ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb

Resubmissions

27-04-2024 20:36

240427-zdqtwagc9s 10

27-04-2024 20:33

240427-zbwbksgc5t 8

Analysis

max time kernel
148s
max time network
156s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-04-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.ps1
Size

1B
MD5

0cc175b9c0f1b6a831c399e269772661
SHA1

86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
SHA256

ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
SHA512

1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exerundll32.exe

flow pid process

151 4880 msiexec.exe
153 4880 msiexec.exe
156 1868 rundll32.exe

flow	pid	process
151	4880	msiexec.exe
153	4880	msiexec.exe
156	1868	rundll32.exe

Loads dropped DLL 27 IoCs

Processes:

MsiExec.exerundll32.exeMsiExec.exerundll32.exerundll32.exerundll32.exe

pid	process
2384	MsiExec.exe
2384	MsiExec.exe
2384	MsiExec.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
4220	MsiExec.exe
4220	MsiExec.exe
1868	rundll32.exe
1868	rundll32.exe
1868	rundll32.exe
1868	rundll32.exe
1868	rundll32.exe
4220	MsiExec.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
4220	MsiExec.exe
3424	rundll32.exe
3424	rundll32.exe
3424	rundll32.exe
3424	rundll32.exe
3424	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 20 IoCs

Processes:

msiexec.exerundll32.exerundll32.exerundll32.exe

description	ioc	process
File created	C:\Windows\Installer\e59912a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A82.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9A82.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICF2F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE653.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e59912a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A82.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A82.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICF2F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF2F.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID913.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE653.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI990A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF2F.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE653.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE653.tmp-\CustomAction.config	rundll32.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings firefox.exe
NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\EpicInstaller-15.17.1.msi:Zone.Identifier firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\EpicInstaller-15.17.1.msi:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exeMsiExec.exemsiexec.exe

pid	process
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
4220	MsiExec.exe
4220	MsiExec.exe
4220	MsiExec.exe
4220	MsiExec.exe
4220	MsiExec.exe
4220	MsiExec.exe
1472	msiexec.exe
1472	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exefirefox.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	2552	firefox.exe
Token: SeDebugPrivilege	2552	firefox.exe
Token: SeDebugPrivilege	2552	firefox.exe
Token: SeShutdownPrivilege	4880	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4880	msiexec.exe
Token: SeSecurityPrivilege	1472	msiexec.exe
Token: SeCreateTokenPrivilege	4880	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4880	msiexec.exe
Token: SeLockMemoryPrivilege	4880	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4880	msiexec.exe
Token: SeMachineAccountPrivilege	4880	msiexec.exe
Token: SeTcbPrivilege	4880	msiexec.exe
Token: SeSecurityPrivilege	4880	msiexec.exe
Token: SeTakeOwnershipPrivilege	4880	msiexec.exe
Token: SeLoadDriverPrivilege	4880	msiexec.exe
Token: SeSystemProfilePrivilege	4880	msiexec.exe
Token: SeSystemtimePrivilege	4880	msiexec.exe
Token: SeProfSingleProcessPrivilege	4880	msiexec.exe
Token: SeIncBasePriorityPrivilege	4880	msiexec.exe
Token: SeCreatePagefilePrivilege	4880	msiexec.exe
Token: SeCreatePermanentPrivilege	4880	msiexec.exe
Token: SeBackupPrivilege	4880	msiexec.exe
Token: SeRestorePrivilege	4880	msiexec.exe
Token: SeShutdownPrivilege	4880	msiexec.exe
Token: SeDebugPrivilege	4880	msiexec.exe
Token: SeAuditPrivilege	4880	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4880	msiexec.exe
Token: SeChangeNotifyPrivilege	4880	msiexec.exe
Token: SeRemoteShutdownPrivilege	4880	msiexec.exe
Token: SeUndockPrivilege	4880	msiexec.exe
Token: SeSyncAgentPrivilege	4880	msiexec.exe
Token: SeEnableDelegationPrivilege	4880	msiexec.exe
Token: SeManageVolumePrivilege	4880	msiexec.exe
Token: SeImpersonatePrivilege	4880	msiexec.exe
Token: SeCreateGlobalPrivilege	4880	msiexec.exe
Token: SeCreateTokenPrivilege	4880	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4880	msiexec.exe
Token: SeLockMemoryPrivilege	4880	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4880	msiexec.exe
Token: SeMachineAccountPrivilege	4880	msiexec.exe
Token: SeTcbPrivilege	4880	msiexec.exe
Token: SeSecurityPrivilege	4880	msiexec.exe
Token: SeTakeOwnershipPrivilege	4880	msiexec.exe
Token: SeLoadDriverPrivilege	4880	msiexec.exe
Token: SeSystemProfilePrivilege	4880	msiexec.exe
Token: SeSystemtimePrivilege	4880	msiexec.exe
Token: SeProfSingleProcessPrivilege	4880	msiexec.exe
Token: SeIncBasePriorityPrivilege	4880	msiexec.exe
Token: SeCreatePagefilePrivilege	4880	msiexec.exe
Token: SeCreatePermanentPrivilege	4880	msiexec.exe
Token: SeBackupPrivilege	4880	msiexec.exe
Token: SeRestorePrivilege	4880	msiexec.exe
Token: SeShutdownPrivilege	4880	msiexec.exe
Token: SeDebugPrivilege	4880	msiexec.exe
Token: SeAuditPrivilege	4880	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4880	msiexec.exe
Token: SeChangeNotifyPrivilege	4880	msiexec.exe
Token: SeRemoteShutdownPrivilege	4880	msiexec.exe
Token: SeUndockPrivilege	4880	msiexec.exe
Token: SeSyncAgentPrivilege	4880	msiexec.exe
Token: SeEnableDelegationPrivilege	4880	msiexec.exe
Token: SeManageVolumePrivilege	4880	msiexec.exe
Token: SeImpersonatePrivilege	4880	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

