dd2b39b01f2d5b73db6a9646b5228ace84aca142b25dff24c63be4fcd1ecd6f7

Analysis

max time kernel
183s
max time network
190s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05/09/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IriunWebcam-2.8.6(1).exe
Size

3.8MB
MD5

3c52b51994262b962aa97465c72ea59d
SHA1

def17e30753b304446360bf27d68ab950bd8f0c2
SHA256

dd2b39b01f2d5b73db6a9646b5228ace84aca142b25dff24c63be4fcd1ecd6f7
SHA512

1e54ba23188989bf91dd6e7972c9ef0f7a5c4f34ca115f23b136b0f53f889081f985d3d34b7c6a85a49b6b7dbb7ab3b36d23aa223d0cf816081e8a97d80f8e41
SSDEEP

49152:2BuZrEUJuqR+0kPdtxQO1K5e8su0gtUNf5Kq30xDDTtdiDNg+RBaXRZatsQuHyRw:AkLJuqs/T1Ktsu0RLr3uDHcgWoJ0Rw

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 1 IoCs

pid	Process
3308	IriunWebcam-2.8.6(1).tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IriunWebcam-2.8.6(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IriunWebcam-2.8.6(1).tmp

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\SashPub.rar:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6384	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3880	mspaint.exe
3880	mspaint.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe
6384	PaintStudio.View.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	firefox.exe
Token: SeDebugPrivilege	5036	firefox.exe
Token: 33	5192	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5192	AUDIODG.EXE
Token: SeDebugPrivilege	5036	firefox.exe
Token: SeDebugPrivilege	5036	firefox.exe
Token: SeDebugPrivilege	5036	firefox.exe
Token: SeDebugPrivilege	5036	firefox.exe
Token: SeRestorePrivilege	4840	7zG.exe
Token: 35	4840	7zG.exe
Token: SeSecurityPrivilege	4840	7zG.exe
Token: SeSecurityPrivilege	4840	7zG.exe
Token: SeDebugPrivilege	6384	PaintStudio.View.exe
Token: SeDebugPrivilege	6384	PaintStudio.View.exe
Token: SeDebugPrivilege	6384	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
4840	7zG.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
5036	firefox.exe
3880	mspaint.exe
6384	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3308	2244	IriunWebcam-2.8.6(1).exe	73
PID 2244 wrote to memory of 3308	2244	IriunWebcam-2.8.6(1).exe	73
PID 2244 wrote to memory of 3308	2244	IriunWebcam-2.8.6(1).exe	73
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 4968 wrote to memory of 5036	4968	firefox.exe	76
PID 5036 wrote to memory of 4252	5036	firefox.exe	77
PID 5036 wrote to memory of 4252	5036	firefox.exe	77
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78
PID 5036 wrote to memory of 1848	5036	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\IriunWebcam-2.8.6(1).exe
"C:\Users\Admin\AppData\Local\Temp\IriunWebcam-2.8.6(1).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\is-RC14C.tmp\IriunWebcam-2.8.6(1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RC14C.tmp\IriunWebcam-2.8.6(1).tmp" /SL5="$10004A,3088384,845312,C:\Users\Admin\AppData\Local\Temp\IriunWebcam-2.8.6(1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.0.1186936284\1613772176" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cee31e6-de01-4bf9-be2f-90f800734e1a} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 1796 1e0c8ccfc58 gpu
    3⤵
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.1.1018545240\371341058" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {880caf3a-d6c4-404a-8b4e-74fb06d03818} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 2152 1e0b6772e58 socket
    3⤵
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.2.2012603685\100660255" -childID 1 -isForBrowser -prefsHandle 2540 -prefMapHandle 2624 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05dd52b7-3875-40d4-b189-29e191d8783c} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 3044 1e0ccbb7958 tab
    3⤵
    PID:1612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.3.1893426814\735327056" -childID 2 -isForBrowser -prefsHandle 3256 -prefMapHandle 3252 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21206e05-a251-4563-8651-5cd81351bc9f} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 3076 1e0b6762558 tab
    3⤵
    PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.4.1487860275\1139504598" -childID 3 -isForBrowser -prefsHandle 4296 -prefMapHandle 4292 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89ad2f3d-343b-44fe-ac6b-cef434a394e9} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 4304 1e0cef5f558 tab
    3⤵
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.5.316493395\1084193731" -childID 4 -isForBrowser -prefsHandle 4872 -prefMapHandle 4856 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abc7fcf7-48fd-4562-9b37-85fd69320472} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 4884 1e0cf0fb458 tab
    3⤵
    PID:3096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.6.1178915204\1436206850" -childID 5 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1f8d27a-d983-493f-aa35-abd252a13ecc} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 5020 1e0cf29eb58 tab
    3⤵
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.7.365726643\1667453521" -childID 6 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e40b53c-605e-46fc-9fa8-1a6b6f5ccaf5} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 5212 1e0cf82a958 tab
    3⤵
    PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.8.1214651845\1715599295" -childID 7 -isForBrowser -prefsHandle 2988 -prefMapHandle 2968 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63f91979-d58a-48b0-82ac-5a1d10288c24} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 2996 1e0d04f7258 tab
    3⤵
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.9.1831996658\1092924042" -childID 8 -isForBrowser -prefsHandle 5588 -prefMapHandle 5080 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d68b9a5-dc98-4551-9830-586c85440c21} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 4912 1e0ceff4958 tab
    3⤵
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.10.371469506\608019694" -childID 9 -isForBrowser -prefsHandle 5068 -prefMapHandle 4380 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c41e7303-dbc7-4888-8fbb-c267dd1f4ce5} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 5500 1e0cf5a5b58 tab
    3⤵
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.11.1740683702\956767106" -parentBuildID 20221007134813 -prefsHandle 5124 -prefMapHandle 4288 -prefsLen 27081 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a77ac369-7740-4137-9528-f35b282e1adc} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 5500 1e0d3e92258 rdd
    3⤵
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.12.1969877635\425441101" -childID 10 -isForBrowser -prefsHandle 6280 -prefMapHandle 6276 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97eb9fd6-95bc-4b13-bc3d-0ae4896ea4c9} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 6288 1e0d4136b58 tab
    3⤵
    PID:1004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.13.1392103445\1342348086" -childID 11 -isForBrowser -prefsHandle 6464 -prefMapHandle 6480 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {066b4273-506a-48be-b631-a9012a9116eb} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 6476 1e0b6766558 tab
    3⤵
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5036.14.172703947\1974998731" -childID 12 -isForBrowser -prefsHandle 6716 -prefMapHandle 6664 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1364 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f856fd3d-3fc5-4956-af1b-8ff6fb0ea47a} 5036 "\\.\pipe\gecko-crash-server-pipe.5036" 6704 1e0d03e0858 tab
    3⤵
    PID:4240

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2264

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SashPub\" -spe -an -ai#7zMap14542:76:7zEvent7105
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4840

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\SashPub\data\skins\monstee.png" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3880

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\3084

Filesize
9KB

MD5
7fae765f72fb3fd0691d93ecafd7d352

SHA1
5e3abfb9d293ab9a8328e2467f51d9d94e551ed7

SHA256
73ebb6b00e8bda94fe4c01e89a2f6421cad6147e8d279b08cb368c76b0d630ab

SHA512
e8c72493e6d37f0bbf9d16e7f8f364ed964110b1b6e91ba1bf90c3db88d186d5110e6d0aa15a98476a9ce5e55d268f82c5640367dd3e99794fd638ec1350a7b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\00C8B4DAB30394D24482931B05BACC88FC707DDE

