15d971e7e9e6bbceea6f9fe3c39a63c119720b3b2c709e81f709484c06129dc5

Resubmissions

24-02-2024 13:28

240224-qq4f3adf8y 10

24-02-2024 13:19

240224-qkwh9scg42 10

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal.exe
Size

14.3MB
MD5

491748f8c5178012f8f497a8fb9860d5
SHA1

3514f3ba1d9cef9c42777652288dc7512799539c
SHA256

15d971e7e9e6bbceea6f9fe3c39a63c119720b3b2c709e81f709484c06129dc5
SHA512

4d7244a15d6d414e893510e10e88b1813823f824b7096ef9fdf4b907babd5123de79e31a9330caa0b00420b5c73eeca48750e4133dd49a9493ae5847f92dd3c7
SSDEEP

393216:niIE7YoPQPndQuslSq9RoWOv+9fgynkUWXwf:87rPQPndQuSborvSYynUXw

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Creal.exe

Loads dropped DLL 46 IoCs

pid	Process
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe
4864	Creal.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
9	api.ipify.org

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
540	tasklist.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2588	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	taskmgr.exe
Token: SeSystemProfilePrivilege	2468	taskmgr.exe
Token: SeCreateGlobalPrivilege	2468	taskmgr.exe
Token: SeDebugPrivilege	540	tasklist.exe
Token: SeDebugPrivilege	3728	firefox.exe
Token: SeDebugPrivilege	3728	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
3728	firefox.exe
2468	taskmgr.exe
3728	firefox.exe
3728	firefox.exe
3728	firefox.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
3728	firefox.exe
2468	taskmgr.exe
3728	firefox.exe
3728	firefox.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3728	firefox.exe
3728	firefox.exe
3728	firefox.exe
3728	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4864	4764	Creal.exe	88
PID 4764 wrote to memory of 4864	4764	Creal.exe	88
PID 4864 wrote to memory of 4000	4864	Creal.exe	92
PID 4864 wrote to memory of 4000	4864	Creal.exe	92
PID 4864 wrote to memory of 4232	4864	Creal.exe	94
PID 4864 wrote to memory of 4232	4864	Creal.exe	94
PID 4232 wrote to memory of 540	4232	cmd.exe	95
PID 4232 wrote to memory of 540	4232	cmd.exe	95
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 2284 wrote to memory of 3728	2284	firefox.exe	99
PID 3728 wrote to memory of 812	3728	firefox.exe	100
PID 3728 wrote to memory of 812	3728	firefox.exe	100
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101
PID 3728 wrote to memory of 4512	3728	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Creal.exe
"C:\Users\Admin\AppData\Local\Temp\Creal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\Creal.exe
  "C:\Users\Admin\AppData\Local\Temp\Creal.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:540

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3728.0.521787139\1645861837" -parentBuildID 20221007134813 -prefsHandle 1888 -prefMapHandle 1748 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b180e669-22ec-403d-88a4-a2d45bc01bc4} 3728 "\\.\pipe\gecko-crash-server-pipe.3728" 1964 244c1ccde58 gpu
    3⤵
    PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3728.1.1830006510\1818020517" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {865086bd-056b-47f7-98cc-2f1b542f0113} 3728 "\\.\pipe\gecko-crash-server-pipe.3728" 2364 244b5472b58 socket
    3⤵
    - Checks processor information in registry
    PID:4512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3728.2.2145668921\760045831" -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 3128 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {945ae490-c40b-47c1-86fe-f8f0968525ad} 3728 "\\.\pipe\gecko-crash-server-pipe.3728" 3144 244c5fb8358 tab
    3⤵
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3728.3.338547502\906548892" -childID 2 -isForBrowser -prefsHandle 3512 -prefMapHandle 3508 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {915c6943-3bc7-4fe0-bbe0-eadbeb3c06bf} 3728 "\\.\pipe\gecko-crash-server-pipe.3728" 1236 244b545fe58 tab
    3⤵
    PID:940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3728.4.1438967970\163913301" -childID 3 -isForBrowser -prefsHandle 3756 -prefMapHandle 3752 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ec6368d-6b46-4477-b455-4d945b9daf31} 3728 "\\.\pipe\gecko-crash-server-pipe.3728" 3764 244c4819158 tab
    3⤵
    PID:952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3728.6.950752029\1178038461" -childID 5 -isForBrowser -prefsHandle 4820 -prefMapHandle 4872 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5539be9a-6e06-4e70-9b2d-ca5fbf786744} 3728 "\\.\pipe\gecko-crash-server-pipe.3728" 4892 244c7e28658 tab
    3⤵
    PID:2912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3728.5.341941607\1567678831" -childID 4 -isForBrowser -prefsHandle 4864 -prefMapHandle 3724 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d3931a9-6365-4931-89cc-b9332ac4ca25} 3728 "\\.\pipe\gecko-crash-server-pipe.3728" 4852 244c6564258 tab
    3⤵
    PID:4784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3728.7.1581418007\469444542" -childID 6 -isForBrowser -prefsHandle 5208 -prefMapHandle 5204 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0a55ede-fcf1-46ca-88ee-683693a0559b} 3728 "\\.\pipe\gecko-crash-server-pipe.3728" 5272 244c7ee9f58 tab
    3⤵
    PID:3700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1348

