healer | e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea

Resubmissions

12-02-2024 15:14

240212-smedwaae93 10

18-01-2024 16:04

27-11-2023 17:24

27-11-2023 17:23

07-09-2023 17:34

07-09-2023 17:29

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe
Size

473KB
MD5

5ae1281ef3fd32f975133cd880be9ba8
SHA1

11f3e8bfb5443fe516ff6922e72ae005e1431e13
SHA256

e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea
SHA512

c7a2df58fc7b97ed642b4671ea2af9573ea9f6e8806c3251703b4d594a24a0463380eafcb7757dc4d732655c5f08d28776cf6d0e5597ea2377463c106de4e587
SSDEEP

12288:zMr0y904pAEvdXQzqmrQAQlMmHeNwwrGfI:XyxTNQzdZanQwwrGfI

Score

10^/10

healer redline mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023202-18.dat	healer
behavioral1/memory/4644-21-0x00000000005F0000-0x00000000005FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g5140893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g5140893.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	g5140893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g5140893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g5140893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g5140893.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0006000000023203-26.dat	family_redline
behavioral1/memory/4892-28-0x0000000000330000-0x0000000000360000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
4480	x8180539.exe
5100	x8801353.exe
4644	g5140893.exe
4892	i5032787.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	g5140893.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x8180539.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x8801353.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	g5140893.exe
4644	g5140893.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	g5140893.exe
Token: SeDebugPrivilege	4668	firefox.exe
Token: SeDebugPrivilege	4668	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4668	firefox.exe
4668	firefox.exe
4668	firefox.exe
4668	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4668	firefox.exe
4668	firefox.exe
4668	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4668	firefox.exe
4668	firefox.exe
4668	firefox.exe
4668	firefox.exe
4668	firefox.exe
4668	firefox.exe
4668	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4480	2816	JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe	85
PID 2816 wrote to memory of 4480	2816	JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe	85
PID 2816 wrote to memory of 4480	2816	JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe	85
PID 4480 wrote to memory of 5100	4480	x8180539.exe	86
PID 4480 wrote to memory of 5100	4480	x8180539.exe	86
PID 4480 wrote to memory of 5100	4480	x8180539.exe	86
PID 5100 wrote to memory of 4644	5100	x8801353.exe	87
PID 5100 wrote to memory of 4644	5100	x8801353.exe	87
PID 5100 wrote to memory of 4892	5100	x8801353.exe	91
PID 5100 wrote to memory of 4892	5100	x8801353.exe	91
PID 5100 wrote to memory of 4892	5100	x8801353.exe	91
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4068 wrote to memory of 4668	4068	firefox.exe	96
PID 4668 wrote to memory of 3120	4668	firefox.exe	97
PID 4668 wrote to memory of 3120	4668	firefox.exe	97
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98
PID 4668 wrote to memory of 540	4668	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe
"C:\Users\Admin\AppData\Local\Temp\JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8180539.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8180539.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8801353.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8801353.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5140893.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5140893.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5032787.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5032787.exe
      4⤵
      Executes dropped EXE
      PID:4892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4668.0.125955706\1654794947" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bebd821-0228-40cb-897a-74cabf466e92} 4668 "\\.\pipe\gecko-crash-server-pipe.4668" 1960 1e8208db458 gpu
    3⤵
    PID:3120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4668.1.92934212\1284565017" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa8ecae6-f6c6-4e6c-a689-71a409370096} 4668 "\\.\pipe\gecko-crash-server-pipe.4668" 2360 1e8207fa558 socket
    3⤵
    PID:540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4668.2.1642751132\1805136911" -childID 1 -isForBrowser -prefsHandle 3168 -prefMapHandle 3164 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e20fb3d-baaf-4010-840f-735f1bc403d6} 4668 "\\.\pipe\gecko-crash-server-pipe.4668" 3180 1e8249af058 tab
    3⤵
    PID:4976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4668.3.1879288082\67386250" -childID 2 -isForBrowser -prefsHandle 3068 -prefMapHandle 3460 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa064ae3-0a81-44a0-a88c-28b1121ed44c} 4668 "\\.\pipe\gecko-crash-server-pipe.4668" 3588 1e82376df58 tab
    3⤵
    PID:2456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4668.4.1892114062\1946853030" -childID 3 -isForBrowser -prefsHandle 4528 -prefMapHandle 4524 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7444f758-d92e-48e8-bcc9-e8d579cf9125} 4668 "\\.\pipe\gecko-crash-server-pipe.4668" 4540 1e8266f1b58 tab
    3⤵
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4668.7.616300918\1404070252" -childID 6 -isForBrowser -prefsHandle 5432 -prefMapHandle 5436 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2c852a4-25a7-42c3-ae05-0846bfada3b6} 4668 "\\.\pipe\gecko-crash-server-pipe.4668" 5424 1e823469c58 tab
    3⤵
    PID:2684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4668.6.614239886\641222165" -childID 5 -isForBrowser -prefsHandle 5228 -prefMapHandle 5232 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fcfbaf7-fd08-477a-852b-e85047a8107b} 4668 "\\.\pipe\gecko-crash-server-pipe.4668" 5220 1e823468a58 tab
    3⤵
    PID:3952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4668.5.1743115087\697869933" -childID 4 -isForBrowser -prefsHandle 5104 -prefMapHandle 5100 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01f81bab-49e3-45ed-83dd-32319a572ca7} 4668 "\\.\pipe\gecko-crash-server-pipe.4668" 5112 1e823468158 tab
    3⤵
    PID:3716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD

