3c372a8919c28dc76414b2f30da423c3e1018b1a8444527949ce20cc3fc93ed0

Analysis

max time kernel
923s
max time network
842s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Size

85KB
MD5

f8f4522d11178a26e97e2046f249dfa7
SHA1

8b591d9a37716e235260fb6b3f601e4ccbebf15d
SHA256

3c372a8919c28dc76414b2f30da423c3e1018b1a8444527949ce20cc3fc93ed0
SHA512

52ea881cad501cf1d5e8ac47355e862ac1bd39cb6e1ff3d362d392b6f2d676e74878832505d17a552aaa3bc8f3977da11fa3f9903722eedd23716fb46ddb7492
SSDEEP

1536:6vFJ5SF9I3BbbHVlnOXrPBdfeISRAOl801AbcsqD95wSxdRfP:eFJ5S7Mbb1lnOXrPXe7Yhq5Z3

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4632	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	taskmgr.exe
Token: SeSystemProfilePrivilege	4632	taskmgr.exe
Token: SeCreateGlobalPrivilege	4632	taskmgr.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: SeDebugPrivilege	760	firefox.exe
Token: 33	4632	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4632	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe
4632	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
760	firefox.exe
760	firefox.exe
760	firefox.exe
760	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 2404 wrote to memory of 760	2404	firefox.exe	114
PID 760 wrote to memory of 4856	760	firefox.exe	115
PID 760 wrote to memory of 4856	760	firefox.exe	115
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 2260	760	firefox.exe	116
PID 760 wrote to memory of 5208	760	firefox.exe	117
PID 760 wrote to memory of 5208	760	firefox.exe	117
PID 760 wrote to memory of 5208	760	firefox.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
"C:\Users\Admin\AppData\Local\Temp\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
1⤵
PID:3708

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:420

C:\Windows\System32\_iyiwy.exe
"C:\Windows\System32\_iyiwy.exe"
1⤵
PID:2868

C:\Windows\System32\_iyiwy.exe
"C:\Windows\System32\_iyiwy.exe"
1⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.0.946523667\1871596162" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf990545-275a-4e80-b48c-df0e346c1f3b} 760 "\\.\pipe\gecko-crash-server-pipe.760" 1948 1cfad4d9e58 gpu
    3⤵
    PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.1.817659543\1620194709" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfff2f5e-50f5-4478-98a4-f5670867b135} 760 "\\.\pipe\gecko-crash-server-pipe.760" 2352 1cface3eb58 socket
    3⤵
    - Checks processor information in registry
    PID:2260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.2.1230813488\359079487" -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 3128 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15cbcea5-4f9d-439a-937a-f4c1cafb3a3d} 760 "\\.\pipe\gecko-crash-server-pipe.760" 3144 1cfb13b8658 tab
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.3.419920419\1840500955" -childID 2 -isForBrowser -prefsHandle 3784 -prefMapHandle 3780 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a011dd23-680a-46bb-8a39-a214ab6d73e9} 760 "\\.\pipe\gecko-crash-server-pipe.760" 3796 1cfafaece58 tab
    3⤵
    PID:5356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.4.1355983539\1152503514" -childID 3 -isForBrowser -prefsHandle 4032 -prefMapHandle 4112 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be8bed73-5b5b-4104-a02d-b3376c8deb7a} 760 "\\.\pipe\gecko-crash-server-pipe.760" 4128 1cfb27e0d58 tab
    3⤵
    PID:5400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.5.358145182\673227461" -childID 4 -isForBrowser -prefsHandle 3848 -prefMapHandle 5100 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {034016e8-8f4f-4053-9568-e51137295ac7} 760 "\\.\pipe\gecko-crash-server-pipe.760" 4504 1cfb2740c58 tab
    3⤵
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.6.597602499\1617201931" -childID 5 -isForBrowser -prefsHandle 5308 -prefMapHandle 5304 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c153201-deaa-4041-a89f-2ebe55eec474} 760 "\\.\pipe\gecko-crash-server-pipe.760" 5316 1cfb3af9e58 tab
    3⤵
    PID:380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.7.2078801813\1374045513" -childID 6 -isForBrowser -prefsHandle 5460 -prefMapHandle 5224 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16b3128f-f7d2-41be-bc77-555b1f183c91} 760 "\\.\pipe\gecko-crash-server-pipe.760" 5452 1cfb3af7a58 tab
    3⤵
    PID:5288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.8.92785803\1423902641" -childID 7 -isForBrowser -prefsHandle 3548 -prefMapHandle 5832 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf51b36e-acb2-4257-911c-daa5ac76bc14} 760 "\\.\pipe\gecko-crash-server-pipe.760" 5076 1cfafb33a58 tab
    3⤵
    PID:3776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.9.1498441084\1480267893" -childID 8 -isForBrowser -prefsHandle 5048 -prefMapHandle 5044 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2399ddbe-e580-496d-89c8-64f17863f382} 760 "\\.\pipe\gecko-crash-server-pipe.760" 4680 1cfb49f5558 tab
    3⤵
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.10.184246838\1875210013" -childID 9 -isForBrowser -prefsHandle 5168 -prefMapHandle 5184 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ed759fd-253c-43ed-805e-43fd0a773932} 760 "\\.\pipe\gecko-crash-server-pipe.760" 5156 1cfb4d9db58 tab
    3⤵
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="760.11.1196087057\1599798823" -childID 10 -isForBrowser -prefsHandle 7776 -prefMapHandle 7784 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b6f86bc-34c8-45fb-acda-c8353bca1e14} 760 "\\.\pipe\gecko-crash-server-pipe.760" 7732 1cfb4f1ce58 tab
    3⤵
    PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3616 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\12014

