168a76679d03d1e2e72cfc68f665ac3e9a498a8f1c3e603b808dd92723694c4f

Analysis

max time kernel
250s
max time network
254s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01/06/2024, 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fm2532X.rar
Size

14.3MB
MD5

a6d8949e3f607cdcc0dab3a8a238e392
SHA1

cebd6a5f7119992718631c1c31dbeb836f60a8eb
SHA256

168a76679d03d1e2e72cfc68f665ac3e9a498a8f1c3e603b808dd92723694c4f
SHA512

71d6417939c535cc0dd6e60b1772d22c840d95977a662d3e18d8f7debde41cd5d343095ca14a7ccc6226b437c8c6c66127a1b2a2d99c053fcbf4ba7f18226d03
SSDEEP

393216:G0RI7Li3FBN4K5aF6XCH/fy7yrcL4MErc7k/hPlvJ:G04Ak6Xwn54EMEok/hL

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1052	X89vM9vMa.exe
1496	X89vM9vMa.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\fm2532X.zip:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
304	OpenWith.exe
4320	firefox.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe
Token: SeDebugPrivilege	4320	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
304	OpenWith.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe
4320	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 4912	304	OpenWith.exe	77
PID 304 wrote to memory of 4912	304	OpenWith.exe	77
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4912 wrote to memory of 4320	4912	firefox.exe	79
PID 4320 wrote to memory of 1920	4320	firefox.exe	80
PID 4320 wrote to memory of 1920	4320	firefox.exe	80
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1900	4320	firefox.exe	82
PID 4320 wrote to memory of 1224	4320	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\fm2532X.rar
1⤵
- Modifies registry class
PID:4920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:304
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\fm2532X.rar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\fm2532X.rar
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.0.239169584\435749690" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6b8e82e-0512-40dd-828e-c0c2983d8d52} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 1796 29e130d0e58 gpu
      4⤵
      PID:1920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.1.1938484359\1068598422" -parentBuildID 20221007134813 -prefsHandle 2132 -prefMapHandle 2128 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e88dcef8-4708-40e5-b9af-3426d3d62066} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 2152 29e12be8858 socket
      4⤵
      PID:1900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.2.2090888110\870486438" -childID 1 -isForBrowser -prefsHandle 2820 -prefMapHandle 2816 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8e83278-6b33-41b7-a7ef-f08eb9ace426} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 2936 29e16be1858 tab
      4⤵
      PID:1224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.3.1504408287\951509419" -childID 2 -isForBrowser -prefsHandle 3388 -prefMapHandle 2944 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5698903-bdc9-4dd3-bf67-bfaabb317905} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 3416 29e153cd558 tab
      4⤵
      PID:2184
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.4.358853892\544998044" -childID 3 -isForBrowser -prefsHandle 4896 -prefMapHandle 4876 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c70eb5db-4edc-407e-8188-3bd8eed14fe6} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 4892 29e18f30858 tab
      4⤵
      PID:516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.5.518702748\1116133490" -childID 4 -isForBrowser -prefsHandle 5084 -prefMapHandle 5088 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7d5b6ec-cc3f-4168-994b-8d0f5ec6c9e4} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 4968 29e18f33558 tab
      4⤵
      PID:2496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.6.865964207\1753435585" -childID 5 -isForBrowser -prefsHandle 5280 -prefMapHandle 5284 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {042ad70c-f93f-4763-ba52-258de272187e} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 5272 29e193e8e58 tab
      4⤵
      PID:2416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.7.138263440\444136838" -childID 6 -isForBrowser -prefsHandle 5668 -prefMapHandle 5664 -prefsLen 26543 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {045a7d65-95b3-41d6-98d3-0ed2aa73c11c} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 5652 29e16b82858 tab
      4⤵
      PID:4764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.8.2050680210\662384788" -childID 7 -isForBrowser -prefsHandle 5988 -prefMapHandle 5992 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bebbe134-c8b5-45ea-a0c1-3726d2ccbd07} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 6008 29e1b0cfb58 tab
      4⤵
      PID:2816
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.9.1875494021\1542272110" -childID 8 -isForBrowser -prefsHandle 3216 -prefMapHandle 3204 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {396f6720-2334-450b-895d-a891652a7d70} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 2928 29e1934a358 tab
      4⤵
