1d9a6517a395b80388c9613594f6abfe3b38bc645629bdc52a3ab7de6deea51f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HITMAN 3 v3.10 Plus 11 Trainer.exe
Size

1.2MB
MD5

f257a0e7008656f9e2fa44a8a14f8d0d
SHA1

3469c35ce974b4c7f0531af5116266393779d903
SHA256

0e99e5e385e731404a25342a226633594e160f2081bbe4c84a756186ea08a9e8
SHA512

e9d9dbadd01ebfcf4ea40d49cbacaab4ac43faaa21c7c0a173032e1382eab52bcf18bc2d26c5618cdd4d7d3642581d5d08a48330551f51617e388ac88e5622ee
SSDEEP

24576:vqbohPJKzB1hZXTAZqAovlj6U7wbJ7yDStJQ:bJAXZXcZYvXwV7XJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 6 IoCs

Processes:

explorer.exefirefox.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

HITMAN 3 v3.10 Plus 11 Trainer.exe

pid	process
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
3456	HITMAN 3 v3.10 Plus 11 Trainer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2928 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

5132 msedge.exe
5132 msedge.exe
5132 msedge.exe
5132 msedge.exe
5132 msedge.exe

pid	process
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

HITMAN 3 v3.10 Plus 11 Trainer.exetaskmgr.exefirefox.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3456	HITMAN 3 v3.10 Plus 11 Trainer.exe
Token: SeDebugPrivilege	2928	taskmgr.exe
Token: SeSystemProfilePrivilege	2928	taskmgr.exe
Token: SeCreateGlobalPrivilege	2928	taskmgr.exe
Token: SeDebugPrivilege	1528	firefox.exe
Token: SeDebugPrivilege	1528	firefox.exe
Token: SeSecurityPrivilege	2928	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2928	taskmgr.exe
Token: SeBackupPrivilege	5812	svchost.exe
Token: SeRestorePrivilege	5812	svchost.exe
Token: SeSecurityPrivilege	5812	svchost.exe
Token: SeTakeOwnershipPrivilege	5812	svchost.exe
Token: 35	5812	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exefirefox.exe

pid	process
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
1528	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exefirefox.exe

pid	process
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
2928	taskmgr.exe
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

1528 firefox.exe

pid	process
1528	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 4260 wrote to memory of 1528	4260	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3720	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4692	1528	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\HITMAN 3 v3.10 Plus 11 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\HITMAN 3 v3.10 Plus 11 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flingtrainer.com/patreon
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf77146f8,0x7ffbf7714708,0x7ffbf7714718
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,16223369051029034611,7292541499415353090,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,16223369051029034611,7292541499415353090,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,16223369051029034611,7292541499415353090,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16223369051029034611,7292541499415353090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16223369051029034611,7292541499415353090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16223369051029034611,7292541499415353090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16223369051029034611,7292541499415353090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16223369051029034611,7292541499415353090,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:6160

