d2c736fc70a887dda619b0098ee25efbc75093bd7f4d2937a08e70be8e66f1ec

Resubmissions

24/03/2024, 15:56

240324-tdd77agc8w4

24/03/2024, 15:54

240324-tch5rade983

24/03/2024, 15:47

240324-s8k4jsde857

Analysis

max time kernel
345s
max time network
349s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
24/03/2024, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows_11_cursors_concept_v2_by_jepricreations_densjkc.zip
Size 667KB
Sample240324-s8k4jsde85
SHA256 d2c736fc70a887dda619b0098ee25efbc75093bd7f4d2937a08e70be8e66f1ec
MD5 3075f21a10b66c29204bc3377120b060
SHA1 37e95606fd9c9d1b01fea936e0c21feb3f13af9c
SHA512 dd3eacd4e9c06cd469842c55afdac7ef86bb70f67db875fd46aa9bb6d34850dc5e611361ef710033055c736935be3286b7ae35fb05da12e4e749f28c9286b259
SSDEEP 12288:bnLoqJ8mafuNkB4h5xhRpPkAtlBm9JUN3P7/Q7Ru9APW9Ok3:bnc+v06vfZ3OI3jqRuNl
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133557689459192965"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5092	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5092	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe
Token: SeShutdownPrivilege	2412	chrome.exe
Token: SeCreatePagefilePrivilege	2412	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
4492	firefox.exe
4492	firefox.exe
4492	firefox.exe
4492	firefox.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
4492	firefox.exe
4492	firefox.exe
4492	firefox.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4492	firefox.exe
4496	xpsrchvw.exe
4496	xpsrchvw.exe
4496	xpsrchvw.exe
4496	xpsrchvw.exe
5092	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1544	2412	chrome.exe	76
PID 2412 wrote to memory of 1544	2412	chrome.exe	76
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 4244	2412	chrome.exe	78
PID 2412 wrote to memory of 1600	2412	chrome.exe	79
PID 2412 wrote to memory of 1600	2412	chrome.exe	79
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80
PID 2412 wrote to memory of 168	2412	chrome.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\windows_11_cursors_concept_v2_by_jepricreations_densjkc.zip
1⤵
PID:4348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe719e9758,0x7ffe719e9768,0x7ffe719e9778
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:8
  2⤵
  PID:168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3768 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:8
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5300 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3068 --field-trial-handle=1640,i,6662090640509098694,13445821377266695265,131072 /prefetch:1
  2⤵
  PID:2172

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:808
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.0.862365359\1918648916" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1652 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97cb3733-8445-49a4-9be7-3571f1eb9e68} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 1780 1be40e81958 gpu
    3⤵
    PID:804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.1.1475187911\383066722" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dce2797-7efc-4c36-a9e6-5c194fe021cd} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 2136 1be2d871c58 socket
    3⤵
    - Checks processor information in registry
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.2.1544093229\672940854" -childID 1 -isForBrowser -prefsHandle 3024 -prefMapHandle 3020 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f8c4766-95e1-41e0-90d0-67e5fa1a649d} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 2668 1be43fb6958 tab
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.3.644944618\1553189879" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbb06e77-ffb9-4557-9ff4-4d643d49455f} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 3600 1be44c95a58 tab
    3⤵
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.4.1775295005\376697185" -childID 3 -isForBrowser -prefsHandle 4468 -prefMapHandle 4464 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1e0c54c-3b18-4c49-8592-4dc8487b74d9} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 4476 1be4616c558 tab
    3⤵
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.5.2015101249\2081553892" -childID 4 -isForBrowser -prefsHandle 4752 -prefMapHandle 4732 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {23cc8a61-81e2-4a3d-b781-3be06bb59c72} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 4784 1be2d861658 tab
    3⤵
    PID:4476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.6.1914837227\89663502" -childID 5 -isForBrowser -prefsHandle 4924 -prefMapHandle 4928 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1a2b692-b240-4d39-a0b0-d93b9babf007} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 4920 1be45d04758 tab
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.7.1194371733\1249220975" -childID 6 -isForBrowser -prefsHandle 5112 -prefMapHandle 5116 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c68635da-e8c4-4110-acae-b921a4b9336f} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 5100 1be45d04d58 tab
    3⤵
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4492.8.1892733890\625639985" -childID 7 -isForBrowser -prefsHandle 4960 -prefMapHandle 4732 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d1b8d1c-0584-4db2-8fbb-85971e0e4d67} 4492 "\\.\pipe\gecko-crash-server-pipe.4492" 5644 1be47ab3858 tab
    3⤵
    PID:1100