Filesize
60KB

MD5
ce6a2b0acfc7e3f426fd4e2b90908519

SHA1
62a703053132717350b7d236678519ff882a1db5

SHA256
882be8f508859b55752e15f44c9d24b4267cd5a8078465c998884bcaf4fa8d6a

SHA512
e9cd7b8c50c864bdd5e36771be1a54f18f32f81ebd77e3b0f47a96c2568014111f934b4141fa05315b91a67e7a911a7239bd7181d81305e5593b4debecfd0de0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\244B84493CFC92803AE819DA14659E855B7D9AE3

Filesize
56KB

MD5
02db927c2e5d1f9d0b60fc064f62d0fb

SHA1
b86cd5e2a5edba1545620803d5a7ef05d21bbced

SHA256
57db7554a707422a262c708ce2845eed51149ce0a4c94cee96bce3b05cc1eef4

SHA512
762be164de218b4fb4ef8b7e0fd2e8a95e62013b48badf44519cf220b5cd272ca414286c063910f732fcd08fe6d8d921870cb8ffe7849351bae58298ac9877a2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
236B

MD5
42ca28c9ded6b98ef7f1848726c4777d

SHA1
cf9e8161853e3421b09cc949467003b84d315e97

SHA256
5b709b75fbeaee8b09bd21483094926a2509ef25d2daefed0e2e9861ca9a1460

SHA512
b7198daf3077cf864a582101bc2d758314c24345e7ca114b845e9b8a8120cf8ca1d57cf0bb91aea478d0833596e673b7057a3727ac9f1b6ccb2d0c829f498f92

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
404a3ec24e3ebf45be65e77f75990825

SHA1
1e05647cf0a74cedfdeabfa3e8ee33b919780a61

SHA256
cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

SHA512
a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RC14C.tmp\IriunWebcam-2.8.6(1).tmp

Filesize
3.0MB

MD5
472f50ba3023877240c4a374073cabdd

SHA1
b7846aaccb0ea0d2ad591ba5cb6743dfc8522afa

SHA256
86be3364dd47f1d3e9e6e91661bf3c6c288e7c0d297e826b15a97846bb83fbdd

SHA512
70ad87d3d030085318cbf6512d7924673600932d4f38f8d2de1f21e41286b7672f19615432cf4ca646f2a750ddcf22dfc35ca55126f4e1b4751b333bd51cadae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
aa0e3f78597e89dfaed79672787fa3de

SHA1
67f68f1031ff4ed5a4af677a6efe53a3891dc074

SHA256
1e11f9d4d44d915dda51d1bc4e5480a3109a85bdb08628676ce57ad5ac9f3e54

SHA512
2de427990a07d8f4f753dfa9eadc125de989ae7f1bbab59f18eafc5437dd92c7eba55d33dce44ec987e20e0871c0fb883d696cd7e8b35aa73f250d2f7f109b51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
4KB

MD5
bb7a179e0fe0f87eae6c80f43d0fe713

SHA1
41303d5228de13818f8dc6e919dc130140e08791

SHA256
15ae1389224918cc4800796897b4d7979f82123471196094bd64f253c356530c

SHA512
a8901fd30c2cf89dfd3dd190022280c50cf56464327721fc41005d2402d6167b93a79c5d839d813a1adfdfe7dd2e94f974276e6c855f8a2513deb6ef034f6632

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\011a2fd2-cb15-4f51-9970-89683eb8c614

Filesize
10KB

MD5
2fc6a6d2a1b31647fe98cea8793095e2

SHA1
2a5f27e107ad6741829abe331a999ceefd493f47

SHA256
2664766b392295711bf0862e012c2440375e81fa7fb1b9a83b1d76a8ae1cf88e

SHA512
8ade3af08ea4558673b1d8b1e6acb895200f9a8b1ac6fe22f9cb40b9f7ea889788a3cd738a0e6b92cce06fa985ed9e6963a258cddab4f44cd3d566aaa114b699

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\84d39db3-9b1a-49b2-b6f6-f03487c90762