firefox.exemsiexec.exe

pid process

2552 firefox.exe
2552 firefox.exe
2552 firefox.exe
2552 firefox.exe
4880 msiexec.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2552 firefox.exe
2552 firefox.exe
2552 firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

firefox.exe

pid	process
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2088 wrote to memory of 2552	2088	firefox.exe	firefox.exe
PID 2552 wrote to memory of 3408	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 3408	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4140	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1060	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1060	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1060	2552	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.0.1925398324\2039631857" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1680 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebcc80da-c199-4b9f-aff7-565d273b8cc2} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 1764 270cfcd5858 gpu
3⤵
PID:3408

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.1.1447953635\1085442591" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a8e45ed-419b-4eef-8de0-af2f24184c41} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 2120 270bd672b58 socket
3⤵
PID:4140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.2.265540757\635014991" -childID 1 -isForBrowser -prefsHandle 2700 -prefMapHandle 2816 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8e98998-a457-4a72-ae06-60468505d7f7} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 3028 270d3c9c158 tab
3⤵
PID:1060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.3.1887693867\754333403" -childID 2 -isForBrowser -prefsHandle 3488 -prefMapHandle 3484 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {084367e7-decb-4cc9-a15d-ac86ee28553e} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 3500 270bd662258 tab
3⤵
PID:1084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.4.1752674003\1934568950" -childID 3 -isForBrowser -prefsHandle 4324 -prefMapHandle 4340 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {657f1527-be09-40db-a114-8f7e5057c8be} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4444 270d5f1c858 tab
3⤵
PID:2404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.5.996723171\541263122" -childID 4 -isForBrowser -prefsHandle 4808 -prefMapHandle 4784 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {722ab432-a52f-4544-8a45-e9cd5bacd568} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4860 270bd666858 tab
3⤵
PID:2780

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.6.1226836893\301891582" -childID 5 -isForBrowser -prefsHandle 5004 -prefMapHandle 5008 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0886a3a-c21b-4a2a-ab3f-90622493e3e1} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4996 270d42c2458 tab
3⤵
PID:3808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.7.535247981\1661015074" -childID 6 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f21aa7c-7c97-4e52-8366-1b32c563a58c} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 5188 270d57eaf58 tab
3⤵
PID:4940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.8.1947249126\1708613373" -childID 7 -isForBrowser -prefsHandle 5648 -prefMapHandle 5644 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51718070-2ab8-402d-8811-50facae2ea8a} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 5656 270d775a458 tab
3⤵
PID:3444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.9.1201827597\1478406102" -childID 8 -isForBrowser -prefsHandle 3892 -prefMapHandle 3912 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36289b88-4fd2-4fcb-a89f-8a1beb57fbde} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 3936 270d775a158 tab
3⤵
PID:3992