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\crpassw.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_cbc.pyd

Filesize
12KB

MD5
0c46d7b7cd00b3d474417de5d6229c41

SHA1
825bdb1ea8bbfe7de69487b76abb36196b5fdac0

SHA256
9d0a5c9813ad6ba129cafef815741636336eb9426ac4204de7bc0471f7b006e1

SHA512
d81b17b100a052899d1fd4f8cea1b1919f907daa52f1bad8dc8e3f5afc230a5bca465bbac2e45960e7f8072e51fdd86c00416d06cf2a1f07db5ad8a4e3930864

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_cfb.pyd

Filesize
13KB

MD5
3142c93a6d9393f071ab489478e16b86

SHA1
4fe99c817ed3bcc7708a6631f100862ebda2b33d

SHA256
5ea310e0f85316c8981ed6293086a952fa91a6d12ca3f8af9581521ee2b15586

SHA512
dcafec54bd9f9f42042e6fa4ac5ed53feb6cf8d56ada6a1787cafc3736aa72f14912bbd1b27d0af87e79a6d406b0326602ecd1ad394acdc6275aed4c41cdb9ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ecb.pyd

Filesize
10KB

MD5
dedae3efda452bab95f69cae7aebb409

SHA1
520f3d02693d7013ea60d51a605212efed9ca46b

SHA256
6248fdf98f949d87d52232ddf61fada5ef02cd3e404bb222d7541a84a3b07b8a

SHA512
8c1cab8f34de2623a42f0750f182b6b9a7e2affa2667912b3660af620c7d9ad3bd5b46867b3c2d50c0cae2a1bc03d03e20e4020b7ba0f313b6a599726f022c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\Crypto\Cipher\_raw_ofb.pyd

Filesize
12KB

MD5
a13584f663393f382c6d8d5c0023bc80

SHA1
d324d5fbd7a5dba27aa9b0bdb5c2aebff17b55b1

SHA256
13c34a25d10c42c6a12d214b2d027e5dc4ae7253b83f21fd70a091fedac1e049

SHA512
14e4a6f2959bd68f441aa02a4e374740b1657ab1308783a34d588717f637611724bc90a73c80fc6b47bc48dafb15cf2399dc7020515848f51072f29e4a8b4451

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\VCRUNTIME140_1.dll

Filesize
48KB

MD5
bba9680bc310d8d25e97b12463196c92

SHA1
9a480c0cf9d377a4caedd4ea60e90fa79001f03a

SHA256
e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab

SHA512
1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_asyncio.pyd

Filesize
62KB

MD5
4543813a21958d0764975032b09ded7b

SHA1
c571dea89ab89b6aab6da9b88afe78ace90dd882

SHA256
45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5

SHA512
3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_bz2.pyd

Filesize
81KB

MD5
bbe89cf70b64f38c67b7bf23c0ea8a48

SHA1
44577016e9c7b463a79b966b67c3ecc868957470

SHA256
775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

SHA512
3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_cffi_backend.cp310-win_amd64.pyd

Filesize
177KB

MD5
6f1b90884343f717c5dc14f94ef5acea

SHA1
cca1a4dcf7a32bf698e75d58c5f130fb3572e423

SHA256
2093e7e4f5359b38f0819bdef8314fda332a1427f22e09afc416e1edd5910fe1

SHA512
e2c673b75162d3432bab497bad3f5f15a9571910d25f1dffb655755c74457ac78e5311bd5b38d29a91aec4d3ef883ae5c062b9a3255b5800145eb997863a7d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_ctypes.pyd