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2928

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.0.388952160\988555644" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e28002c-8fc9-49ad-be8b-ba05814107cb} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 1868 10b38a23458 gpu
    3⤵
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.1.62740864\1830322155" -parentBuildID 20230214051806 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df7224e0-f382-4bc6-965e-7abc1dbe7295} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 2436 10b2bc89958 socket
    3⤵
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.2.2124107987\1775231377" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 22215 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {349470ce-4d47-4805-9d15-aeaaded8e0ae} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 2988 10b3b81fd58 tab
    3⤵
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.3.2135427441\681630888" -childID 2 -isForBrowser -prefsHandle 3460 -prefMapHandle 3472 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {338a1fa6-6bb5-4fcf-a199-227648022f6e} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 3636 10b2bc7ab58 tab
    3⤵
    PID:4128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.4.969259345\1512153696" -childID 3 -isForBrowser -prefsHandle 5276 -prefMapHandle 5272 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7257ecf1-05d0-4ce2-9815-cc1c03aaf473} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 5284 10b3f69e258 tab
    3⤵
    PID:2008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.5.900105114\148962172" -childID 4 -isForBrowser -prefsHandle 5412 -prefMapHandle 5416 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dd8415f-34dd-4e41-9bc1-2d930cd1d50d} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 5404 10b3fd88a58 tab
    3⤵
    PID:1060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.6.229574883\1347984127" -childID 5 -isForBrowser -prefsHandle 5628 -prefMapHandle 5636 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df5a0b77-54e3-4ba8-b8d6-51eff8b23c6f} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 5620 10b3fd89358 tab
    3⤵
    PID:3744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.7.1453159158\573571189" -childID 6 -isForBrowser -prefsHandle 5996 -prefMapHandle 5988 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86493913-e527-4796-be34-679e4ae89a5f} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 6008 10b41653658 tab
    3⤵
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.8.2036963407\690067357" -childID 7 -isForBrowser -prefsHandle 5364 -prefMapHandle 5380 -prefsLen 28098 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbc1601b-fb65-4148-a8f1-aff9648464bf} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 5060 10b3e503e58 tab
    3⤵
    PID:6132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.9.1897741615\1778039209" -childID 8 -isForBrowser -prefsHandle 5828 -prefMapHandle 5264 -prefsLen 28098 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {878c66a5-0574-481c-a9b5-42dbf9952d2f} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 5700 10b4090d058 tab
    3⤵
    PID:2540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.10.76339281\1416309359" -parentBuildID 20230214051806 -prefsHandle 5264 -prefMapHandle 3820 -prefsLen 28098 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {766cd2ab-bab8-4794-8435-b0d67e843ed1} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 6548 10b3e3bb858 rdd
    3⤵
    PID:6004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.11.131932716\1942206453" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 4424 -prefMapHandle 4428 -prefsLen 28098 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b89fe0b3-2a39-4194-8dad-00f3213e4a1b} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 3648 10b3e3b8b58 utility
    3⤵
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.12.1859354602\819218631" -childID 9 -isForBrowser -prefsHandle 6980 -prefMapHandle 6972 -prefsLen 28098 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9551c46a-d8c8-4441-bcba-fb6be37ac037} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 6992 10b3fbf7b58 tab
    3⤵
    PID:5968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5356

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:6616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
2365869258df7a66a2121b802ca4afd9

SHA1
73acc30a2edeb9d6830de559bb8a74f35168135d

SHA256
d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed

SHA512
795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
1bfe0a81db078ea084ff82fe545176fe

SHA1
50b116f578bd272922fa8eae94f7b02fd3b88384

SHA256
5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

SHA512
37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
8298afe87bd467b89211cb6874bc1290

SHA1
2ea272a9b3d538a9c975b1379943dd20a43025e0

SHA256
5fc8ec026bd77951f5a4967508cd32f197a5cbc57cef013d29c64ef3df63ed91

SHA512
644c99c08c5395000722c0891f67475e20ee13c04e05dd2089dd74022f827a36153e854ed0363c7a580de2cf4c7557f451debb7d837171382d71a36d33b92692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
c39bac9853e1c9bdbcf962b3f2a62337

SHA1
1ec0f8bf2ebac966dfcddb615a45a72d9fa06897

SHA256
60ac6d4a1bf8e5962ed23f95efe4e097a72a6f3b1f92c90ba68e640a48401fd2

SHA512
0f6913cdb5e7932ed150d1b319affd280695a70533f252e8f0277769fff12cf454e73e56a8697eb12074c3f1950be78122359223a9d3989667dd5dffa4acc7a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
89e185565a17f063f4c2f41398831de3

SHA1
6665d8061374ae6e8f7d04028d4a836310b97518

SHA256
caddcffe0a96b54e9f1a6378d4b0374c60f93523ecd96492f0a22f2a4ece4317

SHA512
2c6b021adb7b5ea7fe5319396ac10797a7eb36db630fa08a7409ddb8f5c9bb7387e00f9d9b11e4b69cc65d05058a78ed5076baa8a02c8516e8b8ee03990b8bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
630B

MD5
774efc3a451fa1197bce087c250db5ba

SHA1
d5c4805de94f41860b44ebc50d59f96308d0502e

SHA256
ff7e912519094c1e01c510f30e21522fc0f5b5b3ed6d6da8f7d2f9b6b61cb0ac

SHA512
c8522f759b6eedff5bf5cadabad9617a1810469903d4596b5f08fdec57dff15f0bc2a61b1d57fc1e9c9354975e518c9b9ed1ba9f6eac12bd849c2f45d4458a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
25c997cd14492fb234c64cebbe2479d9

