4fd167e871391b6593cc83e9b735b8ecbb067afda8fbefdb2f4fd4c91f9d5a9f

Resubmissions

02/08/2024, 13:59

240802-radq5ssane9

02/08/2024, 13:56

240802-q8rj8asamg10

Analysis

max time kernel
1050s
max time network
866s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/08/2024, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ftah2.ini
Size 48B
Sample240802-radq5ssane
SHA256 4fd167e871391b6593cc83e9b735b8ecbb067afda8fbefdb2f4fd4c91f9d5a9f
MD5 294ab38e0053c30b7ed63a50c3170480
SHA1 cfa378923e848f5ac5a7782c1c310ad195ac1bf1
SHA512 41f96ea1d9421fd653a8e5e60defb5be0001caf687cfbf4bcd7f8242d385fca202888038bce42271d291becca8e1cbe5e142857f87634ceeabbe2832f82a95f2
MD5 SHA1 SHA512

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BEN R3TURN 3.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BEN R3TURN 3.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BEN R3TURN 3.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BEN R3TURN 3.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bens Hangouts.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\ben-r3turn-3.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4836	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5360	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	2944	firefox.exe
Token: 33	4436	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4436	AUDIODG.EXE
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	5360	taskmgr.exe
Token: SeSystemProfilePrivilege	5360	taskmgr.exe
Token: SeCreateGlobalPrivilege	5360	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 1396 wrote to memory of 2944	1396	firefox.exe	75
PID 2944 wrote to memory of 3804	2944	firefox.exe	76
PID 2944 wrote to memory of 3804	2944	firefox.exe	76
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 304	2944	firefox.exe	77
PID 2944 wrote to memory of 4936	2944	firefox.exe	78
PID 2944 wrote to memory of 4936	2944	firefox.exe	78
PID 2944 wrote to memory of 4936	2944	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\ftah2.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:4836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.0.1877520439\1556495806" -parentBuildID 20221007134813 -prefsHandle 1728 -prefMapHandle 1716 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbdf5424-f185-4920-bd50-0020d4e27845} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 1808 288a12f8a58 gpu
    3⤵
    PID:3804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.1.882947660\331721432" -parentBuildID 20221007134813 -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {180a0330-c2af-4316-a202-73c2eb04f38b} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 2164 288a0de5358 socket
    3⤵
    - Checks processor information in registry
    PID:304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.2.146658958\1926955677" -childID 1 -isForBrowser -prefsHandle 2916 -prefMapHandle 3036 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eabdd94d-e08e-42c2-a65c-d5c0f9ade105} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 3004 288a509ee58 tab
    3⤵
    PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.3.340405921\911107293" -childID 2 -isForBrowser -prefsHandle 3444 -prefMapHandle 3440 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07739b58-c98e-4746-ad71-74bc35db8d5e} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 3448 2888eb6a858 tab
    3⤵
    PID:4912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.4.502009776\1623193163" -childID 3 -isForBrowser -prefsHandle 3440 -prefMapHandle 3568 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {891433be-c75b-4fd8-a2ee-d04ecf6b5fca} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 4340 288a5ebd058 tab
    3⤵
    PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.5.1439824603\1370100890" -childID 4 -isForBrowser -prefsHandle 5024 -prefMapHandle 5020 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0a46f46-74b2-4694-a6e1-dc81cb5cafb4} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5036 288a786b358 tab
    3⤵
    PID:920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.6.2091356742\1618570392" -childID 5 -isForBrowser -prefsHandle 5096 -prefMapHandle 5100 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a5fd2f1-e222-4b4c-b7d2-b0c1d9d25256} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5000 288a786c858 tab
    3⤵
    PID:1600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.7.2141413337\975538291" -childID 6 -isForBrowser -prefsHandle 5304 -prefMapHandle 5308 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {794cd4d8-98ec-4974-9786-d0e2d8b1cfde} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5296 288a8233858 tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.8.358644090\173081618" -childID 7 -isForBrowser -prefsHandle 5704 -prefMapHandle 5872 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {983d360e-8748-4a37-a46e-27d5c2c5ad60} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5720 288a746cc58 tab
    3⤵
    PID:756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.9.1757745489\1746879222" -childID 8 -isForBrowser -prefsHandle 5272 -prefMapHandle 5268 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e55a632-0736-4c9a-8c07-56f38a0168a4} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5260 288a8ea8d58 tab
    3⤵
    PID:3096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.10.366611729\1521861710" -childID 9 -isForBrowser -prefsHandle 4724 -prefMapHandle 5608 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {376a2bd2-8375-427f-a008-16197b9412b8} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5372 288a8232958 tab
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.11.765702247\1872590949" -childID 10 -isForBrowser -prefsHandle 9388 -prefMapHandle 9384 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f07e45cd-d97f-4ae2-a90d-f7c8236ca10a} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 9396 288a8230858 tab
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.12.277359842\575190714" -parentBuildID 20221007134813 -prefsHandle 9332 -prefMapHandle 9384 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82e3a3dd-219b-445b-b712-7bf0d1e39534} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5460 288ab52e858 rdd
    3⤵
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.13.1998457729\1649153031" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 9656 -prefMapHandle 1696 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f3a114f-76e6-43be-81d8-808d48dc005b} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 1560 288abdc7658 utility