      PID:3424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.10.1861067633\771168382" -childID 9 -isForBrowser -prefsHandle 5108 -prefMapHandle 5768 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0e6a643-71c8-41c0-82f7-06fec06e5505} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 5484 29e1b86e258 tab
      4⤵
      PID:2316
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.11.334655948\969704910" -childID 10 -isForBrowser -prefsHandle 7428 -prefMapHandle 7404 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9630d58-9469-4d91-8cb5-54c5ac745985} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 7260 29e1ae23c58 tab
      4⤵
      PID:4012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.12.1968115999\425501222" -childID 11 -isForBrowser -prefsHandle 6000 -prefMapHandle 6028 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dd1f40f-2628-4957-9af4-2613239c89a0} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 7528 29e1ba79d58 tab
      4⤵
      PID:4156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.13.2006828724\264679127" -childID 12 -isForBrowser -prefsHandle 10828 -prefMapHandle 10928 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b29bb1c8-ba55-4f86-b167-aaddb32e7a8a} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 10896 29e16b83458 tab
      4⤵
      PID:4648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.14.19243057\1161383119" -childID 13 -isForBrowser -prefsHandle 10508 -prefMapHandle 10536 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e72f9f21-6c31-42d0-bc85-acb9b3456907} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 10556 29e203b7b58 tab
      4⤵
      PID:1116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.15.1016379512\1064666051" -childID 14 -isForBrowser -prefsHandle 10372 -prefMapHandle 10564 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {648ac30b-4c15-4b9f-9f23-ecaef763a1e2} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 10384 29e203b7e58 tab
      4⤵
      PID:4356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.16.2096788343\747154887" -childID 15 -isForBrowser -prefsHandle 10188 -prefMapHandle 10184 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {343bef2f-6a95-4ce6-8419-4188491b3f1e} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 10096 29e203b8158 tab
      4⤵
      PID:5124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.17.2064874203\266301411" -childID 16 -isForBrowser -prefsHandle 9800 -prefMapHandle 9816 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af9730a1-00d3-4de4-a74a-603a660ddd7c} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 9792 29e206ad258 tab
      4⤵
      PID:5404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.18.29894544\2027794927" -childID 17 -isForBrowser -prefsHandle 11232 -prefMapHandle 11244 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9a9fad6-d520-4110-b8df-35e3bd27c1fe} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 5200 29e1fd49058 tab
      4⤵
      PID:5148
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.19.799246933\944659341" -childID 18 -isForBrowser -prefsHandle 9932 -prefMapHandle 4672 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce398b11-7d71-4e27-b0f6-14499cf20a82} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 5800 29e20ac7458 tab
      4⤵
      PID:5608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.20.146352500\1617544635" -childID 19 -isForBrowser -prefsHandle 10996 -prefMapHandle 7696 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96f08ff9-b3fa-446e-a862-5f81ea6166f2} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 10976 29e20e3c858 tab
      4⤵
      PID:508
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.21.1525560969\511416579" -childID 20 -isForBrowser -prefsHandle 9392 -prefMapHandle 9396 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c00c78cd-4ef3-4109-b12b-9a7ae5177379} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 9384 29e20e3b958 tab
      4⤵
      PID:5156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.22.1359216153\1597477240" -childID 21 -isForBrowser -prefsHandle 11376 -prefMapHandle 10196 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a94180c-d14f-465b-97e3-8fa8f122eea5} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 11240 29e18ed4c58 tab
      4⤵
      PID:5928
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4320.23.803230165\2054380215" -childID 22 -isForBrowser -prefsHandle 5868 -prefMapHandle 6112 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcb4da43-761d-41bb-a2f8-36bb5f379a12} 4320 "\\.\pipe\gecko-crash-server-pipe.4320" 10512 29e193e6758 tab
      4⤵
      PID:4620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\fm2532X.rar"
1⤵
PID:1096
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\fm2532X.rar
  2⤵
  - Checks processor information in registry
  PID:360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\Temp1_fm2532X.zip\SolaraBETA3\X89vM9vMa.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_fm2532X.zip\SolaraBETA3\X89vM9vMa.exe"
1⤵
- Loads dropped DLL
PID:1052