SHA1
52af34c2402bb84ea28e545cbb6cea6e639ad8fb

SHA256
6e0794f76d4ee506b844c51b4277194068a86f81a5b15de664d023b46a2b9524

SHA512
12e80b23c6f4bb96af70242075087f25dd6b60dc3e9cf614eef323f02776d607d33f165b9f21677ac3d55b66db0989eaacce7241465f0e59603a961c67a02cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2564da2c2af7372c833c6063f368084

SHA1
c1198ce6d2a0266413a7594c476256a1d529146f

SHA256
3c7f27701e04342712209208be74121f26aa3020856aeea392428df5f0bf828e

SHA512
1adbc4595f29d10b8d6416bd1be71506eb2bc8850cdd3b90c65f845c7ba12f08d42092c18648371c0dadba28cf81c89e387d04fb47a8c4a4d59ec39e4f8be24c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f06b565a8fc4292ac2ac89baa02d8d75

SHA1
13d4b3e84f1cb9b57e8fc2397432390d1cc55c19

SHA256
ea4f026fc2554aff0a940b10acf6da81ceb34aa29f008d45c22ecd63efa1927b

SHA512
b03852bb4f25b4280a98afa7000469acf606812c3fac4aebf165f64a49d43e12b1e523a78e5dd0814b615bde20765ffec4f3cae1a8bd8dafdd73df33bbc1a4aa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
31f8e13f0d680b5280f0a09ae642175b

SHA1
0a9bef753863054b36f71e6e3740469625cce1e6

SHA256
75cfabd14581071dd927df2335d40a55baad8a54c83d56663f5073c9a0cc301b

SHA512
794c5b53a171bc746a4a097d7ad283ae4f670ec039a23eabb2a0b491f3225cc53bdc0734cd48fb7155544f9a8c347527008cba6e13a88b20c3e5a91a02b17692

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\doomed\8712

Filesize
9KB

MD5
a2b1441597ebe01cb3dc2f35d160d3fe

SHA1
07feca258e30fcc27d82ce87bc496fd15db03722

SHA256
268893422f767ca8311c3f46d6bc81272478a4519c428f1f267a7b5d65c1f01f

SHA512
4f086e97f9d05ef1fc9f6770ba626ee023ca211c84117cf57bad0a983193e6df9d964fa24094b49f4a847aa9c7cd792b4fc9204057a607ee3f71717b316ba5cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs-1.js

Filesize
7KB

MD5
93ab1d1b69029d530c7c089f58781a62

SHA1
239d21ef13bb0d9e66b755c956bdd124dfbcc45a

SHA256
4b76b40e6478d459fbac021d104ed137e6dc1766dce78e853aaccb5339c33db1

SHA512
b4d59bb338404ad2a987ad7c7546481c834d0416fa5f7b3df60e2c963121e78b3e7961243d712e8d9cf22e9780307f9a11c1cec0be08a34f22ddeab4f23f306e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs.js

Filesize
6KB

MD5
b9d42544216a16551155e5a3d2ce3515

SHA1
0127d9abe7be803e1160fd711ae000f5cfe5bd8f

SHA256
c877cf85ebc9376fef83fea16338f60e8069dad1eabcc3c0fc19a5c203d7c030

SHA512
944c6ff6d09a43d599321c631552a16b692373c0feeb2a61c3b789ba3e09d575a1f9151840ac29572ee7e59ca08005d6fc16873f3afef32548bfc17fdf01c8f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs.js

Filesize
6KB

MD5
d6dba95f3abe9874e9bceec59e3d4c29

SHA1
7b20814856588ebdb3d9ddbd765cdc7a0e5b98e1

SHA256
80bd7195a0a5f2c514df9b4936aaa039202e665e182bd9edcdfc3024e739b476

SHA512
9692b4565a8b141742281beab6cd184d20090dd3767fefbb47448f811e1dd7658e88bde8098b32937a52310682c5e9a7e52ed9d8c13e9f7309a4a05b42292122

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs.js

Filesize
7KB

MD5
ba89619e9b86d2c45a8c1344e96ce9fd

SHA1
f1677949258c18f5e0fa9f2e817e7444b79b5c08

SHA256
6478ce6d131056e4718dc6cad45c713475c393b42f2339051875b34ebc410649

SHA512
a77bb3452685d865b680e61607f304f645991cd4ca75376e803bd60b52a16bdd3ada9c28b2c978dfa8f875d9f8781356742d4872e6c5c2713aef14c325a0504d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
220ee1e3376b3f994b600127612ba1b2