C:\Windows\System32\xpsrchvw.exe
"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\ShowReset.edrwx"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4496

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SearchConfirm.m3u"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 197KB
SHA256 15fc7a054efbb9f76d937448fbb4814d7b3f25a6d137e24c1a69e32947eae71e
MD5 5e28e72b443ded036a4cf369d0dda3bf
SHA1 0500de4480a54243b12d096745c6ba04c9479e66
SHA512 7d17a5248e54e4dda8fd17a4d662edbb274629161a1e25b3b7f7f5112541663a5040788177268c53b2c78bc7e6d2204ccfb342d93c2ceec0a12d8a41788c088b
SSDEEP 6144:O7+wum67B2lueEyG+gvJbJEOE2nMWdqNBSiPPdsL:OXlgeEyXIbOOE2nBSBtHmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
Size 24KB
SHA256 d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d
MD5 b82ca47ee5d42100e589bdd94e57936e
SHA1 0dad0cd7d0472248b9b409b02122d13bab513b4c
SHA512 58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383
SSDEEP 384:WVO9Au5n8w8JCE3z7e7Ttbu5+Esl5fnOoHYSDzExWCI3+IEesI1uBVm5ih5DTcOU:fWkn0RSdu59s3nOc5zExGd5Mt4OU
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 36b93a3fe1010959688c938343828751e3b6b5375729407c1deb9c101a897a96
MD5 d0bdcc681f2a380604cbc226096cca65
SHA1 fddf5657c50fe9044d639e5399e0012b32ad375e
SHA512 b0026efb2dbdf7426f0b85a0bc0b95a00708d44f9b1b3c76351bea0ec0475211d3b66bc4983d854973407af2fbf05981cb942b9635ea3fe9201a3c2b71ae3faa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 5f305d7ec2f0f548872f2027fd6510642e937ee31e498b1632e390f4ccb2edef
MD5 d966e959191f6428538f1f507d30d097
SHA1 7a67248748d4aeebf534596d42825ec1083db706
SHA512 1bad39b751686cdc44c12b7b97d6ed9cae9e9d2cad19a8332bfc8407901f850c88ad9402dd3c8420791661d6286ba51e8e71a7a3c67d4306b103d57e4464045e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a82515a0de66d0f99b2e28f6ce37cc0af64a2f3ab0bfbfb1b88663da17370ce2
MD5 e9e90fce4d8bd2d9af011eb5a5172bd3
SHA1 b7b60225ab1b296f81f283211db3515e9f3d7e4c
SHA512 c52d9cbef1cda8c274a508e6b49949f1912d60d27a977590df55c5da0c09643fd67d6cab2acb4312159af09ebefcc27eae903e9f738baaf13917c799eb8ff0a7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a4d9f59a6f766719a26db199c4dd79f882794926674430e2871b037eda606f36
MD5 9e02cdaa58767e3062bd104dcaf3960c
SHA1 f53944780d2e442c551b372d70af461049069a97