Filesize
746B

MD5
c2e1044eeead0d4e1c7fd21285b11f82

SHA1
b8e301b7791879b6187b98824c3b2f6469bbb4c5

SHA256
f2f524eca2d2507663f13abe1913d19df7c370b39d489f8aa4848e8613075b93

SHA512
10d6f5d8c7c6b8fb87f4ee8a0dfcd9df4e08bdf07e8ee6f895a240b86d1f9ca8dfe32a222e6587d286d83d2a0061470747c06ed2b27ee04bd3cf67577292d020

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
40ff4260b48168a4a3219169ecf3dfff

SHA1
d5937aba96ab96356b61c82f383556c6d78011ea

SHA256
76e09c5dea244e197cf174ffe1f999b9ee12a2ac2b4dd20b93df75887a60ae5e

SHA512
3fd3ed59be06671e83a756b8e75a3db92c530d9062235a1f5a2ebf445584766369da9a01651d3b9cd99620ecc700e18b18b0c99d8e7ce01c09b7f4a5cbc2393f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
95e8da5b6e87f6cb3dcb7dcba3754864

SHA1
ed33b31e7981ac8b68dda28bd5f309dc255ead31

SHA256
589c19b6194360c5aecb6773399d681b659c3af2b6f869720690d05382cf52c7

SHA512
6a03a44075c38799985cc26daea06cba0cedac8cb25610e07f8c248b4635394aeef36758c9b0c8a907c432eeb74ef6d1a37b9ff6614a49c6ea9e26090c77b331

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
3ce24a642831124bf475352fab7e2150

SHA1
254062ef1fdac7d89bfc75cebc541d0e0128405d

SHA256
921647358209b78397ce51a77c19b64be05941ee5a8e08e5bb9f8af25aed9364

SHA512
edc1fbd245b29e4eec37f01bd5e55f99efd31a003fa2f4d7ebb43412d7ea2ab7edb79578307cb2503496f9a75febf405241de1f2057bef0abe952e89aa6de35f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a6594a389b36c68ebb607746bfe70515

SHA1
1c38a446e4b078a5588666a17808196a4d603fb7

SHA256
11b71bf72581827fa5f89683b320c5ff2aabc305acef0302aa7eae7fc36d010c

SHA512
302d63f14110e911a824ab948ff606a8868125cf1530b1ae406b985fee450e7d16e0c0daf91fe70ca47bfc3ed5f53ac4c6fadf55f62616d024068b500ae46a27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
8d89f70b695cdc1e0973c4b6e2abf407

SHA1
63a7addb6931dbc46d7a0bee2ad55081f4c7773c

SHA256
87d52a176f01bb090b5c352e9cb4fc33cb021a0aad6e778c2c7cdb10a6c3bf2c

SHA512
1e582797ca2534afafee0c8bca99485f7acc3b41fdd81cdb1775c3888b298c5fe07e40c9bbf366156125d91e0f4ca8cc1937a0fb41b09491c51d08d111ffac1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e29bb27263c4440fe9a4f0613cab0cbd

SHA1
0911055ca2150b4efc836e280107a17b560765d2

SHA256
c1485a0852a7c636b2bedcee9cac820dbfa83d5f6edf3477d0569e4bccc6113f

SHA512
f04fa3c8be72a0210cedc2d8c4af91715efb2b9c6d61c13734c16fd3032b437071e047ccb02ffc5796ad39cb4a849ad99b682726d82d9e63f5e2f8dd7ed37b49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
d0b54d5a3f0a1eec35fc21c4c41b0314

SHA1
c5753cbdcafaa2aba7f547c2358c7a7131b24628

SHA256
de04251b7e8f84f39066f73955bd4e386635178cdd256a49560a04a47d4b4cc5

SHA512
ef14af3b0e8e974582d039052bebfe41bedd9eaf60164d46d8c17b093a9ac5446600927b6b13a5c6845e698d6b8f69f5418fad3dc7c17b765ab30d8a47e5bbed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
1bf857b90ae6be8b0bdfabd9b9e68063