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.10.826005311\755426112" -childID 9 -isForBrowser -prefsHandle 2976 -prefMapHandle 3460 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76d7cca3-49f0-461e-ae7c-58a5070b44b9} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4476 270d2ece058 tab
3⤵
PID:1532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.11.98516994\957037164" -childID 10 -isForBrowser -prefsHandle 4988 -prefMapHandle 4924 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {419bc4ac-85f8-4d58-8616-49dbd32dde32} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 5352 270cffa4a58 tab
3⤵
PID:3196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.12.2135961696\1624222170" -childID 11 -isForBrowser -prefsHandle 4584 -prefMapHandle 6000 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a46e124a-ff2c-4049-a89b-ab912ce6839b} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 5888 270d8bae858 tab
3⤵
PID:3384

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\EpicInstaller-15.17.1.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4880

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AE1B4ACDD239D3CE07C368F803967E1B C
2⤵
- Loads dropped DLL
PID:2384

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8BDD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240749562 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
3⤵
- Loads dropped DLL
PID:5036

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1BE0034CBF5A5AF861C2C1A655F9F60E
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI9A82.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753296 10 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:1868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSICF2F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240766781 16 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSIE653.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240772687 22 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3424

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Filesize
471B

MD5
c8b978e2ff8d18a43f298476c84c70a2

SHA1
6eff4954121439680057b3e1a926d37b79d1336f

SHA256
850bb1a97eb6d59172efa0499841035f4adac0f4f48841e668cc030cec328911

SHA512
1ba3ce148566af5162ac3092483cff6a87e53e613fd55cabad91f8b07eb84cf086081b74893fd6be8719a200136191a04f7455763365ca47cac19747490e6cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB
Filesize
471B

MD5
f0e43c972479b11dbc79e2e14d6fc974

SHA1
a1eccde7d697160e19a8a33e05992d190ccbc32e

SHA256
06a0a35279b543b7e1c4d62b134d0da5a24f617bb13a978150b4c0313c14b964

SHA512
5dd630f9d7f76d1319c817726017b0f1010bbfce88df028e2072912b00a9787df14e7dedfab922022ad736a6c320bb1ba6b317839c838c0391fd21fbac3fc3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Filesize
404B

MD5
4c3be3695c7cf8b294756c94a63cb7b8

SHA1
63fd595648b73e258f3e838d2c8e4f304662bc74

SHA256
4d53328b760fcf526289622e7f34e22eeb2517a2426be48fb5e183e5d973dab6

SHA512
fbf573ceb47ddc204a7c3b3e4e1fd4179ffc49c1a8ef8a599260f33ae22c90cfabd380f99121637e91e1c5b3fceb5fce51c5a89f11457a557e58ae7bc50411ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB
Filesize
404B

MD5
158fb3a1da322f094f03d497c03bb94a

SHA1
f9a31a714be01dbfe7397e04e931c6968d5b65d9

SHA256
53f8083f8d00afae53c7b0184b7360bd63c1165d5c4dac8db4c7f32f0511fdf0

SHA512
cb0d6a1ef7b5374494125c5b31769f45a24502806ee4b75a88d07406c4149779903d8510fa445edaa60bf2564acd0c58044580fab1a0b1eb7314f244b2ba77da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Filesize
651B

MD5
47c6667a0d9d4bdb4e5215578054c0d6

SHA1
56f494a719ad3cf29723458166d9831719941fa4

SHA256
b2526c381832cbe24e8f0d14bb7dbf8e9ab753e087a2f9b7d6b8e36065672355

SHA512
7af086ffeee540b70efd190db4b77867356452d2b22904665d6fb53fa0b3749cba6f0613cb96134bed91ba2fa80bf4cced1d8af28679d27f230748fc0d38e5e5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\41eh5pdr.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8B30.tmp
Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_agaqqglq.x5k.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
5.5MB