SHA512 b35dd7b40544760f724b57802b812be7cbaa827ad275a5e512bd38288b8e1277dab7da638593a86a9601de050eb4c096d8c5a65f806101d030fbb8722c8d9280
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 a46049d21fdb5d97731e93a0e602dd9e461786fbb7d914b0ba5d7c51b7b17f09
MD5 123492dc23cf524d21926b60705c18c2
SHA1 5922430c20bc9cd2aba706491fdd571287e9ab30
SHA512 8c7416527f7675e9751c926d7351f57ae58920a505b1773e7e43157ceab8526d9ded79763f6a1f2bcb6942c0549e22dab8702ec4901dc28b63f0fce4d84a9ab3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 886e72366ce6e83fa31a70d48c2e12088d229ac8c4c8a58f692d0a164272c60a
MD5 45bbc84e7b66d7032bb136733a446914
SHA1 0464ee1d16fe360262d1a4d842537ba1a2c74268
SHA512 88cdf7d5dbd32f4f1046be49466966630b8f00ea6ec764290b8ce47a6e1cabf1101d51b3f8256de11530dc23a3e9ee4be97652835e9f924ee84cf9da23d8cbc3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 4060e7fd8609522cd64fb55a24b3346f3362a3fab76a41c981c8ee0b6c1962f4
MD5 bff696de1bb9cbf4da92e04dd0542f4f
SHA1 bce4366915f06ae62e3c878ed5ae26057b6da848
SHA512 afc57f6a12c136568315358577257b7fce087e7e097641822470f32064da26607b76380b7812a1d0ee166f2bfcdfc1678b2c6b4e56ea261b9f30d15d5fa1ff84
SSDEEP 96:YO6LB6KEVKIbdFd8iZRy7Di+6Msmded0IO5OjBkg0ZgEbjVhYtjEsXt0/cg2Vup:YO6LtEV5x8syy+FS0XeB50eEbotjEsXQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 873737d03f664f3c6bbd5f5ec24cc268cceedf7d4fd5ef37facc645705cedde2
MD5 52a1704e5f4e8c1acc4294edcf0912e6
SHA1 242ff89fe180b608c4f20e44777f83182d68d4b9
SHA512 fed431c866954b3192b0fb34a4fddfd15eb36fecdecd8a04428a06e2b971345f76bd96434d97181298edf862ba0129b42ee627f7d21ba8f59e88eccb3e0d60c8
SSDEEP 192:YO6LtEV5x8syy+Fr2kIzt0eB50eEbotjEsXtScPS:YO6LtELPyxrwzt0eB50eEMtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 6dd0b9a06e8bf860a2fe2380580e031589747308003ccdea3a305f0dfe12a1cd
MD5 74f8c81a725eebd499f3441e5b92f75c
SHA1 24efbddf9b59dddc587324b523d7d4a486aae22a
SHA512 61e9946fc09b558f777f04de1c6ada4ce6c5df013f2e95163be6802a645e13e3466a5b2ec71d4db7c97df02be763cf56056bce3b8fb419f74d44b8225e609d9c
SSDEEP 192:YO6LtEV5x8syy+Fr3k6jtPeB50eEbotjEsXtScPS:YO6LtELPyxrVjtPeB50eEMtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 77f340cb710b5400b1e820341db099e735b4c13cacfa6ecbe8ea1268905f2394
MD5 5dec153ee133f945bdf2ce9bc98c6cc4
SHA1 265a9d062d36caabef6aea869de0a3ae16d32e3c