Filesize
16KB

MD5
6c68c83770c35e4de62b8c076907e3fb

SHA1
4456e4d42d16e2a51565558afe0ff4867da29dfc

SHA256
00c5d61fb30783e293e4385abae4eaf78b2dff23bdc1dd26dab3fa4a996e7670

SHA512
15df3ac950b5082688d34d8e9fb462cb109fd8471f60221cf1d7d76210f9ac03b670d44f4d7dd5061b597b5cc8aa96311bf0a401995ec3c56f0cf5710cf2a5f2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\12930

Filesize
43KB

MD5
aac654eb919e5f2e2cda30133cf0db97

SHA1
a9937bba420fa31b776330c4a47f3cf303752d42

SHA256
cbe8eb615ac91dace91fabeb37414dd6b6e83db786a246c5f0d9afd66fcf2bda

SHA512
2936893cb688493b79817fb5a444e1317bb398f9442e5cc1857bc336d49fa96640cc56230769e7ffabfb57fc000bbc8880b214b0ddb3fb58decc3ca9ecfc421d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\19826

Filesize
16KB

MD5
d2ad9ca9e48f084308da079ba2b15893

SHA1
2f82c71afae3c6208debd3d408897aaeb22279d4

SHA256
866cc6d3d5b9fb214c67aca9ffabf5d267537fe0cbbcf5bfb325e82752697174

SHA512
0e4debbf22cad735608a386d5aa2eb099f433d49d7ded262f31b2c945c6a7bbab26c78b975c0b08a440658804a8e45695979a5b3e9ab7619ed4ffd1efc052fbe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\26918

Filesize
16KB

MD5
9fae3993ae36311d9c966614b582a373

SHA1
dcc5717747ef357cab2ba6ecbc185483d183f6ed

SHA256
832fce272b725c6a3eb3a3a6013f15781fba688f5bb831d004357375ab39b4fa

SHA512
bf2526cc08304abaefd1afa1ed8c08a6f7b93e4ed4349d5e06f8f04a7573c5daa08098159cd56da429e1b35aac03f5fd87c0b89518b8f5982adc7493ef924f0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\28040

Filesize
16KB

MD5
fd7d8566a4e27260977a115478d7e71b

SHA1
b42b34b431399639dcfa1d267c99d55190908452

SHA256
edf093734ec4019b4384a39de65087a31f78b9a6ea644a6147b3e3268c52d997

SHA512
367d09ac008040fad96ca24dd69776552b6c3f24957320e28f89df658c99e39256c239570da6094774e9d7a16b38db5dee6d3947b822a0b96c061064a6422e65