C:\Users\Admin\Downloads\fm2532X\SolaraBETA3\X89vM9vMa.exe
"C:\Users\Admin\Downloads\fm2532X\SolaraBETA3\X89vM9vMa.exe"
1⤵
- Loads dropped DLL
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\11046

Filesize
9KB

MD5
653b83c49a52f67543a47fcf6a7234cf

SHA1
f89ae625e1d54c9b3e33f9f1daee18796f950075

SHA256
62aa062536717594c0e863ea10bf341766c453813d7ddb7d8dd63918e527bb7e

SHA512
4d361df451a79f5ffb9bf84ac187cb828d595f0eab71196e196479d4fb6a3fef6271cd3ef3278a742511ae803b496e1d8e849047ad9e38af63aa5ec2517b09b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\13233

Filesize
9KB

MD5
aed95c397676516ec7e98a644d5a69c9

SHA1
a28bf1c851595cf8065532e33792bf26e0ce053e

SHA256
d162351186ba620ecbd7d67013347eb82465ca4ef81efc12dd394afbe5786b08

SHA512
0850f93e1f2293c0c5c46c393925790c52a499d0334b8262a123324be230b38f65799437e88cc3a8dfbf97ea8374b48dae6ff237348709fe3f6fae4357c6a96e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\14120

Filesize
7KB

MD5
7252c55d5f53a7c52216d868fc47abb7

SHA1
5bae7dcfb7de8cceed3d5526a0c80eae54161efc

SHA256
9aa366de95cd56a2915bcb8a82f4175b9a442c0d37f485b22aa81c6c5d44755b

SHA512
92a9a069b995078c8603e0c7a72f983765b17eaf2ffb0d020bb1e6d2a2a592aff84456622a821feb6716c2068ba56abce8f67f53e0c334ee2c044730d36dcf69

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\15571

Filesize
122KB

MD5
e8ec06341c50101040bf373937d720ff

SHA1
85bc5ac2274e29a4c9eac0ffa04ae8cacf94a18f

SHA256
f0be30994d82a4ea7cdd5d00116a79309393ca4fc27e1842cc61c16efcc83e6c

SHA512
bcaea17e3338b46dc76f91a99c65fcaf5d95ed584c0583efb06e067bc28fb4fd87595252bfeb61433ec9cb8ed10a672c521e7874d35adc2b46ed55e1acaad3c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\15607

Filesize
10KB

MD5
91ac03bee29a9583c531887f5efa9e55

SHA1
9f18022bf7dab61027366bf72454fbcb9889e4bf

SHA256
05795d3f55916e9b00f76a5d3376e5061c2c3531737e87242961217bf5e54f86

SHA512
6235711412326cceeb8574b2aedef7735f563d72875cae5d75f269a179975289ab156e551b753d3ee00a34bf3bd12795e5846c7b17b11a605aff616ffcffee96

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\18080

Filesize
9KB

MD5
dea1e9ef59745055b76c0fac3d245b7f

SHA1
17a8b0d63d158519db8e14fb14359396fc4ad35c

SHA256
c07d119acac71f0dc1d5400b592e23c4fecb541bbd44d7389337db23acff29bc

SHA512
b503a33a1290ecdcd00aa8590f21c1821007fdf81058aeb77ae8b5257b0b32c0cf5d62e47eae47044caab4ec5bf0cdbc32a89caaadbf85a9f501baae875de84a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\19302

Filesize
16KB

MD5
0d6182c2d6b418bf98c2e0d51e5318b0

SHA1
59d7200803d6b07ff05464841ada43352c02ab1d

SHA256
1360c172c337d3284e35bf3e5e6e1c9d45bde9a68553bc314de42eb7a0fe0b45

SHA512
602eacc73b3a1133cb8effa58ecf01b341195715b87ba678af1d75e879b9ee95f0aa464f3832e9561f3424353a6dfcb10d2a34478f41733c349c98176fa61757