SHA512 dd6d815aa664887366a23221f06f272530ce968a447cea6c64981295bedd93a7365ec73f6951d6612e406fbec37190957e0074f91b6be7d6a1631c10ef254177
SSDEEP 192:YO6LtEV5x8syy+F79V2kIza0eB50eEpRr2tjEsXtScPS:YO6LtELPyx7fwza0eB50eEpRatIsXtS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 af9510d977cdd000a8421f205d8995cb97c8ac6389c527222a467c62bbe7c75a
MD5 0f258e99729b5ec8e7e5eecb83960125
SHA1 307177152cda59bf45341e9399e3570e036a2bbe
SHA512 856ba7f15d59dc116930c8c12654081f473027351071571d181a6c47d83870b92db40999e2a6c794e5753aa16cdb4508c27e981c5338707bc8d6a59d135057ed
SSDEEP 96:YO6LB6KEVKIbdFd8iZRy7Di+6MsmdeyCkdMkxtgO5OjBkg0ZgEbjVhYtjEsXt0/3:YO6LtEV5x8syy+FrCkdVtveB50eEbotw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 259KB
SHA256 23e882352e9b633d7393c8573cf3dab2d247e181ae9311d180170d6203f695b7
MD5 dad897174a49205c3e53a8ee96b4101e
SHA1 e72202c17615a092d0abed2ce87b296df2980a72
SHA512 97f7c44eed152f9f3bd157a20c1654873ebc5501b93efe2176b003b6c17ffebfb2c268ec5762839006e3363c978379a3b7c25bf390e685d900655fd84ccb1e16
SSDEEP 6144:6rv7qCq4dHL8uXordgRiaCJ6d7Yj3Ua9jHThM8fNHK9K5l:rT4dH/oxIsbUYHTqwNqo5l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8742ad458855b1cd9a0b63b23ffba4b971c9a187c9351196af15180f0f233cd8
MD5 3a818b69f107e565e878a1fe4da84570
SHA1 b6187f5530e55199baeb5318b211fee86f65e61b
SHA512 de51012e460fa744fcb4ca7e5001b1299ab69dc24c8b63ad49dbe15d78e304f8f411c42138a3dae9098c2019c399e00faf02133626438ec72eb6ef127a0bbbbd
SSDEEP 3072:EhBpYx2ZLfq86Eq/AlEyHAk8MPhB6KorpTjg3R2ii7J:4rv7qCq4dHL8uXordgRiJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 dc6f9f294bf6fd2607b2be9c50b2e079b06cd61670a97155d2b32ba86ae993c9
MD5 b6bb885fec9652ac984035f83a023983
SHA1 c4af1bf641ad08bd430061e6a25113d1068bb4ae
SHA512 c91c39e93f1c985d8f3a37fe1d552f3f12796cb48df704d9e5ad5f7c5df3c6c7457574ee4317873e8cf00e3039a20785dfc3a4e8d3e004018abcbaa7bb8a2a2b
SSDEEP 3:MsEllllkEthXllkl2zE/lBKtl:/M/xT02zoKtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 a0bed0713e779db23062ffc7afaf804c8f139c52eb2a2160762feeec770ddbda
MD5 48939a5bfa2dc31ecaea3649b72db34b
SHA1 6b722ea02b96cf4720aaf064bf98a40224e1748e
SHA512 d4deb5bee3f5d291bf2b0e52cdad25b8af672e6ae497dbcd8ecff5b62f47c6feaa2926f65cc77a467c363cccd01442fe78b359d6fdc9e7e3245cc2b4babbc55e
MD5 SHA1 SHA512

