40a07d9175579e66c78619b42c894031265f6400

SHA512
f85cbc5e8014c760d7b9b49071c7cf49158205dd05e2cbb0fe54a741636b59085d3a931cf8162ccb8142e2bb0258da54742a7e7fd24650916c5b355828ba7dcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5af303428e2f89d38b9c97919f034d1

SHA1
33b4ce8cacceb4857efdeaee84c453872a7fb0f2

SHA256
d150c9d839472182dd98691d36921cd59822d546044d3a96164c3ab0fe035255

SHA512
a62803c303afd2a2137d3fd90156b33ee8a97e7bc06799e7e344ab337fc9381e937857a689c20d4411b2d5612a5fcd10878e284b5af6ec8496b8e852796f5b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fd3e08027a760a3083f3b92a6645613a

SHA1
c963454ff7d4553cd61aa96ea6477ffb3fb0f7b8

SHA256
7b9d5b5c28d2db61fc30b3d747579eb188a48447e6f7442caf8c69a335711d45

SHA512
9f4768b88af7e69f5fc3a6b0fe6718c6b592eab55bb255fe518e89da4ffb2e8b512dc960db678e79331e6e97450004b65953be2bf54bd892082c4bb9d75074e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ebde6f3c1766551a8236a9788fc034ac

SHA1
2d3ed434c64a8c43ba39e2431c36062f974d5a58

SHA256
db2caf9889d209f1e15acb3bf954c12e94c2f70ee0ff1219e0b117270335bb31

SHA512
1aeb97b31e51ec54a1b732695e2eeb9dff376f5b8e0205d5cd80093f1bee01af181ddb99a988e55d4c9efa0b610b168937332947bb337af628a367dd45f81868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e2565e589c9c038c551766400aefc665

SHA1
77893bb0d295c2737e31a3f539572367c946ab27

SHA256
172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80

SHA512
5a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
30e20adf5a28cc4511566bf684838cb5

SHA1
1203b2788d7842519bf88932dbf6c0c8655987a8

SHA256
f3678f0aba1b5c8c42605ac807b4da1ba39f054d0a0fa8c0799877a667117f7c

SHA512
2014c353937288c46ef7fa9bef413bb0de8a5d8f6fd5a68f00c551b43b79af7b3e6d502343a7e3e9dbb77785400f069aae8c779fdc374981eedf38432fb93fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ff6e.TMP

Filesize
872B

MD5
b948bc82b376da836d3eb9d24eab3fb4

SHA1
03705a91c83e522801913364145da4d5bea76628

SHA256
9a730df93e6f96bf23e8e598fdbd693df950fe770a712425dd39b3b7a29935c3

SHA512
387cd1e2a8d1c53b514b32a461fd44016512e7b7890d61081c06c126d47e85ddc4ac9741e52f6f84d20006a9a1d621e435645570c213507c782855a78d63dd82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b7e728c62783403c51792dd5e17203d

SHA1
9bb539f93de51540e49d3c8beea6686bcd7ead76

SHA256
8e4933f98030e7a311298784e0adc68dbb9158e0245236a4ac17df1779b91873

SHA512
bb5129bb409b4ebaf07e1503eb3c299a5a41f79d657df94dd3db63060eb946d14df51ae9e5ed14e5c93e573703633ef4b8706fd5ebc165ae4a604c13eb223f6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ca7b899a2ac3380d23972594eafdede1

SHA1
90d6b59c3ca586241c0c9b65fd6e11133773eacb

SHA256
b02a2443ec6b454306e9c30e0763fea1d4b87c21e15c8d6207d226addc0d5226

SHA512
db65c3cecbb8b0bb26f58214b1b9449767f81fe38dc665d3845bbd56216296505a08730c0b67ff88d96c3348533f9cdae496588c7fa8a3489f7128b88cca0432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
456209b6fcc8d3458432ca38f97aa726