    3⤵
    PID:4220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.14.1187117943\613182693" -childID 11 -isForBrowser -prefsHandle 8988 -prefMapHandle 8936 -prefsLen 26925 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0bfb72f-53e8-4612-be15-8a832d1c1431} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 8872 288ac4ab658 tab
    3⤵
    PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.15.2028420053\602028948" -childID 12 -isForBrowser -prefsHandle 8700 -prefMapHandle 4400 -prefsLen 27442 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ede7523e-7923-4fc7-a2f1-e3281647e32d} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 8720 288a8c8ff58 tab
    3⤵
    PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.16.783677186\401198583" -childID 13 -isForBrowser -prefsHandle 8312 -prefMapHandle 8308 -prefsLen 27442 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cc06665-4419-49bf-a729-af4646befb79} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 8224 288a8e87558 tab
    3⤵
    PID:5592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.17.568407390\1244202009" -childID 14 -isForBrowser -prefsHandle 7760 -prefMapHandle 7764 -prefsLen 27442 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {508d397b-2db9-49cf-8a30-b0a45cd579cc} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 7748 288a94ce558 tab
    3⤵
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.18.2113999337\1483809131" -childID 15 -isForBrowser -prefsHandle 7608 -prefMapHandle 7604 -prefsLen 27442 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4442a3de-239d-436d-927c-b511ff3fa813} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 7616 288a9667b58 tab
    3⤵
    PID:5212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.19.486385021\227771999" -childID 16 -isForBrowser -prefsHandle 7412 -prefMapHandle 7408 -prefsLen 27442 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5630f14c-7584-4ab0-8367-3cb31a63bb49} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 7420 288a9666358 tab
    3⤵
    PID:5204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.20.824753593\447124547" -childID 17 -isForBrowser -prefsHandle 5000 -prefMapHandle 5476 -prefsLen 27442 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8793e0ee-b13c-4c67-85e6-5b7c9a393ed2} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 9632 288a9b4c758 tab
    3⤵
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.21.1765483020\157891880" -childID 18 -isForBrowser -prefsHandle 5040 -prefMapHandle 7652 -prefsLen 27451 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18c42724-401b-4893-bda5-2a1df042b621} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5044 288a7417358 tab
    3⤵
    PID:5248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.22.17272080\1140027338" -childID 19 -isForBrowser -prefsHandle 7728 -prefMapHandle 1492 -prefsLen 27451 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21089f75-3079-4adb-8469-bf3f139fcbd5} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 7480 288a509fa58 tab
    3⤵
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.23.2051844354\2043112136" -childID 20 -isForBrowser -prefsHandle 3108 -prefMapHandle 8988 -prefsLen 27451 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72e8dad9-464e-4656-b977-7882c1b2dd23} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 8936 288aa456a58 tab
    3⤵
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.24.1266810692\103445396" -childID 21 -isForBrowser -prefsHandle 8124 -prefMapHandle 1492 -prefsLen 27451 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce26b0ba-4995-4722-9956-cdb65eda3973} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 7240 288a7439858 tab
    3⤵
    PID:5440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.25.1594052437\1179356977" -childID 22 -isForBrowser -prefsHandle 1496 -prefMapHandle 7760 -prefsLen 27451 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fceb98e1-074b-4b0f-b84f-98db041bf2ca} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 9516 2888eb6f258 tab
    3⤵
    PID:5140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.26.939871581\1716932595" -childID 23 -isForBrowser -prefsHandle 9796 -prefMapHandle 9812 -prefsLen 27451 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {580f9c97-7bf8-4ea6-8bec-c3437bff8026} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 8904 288a94cd958 tab
    3⤵
    PID:3980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2944.27.1177367451\1215772834" -childID 24 -isForBrowser -prefsHandle 4680 -prefMapHandle 4792 -prefsLen 27451 -prefMapSize 233444 -jsInitHandle 1004 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f4ac864-c452-4bb3-bd63-2fa9c939d7eb} 2944 "\\.\pipe\gecko-crash-server-pipe.2944" 5032 288a8ca8a58 tab
    3⤵
    PID:4924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5732

C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\BEN R3TURN 3.0.exe
"C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\BEN R3TURN 3.0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6048
- C:\Windows\System32\cscript.exe
  "C:\Windows\sysnative\cscript" C:\Users\Admin\AppData\Local\Temp\4462.tmp\4463.tmp\4464.vbs //Nologo
  2⤵
  PID:6104

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5360

C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\BEN R3TURN 3.1.exe
"C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\BEN R3TURN 3.1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4844

C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\BEN R3TURN 3.1.exe
"C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\BEN R3TURN 3.1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5320

C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\BEN R3TURN 3.1.exe
"C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\BEN R3TURN 3.1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5224

C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\Bens Hangouts.exe
"C:\Users\Admin\Downloads\ben-r3turn-3\BEN R3TURN 3\Bens Hangouts.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BEN R3TURN 3.1.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BEN R3TURN 3.1.exe.log
Size 1KB
SHA256 20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
MD5 90acfd72f14a512712b1a7380c0faf60
SHA1 40ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA512 29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
MD5 SHA1 SHA512