Submit Download

4f9daf61-d4c0-437f-b1fe-afe5040ca59a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\datareporting\glean\pending_pings\4f9daf61-d4c0-437f-b1fe-afe5040ca59a
Size 746B
SHA256 56c87b230883e65c931598cd022d12dd2e3712a4f3cb2f6dead18f2469c17f7f
MD5 a145e090a1d5278908d8414813a1f68d
SHA1 d3468d3273c5fad4f61b79c50e509a1b2a24764c
SHA512 eedd155b5b969ff5cdcc4d06c1bab37f6828b377c2d36e2e53b86386c42f442aa1228b5988bb29343adda35dbbecb1c1e7b38bcf1d1d7d5d3945c95d1bc87333
MD5 SHA1 SHA512

Submit Download

f40bdd52-e5d8-4947-8912-fdb1be18b017

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\datareporting\glean\pending_pings\f40bdd52-e5d8-4947-8912-fdb1be18b017
Size 9KB
SHA256 00bcbc516b9bcca1b514ddce3af23b6c082d1b3035ae67becaf6847305f77981
MD5 ca08b9d86f6bac420a341bb1af07978d
SHA1 7ee7415c57f54bc79508fd716fe859c77a4c4478
SHA512 d5f41dcc723f4148cea61eaf569aae8b1194b460df9c20748d9d92bbf569387fd12d9e730c09a09dbf75e4eccfca58c8cde096cb2e90caf1406968e81ec9db12
SSDEEP 192:GKcXESMAJPwJ3ZSf3JqbL01q644V24CQudM+c5L/c/EDlw35f1shAtx7y:GWHB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs-1.js
Size 6KB
SHA256 62bc2b3db324be128df268ce3e468040ba4748d32d7513d615ba6577974f2423
MD5 f22c7f0785e59418a1dc7ab1c24b7f73
SHA1 ce463640dc02bce9d05c51bf6651376dc9b7574e
SHA512 fc0f5035029d6c9bd6def714e8c7ea38c0872c160b5dd156082b10b9c6f2f7a706a25f78091f5e937ff21787b5b689ac1c6cd028089a42932cd80c971c238fd1
SSDEEP 96:xHp5nUTeqGqAd1zmeOTzStPXAnpjYqHH2zQKpBw8Hzev:H5nIRAd1zmeLPX7EHziBw8Hqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\prefs.js
Size 6KB
SHA256 434c05c99c03f6de58687ca599716b7daa1097a9076d7b511853f05ce07f2d79
MD5 7cedfd5d795e3bda72cb23ca3e75f19e
SHA1 6ad6ae5f542b2155b2298027540a9a10b7fe5945
SHA512 8e0791677610f8745a81b7bc8b3080731361d7b22abb880e66a6c1c094313ae7234b19cbe2296dae0313701453d19f72a6b64aa8b8aaab29cffbe42b2b60819d
SSDEEP 96:xHp5nUTeqGqAd1tWKeOTzSlPXAnpjsHH2zQKRBw8Vzev:H5nIRAd1tWKeTPXlHzCBw8Vqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\sessionCheckpoints.json
Size 228B
SHA256 df49028535e3efe4ed524570624866cca8152de6b0069ebb25580fce27dccebc
MD5 66bdbb6de2094027600e5df8fbbf28f4
SHA1 ce033f719ebce89ac8e5c6f0c9fed58c52eca985
SHA512 18782069ef647653df0b91cb13ba13174a09ce2a201e8f4adfb7b145baf6c3a9246ef74bdad0774a3023ec5b8b67aba320641e11dd4b8a195e1c2b448202a660
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 8581b114e308f8e6df46b5d5036549a366c1bea81e04549a406fe1091b276249
MD5 f54425f2306a75f58dadd81668c9548f
SHA1 207b4f7e56a7bc75c1fe46141343b9caebf9d151
SHA512 b849f832914ac188883a5b440a3f684886200f58e5ebea480142cd3bb89be8d7a6638c5430f8b799957026e5d32b7e8db181785721361083f2288a1ef81dc194
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0htfzopy.default-release\sessionstore.jsonlz4
Size 4KB
SHA256 6c47e847a23cbbcb9ba5042d3f8ab23f5d52a3fa8f071ee23c9b08879dfe8ae0
MD5 c688f2f7d56cba3b113f604c63aa649c
SHA1 ccc03b6e3e6fbadff337cf10d23e4540147d132e
SHA512 b8119172a4520644fcf3a546f2f64832a5b19d799555019c0f3c214bf8c92a834857453ebe2b79b53b7c238f582ea4c60b1535cd71c113db02e5195c67fc0c9c
SSDEEP 96:TIpqMey98EMJF7dcMZk0zf8W8Qge3ZwS2BqvN:TIpqMzRgFyMZkcuemFqF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x64.log.html