SHA1
b7c1ae4f5b06b5f3a0795b19175c12bc894b86bb

SHA256
151f024db7e662c6d883d45c435b04727d1b532d02f62ccb132c173e527a993f

SHA512
592cd25e41ab76935a03c77e42699eab8f07b761867c90604dd1a2ca7c0cb3234be9c2da3f2383568f9854be75157f23f902ec1ab958127ce67137134a6a99b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ppqxj052.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
5d196b7249379d3d2c0014315cacf8dd

SHA1
edee30fb9e6d5ba9ae810a1bb90b39ac77544ccd

SHA256
7e210d95ffc7c39f21dd27150043d2d01600aed54157838e4cd2e241eedf5457

SHA512
8cc568d00586e1eaafbcb61602c5991be31f498bd924e890670b30d3eee9a81801452485f92378b280490461778f255b14b39d954728d9a751bc2588879fb0c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ppqxj052.default-release\prefs-1.js

Filesize
6KB

MD5
88da80429c764475115927c5fb8af55c

SHA1
33dd52027f02afc78d679f33282de8ecd395052f

SHA256
e4ce621c6338a220f4c2316209d9a832dade09175f9206c561d7478b721f4468

SHA512
d92e307334d79010d37cc8118c062c507e98f2e736e9efb458409bee03ace406e88150e71d7900c5a71c33b550d8d2a849349ff2ad81e5123b9b531a42a9ec52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ppqxj052.default-release\sessionstore.jsonlz4

Filesize
885B

MD5
53e3ae5dd3caf979b7578cdb95c82fee

SHA1
3f9fad9df5cf90531d05e11044f96d81c782d56b

SHA256
bb513ca03c8d7eb0019422855b91dfd256160df817da3db4ae533c0b6bbb2fbb

SHA512
48d611aaf68accefcba5f8714ee6b65a2475e7091b30e9753f7cdd986323d1f8897c6391fe19ab00117a2a14171489a0d6bdcf15c9c121d83496c805e45617f0

Download Submit
C:\Users\Admin\Downloads\83461806.IMG

Filesize
1.2MB

MD5
eafbe741cb50689cb30936f0b559cf43

SHA1
fb2b6a4a3dc1611ec1b821387fe8739d8def996d

SHA256
87ba2a8204ae7233a66cda9bbd8993e736d07d682ef7f39a222fc58e979f3dfc

SHA512
7faaecd95e52e9ea2996e97c274c932e2814043f6dad3faf6566687ee0d7a8a9a17c6beef5aae49a1992af74706977fad7f0477a72d3c88fa252586297f540fb

Download Submit
memory/2100-550-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-551-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-543-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-544-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-545-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-549-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-555-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-554-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-552-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/2100-553-0x0000015316030000-0x0000015316031000-memory.dmp

Filesize
4KB

Download
memory/3464-300-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3464-273-0x00000000054D0000-0x00000000054DA000-memory.dmp

Filesize
40KB

Download
memory/3464-275-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3464-282-0x00000000072F0000-0x000000000738C000-memory.dmp

Filesize
624KB

Download
memory/3464-281-0x00000000059A0000-0x0000000005A1C000-memory.dmp

Filesize
496KB

Download
memory/3464-280-0x0000000005710000-0x000000000571A000-memory.dmp

Filesize
40KB

Download
memory/3464-274-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3464-278-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/3464-272-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/3464-271-0x0000000005560000-0x00000000055F2000-memory.dmp

Filesize
584KB

Download
memory/3464-279-0x0000000005700000-0x0000000005706000-memory.dmp

Filesize
24KB

Download
memory/3464-270-0x0000000005A70000-0x0000000006014000-memory.dmp

Filesize
5.6MB

Download
memory/3464-269-0x0000000000A60000-0x0000000000B02000-memory.dmp

Filesize
648KB

Download
memory/3464-268-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3712-432-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download
memory/3712-433-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3712-431-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3960-306-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3960-303-0x0000000004EE0000-0x0000000004F46000-memory.dmp

Filesize
408KB

Download
memory/3960-302-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/3960-301-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3960-298-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4696-430-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/4696-295-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/4696-294-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/4696-284-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/4696-283-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download