Filesize
13KB

MD5
5f2a8926085a937d6116b98b25e61d2e

SHA1
b8b03625800ff2acbdc7e9b7d266211b47d93db0

SHA256
fc7fe0af6dfba1884316b3486c3cd03d70d6823895756a1486e185ce7f3780e0

SHA512
f5cb7ca8ccbe1bd7760ddec05d3fcd8dd10d58e82b0dc5601c724ef1c3ac06c110917c7e0faab72886c413e034bea326e5046a344e38c864200d995d4139593f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8180539.exe

Filesize
371KB

MD5
77b13a3fd07083ce83966ad88c56783f

SHA1
f233315220091a448f740a6ad71cd7b45ecaae92

SHA256
5fb312ef2771f6e0870cb919e6cb40ff56b834c69054dd7c5890544a480493b8

SHA512
e030b9de4ba08956297af6ea1bf2539641f7960e0ef327ebdda5b7e39ba2171c9b50d028c8db18723ba15e0a8614197d56170fe9e569264bcecc8177861e825e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8801353.exe

Filesize
39KB

MD5
36fdc943b9980b3355f9bcc2c96fc33d

SHA1
53bd3e429f26bcca98378abdab7a5ebffde919bb

SHA256
f135b3be100d874cce4d6529876abf4a8390b8581371fff4a160a287527e9aa4

SHA512
2f01dfeef31922aa0ef541209813d81286b07d09b25ebc52aba2e1955437090098606f8ae585f9f3adc4edb61aef3edca9383b8b9e11a6bd4ee4791d552a148f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8801353.exe

Filesize
206KB

MD5
ef4b98983a112ab0cd247faf227bd5e1

SHA1
6e117ab856666570dd067008aabe5fcd9f0735ac

SHA256
6639b1af65588c7bc5d7dfab64d99a84b64192d9553169a9abdf8c88862b1620

SHA512
adce7f277d3920e08bbb390933e626b3659afb2160e9dda88868a6af0728f078756d49b91867eb8b81c2850ef2c56ff914fc09f349d9081aa1ed736e7cfdc221

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5140893.exe

Filesize
12KB

MD5
9403417cabef4a164263a6d85bfddba5

SHA1
3c1f1b1c7e911b93933d8c116a6bfd305ce03d18

SHA256
7a1985041896a40c9846c64fe801d4e503f9471ab7a3e5ebd5d42ac843c579f9

SHA512
f6c6554d43f667592586f46e56274e0934e6b632016c49c2dd11b3214fd088c392532e8bede5fa911984613b7cf79f353151e5940a3c9fa9abd28455d7c65991

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5032787.exe

Filesize
176KB

MD5
486ce910a0924bb56ac5d8d7db61e7c0

SHA1
88139cdedbe75eb1441972b4bd5b498c1eb2e38c

SHA256
8511b1f1796c6bb4f49377a78b3cc1543f9f7ad0523e91df7cf4f5e6ddcc86b9

SHA512
0b277bae0dea7ba4543f32cbc6c084b1f23f47a74d9a01a2a0f3baf4d0ea99b7a7cf7a2a4af7110e0badc39400d0feb3963db1392e2bacefbcb8e2597c98f7e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
6d34578e0e6ed7f3d4d0237f72dffb5b