Path C:\vcredist2010_x64.log.html
Size 87KB
SHA256 ddee32c3d582270eeb948d7569e01bb3114d5037c15801938f691c4b520a4b22
MD5 68ec947b8ac103289c92b07edaf11698
SHA1 a58283a620591a82d9af337015db2aff86267175
SHA512 aa00ceab3f05a503ae4b409d4493837ecdcf0de0d4c4d54ca149b472e8d75698ddf3ace06c45cc41675af88a3fd147b7e264539105813a2ae6b8c417d2bf6966
SSDEEP 384:fdsOT01KcBUFJFEWUxFzvHrh3CKdzvxQEfax6vEDaSo:fdsOTLyUFJFEWUxFzvLJJQUq6vFSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5092-528-0x00007FFE70E20000-0x00007FFE70E31000-memory.dmp

Download

memory/5092-542-0x00007FFE6FAC0000-0x00007FFE6FAD2000-memory.dmp

Download

memory/5092-513-0x00007FFE71600000-0x00007FFE718B4000-memory.dmp

Download

memory/5092-514-0x00007FFE76D30000-0x00007FFE76D48000-memory.dmp

Download

memory/5092-517-0x00007FFE715E0000-0x00007FFE715F7000-memory.dmp

Download

memory/5092-516-0x00007FFE71D30000-0x00007FFE71D41000-memory.dmp

Download

memory/5092-518-0x00007FFE715C0000-0x00007FFE715D1000-memory.dmp

Download

memory/5092-519-0x00007FFE715A0000-0x00007FFE715BD000-memory.dmp

Download

memory/5092-520-0x00007FFE71580000-0x00007FFE71591000-memory.dmp

Download

memory/5092-515-0x00007FFE76D10000-0x00007FFE76D27000-memory.dmp

Download

memory/5092-521-0x00007FFE700D0000-0x00007FFE702D0000-memory.dmp

Download

memory/5092-522-0x00007FFE71540000-0x00007FFE7157F000-memory.dmp

Download

memory/5092-523-0x00007FFE5F960000-0x00007FFE60A0B000-memory.dmp

Download

memory/5092-524-0x00007FFE71510000-0x00007FFE71531000-memory.dmp

Download

memory/5092-526-0x00007FFE71470000-0x00007FFE71481000-memory.dmp

Download

memory/5092-525-0x00007FFE714F0000-0x00007FFE71508000-memory.dmp

Download

memory/5092-527-0x00007FFE70E40000-0x00007FFE70E51000-memory.dmp

Download

memory/5092-511-0x00007FF6B90C0000-0x00007FF6B91B8000-memory.dmp

Download

memory/5092-529-0x00007FFE70D20000-0x00007FFE70D3B000-memory.dmp

Download

memory/5092-530-0x00007FFE70D00000-0x00007FFE70D11000-memory.dmp

Download

memory/5092-532-0x00007FFE70C80000-0x00007FFE70CB0000-memory.dmp

Download

memory/5092-531-0x00007FFE70CE0000-0x00007FFE70CF8000-memory.dmp

Download

memory/5092-533-0x00007FFE70380000-0x00007FFE703E7000-memory.dmp

Download

memory/5092-534-0x00007FFE6FB90000-0x00007FFE6FBFF000-memory.dmp

Download

memory/5092-536-0x00007FFE6FB30000-0x00007FFE6FB86000-memory.dmp

Download

memory/5092-535-0x00007FFE70860000-0x00007FFE70871000-memory.dmp

Download

memory/5092-538-0x00007FFE70350000-0x00007FFE70374000-memory.dmp

Download

memory/5092-537-0x00007FFE70830000-0x00007FFE70858000-memory.dmp

Download

memory/5092-539-0x00007FFE70480000-0x00007FFE70497000-memory.dmp