MD5
f76417289f9eed5898107e0cd06284ac

SHA1
c68f7c51da6f39283238cf6f58c7303a35c35a46

SHA256
9e7d43aa94a9ecde70650065eb915a883f9be3a6bedacc7c74315ebaf49c3f4b

SHA512
b0139c32b3d89456d54ecd8ce2163759f4395ef463ec567980ee0a83eff53914929c36b0bbdd40681b4d69a8100257adfd10cdda9fda0ca241d3649b1d5bb34a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
e0390b8b6afcbe5fc10533e3e8d1e370

SHA1
512cd6be65503c4db51fff3a83c2d27e000fa02b

SHA256
944f0786a88f96016f15eebcb1df2b55c1d22963712d2ae05e00b8f7b388b871

SHA512
81a8888bc781c50ef8fd963926ca98c652c5c780453f2fbf4ee1cefd11c6005cbf6657275c706bd0300114f79e772f15b4dad464377049d7f14181fe757062a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\pending_pings\3397cf3c-9109-49a8-9144-74c3a648bb21
Filesize
10KB

MD5
3e2985acea5ba4ebab4dbc4e165d5312

SHA1
15d683045c22155456dfed475e2a0a7d3aa1390d

SHA256
2e5f72641ad89c0d184b3dd883f9a361724883a8093d78ca520245451bd148ae

SHA512
6569552dfbf5f3070f93c00eda103bd8cff055a598495786f72cf837e5b643af0db082b2584fe81272e2b851d01c57887678a78959b464db359ce319b60dc630

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\pending_pings\d646b6c7-dcd1-4cfe-a470-db4cb4322c5d
Filesize
746B

MD5
fa6c84cd54af1bc8482a2d2c1bdcb06d

SHA1
09ba755d6d8fa97fb2282022217ed02dc198d113

SHA256
b288dc99ab09c6220ee596719734a81779aa5f457abe377599b043bbdb49ef3f

SHA512
6991e0a0b98ee7f33847f919dab05d3e884fbbd54dc124ba7949cfd380000708e586bcaced3b7e232d29365575c77a9911844d6042ddd7a87d70e93d85c31052

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize
5.1MB

MD5
a18edee7f40707f6dd6011f7d5e75090

SHA1
bddec9fea65096c0b9771b3fdf656254bb14f2bf

SHA256
224ae62460b52f684192097d7ccbbd920f53864e4c3f0e5961a3ad298089fe26

SHA512
eb22b53a9d5773aec07a70486baa831ace19d9fb5a39f7d2264740e8ba292273dfc14794685d7ce2e093ed2e20d94735e7644568b8a1ce1184612c3ed5271bfd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.js
Filesize
6KB

MD5
8ddd14892777036fa29b0c374f031368

SHA1
8bc60fc61a0429d36bc70fcc678cfca618a53795

SHA256
589576ba84596f0014a3fd1e02f4aa06c4f1092531a011fe3d7fc3db2598ced1

SHA512
93784c57db99aeb228967a5d04bfb6bb1fdb2a997753aed9abd45ba763e1b9106f44a0f3a61d8da6b22db049c8d01eddd9aead189989367125f389af0ada8771

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.js
Filesize
7KB

MD5
da9c8eaf3adaa632a1c2295919aeffed

SHA1
2b091657683d30c1cbfb920dcd4465cc3a90bad7

SHA256
5013ea0c81e97d7b90b928b5390d318fd834b58c178259a64fbb840c3d48222c

SHA512
16b474e8f58d46699cf2f7e1c62e5a0ccd498223bf1469cbc7913f09a261fbc13ecb81cd6c7d8492f543c87cf99275b6f496908ab354a5ee96e0fc59a485fc06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.js
Filesize
6KB

MD5
2c34d8d4fd943c344a0c873403ec4a91

SHA1
3a2b85d4f5f3f2b93805f8fa4d07098e01cdcc44

SHA256
50bc324f2393f11ed8f0e11ffbc96f1c76f9677f119a62b2eccae49df5fc182a

SHA512
d3a53c7b6a97fb43d92078a155f07d546171c9279ebbc79a6160f388afeef4b3062e3c78cb01b476b0759824c24c549b81307939c323408f358e12e74ce57d9e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.js
Filesize
6KB