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\29688

Filesize
16KB

MD5
d19e5e9db62628cad3db0766db2bfd51

SHA1
81c93d19aadeee44288aa68d21d906bb3a1f4e12

SHA256
22b9006d8e8bbf455ab799e5289b65f3772b2255db29b3224f85079a7050b22c

SHA512
4c399681d9a63e6a4b07ecf5eb6dd7711ba70ab9586c13057a826c301cf411ebf4d132af43fe8c64b3f9c591b8b6f27a51be11b8046339da5b8e5e8bb09dce07

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\30586

Filesize
16KB

MD5
ebdfc39f8d4c07aaea2669496330a18b

SHA1
f809a0c4125487accc61f2e022f60b40ce940342

SHA256
ddfdf4e4351bb5f59a1d85ef3f929362ace8d6caaec5e12c73bacc4e0c38a395

SHA512
6ca6495891c6319add279fdebf0b6c506cca45d39adbc59cce76a13aac5c4efbd78855ed4f39ae2510220f4ba7374213f00185b84eeda1e5189527c4aac10346

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\32169

Filesize
16KB

MD5
78544f4bb1de8c29e938a960accf3ec6

SHA1
30aa8da8b0afcbe1494ff5833a5ecf0d874027a3

SHA256
639186543da7b4a1b61565bcad8e942ef65df6914692127b2d55891708a37340

SHA512
1b71ec8c5b3a44a7f3a03412298e92e33a9dde6bf7b6d58974e10320e66248eedd55ccf54574417a71855a2db5523fcee457727639dcae3f56341e529236f854

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\4340

Filesize
15KB

MD5
26126daf26e5594a445385ead0e2a759

SHA1
c93674ed29e9328b3649a81660d28404e8c9f280

SHA256
af27029349f99a86fb064df149cf764ddbb3d1821c0558212dfe39968cb9ec91

SHA512
2d7ba303a7716281c5437a7016b043158074167a3a34f47e10e28569bef9fafca2b5b2815832d9e072f09384ca6089186bb4c90b6ef21717617932b7fa7026c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\6090

Filesize
16KB

MD5
12688c77862e2e0293de7a00fddfd51f

SHA1
4bcde226327e608594db5e24b87af390c2de71e7

SHA256
6114deff7e7e3ec2d76c281957c8b01555d9c7a8bc4e1d74c064db8737f5d31e

SHA512
8d7243b7a124810a29985027dcf313cba112d04d5dcf854d3ea65cadc41904ff3779b3eb220d63a7138d45d397df47b7243faf8a227682d9de500b050af5d9bf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\8572

Filesize
14KB

MD5
2b06de82a7fe666da528c3943354bf0f

SHA1
08700f3a53c6e80725659048ac44fc19ded96d44

SHA256
288c29decf1734485997d4c11ece3db429e61a3b2c172db3bedce4a35afffaa8

SHA512
5e10442a5b5eec325f4d76195d318fdf505ce3ac93abaa3d2267cd7ba71310767cda09111dea48561294a96b44968ecad34ced024e0933aa23ee649aa3c76e10

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\323E431C97B4234D870055C9D3D684DC28942105

Filesize
215KB

MD5
0e659a2b954756c633c1ef465564c465

SHA1
eb10ad8d6595e9ad105e77e06da362a4fa0bdef1

SHA256
d76dc674d4462cf3299d60df76557e41f2c40bb6a25bddc3b5a076c6e9e00474

SHA512
1c8a5f9e6dc9680e0844881f5fa8b95874a6aaa3834ac4383ed641585f0e8512eec09682d667e2cdfb1cecfb01e0fa3348ca7e0fff55784541f301dabf507a78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
db9ad69d51a75125ec70409dff49f463

SHA1
ba7712e54ab5f78ce27e5663055b74c94c4426e9

SHA256
ee06fd84ad1b3e587ca4c72fff2feabdc217d5054b61f64f846118c406f65fa4

SHA512
c4f453b7b10ab094a9e6e6ece44a1bf5f7788a42f4f98c2e64385a5f39c8b2cd80b4af3023e851064d7079f19aaefa19c56d22208d11928d6aed3b5d4764c252