SHA1
1ff7370e233573d72bbcc7f3cefd24fc234e50b6

SHA256
2b466f89b210d09023882ef0e9f35c605b8300ccdaa4501cf66cd73c55efeb5a

SHA512
303baa4baf893a7782d2f8a1451c60e2976aa58ebebfed5c84a9a60cdf368e4cd4de29d64255d18c4763bfe210b1c5de3937d12f7464177903ee371ce89d49d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a6f3f418ff55586688714cba2aaa115b

SHA1
ea723e6550f6f70a25d80ae676d11ee6c5ad21de

SHA256
51c29a1d55476056e2f7a7188fa4bf710b666e553de99ca0b6c904d2ff923ecf

SHA512
c2cbfed5c781e4a7210b44f2754fd6e5397e7259b6d250869c2790c034b17ea012e988192ec972c37035139602e0fa6ac871b71f0819e742d4271fb9fd258b34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
86455cc9552483bc2c52935f401d1d4e

SHA1
c434489e107108e44f570a2309c58234b1057be2

SHA256
16e0acc2543258c9abf7ddfef18a298750b8975db3e9b65f11349be54d6a6bb5

SHA512
f4f406b392ee80591fa809a3020ceaaea300235d15790f3079aadd5f1b3e5bde5e23f6916c9a44a785761801f9da257afa9f2ecad440658df2981b123e43eb33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
9feacdab0f25f6b22f94d5a606629962

SHA1
6dbfe2e7549024f1a146f24f72b575085a9fd5a9

SHA256
ee13e795dfae4be5ae7f177cf63a5eac9c490ae08b88f6986122ee8b9d203da9

SHA512
a4cc81c0e3b3550d6e8a01e0a302440a4761fe15496148684f88bc2b0206ac7e60c1222a293d52cfef2833c5072680e93bc07a2202fe9e7958739259be44c47e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
5d2f3d4f2a6ab767d03488d28e1787fe

SHA1
83c224671c5918ed042445ce83d6fd60346cfe62

SHA256
1d81b6448b96d77650376f82d1d10f8a1d4eac3aaad945aca8bcddf2941e8a07

SHA512
923ea09b267e24b09eb1c5ed82b6ecf7970a259ddf543bf465e8588f062ca594c4e85bee1922c4ef79c2319c31a0d232fe7fb188efa72a6eb4f313b588991ff7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\storage\default\https+++www.youtube.com\cache\morgue\28\{89039ef1-7b61-4001-92f5-0aa9da72dd1c}.final

Filesize
192B

MD5
2a252393b98be6348c4ba18003cc3471

SHA1
40f75302fcbe4a8ac2e33a8d9daf801abc2a9598

SHA256
04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee

SHA512
07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\storage\default\https+++www.youtube.com\idb\4058259242yCt7-%iCt7-%r0ees4pbo.sqlite

Filesize
48KB

MD5
66e522e97fdf01221f028b9cfc6a9732

SHA1
1f691282ac9e339bd978d4a069fa8e9ceac025d6

SHA256
d942b213d1a0637cc97c9d3cdb125c5d76c791586a1e2db0c08ef7762b49cf5d

SHA512
6cbaa196154ae87969392f60724115374aaaac6a42e247db29a62cd562de9f910db27271eb70a126420c62080b578095eb9d42bd80cd866ec10cba73faa5575d

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2928-20-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-819-0x00000262D3570000-0x00000262D3580000-memory.dmp

Filesize
64KB

Download
memory/2928-10-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-12-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-11-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-22-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-21-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-16-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-17-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-18-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-19-0x00000262D35E0000-0x00000262D35E1000-memory.dmp

Filesize
4KB

Download
memory/2928-825-0x00000262D3EF0000-0x00000262D3F00000-memory.dmp

Filesize
64KB

Download
memory/3456-1-0x00000275EB740000-0x00000275EB772000-memory.dmp

Filesize
200KB

Download
memory/3456-9-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-29-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-30-0x00007FFBFCCF3000-0x00007FFBFCCF5000-memory.dmp

Filesize
8KB

Download
memory/3456-31-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-32-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-33-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-34-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-7-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-6-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-3-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-2-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-0-0x00007FFBFCCF3000-0x00007FFBFCCF5000-memory.dmp

Filesize
8KB

Download
memory/3456-967-0x00007FFBFCCF0000-0x00007FFBFD7B1000-memory.dmp

Filesize
10.8MB

Download