SHA1
bf6ec272ffdbf010c981eb8539df8fc7002b3896

SHA256
f1ebd270a51a96f4069ad47ed5a2278e9a217be2d34028aaaf8433d01336c9c2

SHA512
288c2adf7f2a3bcaa8dbd132d2f0e8d9b1e1f6b0727ca166c77870040019d4d0ebf7c00b69360abaa883a71ffe8f4fc61688d913c251724059acc4fbe656c7e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\248660f7-52f8-43b2-82af-aba61c0d8d86

Filesize
746B

MD5
50168663c7370547fc3e71d737eb93ba

SHA1
a466384ebd348aba2b0a12de88c90f99021bc399

SHA256
4b5b71144eddba6eac9b6df0767afb58fd00e62f57de0dd79d198a9d6b84cf77

SHA512
3f482b567bec5ccb972c1ff75efd4127f3504be3a91a90cac7112da3e90974c9cf957ea28edf5e1fc650996e327decab58987491f29ac4ebd34cf87cda2a3874

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\307d5804-3cfc-4cff-a659-dd33e5da2da9

Filesize
11KB

MD5
8f9a3855443de91f7024f02ac06c1d3e

SHA1
d5b2379cfdf34accd576f2e476b8a02f3b44e10b

SHA256
d06cb9e00b1abcbbb3e2eac448ee28156e4f24566708685b1f77b4ef580a3d94

SHA512
9669d8f28d02fd743b053ef01713cef1a6ca4f1c1765d0b1b5dd093dd6102bd9deea77965ea27f694d8890f3590c662f291bc7635a9ff3ace80e6e2bb69da490

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
9.8MB

MD5
cd296a704d47915c1c918c28046ab016

SHA1
f1551a02d280dcaac52917c27672b3c6e106e2d3

SHA256
f433643bc34a5ad4a5a9773db32a446b16f066aa1e51b7cc3c59823fff147634

SHA512
67f42d1173df2bf5ce7744cef958e195168998cb7bf3f1e20f362d7d9478b76e042bbae3db1bd1e62977eebc78af43fec2f46d3edda8780bbb6163472579182e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

Filesize
6KB

MD5
a1e3a31117a09a8a278b416fba5768cd

SHA1
d563a12c952355534d78285ff6cc55ac01d86e79

SHA256
eb52f78a0d31f57940550cf0464a89578cecc369a7ac710ae1d60a2f8ff672f5

SHA512
3bf21d68b4929a51c6d25603f03139b1b3a61c993f79cbef08f47c9f74789cb942a7bbeb4deb45590c61f6ab5a80e0f1316dbb468e7d4d3e015354e494e97946

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

Filesize
7KB

MD5
7d85d71ba582dfcbde38375fd3e0a118

SHA1
41d125be5ff5412ec3edac81b71ed00b9fd3d887

SHA256
6307d035918c1d90e056e1902fd5ce3fde64401843c1474125b87f49c12764e3

SHA512
b66faef8d706247930fb9f8930d5c38405e6801a67d24ed93b7cae3fcc89780b8b7cba87361fc63f7337eadd2438504d94867ecdcdcf353ee64585723bef22a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

Filesize
6KB

MD5
78490c589602fea30649a4a99808692a

SHA1
35d4a3348c1e27ce1d2839d54205eabd4fb0c1ad

SHA256
19853a7923d43df0875246b240883f49b86e62e4ff1eb28905833376f4fe7bac

SHA512
bd21496ed332b75a704226939441f2096c238e19f6aa763a5e7726c74f80cc8ac95be305f44a8625481e38151119ccc186dee30425a8d8eb0d1dcb4a0520f922

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

Filesize
6KB

MD5
4ced6128bd2f4c4af1030c1151901b79

SHA1
060623221fa241ca6fa4538f1aaa52426a5306a4

SHA256
b243d8656a3a131d913ecec695b927de940a7f1d5775a62e01077b4637806c76

SHA512
048b42bd1d1d0285954bedef6857232e772ad1f4b7f5acf374e5870a3bfff9efe554dfda4256e9d7ffbd59a5e3414311351197605aaaa3531f0f9e947f011edd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
d05f7e98e601e6cd308b09a2f9541e5b