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\23990

Filesize
16KB

MD5
46945fc9ab0b3c273935e89c1abec25f

SHA1
dd80d02499e87a5c2bc302161f43d96ac702d213

SHA256
cdc7d8eb0fa3ee39da20418383a199e735df2f03b24cfa5632efb679e075d347

SHA512
3c17c3c3bcb9b09b3c6923ab05f5144b9ed309754b3c80c53dcb27c57622e87bccc6daca244cac467f5385d92b555a3217922bc389653b80be25bf0bdbd54282

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\24103

Filesize
16KB

MD5
bc3b53fa961da8fc4e52538985af3c10

SHA1
ec3e21e5f41b76a8b5ec43ab6dc6209c008c9ce4

SHA256
8de636ed919070ccf2e91aa698a9e635a6bfd5f45ecdff0c7961988787463d52

SHA512
5c0f903db7d2e69ea1e609795baf418c9d6921ba299b2675b3e12124a4e4fbb1baa756c4795ac293f7701032c3a714f72dd4b87da0ed277b57621a89044f95a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\29706

Filesize
16KB

MD5
0e0478a9942e4e08bde6f8957904d55d

SHA1
e0b3966ef6d4db2591b0f4cb4a453c3f5897c7a1

SHA256
40219a6f74e94965144287d696543fda9ebe7d8f80fdc3d47000693f2622a792

SHA512
c58792f94fc25afc23744ecdbbabaa34d4246fb27bc5575a7cd0e04f688654908d2bf068c1f4b205426965c7b7690119c4a40876cf8109fc45d43610583dbc2c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\30587

Filesize
15KB

MD5
46bee80893fac8e5ee5d8004baca9714

SHA1
29a31da7a3bbe2cad94fbbcdefa75edb2e7c2a66

SHA256
dea310c5f99ba81bfed638839ebf33204f851efb6e888807bc33b2fe31976d11

SHA512
32566896ffce01e16da6e728bb501b1cefbe7a440a8363b4acc4ea0134dde4658f2708e8f2685e490f12746d4283836f44e73b15aaef1c0d5faff96aa5762087

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\31906

Filesize
6KB

MD5
c7800ffce71ff2c020467632b019499b

SHA1
ded09d009005a6d47fc27098f873d35e19b56716

SHA256
bf25e28b35868af9e4b2b59d0694b2bfff791c2635ce41f433f2e0f5aa247e13

SHA512
9454ee5e6364092b9c5d470e07507d1f8e9d9e9ad825b4093cd5b9879312ab55fb18c75f73f3058fc973227b53c094dfb643ad20ca64c6e0eca92b49784ca8cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\3469

Filesize
16KB

MD5
1a4769b557d391bd6e3a2caf123af8d7

SHA1
9c7cea2584eec79c3995c35843b6f0012178b660

SHA256
6ebcc6613962659eec9b97edfccce1f6cf20b1057ae94d527b8a8fcbea275473

SHA512
3bc35b3a671ee55d1d3c9a07194284176d006ed5cac4a6f0485c45751b14f0452915f582c97e45a7cbccfbb6dfff7084525b0db0fcb5077ba9d25286650bb109

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\616

Filesize
16KB

MD5
145666bf53463c34fba43e1f6c8eac17

SHA1
df901990e140e9c7f8f0797ccf34adf779743790

SHA256
2a1c9a837b4d330ac27e8918c65e0dbc92f5391f29a3bdf3435c9c450234d0d6

SHA512
4847d717dd6b10b714097132e390c2f78604f7e64e23d15afc54ba4fb7aedb23bbd546dccc47d272f015c61561d373ed8a21e6b0519dfad84e16956193602dd4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\6239

Filesize
16KB

MD5
9fcf4cf0bebc6dd0379891b7f971910c

SHA1
f52b22ac9bfa18fea42c28f9db61554dd329dde5

SHA256
dd6db3391e6b40f146162cc3832880a6808bc222a12b849f90746b4aa49e305d

SHA512
9cc0863c3bbf7e3f6f6380a073ef9084544f8561b53328e88e04b1f61d56b34322c091b466986a54a15eddf0a071d99a343781f8945d56dd2b925b09aa61870f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\7148