Submit Download

15807

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\15807
Size 8KB
SHA256 bf437297ba9152b0e07d1b0e190d04bfb0093b1b109056b60a1c8ccbe0946a7d
MD5 35d6cdaa2b337ddb9e6e168f760e2297
SHA1 b152121b53091c3a4da6c043676c549e329968cb
SHA512 e5115e3961b74c480277891736275abef42693891ce22f4f7d89b7f17932b21d3d49857dcb3a6d1a36bcd353d628852132dfd3d45df390c9ba3c835797eb8ac4
SSDEEP 192:8zoXlqHcEd6M7uDItBoXlqHcEd6M7uDI6A4KKfCPJMGna0Axkoysyn:SHcQq8t3HcQq86HKKaPOGnAI
MD5 SHA1 SHA512 SSDEEP

Submit Download

24222

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\24222
Size 9KB
SHA256 5d3b44269af2549c169be52d2c22b5b1066775c404bb8fbb30e63182c58ba59b
MD5 be6106fdf1b94eaeeb456eaed94ffa0f
SHA1 adad8ac0a65cce240b178abc3444bae58669126f
SHA512 1ebb8f1db2c02b27a2aefd55aa0db1293ea8f6c334095627a836f135debf24397a7db6aa7a4fe4d773f2ec84f371d855f65a7e65e24cd7a0b535898f6032c60f
SSDEEP 192:bkKm6LYLBHG4awimmf0J/lIJ/GWU587N6lPSXSM:bLbLIgwSelKy87N46
MD5 SHA1 SHA512 SSDEEP

Submit Download

25019

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\25019
Size 5KB
SHA256 f68908927a0a675df197be68da0136aeb13c70fbf9c4a983ca04faf4c2ca210f
MD5 71c9f675730a768614c3bb8046b24fdd
SHA1 5831884c27c78b355346e9a398d3d5b59a82a131
SHA512 e0ff5e30efdc5a5cd84a250220d03bac20515c8249fd6c979e81d9181eb0d35a346767ca9584a618b486c286aab1851f76e7b7277436aa270e31baf9a716dfb9
SSDEEP 96:88p3xwvJzz3lu6JyJzz3luDivUU1K87o/s6nxBlGWGo1GoE6:843GvJ/lIJ/GWU587N6lPGiGa
MD5 SHA1 SHA512 SSDEEP

Submit Download

28404

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\28404
Size 8KB
SHA256 608e0563b471dc4116bcc047cdc61f0ab19bfe98e0a512ab546445ff497ea104
MD5 239ab8a3ac30b703bcf37e7223820d93
SHA1 00952f1d26da952d08936ed2ed3a7adf41452f6f
SHA512 5d4c54f31ba3ffc8b507a7aab5c0f11210b0d98e32b1500b867bf8eb3830c50e616becf2d074ddefce01c5e7fcf54ddf83739c253f09db1a1531a52057bbd86c
SSDEEP 192:MsKVUJM4529FTd1JJ/lIJ/GWU587N6lPLiLZ:pKVU+45kTzlKy87N4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

2AB0ED3D72F6842459296C2654AB13217682D975

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\2AB0ED3D72F6842459296C2654AB13217682D975
Size 686KB
SHA256 4d748d4d18450edd5d6724b26cb4cf4992bee6d7097d8f697b666140afd08d3a
MD5 84abb7bd0ab47c2030655010c62f3965
SHA1 9423d5bf214114194f1d2cd691bbeaa25febffd5
SHA512 7846e5de6676fb49b3076d831571b8bf48828c94d6a0002c8250fb02521490e4c18c084ea5ba8c1ef4b3b2c81cae2354985078c653621e84af8182b56181305f
SSDEEP 12288:etbDWYL+QSVVW7Qe8jBdB3qmn88t6BVUXkoV1vq8Uy8AxWCYUj:4fWYyQSV87Qe8jp88t6BVUXkoV1vq8Ue
MD5 SHA1 SHA512 SSDEEP

Submit Download

31ACEC1D58BA9248D525E953C5804F46CBD370D6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\31ACEC1D58BA9248D525E953C5804F46CBD370D6
Size 18KB
SHA256 069e2e77bed1e0a72408d60cc6416dc2568aa2c5ec2e35c94ed5ab59de2c04e2
MD5 bcac8608011e1dd80a2c506d5f944a5e
SHA1 0944c820bd1ed634d6b7cc4f296fcf39f68f9a04
SHA512 07b7732e5db2c64d3d132a9886810a863b41aca2b9951853bfe57d9dbb0f937811133e27f130bd2a03b5232c66bb52a36489b2855c503571899acd862ee635bf
SSDEEP 384:4NxZ5gSecIbgkUlA1tDUxCIHcQq8t3HcQq86HKKaPOGnAqCHCp:4NxUSeBSlAbU3HcLe3HcLBHNaZ5CHCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