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\650662c8-cef4-460a-ae7c-5b682f75cbab

Filesize
10KB

MD5
0e0fdb1f692522b05e760f5bf688e984

SHA1
178d3cea207194f668c311f09fcf452bdf5347ef

SHA256
a3db2328730c29d952f5ee76c59e94334f374268bbe77de7b2db513fea9d84b7

SHA512
ce83a90890e00128f397c24a9328bdefa6fa03b348c8a7688991a589e9c2eec01acff12c064cdc03eaf26c8c843c17740a1c6b73fbe93198f57143dbc4c89b0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\d6ec8a80-c902-43fe-86d1-324df6b1dc45

Filesize
746B

MD5
4ac87cf69486e1ebd3f9f20937f5e181

SHA1
5a5dfcb7fb92588686e58778843d76183b7e2550

SHA256
dc3dcdc50f3ede5237e5b0b9cc2995e2cc29753e2ec86783ec5121de834b470d

SHA512
70fddc702dc0f80508bdc88045964907b7dd0081ea406f893b9b2efc21aa389325467ace921c19949916c3eb8bc05c5233d49035c642d1c08c35bfd8e227ed5b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
bc8993e45adffc7f0990fc9a39f44845

SHA1
8c39d80621b7fda2c556938980ba1bb20557f622

SHA256
ddfbf67c80629c3ddf843a2c7f945c1de3f900ba266195d12ba86c5c99445e71

SHA512
b71e9def066bea321a8cf14d27c7b18c10b79623f5fca6fbcf55e660ac6fb793a3990917127d0c7460e3df1f9b907de28ed399c416e7be24c9ad94e79923ff7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
5a8458f4f70386688e217bf3bb841256

SHA1
c0f238fa6d3f9eab1226c1736108d8fd9480ccda

SHA256
a1cadc8c5a9de38d13f92b11fbf9e7fcf528df9c41293864d2b488d5705bcda6

SHA512
bc190e2dedbeab375cbe94e9fca8e9a906c6ab4458f7c53231349b802c5a4d1bc168f99bdd842a18b312a7f4d8731fc7b6ffe4c565a97233482a3209ade5801d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
9365eb32fa36b5ea63c18a13e777f3b1

SHA1
5ef5357c239c629f83580b0c1b8f04d1f3b248cd

SHA256
50e6bd89abd7310f9bf599e676733b8711f8c04fc04db27756fc0b5131308812

SHA512
1639b9d057dc4f994db92bf22ba74463cd1e39623e01e3ad252814ea4e1fe7fa9aac0a4c79ea3b05a9045352ed59a00978a5fb6ee5b68ab1f9f3085326003822

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
3c3abdd9d5d44cb068fa288d7df66931

SHA1
88ad22f0dba822f6bdda92c15ba0e07d46b39094

SHA256
bd2af2cb3112513d90a2b489f5696f6e727d11f1e57af7eb24f84aa4f7d11fd8

SHA512
e652c4087bdeb65f49732d45bdb8572ba4f157785ac48601255ab39d0095a73a2a386279571d7070faba9fe12b969c7959dad0b593bc450ec945ee7ba4648140

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
b6a3fd8647feb063aad0529d954d0c4d

SHA1
1f5223c7c43c54d6cb93bbf327903d9f2bb9ef8f

SHA256
244203f88124321feb3d0c5227b4d3ee65854f02901aab666e66888e88d28a93

SHA512
7d5e8cc65d8f09b3c5bf4472ff11d266f4f01a7460650e2847f9eab6b704db17edc447f4407a1716e71afcb51a1e820b87f61809adc178fb2a2117b3a6871459

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a391ef3fe74852298167862add45134b