Filesize
16KB

MD5
4f414a2d542ec88e93db5605a99a81b7

SHA1
862503ef7ca212649f74fc5d5a35f174bcf50bce

SHA256
60cc88a3ecce727b2988344be4e42dd701602637b3f2f060dafb18f0187b6683

SHA512
09be4faa6ed4a51d552c851e88c06b6b405da785ca01d377a8cbc9898de0cfd7cd447b5989a270c231ba1736b4ea85a15cd834a068d2a28ef63139583f1405c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\0267C0CA19FC95888D1BDB3470318E9A183173B1

Filesize
74KB

MD5
6260308ad542e2093f224b1931e729f0

SHA1
836c64806f7837888bbde90bf66ab72d2c9f7624

SHA256
9236251a79edf3a4f6243ceb74aed51f7061126cd85689e20a65da967bb5c375

SHA512
72e97a83d504d980f5e594ed01c3074cc306e55b99abaccfe81c457b49e1c80a4859069e4083a42868b59a8b586e1aadf18eac85c0b9f2b84d1765a9fed4c5b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\14FFF4EBF10F8EBD22BE85E79C23D56F631A29D5

Filesize
47KB

MD5
7fca47a259dd80e6c18ff652161a2404

SHA1
6fc2903c572706e5a8eac83d43f5c0b823e5c197

SHA256
b5e64dc7a5e670c620d807e93bbfe8364275b9be5b4346df9eef8a3919dcc385

SHA512
0bb7051a088d739b5509558bf13987b8743d349778b6c324c7ca0464547422fb2758e3b8e4aaafa5160e2eca886c0d281660af7486bf7b433aa6773b9189fc57

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\BB4DE047F15E3DB87E10A0F6ECD87863F33875EC

Filesize
2.3MB

MD5
c416ce9fe0f453d33bf1fbdf97e7e629

SHA1
616a50e801e37169e3f822d346eb4c07c87ae3db

SHA256
4495eae09aad050861797168081b011e3e628bff7362cc26fb51b1a4e7be35fb

SHA512
81891d8dde6dfdf1f48be20b2139cc8ab73325819da09f594730b3584172cdbd04a102ae4d639c9a5b6847b0b515efa0b60828f23947607e78e8beb04b090cee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\C0327CB6347B6E6071D3ED1845AD9922DE7D645D

Filesize
15KB

MD5
54119ef89942040e4fc157f7c232bf08

SHA1
f00def50c0988c7995a667d532610660f7ef6a61

SHA256
0290c8ed46ba2ef65dd7d804fe9f456757ec835739238b2e273fa068e4e1c15c

SHA512
e752299d3c0bed3525c08343e3c743d1aa62a896bd038b4c4cbeb7e63ad4a226e23cebdb85430214b98fda4ddd175f3d1f930c8c8a656aa5bde13f07d5c39cca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\C56922395CB899E604C78664966B5CD396DC0C1E

Filesize
122KB

MD5
ad8b4337aaef6fa18fb4091d4a2c1585

SHA1
1ed92528db9b10aca74debcd3a82399003302b77

SHA256
d819d9214482e292e483f0ee93ca7620a02e1ce1f18fa0b126bb05eee146a73d

SHA512
35094b1f7bab55593531a71dfb2c14bc2ba160577e6c3bd5e1578d24dc4ca6200536cd851f269d51acf22a477252c35c92f1ed652b258ff0b55f46dba3e375e8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\DF56DBE5EEB1E7EF7D34B1E8B6CAB0377A1A6BB5

Filesize
51KB

MD5
c560c42380c719909f2ac95aa0ec43aa

SHA1
8c54e243d1cc260ff9cf87c195293e11c75d81a2

SHA256
b7db74c9cc1ebb3635a1d557f75ff72a5a492e47ba0eb4537e69bc06b5a74b07

SHA512
7fb01f1843403a17e112f22cfa3a6f66cd9c67f7d40aa0a0605f404b1d2256c73f81454e40c0191584d910813c0018f1e8ec582dc7fc671968bf4561516edfe1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\EE2D220BA131FB2259BE74E74A3D52A12CBD5707