54BE58374655C3E89277B3F0A4079B76B81C3F46

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\54BE58374655C3E89277B3F0A4079B76B81C3F46
Size 119KB
SHA256 3d2a87e411bc0d4bb10f9769d8afc934593e6fafba853010acfa89a4b378cc0f
MD5 ab6b7771116726ce3cb402786e9c54f0
SHA1 9f396ea2b8512f8370f429c0796862f3627eb521
SHA512 d8567730b12053ef3271dac3656e0d8fbc82bf91092a7e7c26fb1b6f55d773bd9ac3b8d96a4acddae70fc14df3a1fea21f15c5800353535bda57b1adbf7e7646
SSDEEP 3072:i/NMBc7Xkiki18aRk7Nf+wkRuFlGKJQVkDIE5WIos:nc7qi18aRjFkIyWs
MD5 SHA1 SHA512 SSDEEP

Submit Download

79EF1E1519435FB6A84E4506CE1583326B9CBEEF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\79EF1E1519435FB6A84E4506CE1583326B9CBEEF
Size 62KB
SHA256 9e2d1544b2506e0081ae4b1a30096cac2af7d385c1806f8c049724c098fad321
MD5 0d352ebcc54375fbbf8d20edc87e40cf
SHA1 e682eedfd24ea0acda3bb7bab06ca7139f9666c7
SHA512 7ae28227d35eec07e6b443b5f014ebe99a41a47806903c5bdf367477e79908a58ce5ba57dff06edbcb1611e78d02b5e45f7b7ca358eb93d49e02439173559ed0
SSDEEP 768:SqzZ01kp8AubB0lk5+c4fAE5L3aN0ikxpD6Y3EQY0s0:Sqd9pSpHL8p3bD
MD5 SHA1 SHA512 SSDEEP

Submit Download

8B1905E77949FF7F0809A55B15A5B04670080E70

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\8B1905E77949FF7F0809A55B15A5B04670080E70
Size 72KB
SHA256 0b0ab6e36a07f9807206e018345e16a18a2703186ac983f0d4d2d3de0c86aad1
MD5 dc08bb241d641ee8e76046b3bcd9f03d
SHA1 f0ed7912848061cb47602b153a157a245020e591
SHA512 507c60fafa1aba1c66ae3906db1cb8e39a6e5648e76f412c9d55364f5d0106cfa82b2a2ddad367e77771d32488ac8db8f1d6b9690f0a82ff36f9e24566b08a1a
SSDEEP 1536:I0nfx1oq7Gg0X5VAu7KKRmlC36BvMTkhZY8g6CEekou3x:I0nJx7O3X6GGhZQUou3x
MD5 SHA1 SHA512 SSDEEP

Submit Download

92572A7C04F7C5BB2504F508939352B84A900C96

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\92572A7C04F7C5BB2504F508939352B84A900C96
Size 16KB
SHA256 33e5a87796855dc0f647950425e634c2aed69f2021fef6677321165e118612f5
MD5 ef3681578af8034b85f6a5b6f15043d4
SHA1 44500fa816ef99f3b3a954b63bfb426cf7279cb3
SHA512 e757b08e85d79cc4e24a34a0bc6eb7806a1fc2e50204e7fa050300a09e9ccac3f0f93642a87aebd453d258d81ca46ab83598804b15682295fe8ca5552200acb4
SSDEEP 384:7VEJ024I+kLx5CpJqAFeApEdYGxLeFNCCY3EufYArnsm:7TLkLxopkAppENC/Y3EQY0sm
MD5 SHA1 SHA512 SSDEEP

Submit Download

B16898CE86D7BE4F60E8482A4AD97AD942B76C66

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\B16898CE86D7BE4F60E8482A4AD97AD942B76C66
Size 139KB
SHA256 b3d2d37b321a22a73702059645984d989330cfa6bb25346948f2add0a920f48d
MD5 3509df9e3b848f3444a87512578898dc
SHA1 fcb4c278296469e9441bd32bcbd9d934809f5862
SHA512 777287db705870c2b9a59acc734deb557cb91c666ca56b1477d6576c4c0ea7c4de347434cde609013616e7e5be161f3581f6ac6b80f1337b899cc3261d97583e
SSDEEP 3072:KOjEEQqGNyHKgpgH9XkeBOWLNyMygpgH9nkeDOWNoW:KOToyqgiH90eBhyvgiH9keDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

C941DBD419649B820658FDCD20C966BAC6540424

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\C941DBD419649B820658FDCD20C966BAC6540424
Size 10KB
SHA256 fbcd9647326b946a9acf3a75355c6a85105da1fbab5b1b1484a944a2d0fb877a
MD5 3239610eaa158e2a22c19e1cecaccbfe
SHA1 1c7207191b7c3cefae1a550c81390bb2fab8f8b6
SHA512 701860a04f0dca337f11fc82579eec1d21a699141240eb256a17038f1dd93a40c0579ec8ea5032eb34d5ed6bb8110a87172edddde3ee19ebad50d1852a02299a
SSDEEP 192:ZcEFJ3CdARuzSO8hJ/lIJ/GWU587N6U+Lv:2g3CSkzglKy87N1+Lv
MD5 SHA1 SHA512 SSDEEP