Download

memory/5092-540-0x00007FFE6FB00000-0x00007FFE6FB23000-memory.dmp

Download

memory/5092-541-0x00007FFE6FAE0000-0x00007FFE6FAF1000-memory.dmp

Download

memory/5092-512-0x00007FFE76D80000-0x00007FFE76DB4000-memory.dmp

Download

memory/5092-543-0x00007FFE6FA90000-0x00007FFE6FAB1000-memory.dmp

Download

memory/5092-544-0x00007FFE6FA70000-0x00007FFE6FA83000-memory.dmp

Download

memory/5092-545-0x00007FFE6FA50000-0x00007FFE6FA62000-memory.dmp

Download

memory/5092-546-0x00007FFE6EA10000-0x00007FFE6EB4B000-memory.dmp

Download

memory/5092-547-0x00007FFE6FA20000-0x00007FFE6FA4C000-memory.dmp

Download

memory/5092-548-0x00007FFE6E1F0000-0x00007FFE6E3A2000-memory.dmp

Download

memory/5092-549-0x00007FFE6F9C0000-0x00007FFE6FA1C000-memory.dmp

Download

memory/5092-550-0x00007FFE6F9A0000-0x00007FFE6F9B1000-memory.dmp

Download

memory/5092-551-0x00007FFE5F8C0000-0x00007FFE5F957000-memory.dmp

Download

memory/5092-552-0x00007FFE6F980000-0x00007FFE6F992000-memory.dmp

Download

memory/5092-553-0x00007FFE5F680000-0x00007FFE5F8B1000-memory.dmp

Download

memory/5092-554-0x00007FFE6E9D0000-0x00007FFE6EA05000-memory.dmp

Download

memory/5092-555-0x00007FFE6E8A0000-0x00007FFE6E8C5000-memory.dmp

Download

memory/5092-556-0x00007FFE6E9B0000-0x00007FFE6E9C1000-memory.dmp

Download

memory/5092-557-0x00007FFE6CF90000-0x00007FFE6CFF1000-memory.dmp

Download

memory/5092-559-0x00007FFE6E170000-0x00007FFE6E182000-memory.dmp

Download

memory/5092-558-0x00007FFE6E1D0000-0x00007FFE6E1E1000-memory.dmp

Download

memory/5092-560-0x00007FFE6D620000-0x00007FFE6D633000-memory.dmp

Download

memory/5092-561-0x00007FFE5F5E0000-0x00007FFE5F67F000-memory.dmp

Download

memory/5092-562-0x00007FFE6CF70000-0x00007FFE6CF81000-memory.dmp

Download

memory/5092-563-0x00007FFE5F4D0000-0x00007FFE5F5D2000-memory.dmp

Download

memory/5092-565-0x00007FFE5F350000-0x00007FFE5F4C8000-memory.dmp

Download

memory/5092-564-0x00007FFE698A0000-0x00007FFE698B1000-memory.dmp

Download

memory/5092-567-0x00007FFE5F210000-0x00007FFE5F322000-memory.dmp

Download

memory/5092-568-0x00007FFE5F1F0000-0x00007FFE5F201000-memory.dmp

Download

memory/5092-569-0x00007FFE5F1D0000-0x00007FFE5F1E1000-memory.dmp

Download

memory/5092-570-0x00007FFE5F1B0000-0x00007FFE5F1C2000-memory.dmp

Download

memory/5092-571-0x00007FFE5F190000-0x00007FFE5F1A8000-memory.dmp

Download

memory/5092-573-0x00007FFE5F140000-0x00007FFE5F169000-memory.dmp

Download

memory/5092-572-0x00007FFE5F170000-0x00007FFE5F186000-memory.dmp

Download

memory/5092-574-0x00007FFE5F120000-0x00007FFE5F132000-memory.dmp

Download

memory/5092-566-0x00007FFE5F330000-0x00007FFE5F347000-memory.dmp

Download