Filesize
119KB

MD5
ca4cef051737b0e4e56b7d597238df94

SHA1
583df3f7ecade0252fdff608eb969439956f5c4a

SHA256
e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

SHA512
17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_hashlib.pyd

Filesize
60KB

MD5
d856a545a960bf2dca1e2d9be32e5369

SHA1
67a15ecf763cdc2c2aa458a521db8a48d816d91e

SHA256
cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3

SHA512
34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_lzma.pyd

Filesize
153KB

MD5
0a94c9f3d7728cf96326db3ab3646d40

SHA1
8081df1dca4a8520604e134672c4be79eb202d14

SHA256
0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

SHA512
6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_overlapped.pyd

Filesize
47KB

MD5
02c0f2eff280b9a92003786fded7c440

SHA1
5a7fe7ed605ff1c49036d001ae60305e309c5509

SHA256
f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973

SHA512
2b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_queue.pyd

Filesize
29KB

MD5
52d0a6009d3de40f4fa6ec61db98c45c

SHA1
5083a2aff5bcce07c80409646347c63d2a87bd25

SHA256
007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75

SHA512
cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_socket.pyd

Filesize
75KB

MD5
0f5e64e33f4d328ef11357635707d154

SHA1
8b6dcb4b9952b362f739a3f16ae96c44bea94a0e

SHA256
8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe

SHA512
4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_sqlite3.pyd

Filesize
95KB

MD5
9f38f603bd8f7559609c4ffa47f23c86

SHA1
8b0136fc2506c1ccef2009db663e4e7006e23c92

SHA256
28090432a18b59eb8cbe8fdcf11a277420b404007f31ca571321488a43b96319

SHA512
273a19f2f609bede9634dae7c47d7b28d369c88420b2b62d42858b1268d6c19b450d83877d2dba241e52755a3f67a87f63fea8e5754831c86d16e2a8f214ad72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_ssl.pyd

Filesize
155KB

MD5
9ddb64354ef0b91c6999a4b244a0a011

SHA1
86a9dc5ea931638699eb6d8d03355ad7992d2fee

SHA256
e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab

SHA512
4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\_uuid.pyd

Filesize
23KB

MD5
041556420bdb334a71765d33229e9945

SHA1
0122316e74ee4ada1ce1e0310b8dca1131972ce1

SHA256
8b3d4767057c18c1c496e138d4843f25e5c98ddfc6a8d1b0ed46fd938ede5bb6

SHA512
18da574b362726ede927d4231cc7f2aebafbaaab47df1e31b233f7eda798253aef4c142bed1a80164464bd629015d387ae97ba36fcd3cedcfe54a5a1e5c5caa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\base_library.zip

Filesize
1.0MB

MD5
af325008909ce731d1d70c6e2adbca46

SHA1
c81b3a93ecd994f27c04143ad8cf3130174e3ec0

SHA256
d4f3b954b3f1f15d29b896759837f236d9ba17b997bd3aabab5b2bad703e913b

SHA512
31f86fae11fa8f35a1222d4b6d96c8f8a70e09874f8151c7104281c442e4f60f22a69604f20f328fc80c5f92102ca65b2a267e84f260ffc8686385683c8579fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\charset_normalizer\md.cp310-win_amd64.pyd

Filesize
10KB

MD5
f0027550d46509b0514cf2bf0cc162bc

SHA1
5b5a9fd863a216b2444ccbd51b1f451d6eca8179

SHA256
77300a458bb8dc0d4ff4d8bddb3289e90cb079418dbed3e20d2c9a445f39746e

SHA512
bb09b814dbe3e4361abbafec4768208c98a7f455ef311b653d61b0b6098197bdac43e74e2e3868e486819f147b8f7c442c76e5181cc5a7eb13b6e2c2e07bf9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Filesize
111KB

MD5
e9454a224d11e1bd68c7069b7f5f61a7

SHA1
793098653d93652415f8bace81434f6f4490cf1a

SHA256
711f292ace44576f5de4f592adebd9d21faf569357c289425251d8dce4fa84cc

SHA512
17d993a0c4b56219e8c224eb2bdea92d9cc4bd3809b0f9fa4cf0ddfdc5eab4371441d488ea851abf2f88c691d57a268d5cdcaa9d11d4dd091bc130638fe36460