Submit Download

EDA34B5270C592C18984B2A3EF601B71AC2CCCED

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\EDA34B5270C592C18984B2A3EF601B71AC2CCCED
Size 204KB
SHA256 7db8429a8e9d366cae7f651a222bbe41b68ea14d7ac5b8b6db9432047e2d99b1
MD5 6aac39bd941feeddd7541255c42c267f
SHA1 30310fb3fe31ea2d565bb44b5584e7b2769b41f2
SHA512 388d272a5caf0315b82ef1296abcafc00e36e805fe000d826bb83771ae81a06d11f48bcd1195db4a3624f14439ad3a00c3289e0b8482a5f64813a48a308b31fe
SSDEEP 3072:/BgZwINNpmEs0xBlQEPWUp0ZDn2lEzlxfllnB5P27SDIO5E+9b246MEhpev8toN:5gZwINbp9BlpP6LrISR2Iv
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4985AC5E5A008F12E05196A950FF93AFD688B22

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\F4985AC5E5A008F12E05196A950FF93AFD688B22
Size 399KB
SHA256 1e0edbebc3a026b37463aaa32d0a542266afa64c902041b53fb4a6c80cae00ae
MD5 5d1893e82f51395c85eefb98271ea9ee
SHA1 c58d1b7a4a8365dc4a911085a0557ac8098faf2c
SHA512 61023023cfad448e0c3d40dd41ed4ceb42cc12a4ec94e04633a7120e9c293b586f923fe993f237e264ca513cbaade5656729f991fc858591102e0be53042a23e
SSDEEP 6144:wHMkXA5q48qIl3rxXNe8jh4FaVVNcQ1IWtrpNuGckJuPFaat:wsuxhl3rxde8jBVVNcQ1dulxt
MD5 SHA1 SHA512 SSDEEP

Submit Download

VPLK6n70H3UUxCWyJXumAg==.ico

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\jumpListCache\VPLK6n70H3UUxCWyJXumAg==.ico
Size 421B
SHA256 eb75229a7f4bf75f34ce782151850e309cc4e71113bc09925c2dc1d1ba4e7d01
MD5 dbf33c11fb236301c1e4f5504d838ab0
SHA1 3fa9186c776b2dfaf9684a50ae0dc97844e9e6a8
SHA512 ad1d6fec2c9b29007b3e4011d75c38997bd7d326ad091b3199ee95241a9d58159e82b9d36a45ea61faed9731d22b4ad5b2310e3b44cd8e0d66394795324d49c9
MD5 SHA1 SHA512

Submit Download

d888190b76b4010c8e5daf7dbea547ff.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\thumbnails\d888190b76b4010c8e5daf7dbea547ff.png
Size 6KB
SHA256 2748680f61a2b2f5016609bc7dc5a4865ec367e97db4b7e9e5dd6a340e3420f2
MD5 b3c808e7684ae16befa9478335c588eb
SHA1 fc1d7dd6a537fe9135146eea7a8c8acd2c50021c
SHA512 d7347699cabe7c777ec5f4c85c1c8da6069db9873c7ad33aa546965675857c35ce0c02bf7d0994e764f5fd6b24e87fc72ab1777f4306a2cdda0f531caa78587e
SSDEEP 96:Aju6U7gQE/tWubeAr/ejD2ydauuHHZGnbWB0PH8f3FJnvCz61OhQToSY3VTq:57gTtWubDGRanHHkbWoHMb6z61OgHYlO
MD5 SHA1 SHA512 SSDEEP

Submit Download

4464.vbs

Path C:\Users\Admin\AppData\Local\Temp\4462.tmp\4463.tmp\4464.vbs
Size 2KB
SHA256 75950db15378109e1964c0d9618867bc369760585ebda5a8dc642d4d1700faf5
MD5 631bffa8703b397d095663d3ea0331e5
SHA1 ff590723e39797e32adf42f033104ee78bbff772
SHA512 a6bd6df3558cddab1909c09c08b084e65162e2a2a0578a75a9ae0dcd28cff301d6418fd9d864e7079944a2589f90e682c5d4e60855c4bb8acf8f96c5555e90f7
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 e447aca4b287499e21df1532b0e5fb5b7e2b3bc49ab2145d58f6740e72701326
MD5 d2ef1162e5d36292c1b10a60da931c14
SHA1 1160e1d76e11193be9c204cc710b7879cb649b39
SHA512 9afa6143a8fa2ffe7ff5f852164768d8c78eba7d2f9e29c51bd702a912136cc102b133163eac98be58b0383ceb787e961a6080230e2ffecade96cb38633e62f8
MD5 SHA1 SHA512

Submit Download

a9db6a62-a386-4212-b31b-25f1d47f3f0d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\a9db6a62-a386-4212-b31b-25f1d47f3f0d
Size 10KB
SHA256 190207db2568d4898599034e19e7227b447646ec597d75fc62a8b3f2153de974
MD5 49f097351a8acc82f2aac4950d2085b5
SHA1 d2350847a1b67f3600e3480dd3c8a112a5619f4e
SHA512 cbe456105d1be8dbd1bf3c65c8dea113222195dd2feec9c06796d5a7a8c5d141909db11129f11f021387621e47eed0a6cdc05641cbdb78fd78e14d6224b96762
SSDEEP 192:1jwVH+t38Ll9KVjWThZHuq3MIuQIKc8U4e9SYS/PHsV3fPZIQuqMAiusW8i:nSYM19vi
MD5 SHA1 SHA512 SSDEEP