Filesize
47KB

MD5
33dfc724a77101a958f9793ea58c0ddf

SHA1
49a7623093db3eb20e0e3ca0bbb739dc94a4fe2d

SHA256
1b305015ed148e207d342558a47dc0c728da0a5ef51d3653a4e8c56f2b2290cf

SHA512
ad8ddd00c6b2fd0ac6f4836f5c835dc12c1c67363ac683b6a1f5d63db8d5bd6785fc57b3ff7c10cf6db95081b34697f660a5156d145ce6f75cd438a46989370a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
45e693b5e4cf1c8b3d5537c5e2c7d943

SHA1
5c5aaf99dc465166bd737449fe3be6d6d20fc85f

SHA256
eaf83e202b400fc09625a1fa01025ac1901a19ef4ac359ff5b5f984a6c1c095c

SHA512
603c16cd98a0276d293e29e3d8778bcbd59bb4f3cb6fa685a5034164f8e0da3e0e5dd7bab1fb134b154bf7d5ae17e481053fa7283359468ffc0164295467b785

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\72a343db-6125-4161-a22c-10c5f4f430c5

Filesize
746B

MD5
57dd1dd5a18e1e700e922892144cd278

SHA1
70a55f9f9695c1dff98070577596877e041fec04

SHA256
9c9d17f58b8ccaf28e6b5526bfdf02621e63346997ec5f9e77a9432470746f9e

SHA512
59bbe55c479c339fbcb6338028c05a0bf368c85879082719e93cad5230c7598a9bf7d01a522b905cb7c3791625e5e9f45d67815d7ed90b76ef064b168ea165ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\dc793dcb-0a1b-4e7b-a32a-bfdb4df75e73

Filesize
10KB

MD5
37740c342af94c00589bea7768c4efe8

SHA1
cee62685fc458c85cc76d99668ddb33a0ac59785

SHA256
cc4a05b74589bad3e1abea98769e51a9abd6710c03dac124ce5993dbcc0b8749

SHA512
8de33b0b13c5ba1b37c2fd05236f36b823b813640d9a92094a90f95d03e96f12201de60b44f17944483e309d7acd71bc659871094e4eb60d7572ac5b389a3f00

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js

Filesize
6KB

MD5
7c629a611062d3585443b542b4b882e8

SHA1
8b3dd1a16aa440fff91582c883b26252caae5f61

SHA256
314024c422c84d95e2b32d5a8bd944df3b8c1cc063807903a701c93877496c69

SHA512
2e90964f7f4e9de0940c832b43bd22bc5cc9828c873dcb399758786265bc9f11459f84755b8ecd0c794b97cb7f813a2ecd7c2d26ba94e1c4b2677ee574fafce3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js

Filesize
6KB

MD5
a61790de775ad04653bc9e92a48d4a64

SHA1
8abb8e2424f1e4fb73200bd6498c4ccc1fa0466c

SHA256
a2301761ea43e172c1e400c1eac183a2cca1c90b663a6da200e4b2f67456b732

SHA512
bd0673f4ca1413d7405caf52b13684d3290d78d49d92b6f368f90333b35f286d87433f73572a475f7b4b9f585ba2e4b4ed4995c955f5bdc1538de55165c708fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js

Filesize
6KB

MD5
970f00ea0587c9ec08c27a25c9b65b31

SHA1
ffce2668452dd74985b0db82316c7a4ed0e45885

SHA256
38e540365a07c1176bb473d744a96289febf147bb04b159893e7ecbce8144457

SHA512
ac5af3649d0da33c6852300b2b8600664b192e4eb3a28d36e6fed228dcd6929a44a2287354065c68ba59a490e309e380c6de82ba9d78b54fc8b66d57cddc8845

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
520a0d0232afc83b48e718f8b1069406

SHA1
9f389c614812f4ce6972ae722f781f605453dc37

SHA256
c4f082fbd1e72b70b020317d77fbe10c786b070c27e88454e6d35ee27af2d5ea

SHA512
282f5bebb593eb2ea0b94e8176a0073d481106bbce045f957d1ed72ff439d492b59cc3a0ed529dd9dea3f2ee0ef2a59c4793361814fa7600a326a55d2d5738ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
20KB