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\libcrypto-1_1.dll

Filesize
451KB

MD5
c42de91fff526af1b13a6b3f0a247d5d

SHA1
7889e171b6017c5938269f5cc2db5c2e560ab2ab

SHA256
90668c4554127d9ef00feb18ab48bbae3a34832a25cccafb6e43b93f83c7b720

SHA512
b84ce6ce75b39da47ecceb097cfb8ec3740d93da526eba835d58e8aa4d2bdff4b6e975320cce135682edff2810b04b843686e78d70915f4d8391d33192687e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\libcrypto-1_1.dll

Filesize
332KB

MD5
94f6b4fc6f2312723cf6cddc39348f82

SHA1
9265202a4cbc8b2c761c4396de9561074fe7ed65

SHA256
8ab4b7ee2c1cf69f9ab38ec7ba3c50a3a73ec46cb941a771dba1c1a479334f58

SHA512
8ba8dab4dd0fed7b48d5c14557e888391715d641afad6ced43f936392e5ba708815ca7d9d157f3acd8e93f4d1e7a146181b35d0caafe4f3bf6156cf937caa48e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\libcrypto-1_1.dll

Filesize
269KB

MD5
2cd8f33d86b7b5724a5e1b642375b320

SHA1
f2f67a0a612db4f17c07f6d318470e642ad2caf6

SHA256
4662eecea09a250e6040a78abec53c29764cf40f72aa5fc0b744bbd38f200ad7

SHA512
d20c7b3a16d369254f7dbce889c00e87eb742a4ead919d9b73237c0c9b8686d52ef266c99e11d6485fc8de1043f74539961eb42707b32b5400573cafdd049582

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\libssl-1_1.dll

Filesize
193KB

MD5
e8285a14e201dc29649f96de4001188a

SHA1
b57608704e6678be41830b320491cc8a8c4cafb8

SHA256
c374640715f89b80f0273937813064933b9449437b3f842c1acca40ab0a8ea86

SHA512
a453a91208190e57590f316cd48bcb20b83b4f62acb0fbf1eee354bf0097708a7718282b0b1a37073abc13a6da3f3b7bc0e6a09090c57cb1b9421516996a8e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\libssl-1_1.dll

Filesize
416KB

MD5
7d4dbfdd8936aa00e708e29112ae52af

SHA1
67f4234745c0ec4f944a318d5f6fe88109d8acbe

SHA256
7568c005a970df3b6fe84ec23c52906f026618295e85573e62fd5527f2268705

SHA512
763f276827550013bc7bd6a416432932108412457bd47b3ec76776d3913e2f75893ef9b7735063da4478ba865efef6c3c6a6ac2847a770f035a9e6053d8deea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\pyexpat.pyd

Filesize
193KB

MD5
43e5a1470c298ba773ac9fcf5d99e8f9

SHA1
06db03daf3194c9e492b2f406b38ed33a8c87ab3

SHA256
56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65

SHA512
a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\python310.dll

Filesize
429KB

MD5
9efd225f6a20b0189097bef7bda82be4

SHA1
04765a54ffe4fa9eab11776bb2d0d09d71be2fc9

SHA256
0d0fe0db1332ca038f4fd5a2ac4905b5847bd05280467c862fc9ccab9006c3d1

SHA512
26cf1fd61a6fd4a4ce9c6f25e6a15a3e3856ab9a1c0c7086a50295bb6f7b2b200766b98c65b136bc94c48a1c892495307865bb7faaef6fb6b3cc7500f22cbf58

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\python310.dll

Filesize
1.3MB

MD5
c9883ce4b09a2e44fd52a93885eb7699

SHA1
400ba242c82f4dcdbd003a34589cb798f9af44db

SHA256
750b7ba61cfbc0d44424233f1966e0f99d01666d741219c57e5eb30fd0bcd07e

SHA512
6f5a899c0e0ba14ebf359002c763a699d0c2cc7e31e005aa2ce910ff3afa4a81eafa4a526bafdafde710813d763c2b307d28d036ab566a6ad3c39d727b5c9a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\pywin32_system32\pythoncom310.dll

Filesize
433KB

MD5
1a3fb0c1c1c20616092a3d423cc64f77

SHA1
17d68d5fbeb32a034cf4324019f842666dee1a81

SHA256
7ee6fed5ce06ecd7c5908eee0c2279837c4f5312cc393118e2820f1f67200fa4

SHA512
0cad38a9868cea1ed3615d80092c20b0b9d4729df2b688cf00a2558105c545535ddf9d174d9386e5636480c2645515379ef062cfb25fa37da8a31ebf81a58870

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\pywin32_system32\pythoncom310.dll