SHA1
a368bd973e5c66e4fa491bb015fcb2a733f12831

SHA256
7ed97fe23c2bda63324e2ba1e2d46c0ba5c04f4a007d9c90d0e83ded5dbe4f71

SHA512
248ddf3210a2a58812ac61ea791811467b5dc3111e173cf3d34386beb3c76a98f461b246b0e48428c5952959db322438f222d7f3447d237798084e52fa3d1e56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
34b43875a982caed73ea3d17ba71e08b

SHA1
69f6f675f1a6293b98a1e29c6dd5718e540899d9

SHA256
57cc57202cf4dcf71a81d556e54ec42e90a25f623beed18b21ecc0438e6de812

SHA512
27489efdb43d3b40a711cd66eedbf7dd71505928e3fbdfe88de7a062b8d091d6a1d130ea9bacf86693c57686ddee31755bea39a5af74ccf5d820b99dcc140097

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
de41a35ccbaec013b753d4ffe4a18fd2

SHA1
dcce2011615b70974b5c6c8e0dd9f08df717c675

SHA256
4678f22bd82936495f92f04a88af4c319636371954c8e2c7e288e5360f0cb99a

SHA512
a32f2072c5923cc05da8c477191a01318632e27792e5ec7cde2d1fe88157d13fbb9b6d35e60c2c2528c1b3c7f07959e28503e6a8efd89549d1b03281c2de797a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
62b3e4e34f6e30d6ea42c29bfaa3f015

SHA1
2300da9be1099745558c72d2259b1961bc0f3b3e

SHA256
13b34ebc2b086a26536312a2bc27aa1bee16b16019406a1b8bbe2ea52c6e7b13

SHA512
d852f87a167274cb1902ed2575cfb524ca8c8d962087203df65dc04350449c0965a476a5248c69dc3dce1702a45d16b42ec4f487485420ceb690f972ca33cd27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
097cf16d424876c49397dd49f9cb9e69

SHA1
b34d6bc20ee1960fc0cf957f8021433f27498174

SHA256
6888a0c6eccf1fab4beaeb1487e5fa187d8f70f1fd81351deb9092e550a4d70d

SHA512
dbee9ee43292bdc27a384b9f81c9ab468e18c1927fbb6b523f6f6d6f4ceff02aaaf39a5e8a0b14d66a19a2268c80fa11eee80706997f4cb050b535dfdf694dca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\default\https+++www.virustotal.com\cache\morgue\21\{8c0cac6c-0545-4700-83e8-7d6a2b18f315}.final

Filesize
47KB

MD5
aeeaefc8431138dcdb60974b098a7ed5

SHA1
a192b42a40b2aed9790927f9165041e992a729be

SHA256
26737b300313177480c41b7f59fd0e98af75bda6a67a98df8ce07c2d649c6035

SHA512
70cc0a77522eb4869d57f914ac9e6094c1b2d748553f823e4d61bd6d30db12e8d03e6f3459018ca3dcd98c66d79074f9920b83cc0f7e0aeda866551d78392fa6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\default\https+++www.virustotal.com\cache\morgue\89\{6f5cb411-9bb7-4fc6-aa7c-e0be80590659}.final

Filesize
47KB

MD5
81afc6cdbfe9fb574b2d8e4dc2819e68

SHA1
00c2107499e15e22037a1ece23a5a580fbbe9143

SHA256
1fae82f0956594451981b3790104567d003560eef335b4468e5220e4402684e6

SHA512
bf72df98d8e39301cb8c6e72d08b26129b905897c9882cbc5cb93f149954382ce3173eb437632062ce1442295e1e98646f5ee4c590b7a4881457ffbafaaabaf5

Download Submit
memory/2868-17-0x0000000000EA0000-0x000000000162E000-memory.dmp

Filesize
7.6MB

Download
memory/3708-2-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3708-1-0x0000013485E40000-0x0000013485E5A000-memory.dmp

Filesize
104KB

Download
memory/3708-3-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3708-0-0x00007FF82DDE3000-0x00007FF82DDE5000-memory.dmp

Filesize
8KB

Download
memory/4632-11-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-5-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-6-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-4-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-16-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-15-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-14-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-13-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-12-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download
memory/4632-10-0x0000020E6A700000-0x0000020E6A701000-memory.dmp

Filesize
4KB

Download