MD5
3cc9ba16d09a607084163b06a7207804

SHA1
83fcf3248e22ea81b993ac5c9b3adae69ecdf5a2

SHA256
49004178ac3616bba0ad80d2fee769ced27dd9c371c43004b46d5d9150eaaf7f

SHA512
12e619b42f18b1bfe5e510324a64ea7ceb24bdb20e7a557f44ff0ee0b4d1832bae5d3dfd1b42377ea08cdf446cf8a82c17d65b796ea61f0d03fd2df1f6b9949e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
5737af3fe6ac9670f776f69727c02d89

SHA1
886469269feb06841748b4feb87d69bf611a9abd

SHA256
352139e75cfc7970190a8fab09ba2f58b1657381a4f7c4c7775d638ecde00e2f

SHA512
46c375a8e39c246a4f6a5da965e6126e2e8509ba6324fede457538dcfeeedcd9260782a5c2408a196ff9b641b8994199f784b9f145b9a6be3438dbd7d9846599

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
726f2010b295356c32a6c65d2c6254b3

SHA1
4c6dabeb0e4a32c50089a391679253e32493ed2a

SHA256
b436949dd07b7d4eec3aacf93fd06bc49e6972e4648f12677fed4cc6ede91e6b

SHA512
36cf69d0a503769f3fb6715993119746de281b72a11cfcd7061de0c1e81f700cc80be94c5d0751833768aa390b72ac1bc8f9286b4dfd53eb077fd84e73f05983

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
9d9972377cab5c84f651002ea2fde446

SHA1
b88f4ebf789dda16cbc9e0a6f7469742b724c4c3

SHA256
f38fc26b1e4bb2a6bc726f9cbcdb2e024c6e40a5a50023a1b17705050e70f821

SHA512
99321c171a5560646c246e9cf80ed9165d68c864d5c9bf7089fca11e7cff701479385c141f89d76468758c203e290744fc949df275a1a37534d3db15ec425016

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
bdfc0992956ffb0b285aa7bb45a652cf

SHA1
cb4be3699770a1197fbb383929b8f6e30fc98348

SHA256
79526722ad2179d8cd8e21f489cee5a7d53087c3c51a1fc4dd6858390572d732

SHA512
2b94c5c3de817e640f204299b06275ed499bef37e7c32e0ca57cacaaacab2c668bd04e57023606f0e7fbd1067c416a9a72edf898170d80885dfe2342bfda9ee0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
19KB

MD5
14e73c645f9f69c3f6e9cda1fc3b7a96

SHA1
e4e31fee840babb035c53993883e483cd68a7c33

SHA256
8e0d5cc142c33940018ce5e24e2fc5caf0243067abf62025931c61acfbac7486

SHA512
2f647556366c8b3c0c856d2544e30cf38b053b2b6e087d7b4e1d6c31c4134e20e97892d65b775e8d5192c01e22bcba2a48e4cb7010b415ca7143dbf086644f2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
995B

MD5
60e537cbfc74e5dca2519fa6672dcbfd

SHA1
f2fb1bd7187f3f2dc92941cf0e4994080d41c338

SHA256
358e7206d094cb4c86c35491278301ac09c08f2285adaea396fe1a6907b1d61b

SHA512
74665c0a4354d9ba2c8b9c209311d4b6c7ec502738d43c31f487b1301dba86534866b06b530a8bd19b441697d158bc84b45c5feabb0be435f37b277f2a7c3e82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
c411278c6b365aec0d0bd359353b4f61

SHA1
b47fe5067af0c814a4095bf7b8e0d9c80c9e54b2

SHA256
d1bd1bf67f90d318e1568a0d908748d51cd635d9bce4f4aab47fc914b7d726fe

SHA512
baf3483feb8a8b2627b9d2f4ade6bb35fab52a85b3890da51e2a5af66e12b4c7f620874104c1cbf6a1dd0f1917fd892e4ab9643c46b458cf0687a8cbe2ef3a93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
6bd8df0e338f2cf58fa5b4e9da743953

SHA1
975b88d1c572d6bd7c0faaff9785b70d940cc174

SHA256
db59c2772cf57d7611c597c49737f3e908e6a82d6a1e98ca97b463453159bb85

SHA512
d58095c8a91c2a34ae6529f7324b2321897175ae46cff3dabdbdbdbb6be7fc227972d682d15fce5081d9117590651a5e536b09148c62a63ba6f0b10e5e976faf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
eebe5a3cc8cda5a55a38670201d0f691