Filesize
519KB

MD5
b3a1c2f1e474b6de07f93f9b33c2cd68

SHA1
094d5ce277e5efd2ae3e9535c7c2e5e46003df4b

SHA256
4410d3b93e0de0949e4c1918ad05755b7fcd08ef7d297f25da75ad3162414258

SHA512
0e282f815b6c6611d6f71438cfab7aee8005f543de64e5e5d2697598653514c7d4760b1e691d7e611dda5ca1951409b9b1efa16f69c7b8dff101143449b03e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\pywin32_system32\pywintypes310.dll

Filesize
131KB

MD5
ceb06a956b276cea73098d145fa64712

SHA1
6f0ba21f0325acc7cf6bf9f099d9a86470a786bf

SHA256
c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005

SHA512
05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\select.pyd

Filesize
28KB

MD5
c119811a40667dca93dfe6faa418f47a

SHA1
113e792b7dcec4366fc273e80b1fc404c309074c

SHA256
8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

SHA512
107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\sqlite3.dll

Filesize
267KB

MD5
e301ad28cc1799d0cfa33460cea11f0d

SHA1
6b4e09c136dac191e87f568cc3d5eb5d6345855c

SHA256
d4370dba657bbbed1caa3051bebeb6707ffcbf464b79daaac0504a68e33b3e8a

SHA512
75c060d1f9074f4f733d1710b6abd357fb6d58dc4026307a6daedf35ccfc14bb663fc464b42be538b2a50c86e3882e408ba01585bb6ba8d598a610c031188257

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\sqlite3.dll

Filesize
184KB

MD5
d23ddd6c0fe9ee2ccc596f78cf63ea34

SHA1
b25838e0384b712353b714326d5d2d9e9bc92540

SHA256
f46fb2cbf6ccefed1fc5bdbe5ac3f74d24222c27af19512f30f0efb5fd1184eb

SHA512
4916aadaf74858b3b58ab5dc56dae707b247a6d3cbf0241f533e4b341165d71a2c66a5bcc48c0f25466d0a4a788675ff6efcaf496ae9dafc26523d50ef2af722

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\unicodedata.pyd

Filesize
852KB

MD5
59fa30fb046f4c994b3383eb750d838c

SHA1
d21c038cf82c8681e21a65ba58a14f54300b53cd

SHA256
c22b0a1c8c7b35aac62431aabd2ad068e13944bd383559caf8b708b099efd7ec

SHA512
9c68b68eb4ac2eb5dc421619ea72f90c6361ffc58e64f9abf463f30fcd69edbbb66e83dcd8ff9e0324f452e365a894c145000fbd6b20fab22b7bf69ca5782549

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\unicodedata.pyd

Filesize
603KB

MD5
c046c76d10de56305d2d9b08ce054241

SHA1
c7d53b6bad7b4cc5ec3af3ddafc27ba8d5c0803e

SHA256
5b6fe8e972c22ab15fb29731e5f7a56ae3217115d0236afdba608f504364368d

SHA512
626783ba645f2135f475b33e1a86223f48fcea828482a3c83613ebfbdf8118ffb81267d65675475ec965dc28629bc65af488fa7bbf64945881a279b771182a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47642\win32\win32api.pyd

Filesize
130KB

MD5
00e5da545c6a4979a6577f8f091e85e1

SHA1
a31a2c85e272234584dacf36f405d102d9c43c05

SHA256
ac483d60a565cc9cbf91a6f37ea516b2162a45d255888d50fbbb7e5ff12086ee

SHA512
9e4f834f56007f84e8b4ec1c16fb916e68c3baadab1a3f6b82faf5360c57697dc69be86f3c2ea6e30f95e7c32413babbe5d29422d559c99e6cf4242357a85f31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\datareporting\glean\db\data.safe.bin

Filesize
3KB

MD5
657fca9f90ed4ca50f3116b4b52d421e

SHA1
0f95cda22d1aa96649a7e0e909605a17226a4dd2

SHA256
77a0bafa035c3c1e4bf72fd15cf5b9a581670f2821ef623f595ac20ccffcc327

SHA512
51352fc12c354eebdcf91198f9af8090584cdbc6f0ed1f923b33dee26dfdabf618643924ee31592b081b68c667fa1b662c2feaa163236b0e043f81e32612dbaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
3427731109c3dc0319bc223ac69326ec