SHA1
287c1390bf7e750bc746a79210ec7851e934f99c

SHA256
153bee2b2b8fedae9594655a653cde0d6bea9d41e7f26af91ba46627e036a8fc

SHA512
141dbc9e277d34f92a47f9acda3f6e7041fb121322930d1659bd80d33f771500fca7379a95540a5a8db91ee9ae8b219d8a39b515e5592568da4ad5f20cf79fb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
9ba6961ef11d038469cc40d49bf73f2f

SHA1
0692d5fe2602707a27dcaeb228e0f301ffda1597

SHA256
583a0bfa4786567012d0cfb0b4638b5dc8adcf0dcc6706d2f8c9397332d3844b

SHA512
05602184cad9127bc616b8d9cd418929a947d47ed2de2af565ac3cb9278a626f68e55169730ce9234dfb1cf472e95780338134fb86dd4c8c121b40edf0cad0c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d332fd693331bc77ad10b6b1267b5d49

SHA1
50a1a2732c6f0b72dbbade6528aea635592db3d9

SHA256
5cdc39a0ae3a70cbbeb527a6da7ef8f8582b9b7971f793276a4393bbec3ab7d0

SHA512
71abf7f4179f1c0aaa9cf9cb5a6068e2ccf58dbdf094da227097af9d913c72a8dc6fa17997e8feb023cb9a4a165179cc58a007ef9aaf30ec256944a77068c990

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
f5bed6e266d9e7bb6b705ca06c7aca70

SHA1
98b708dd7012cd1666aed93d7242af524fed2957

SHA256
56f1362e1d2f1d434febbcbc74b317b4c7cd8f5257af0f284638f8e4cdc6a51a

SHA512
d07313313eee225946d43a917887c548344743b7d34b95121ea77fbb9e4b5a469c0a04b6d4a2a2ef6983f8252cbe7f4895adb54143f2cbb864d6568c765357ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
fb18d7ff72ff765babfe2ef1e3e2c66f

SHA1
44e4242e8e460f178293fbc52afc8e85165f4bde

SHA256
96c2e1a268309d334957dec451052a1362fcd340379275112de3ef19bd654b43

SHA512
027d75988318941ef02bc5428a0d14e0a7fb6a851c46901dd2b8aa4cb504ed134b1fbcef156847ce3923e869ffaac806bf8436e3db9af429f00c35bd095d0aff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\default\https+++mega.nz\cache\morgue\232\{e698e504-2a2f-4174-bf9f-bb430742c9e8}.final

Filesize
1KB

MD5
3efa9abd92666265dd81c4f4311a96f9

SHA1
41b6b716d67b93555e444cd453f3c6e3f8c9522c

SHA256
5066b1841e8877db31312ef3af86f9bc9234c95071119e025764f45241a4e2e7

SHA512
5961950f077501608a0f2975e7f69c483eeacc4eec4ac77fd650cc1131609501f87819f93ed23aa508a90426156abf038a859fac4112d2d4435bbb634027cd6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\default\https+++mega.nz\idb\3713173747_s_edmban.sqlite

Filesize
48KB

MD5
a6479e5948caf1b068c484b8b9dba888

SHA1
3b3eb538cac360a3ce10080da1451b3e8231b9b1

SHA256
3206801acdb44038e8a6ca909cb7493f785dcf3a4c917ef156698fe2bfadb968

SHA512
d2521d82be58d8c96617b36999d4618b5fa8e697d3d6b3fe68921503b333508b2138f331ac665fd26b5097f4eaac9a3bb123950a07b53c0147bc9cc884062051

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0d0013d9708d9fef539adc917f5b87f6

SHA1
5e071e6b4d8abf007c8bb78ee948caf5bb0439e1

SHA256
f416d29cdbaa66b7d04483831d2a593a735316fafb643414a12df78da0ab054b

SHA512
851e9965a0fed9e0f5195ce655635cf13687d18678e4a9df807ab22cbc53c02cd2006fd65d93cd80b2a06d709e59122ea9933ba5cec551c6d51f5e9b4c175388