Submit Download

e85e4744-8da0-48e9-8573-da910d2f9de5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\e85e4744-8da0-48e9-8573-da910d2f9de5
Size 746B
SHA256 94c09d6c7772d735e5ca2a65914d38f5ef5fa7dc0d6bb12244981de4471d3f4f
MD5 879ec342bd97336a3ad3c27af0ee53e7
SHA1 5b62bb2407de6fc0670219bc294e2c1cc0f74825
SHA512 bff1c472272d93e58ebde4d23e8e1fbb4030f87d629d481c1167dfa69294ac7a6f0c780f7f61ce315c02f0facc7a44533d348b7f05b5c48138c297f5f84fe0ef
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
Size 7KB
SHA256 a8ff55d3ef2bbf61e754bd6316f284f3ba0d222d281ef8db0fee92714312682f
MD5 e296c0fd1e4c5b9b551840947af9f54e
SHA1 7191d63d122433690c5120e56838df7f5a11df74
SHA512 e9a903cd75f6f0574166d0b3db6460437b491968be5d7ce3f1324ab8711bb710a602cdd02825d8f9cde516427a45c8731091a812c3a8d026f0eae7d0a0eff63a
SSDEEP 192:VcnQCRsdjMQweSPX6A7nRHYI8IVRBw8Vw:phi7nRHBwP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
Size 7KB
SHA256 a55c2f12c9544dabbe476853c6048f0b3f0ecb1a4817abc5c4d4174c0853e84c
MD5 cbb5dc2e777e62c1d759a523580fdad7
SHA1 7b6cfa52dead0014e82405442aaa1517ce53eb97
SHA512 90d9723eedf320c3a3395256bd832472a09d7908bd48ca8f76819ff09572070f5313b5207f9e0c3b875824f894a604aaf32d0df66e59a6eeeb7a65aef4c8b77e
SSDEEP 192:V5nQCRsdjMQweSPX6A7nRHYI8IVRBw8Hw:Qhi7nRHBw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
Size 6KB
SHA256 34a3f37780c28db6ce4d81d3c1639557fd9f6d4a219422104e4308808920dd4e
MD5 09924847359d27afdf569717b137fc3d
SHA1 2f6a72c66a6126cf2bb527732f9e8a60fec0192f
SHA512 b24993240c9d7d74dfd863d5d94de4690d50971227c5a85ef0f0260fcb77b4d69f3e90fd24588655dca597674119a839d34247fd71b443e9f0e0429102bbc1b9
SSDEEP 96:xHD5nUTeqGqsdjMQweOTzSAPXAnpjxuHnDPnKOHZUBw8HH5:V5nIRsdjMQweSPX6A7nRHaBw8HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
Size 6KB
SHA256 dcee4437899cf07b7208cf54f69997bbd0bdbebf159725632c9e17e062d880ac
MD5 1b1cac3e3bd3529210329a781a1c0f2f
SHA1 42f98a556e32d23b08b7e99726913dbed8bcd51b
SHA512 442106547a62fec8705e97e79ed8a355f6d167811978adff4c17c0b7ce741a3fd7661f6afa38ab1234edf14e68af622e715cc9ea43c18088f1663c353f73e66f
SSDEEP 96:xHD5nUTeqGqsdjMQweOTzSAPXAnpjxuHnDPnKOHZDBw8HH2GS:V5nIRsdjMQweSPX6A7nRHlBw8Hw
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 cf2945440690bd01a70e6351a481348d8fa83300b96a5ce41b400202f2f5ad83
MD5 c1f7330b983f8759eace2179135dcfa0
SHA1 6757f9250ae1bee39f4894f4137d0acdf8095933
SHA512 0a290bd3ab0a59ba2b5c020159e8153fd37c1d4224422fa893c4d16274b1816730818b3fbc133cf2469bd5fb792b086c5b01f24a94d07738cd91c1a65117f614
SSDEEP 96:rqM+w9cWFsMC0A9V9lbw6RZgJcGaJlAYbowCnIZfLR+2xIRQl:rqMnXGv9VTkKuyaYbofUfL8fG
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 fefb9207fe2f23a7bfcd3926e21e87ee9b44bbea7a9d532a8a16a1c5d94f16be
MD5 7644571e43efad93bd4197226a58b9c5
SHA1 38262c6897d89a91861a0f97dfc8cad6bc750d2b
SHA512 ceac22e101525cfec8e6a71427ca9283d68493fd17cab84be964a2e6fbe924460848d6b24b79e9bc668980cbab14f7cb85c24e885a37b4aa7228a002495b690f
SSDEEP 96:NqM+w9cWFsMC0A9V9lbw6RZgJduJlAYbBnC7U0GqLpIHit:NqMnXGv9VTkKRaYbwjGnq
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 e062d3dcf5380abcc01d747cf91f02639e2896524796c75c593e12080b8d28cd
MD5 9976b9cd52e2c842d50a4a6b48cafeaf
SHA1 42fc725d25ce1f261c5b1a0fd6fa2edce5ae22fa
SHA512 33e763d6bab93e42aaa65163f9608e43a72b0c02695b41717e4305398d4830ae9ef85c9d9edcee162cc9a26b6240d72e87977bff6e51930456ece48884d411de
SSDEEP 96:MqM+w9cWFsMC0A9V9lbw6RZ3f8JlAYbDCNCQdNp3I5LEimI4rc:MqMnXGv9VTkK4aYbiDduPV
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 48d8ba2085d54f8510c9c94da43a3afde4f74c76e6c8506050b8b9c8e329edb8
MD5 5946155255ce0f53e6b701ab31a6b2d5
SHA1 82907a8c0a1f7f03742d5e388342d05c069b86d9
SHA512 c168a2526a18c7aae5ed44709c9871e422517ce7f01c48c6d34ccd5f65f18526a0db0907c3c8ef333b731008f467b9e09fa354ba7eaf3e150f5b7fba2bbcab7e
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 635b365f7b19ebaf49bd9dba6d118ff37c558ca1a88851aac688aa088d067551