MD5
6f7a962a6d57d30f31a53e482c517045

SHA1
5461c7ca2ce07cf17680cba421c14ecab35b514c

SHA256
85d7d562c0c4f04714f078f310b2d9966b30f215492a4e93d83a23b271e3d37d

SHA512
885fcd406aa5921790431d105c7c37884581aa2d384169495ae47d8f016db84eb53f8eac2b3f35ac2e4899659c3f616586d94c5fdf2bcefa8c2b6f6823476131

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.js
Filesize
6KB

MD5
7498f1c6d33327f684d266a08ec6d282

SHA1
5b16aeee22d883e5d4bf10b566de503360d51ce6

SHA256
efd906d4ff1f74c60530eed653137acf0f7967393b9f3587a22d701c0a17d8b7

SHA512
131fdad3854ea30a9edaa79cac75f3fe1616eeea32a3fb297b6bd7946ea3d194e1d811c2cbfd440e027fde3d1705659a96ea7167ccf2aa83c43e16216a39f214

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\serviceworker.txt
Filesize
174B

MD5
b9b6360cc08698c8f2801c61572a2f11

SHA1
c5ab8873e9973bd2090c5e78ab521aa8799c4a7d

SHA256
d4127d132dfd52099a006e4545e92bab154ebd735652bdd1535ae4df67a2520c

SHA512
c8fa7f2caec64cb9c41be153db963ffaace7067e5dc2cde93d2531bda1ef463ca832aa45c482e47142158e20dccdf7e3a8c7661ee42be8d0817802fda0230139

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
2d2222661a978538d4af591ae2dfeb7d

SHA1
df915f235cbebb8d9588f6adfef94fa77eb14a6d

SHA256
579105503bf23d51a5d8e663de5e5c231346841f13a078a48f6517118054cfbc

SHA512
28ee59c34fc310a1a04bff46db9752e763d5fecc8cbde7efa57935376af2dad62a189fec500c216b109d38276195624dee2c5b948a67ffa6136816a4ab75a89f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
7de046a9438ba5321dc92d94f016de16

SHA1
330e6bb2774639b26c3e6a92444858fc0e031cc7

SHA256
97bdf5c884dab0edece6c6dbb11c59b641c72725c01643b83dc03283d5daca71

SHA512
879b0a984caa49e7cad4ad3108314138d5f6a15663c8a1997ad86af0e725a37ebe9255db2f8594a207f2268ffbccd0a948792e32907fe267ef92c2248e724fa1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
2KB

MD5
80503ce0f1251cc7bc743aeeea37d5c3

SHA1
5fe35aae3fada69df9947dd87371f567c09c5241

SHA256
3fbf7b50ec8ea43307a1a1c4464b21238f2c4c7ca1c913320b9acff9c381a980

SHA512
981c2e2c5d9e6fad56aa987c2e7ddfe64fc8098adbec0401ff934333252c1838bac86f120a6fa3c5f25c2da834d9668eb95c8f55150caa16978d8100fd719311

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
10KB

MD5
8cf4edd18bd18d16cb641c4c5cfc549e

SHA1
c7475051cf7c7f9ad252f8e6ab1daa1065142fe6

SHA256
a85c77db71a0ee42f2449dbe96a9d99d2b80ca6858f456b9c95054c6b8a51c7e

SHA512
da9034ed17729000d595db5f8416bca077c45d86f369a447b123cc8a1781b55fa97a95ad9022db33181cbcfb34f467e9680fca5a6c5a0ea8134cb4bd4e5f198b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
10KB

MD5
2ecd90b0536c1b5f495042a61e969de0

SHA1
ae6da64978e95de0c16223b26bd510cf65c0e1dc

SHA256
5b6961e5edbb6d3a4ecc6ded3d75326be7abb67887e2050376d91493fa7eb7fc

SHA512
11a7e77b5f05fc81d551d3972d85cf519bdcff0730a954ce9eaf52e8312891e924ad74295a167f4ed3a6e3e3dc34083222a1416711f2bda2d6d438ffe0c28bcb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\storage\default\https+++store.epicgames.com\cache\morgue\221\{efd8600a-83f5-40b3-9d3e-3f048de990dd}.final
Filesize
4KB