SHA1
645f9775a49a0e622b0d4d0676b5c957989e1666

SHA256
f2c5aaa4dc293367aa756ea3900ca906fbeddcda7024cbaa9edd23ed0db263ce

SHA512
feacf1a76592963938f37727181edb5a3e5a218f01f7bedb7f5650b8c073cede174f3d094677fd1454e7c2407d0136a0c727b070fc2603cd215ad617955b3cb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
8296ec7aa33245e27188d12249294ce7

SHA1
6bb63cd2ec33a551ef7d2dd385c938636f17dc33

SHA256
69d9a388671e16fb0a3a765cb86acc1a039eed4355c341d46875d12f08d1f52c

SHA512
e350b29e21f3201373a70cdb65f9486b392f00d5b2511835501040c6ca3d084ea1bb37aff76562578fda7df971d29c75b346861d6ab5266023b25266b0842801

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
731c0e733fe1e3123d366af7c8e578ae

SHA1
9756304ea773dd9cd96e5996dc79de2ed6a9ae9c

SHA256
8f426b4be5e3440fa14d37480f018b7dc3d1a547b0e91c2fbfc6e31d9054a359

SHA512
d29e0f2356a3226f64692b390c122d4d70f09f677d9f5d086f2babaeba6574d670171edb24ff52f928871ec489680f57910e21fac1ca8ec08783a07d21b1f427

Download Submit
C:\Users\Admin\Downloads\fm2532X.aCpUWFok.zip.part

Filesize
32KB

MD5
7936be4383a2125f33e51422ffc1a292

SHA1
e8791189378bdf05566f7ecda3a73f4ed0ddb3fe

SHA256
80b5e68631f10efcbf083fae95780257cafa04f1b69958e760f0c66c1ab29300

SHA512
442725de8a274117549ff931e4f66b13efd1c3f8a18ae5bbbc018bb7b0d786a2f966ac76f1b995809a48a05de211537bbb9cacf9e1ad2333f255c89b3d9e2293

Download Submit
C:\Users\Admin\Downloads\j0-ivIQO.rar.part

Filesize
14.3MB

MD5
a6d8949e3f607cdcc0dab3a8a238e392

SHA1
cebd6a5f7119992718631c1c31dbeb836f60a8eb

SHA256
168a76679d03d1e2e72cfc68f665ac3e9a498a8f1c3e603b808dd92723694c4f

SHA512
71d6417939c535cc0dd6e60b1772d22c840d95977a662d3e18d8f7debde41cd5d343095ca14a7ccc6226b437c8c6c66127a1b2a2d99c053fcbf4ba7f18226d03

Download Submit
\Users\Admin\AppData\Local\Temp\bdfe1398330148c085d9bc6215bd335b\WebView2Loader.dll

Filesize
133KB

MD5
a0bd0d1a66e7c7f1d97aedecdafb933f

SHA1
dd109ac34beb8289030e4ec0a026297b793f64a3

SHA256
79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36

SHA512
2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50

Download Submit
memory/1052-1091-0x0000026590AE0000-0x0000026590AF6000-memory.dmp

Filesize
88KB

Download
memory/1052-1086-0x0000026590630000-0x00000265906F6000-memory.dmp

Filesize
792KB

Download
memory/1496-1188-0x0000020A3CEE0000-0x0000020A3D41C000-memory.dmp

Filesize
5.2MB

Download
memory/1496-1189-0x0000020A3CB60000-0x0000020A3CC18000-memory.dmp

Filesize
736KB

Download
memory/1496-1190-0x0000020A24080000-0x0000020A2408C000-memory.dmp

Filesize
48KB

Download
memory/1496-1191-0x0000020A3CE60000-0x0000020A3CE90000-memory.dmp

Filesize
192KB

Download
memory/1496-1192-0x0000020A3CB40000-0x0000020A3CB48000-memory.dmp

Filesize
32KB

Download
memory/1496-1193-0x0000020A41A20000-0x0000020A41A58000-memory.dmp

Filesize
224KB

Download