MD5 ade442fa0e1fd59bd24dc954c226d210
SHA1 4abde5af459372589ae0ad09f48375078860439d
SHA512 b6dc2a542e835956aa77fcbe48a36b58db7d16c7983378b5d2dbefaba9106e7e3588b011a4b70c993e732fcb80c23236024b95c99fe86cb525af37f2e2138bc4
SSDEEP 192:RqMnXGv9VnlZtSByWq1lv5M8SY2LXghqiS:R1nXGvx/m1gvG86ghfS
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 91299094fb586fa22053f08995c8fe5b5de94d3eea6d0822a3ef9e70d1ae86c8
MD5 be4365df54fbe96b1d650e4c0458145d
SHA1 4efffcdb07175056307815dc97998a0e1df1fba2
SHA512 1433d00c37ba60e632517eccd1220fca959ed1330d724aa7c197aacd90390ac763e0b778fb17a8891e208fcdcbac85a9bd51f0d4e0a8ec9bf420ab30390b13e2
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 d5ef5abf257f90c0dc505e47101a42f6948e5c4b457cacd9dec83c181e23a88a
MD5 8378db6f612ff16788c81f4253063b33
SHA1 61d37ddb4326dc870f8fa4dec131be0c78a634ec
SHA512 9117240aaf7b6901bbb20a3cbb5368500c108c1bec594657be72d84355bbbf029f57b92609f1a9140eb2b9524437974b8b3b6b3289bb88e80d6cf26ef9fd5e05
SSDEEP 192:QqMnXGv9VnlZtSByWqZMr3305M9cL2Jwr7iYUR:Q1nXGvx/m1vH0G9RwNUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 ab21ffa668c708f05fc4a8c5a643d6539831c75483f05119bbbec1269c792e5c
MD5 58b6f7d99d49233dac507071f555fc86
SHA1 a9768c9cb1442768771e83cceb5ecbb5d436d436
SHA512 8346d532a699b6b61c63786b29bdced15b3c4ae26c2baa8211a4d2251abbd4f7e09a5e51ee2bc279896a20705bef445cbb617be7dcc5b8cd5a10ba049438520d
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 c7802992d106f57f049b9f67ef146baad888d0928df5b6a3db6b3dcb51bf51af
MD5 df35a0978e95f2ff37c1222f5da90c02
SHA1 eee60b2e4b74f5567ce2d801439c737a5194bab4
SHA512 d34fbf6dc8ab9b8c362d782e60ce1b3acd357188695261c5c57899093964a6228448a7a0f8e8b74616a656e327f811d0fe7d1c7639a5f7e5a819dbf638fd727d
SSDEEP 96:KqMFwCVsMe91HwGLS629vJlAYbkCPi62B3+uE/MOINDyt:KqMrK99wdb9xaYbbXAuSDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 0354d97ce80a1fc134258ef82d43ccd21dcf25fead3fb2aee2148284922a9af1
MD5 76edaa60f3f71b900b69966137165a7b
SHA1 c438192749ff176aab6f8d26503fff73022299a3
SHA512 3019e031ccdffcf435ab33f2d8bbf60f5cbaba5a09883a3dd93a7d0e67df1f9b48f153b2dba8668ab8961d7cd3ad86e8d9a92d8cc16c298326e3fa48617aa40b
SSDEEP 96:XqM+w9cWFsMC0A9V9lbw6RZgJPuJlAYbBnCd8s9z+4y4UInZfCj:XqMnXGv9VTkKjaYb0jk4JZn6
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 b74fe414fef6dec5b236d8e8669873078c13bf1c05a2fba354a2ab6c26c5c2f6
MD5 a85a1e2a04825a5e4429357c1f232e07
SHA1 54a168930fb3775e3ac4366d5fae3bd6dd0508e7
SHA512 fb45c779a04637f2fb8c64e2c0f8ab74467d4ce0f2dbb68700c1108c2fb4510687956e45127b3cb564db2e5e2fa475101158f433d8e3fb510d62c66d8acdf41e
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 2750d6d3f0a8b6e47c82b0334ca87c1f000d3e43f3a304d6952cf9994db9e0fa
MD5 5e9d11c9f8b8df2a0ae5ba5cf8b99ace
SHA1 753648c4e0f8d7dae5d68530ac467fcd493050cf
SHA512 d510dc94a99eb065c39e6546dd829ac615c12ec12f3598914e51631259e7d2d8175d585a220abd853554e969e5a50c36588f092f2552174a9aa79340d7a7f9f9
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 c9ebd4ed91b5b85b2f490430a9b858f6e8f4840e477e9ec1049539cba7a9572d
MD5 289543faa8063ea3c0f43c21bc9718e3
SHA1 dfc4a8ac02c8650f83ca4b0004a8d3b956936402
SHA512 9eb3781cf91122f8ad545f4dbc2bdd08e910ea48644e92a741c8829463983e862a1c262332fa23a84620eab936c1b9477f6cff5570a224002068d68657fed952
SSDEEP 96:rqM+w9cWFsMC0A9V9lbw6RZgJ9GaJlAYbowCnIZfLR+2xIRQl:rqMnXGv9VTkKXyaYbofUfL8fG
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore.jsonlz4
Size 6KB
SHA256 8bcaa2cbd72bb2471f03958929ff12fee3216ec751b4d127fc2c0388665a5ba8
MD5 f2598ab60424b7646eae09199b8d3105
SHA1 1b0c845ed17c359451226243c3b56dfd7e725a80
SHA512 f359089bac9ff26843b49bb083dd9073b96c30ba249643ca49d14d584ee7e8fe82406ed0890774dd310e8502280bac95827e7177acd674f3c61d5e4856e44c0d
SSDEEP 192:X+MJ2RJ/m9klatSCD32FLiLZeGmi4REPGMvJ:XpgRJumodrt11mi4aPG4J
MD5 SHA1 SHA512 SSDEEP