SHA1
d71cd7e8880c47abc9a36868ed5bcdbaec776a06

SHA256
6e18722a47bdc6adc20cec431fd5c8c3859ab29e357054fc47d9fe8e1c83eaec

SHA512
dcfaf1685229ac01bd6b26cf2ddd8444f812b451ccc4e0ec5fd0d38dcf94b9ce77ce9a8ea4a522cedbae3c2651b0ab96bfcc4225445725e2ca86a5beec486f92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\datareporting\glean\pending_pings\64b6c7ef-a00a-4449-b5e0-69d206c3e81a

Filesize
12KB

MD5
cd4dc6ed26717ddde4cec16dcc8366ec

SHA1
be0eb42069e4d50dedd08f9c2a49bcf73ff722e7

SHA256
6ab4630cec5655665eff41688547c83ec90488448aa13e56cbb3d0a09eefef41

SHA512
a30cb640cbfef9a805196467f67117b2bfdb4df22a1b1003fcba0ad16c409a62757a105675af5bc86bfd5c4479ee16ebde36e02834ce40931aa580debce51642

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\datareporting\glean\pending_pings\c68586f3-5dff-4cc4-b06f-15c6002995b2

Filesize
746B

MD5
402af3ebc236aefe34011d29c6fbfd99

SHA1
d85fb2df91b4bd396c85d65df5a93d8949252388

SHA256
99b1f49a944e1ec93dbae447a17aab66f00287e61c1436a06850ed31bf4300cf

SHA512
11e4a393d12b1506c728f6a26d4ca9049561b92e629171cbf4a56f6152da34752330e3af63df5285c5d029df6d0d7b946895ed4fd6c5a8f7f991c68a15225415

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\prefs-1.js

Filesize
6KB

MD5
523535143094ce4fd26a667f8de25ffa

SHA1
9668f9714af66c1fc94e09db6a5b8dcfbee6e00c

SHA256
37df4b9c0e354985c36f558aab7f849520e7971d73ebf7bc103822c36f35ef1a

SHA512
3a4b3100014858e0e1ffc6f50821cef9fea2824dc8c3c1f35fb58c5dd347ad5c0a6c9edaf54348c321e68c503b342ae7c9880618aa33988a2d16692224db6c29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\prefs.js

Filesize
6KB

MD5
f5e1e635212c641039fe6b323e445dd6

SHA1
05edf259aa2975d888a9a5ec9874225faa0e673d

SHA256
5a850714b1453e709333ecec206eeb680c4af0750f7a84e45424e9025ddae42c

SHA512
57a8a0fd0079e04180a3e74928c4f382fcd5ed14dfb7c880abe8923094e7db6f612b71049ac1079ed2a04a047caf63c3db3c665a6d01c37c21084f4e0c8646f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\prefs.js

Filesize
6KB

MD5
cdf02779a7dea5a4889023567d06db2d

SHA1
b63b38947a4c573d0f1d9daf0c40abdae0a26ad7

SHA256
c25db25064e93faabab3be481c94ce4e35d34b4199a92efe09aebc01b7e1a685

SHA512
9271b7a304f2df4386ccb6112b62cd91b52bc3bfdaae117c2bc982efbc2db7dbeff27468d884c503c9715c866ed76300a76c4928a7908d99afb619ab8a65ea22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
638b41f5a61bd9aea6178e90c79119ad

SHA1
bb9902fa5ec3b22bd1ca8f6b0f0342996ded38c7

SHA256
df799bd7d9a12fbe0a9751a13ffe9ac30d695fea30180ebaea60909cc11dc0c8

SHA512
2834f434ec02323a6141fcba80e18cff0b4cb6d9fcd9b94dfd49bbde03212782e58295e6e5e00ceb20a9342d5883825ed91627a0405a9356ac715b99817cf271

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2sf79v1.default-release\sessionstore.jsonlz4

Filesize
893B

MD5
948020726ad988cfce8aa6c6e9268a9b

SHA1
7ce785b769bdd61f1c9b4e40b3f6f8ec8868c561

SHA256
29aefa08d14d6f1048ab6336b102df3ed823d447a43cd389b08cb2ff7fc9eb2b

SHA512
9f7891775c6dce40a12703287241c1d4f01230d1f88d2b3f489702e852309adddc2743dc512fe531703f19facf9f90ecbaf23a2e9109420bf445190172d2ec2b

Download Submit
memory/2468-131-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-159-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-160-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-161-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-162-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-158-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-157-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-153-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-129-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download
memory/2468-130-0x000002298D850000-0x000002298D851000-memory.dmp

Filesize
4KB

Download