MD5
cc20a909076adb717485fc156226456a

SHA1
fb16ef21c3d581c1f3863d6118c74f37bd34e326

SHA256
367dfe83ce1c30853e56eccb2bd9bd28584dc47265af9a5792fbb73b21117501

SHA512
7af0ffabd18d7bc14afa2cdfa4ea6b8850682d3abb15a836372bee08aa9b41292d1d5db3d47a2c5080627de723abcdb329c119881af9d2402320c59579961f86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\storage\default\https+++store.epicgames.com\idb\2886129919SetsaatbsaDta.sqlite
Filesize
48KB

MD5
6c162d449941ee290587ab72ff5612e5

SHA1
62149f7f18508c498007b4c16609075021ee8547

SHA256
a499db931821190101eaeb84a437ea8d6076d89062ec50751a310439b90db72e

SHA512
2f12c2c943ed298dd80b23d25424daa5486d5439629c53fddf07c7759e0a098fe5fb6c1dc8f76155d6422d473b1b6bc2f85009561868ae3e644c26894d3a87a8

Download Submit
C:\Users\Admin\Downloads\EpicInstaller-15.GYUUXxqi.17.1.msi.part
Filesize
176.5MB

MD5
7a2cf04ac0c504a8ea5aed805dde484d

SHA1
0536d7a178d1a42cea1476ea6b44bc53ed26bc63

SHA256
6f3f486d7a8409fc174198818c039152c6268bd9fdf210ee6be1c91bf832b7e9

SHA512
42aeed1d015ab279df3065e04adff8001672a13180f4d73121ace3bc8989783f12c7a5d0b50c684c74fd138fc1b4f451439acd7b6342d4f60c7d3a18034e0988

Download Submit
C:\Windows\Installer\MSI9A82.tmp-\CustomAction.config
Filesize
1KB

MD5
3a35350940b2fa2c5a9c57bdb25aae3f

SHA1
f4d32d9e007478c80c23f7b70245d6401550ce6a

SHA256
361f2f5623b1e11403827ffd625c9edc5d7977d584393d6475fc5e6559c3edb7

SHA512
62756d9247cd6ead152f00d5ff7627e3158e5f0beae00520510830eeb9b1ff5b3a33201bc81240bd31f066198c6b639e3f2cbceb9155c2ce994900ab3a685e8b

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7C4A.tmp
Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8BDD.tmp
Filesize
253KB

MD5
f54843af156794ba61ae0ec764251229

SHA1
069ba2232c67729a23841ec6c69021ce63b59a37

SHA256
02a22318281d8f0475076239a63434189b142f2f533ca378d074ab9eb4e9cfda

SHA512
2d687454aefcf93667b4d044092f549650c048e9311ed0a474f7e573f5bc8f9e3e18cecd00a69eb6f2fecedaa23cc63ad882c193b310d52dbacc6e8049e7ce5c

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8BDD.tmp-\CustomActionManaged.dll
Filesize
35KB

MD5
2b54558c365370886723974967a60b45

SHA1
faf9bf7ac38bf35701db8bd14321ba5e97a0103f

SHA256
a7c459ca67d6388eb3c8d16a210e1dc73f6abffbb8a78bcf071c22f809942afa

SHA512
a47e0589fe690d45eebdd540033fb1c0bef88dbb6a9ed6fdda0b989def4ebe5683a387ca2f72819727ba5ba372368bc35f76fc6bb32ef860f298fc13525bab84

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8BDD.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
memory/5028-31-0x0000023D121A0000-0x0000023D121B0000-memory.dmp

Filesize
64KB

Download
memory/5028-7-0x00007FFD98670000-0x00007FFD9905C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-9-0x0000023D121A0000-0x0000023D121B0000-memory.dmp

Filesize
64KB

Download
memory/5028-8-0x0000023D121A0000-0x0000023D121B0000-memory.dmp

Filesize
64KB

Download
memory/5028-10-0x0000023D12390000-0x0000023D12406000-memory.dmp

Filesize
472KB

Download
memory/5028-4-0x0000023D12160000-0x0000023D12182000-memory.dmp

Filesize
136KB

Download
memory/5028-35-0x00007FFD98670000-0x00007FFD9905C000-memory.dmp

Filesize
9.9MB

Download
memory/5036-719-0x00000000048A0000-0x00000000048CE000-memory.dmp

Filesize
184KB

Download
memory/5036-723-0x00000000048E0000-0x00000000048F0000-memory.dmp

Filesize
64KB

Download