Submit Download

2926346687feisraebbaatsaed--hte.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\default\https+++gamejolt.com\idb\2926346687feisraebbaatsaed--hte.sqlite
Size 48KB
SHA256 122bc7bc28a6cbe6ded4ce107a5789de31f775543d3a188a1bbe32fab6ffe145
MD5 5ca46dd58095a0b02f2d70a96210873d
SHA1 706632536387ace08c541d4dc4e8a5103f60a595
SHA512 b4b51429e8ad33cb21045f520596a98ded21235421aed480b96ed87ac4905a05311380427efafb576714a09afce8acc98395b68e53503a6d9a9012a5a4bf8cca
SSDEEP 48:T/OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:D16S6CKnqlizbxV+2xVeU7X2B0
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 06575a0a693c9e0f265fcf03ee5b6ced4dd922ac999f5d767a9a7d92fb199082
MD5 f72c2c8a738f1bdd4a5e24326ff248df
SHA1 d60277881f6b36509d709948fcf7ed3ec3da74a6
SHA512 7fa2cc3e4f6e6f9c77fc12e188a0ef4e5dfd9079e1ddd2d689669513bd2e512136ac4485b34aa0ed8587c8cd519572d31eb2496b4091e229b6c339bf25c27d6a
SSDEEP 1536:P6S6dlG6luwPcHUXVNRuFPW3y328asbPP9wR9ap6SJOrTeHWaqaZvChColUPK9:DocHUPRuFPW3y3P3969ap6SM3eH5xRK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ben-r3turn-3.8PDSUrEt.zip.part

Path C:\Users\Admin\Downloads\ben-r3turn-3.8PDSUrEt.zip.part
Size 84KB
SHA256 8a9376896670dec7b17c30ba279f5f875cc81145b49e5487d5e4ffe750c36974
MD5 dcc2feb464b113a0ba0c16464c2369c8
SHA1 865e761e39661ba76313eff33106048319ed57d2
SHA512 8ce80b622634251a66d5b96916ab40a0ebb4f46ff50ee884d1df11d25f4825431bc335fe2118e9296a5500b158fdddf320d6941fea7157cd41e89c0b8ff32405
SSDEEP 1536:Tqik2ZTp1ol979r+RHfVAjnEdmg2hMmHWMYpuiIsjVdcaSLPHaIBvNTa5Z/BK/AZ:Fk2ZTpQF9G/VAjnzg0Mm2M6J1uaSrfB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4656-2216-0x0000000000750000-0x00000000030D8000-memory.dmp

Download

memory/4844-2208-0x0000000000290000-0x0000000004AEE000-memory.dmp

Download

memory/4844-2209-0x0000000009340000-0x00000000093DC000-memory.dmp

Download

memory/4844-2210-0x00000000098E0000-0x0000000009DDE000-memory.dmp

Download

memory/4844-2211-0x0000000009480000-0x0000000009512000-memory.dmp

Download

memory/4844-2212-0x0000000009310000-0x000000000931A000-memory.dmp

Download

memory/4844-2213-0x00000000095F0000-0x0000000009646000-memory.dmp

Download