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\weave\toFetch\tabs.json.tmp

Filesize
10B

MD5
f20674a0751f58bbd67ada26a34ad922

SHA1
72a8da9e69d207c3b03adcd315cab704d55d5d5f

SHA256
8f05bafd61f29998ca102b333f853628502d4e45d53cff41148d6dd15f011792

SHA512
2bce112a766304daa2725740622d2afb6fe2221b242e4cb0276a8665d631109fbd498a57ca43f9ca67b14e52402abe900f5bac9502eac819a6617d133c1ba6a3

Download Submit
C:\Users\Admin\Downloads\SashPub.nqJwRuRJ.rar.part

Filesize
79.0MB

MD5
74afc6c2ffcce72a250e44f5c8adab53

SHA1
aa3fcc932f4bae91c0738e6f9bf7a3d45c1873ae

SHA256
9086fc92d373d9c56ca61cd35da7add8f7605b2a22ce41de162c464d810ae4c0

SHA512
c9b9913e7421bc8c20482b89a524d819cd17bf92a84fda181cc210e31258d68d28a7f3435403895ca3f1ad706264892f2b3bf30c34e64623fa1de20ee2436f66

Download Submit
C:\Users\Admin\Downloads\SashPub\data\skins\monstee.png

Filesize
6KB

MD5
4d0f98ef748832aabbb1377ae767fc9a

SHA1
d0b60334c1b0e25460bdada80183e850a9f8d2c0

SHA256
e4742d8e63d6012f9a9934a83b6df4b9d14842c88ced777ddd06f35590e08679

SHA512
54e7919e6b87df66bc34e8d2baea7ff8fc1639f8514ca5bfc3e6810180c3ddbb14de3aec3eefb15b72e46e8b453d483e2d98530bf31542c8dba75555de435ce5

Download Submit
C:\Users\Admin\Downloads\SashPub\data\textures\game\Mentos_first.png

Filesize
167KB

MD5
24bc0f3886f8acc3f8e052c1fa9201f6

SHA1
b269829fbe1676ea4527d2ac22dca66095f0bb4a

SHA256
15a49960703938be4a2ee4286e6d87a00d9781755c5bac45a28a24d2d82d7ab9

SHA512
3d9bff3f11d39c81ae5e72421925d3c59dfd9aae8595e70610da0eb53943302b016f182c5c1804ef868b1aa21242071415c44194e1c4ed8215ce905bb4477eee

Download Submit
C:\Users\Admin\Downloads\SashPub\data\textures\game\Spitfire_Overwatch.png

Filesize
147KB

MD5
8d2afc8364c865a4df6590970e85f44c

SHA1
f433505b1eae58e6c0e014fb73d9e93162cfdd59

SHA256
92a201a64eb07c57f550c99e7a1b7840e689a89571d76bef58b6adee7227ca49

SHA512
4dfe46567246af1315925f641e501a2ed2a227cbbe9862a793d9d091572b00ea2f40c1c757f2068b063d00609283a16355d0bc5ea1dcf24663c82d138861a977

Download Submit
C:\Users\Admin\Downloads\SashPub\data\textures\game\zombie v.1.1.png

Filesize
260KB

MD5
14befae392ec18493152e758e41e41ef

SHA1
068ecac0ee21164125e72eb21d3e65dbb4a207b4

SHA256
37b80bf9aa5c1f02e350a01498dd7b0afda4c4c7a067388415875e15ac3da37e

SHA512
ca9738e9eb344e8f0a3cf07f3341e7c30f29da7e712ae77e37194d5e87f5f194d6b4cd2832a86cea251f5cd751e1285f321fb66447d83fb374278de05776dec1

Download Submit
memory/2244-90-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2244-99-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2244-0-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2244-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/3308-97-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download
memory/3308-91-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download
memory/3308-6-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download