SHA1
c54b5b943858d461fc4ff5dce4d0e19e9297d6dd

SHA256
9854b95d5ed395bf70b054b5edbdd43186ec5dda1ab046cb6b272e3fa55ff445

SHA512
85093c942ff1d603a284d74e24ac281ccdfaf006b6198f46e66aa7f899834a1a612cb1e4f15f1bb2648db0342d420a2bc8ec34f629ead5fb15c946aa225611d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
dbdadf72267e635f05dd1bf03fce2bb7

SHA1
1769e29dacff5a8b0cf2b32a629f5d6e64ccb09b

SHA256
5494578b82e75f0cc731b3c2b80cfeac19f9a86121a2e9365bbb22c98683f6f7

SHA512
589bca05b6fa000dc332418070b58e005e8be878f1952be2b04ef3ef686574ba0ffbc41536a92d6b7884677284010d140a6677f7da518536574e686ebbc68199

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
adba586faa7bac5b3efeb23eab177b79

SHA1
083a859fa0e629b0e9315728c42302072783ab3f

SHA256
e74bbdffeb502d9613b8aa04b8b0ed0dff680377c6e87e2a156736fdfe259bca

SHA512
6ae1b396b3e83edca31b52941f19c02bd09d8093a4173cf8634edba1555db7b1f2f53f36e0a3fbed9f32cfeb5512745b79103a1c34ec0af3060d5b58259e9047

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
4d971978cdc49b6a60d19b9158114966

SHA1
07f0b467a2e86c58ed6765a1341c87cd8dbe6ceb

SHA256
b80aaee96d5eecaab5a429d67da1df121ba56c538a1419cc6f7cb2042df5520c

SHA512
a8a076b1262dca52783995af9e0d1deb1ef20acf5bb27585ef1073665b65febe4d7dea967c333b1646ec1ce332328baa1c8076743b2705e46ea2072bc05a5726

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
feacfeaa6370d0dd460a0609e1e1435e

SHA1
1463da69f34d0efa56e61d9dd55ac1f435237b5b

SHA256
d57b87db93a487d521c52be8e0d599fcfb17e8012f6066c303f4e48e92c3f439

SHA512
61097d4419f67e7b364a5f0f3a248d801e0bbff2283ffce8cb89a5d43309145288c20ce1a6620217c81256db7da81de7d184a0c7eb769ea237902a5abbe5782b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.3MB

MD5
dfe5292712a24cb5fff99066485c9e14

SHA1
7788feae52e6d5fdc36d35626cfd117a92b2aca0

SHA256
618c7a0ef747fd38fc9b969a53c9086daf76e03101d1eb795d6d68afac061811

SHA512
da23917d12695fc94674847a5274660bd55cf0f94a90a2fdfd7bceeecaeacd751dfaa20886df2af2e8504dcec0fee98f4e51b0c3d18764c118c54e8d0a4bcef0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\weave\toFetch\tabs.json.tmp

Filesize
10B

MD5
f20674a0751f58bbd67ada26a34ad922

SHA1
72a8da9e69d207c3b03adcd315cab704d55d5d5f

SHA256
8f05bafd61f29998ca102b333f853628502d4e45d53cff41148d6dd15f011792

SHA512
2bce112a766304daa2725740622d2afb6fe2221b242e4cb0276a8665d631109fbd498a57ca43f9ca67b14e52402abe900f5bac9502eac819a6617d133c1ba6a3

Download Submit
memory/4644-21-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/4644-22-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4644-24-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4892-32-0x0000000004EB0000-0x0000000004FBA000-memory.dmp

Filesize
1.0MB

Download
memory/4892-33-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/4892-34-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/4892-31-0x0000000005380000-0x0000000005998000-memory.dmp

Filesize
6.1MB

Download
memory/4892-35-0x0000000004E40000-0x0000000004E7C000-memory.dmp

Filesize
240KB

Download
memory/4892-30-0x00000000070E0000-0x00000000070E6000-memory.dmp

Filesize
24KB

Download
memory/4892-29-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4892-28-0x0000000000330000-0x0000000000360000-memory.dmp

Filesize
192KB

Download
memory/4892-36-0x0000000004FC0000-0x000000000500C000-memory.dmp

Filesize
304KB

Download
memory/4892-37-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4892-38-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download