revengerat | 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
Size

1.4MB
MD5

5673c04d81969a6603184069b6846213
SHA1

49fdd9c69f1c281d94486029dfaa5108dfc168bf
SHA256

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446
SHA512

c381630f7c9c72ca538679bef37b9e966ec2f906bd5eb36a42069e3742ddd57bd958d867ede257edc3244e40fa3a6c65c10cddd07dddfd89cc2085eef13291cb
SSDEEP

24576:rq5TfcdHj4fmb9Ve9u2qTPIMeYyBMLlQjzCEzKJ9TtLzCwn1jAh0zQJ9TtDRli:rUTsamC9uxKjY5x1jAF5i

Score

10^/10

revengerat discovery stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/files/0x000800000002347a-6.dat	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

Executes dropped EXE 1 IoCs

Processes:

dmr_72.exe

pid	Process
3592	dmr_72.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/5028-20-0x00000000005B0000-0x00000000008AD000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5028-0-0x00000000005B0000-0x00000000008AD000-memory.dmp	upx
behavioral2/memory/5028-20-0x00000000005B0000-0x00000000008AD000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

pid	Process
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

pid	Process
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

dmr_72.exefirefox.exe

description	pid	Process
Token: SeDebugPrivilege	3592	dmr_72.exe
Token: SeDebugPrivilege	4408	firefox.exe
Token: SeDebugPrivilege	4408	firefox.exe

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exefirefox.exe

pid	Process
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe

Suspicious use of SendNotifyMessage 23 IoCs

Processes:

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exefirefox.exe

pid	Process
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

dmr_72.exefirefox.exe

pid	Process
3592	dmr_72.exe
3592	dmr_72.exe
4408	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exefirefox.exefirefox.exe

description	pid	Process	procid_target
PID 5028 wrote to memory of 3592	5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe	84
PID 5028 wrote to memory of 3592	5028	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe	84
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 1524 wrote to memory of 4408	1524	firefox.exe	97
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1372	4408	firefox.exe	98
PID 4408 wrote to memory of 1908	4408	firefox.exe	99
PID 4408 wrote to memory of 1908	4408	firefox.exe	99
PID 4408 wrote to memory of 1908	4408	firefox.exe	99
PID 4408 wrote to memory of 1908	4408	firefox.exe	99
PID 4408 wrote to memory of 1908	4408	firefox.exe	99
PID 4408 wrote to memory of 1908	4408	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
"C:\Users\Admin\AppData\Local\Temp\3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54417509 -chipderedesign -a80c61fa351a416282afb39d6c109d6c - -BLUB2 -uqtavzboeoapfnvu -5028
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {238955f1-e95f-4b85-9908-dcad2ccdda64} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" gpu
    3⤵
    PID:1372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4153d693-d41c-4053-b27d-a2032c5757b3} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" socket
    3⤵
    - Checks processor information in registry
    PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1616 -childID 1 -isForBrowser -prefsHandle 3048 -prefMapHandle 2816 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8b97362-261a-49e1-9799-c3a3363962d0} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" tab
    3⤵
    PID:4832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4244 -childID 2 -isForBrowser -prefsHandle 4236 -prefMapHandle 4232 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffa1edc9-7f6f-44d5-b26d-ed71124759d8} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" tab
    3⤵
    PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4812 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4796 -prefMapHandle 4780 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64a382ba-7736-48b0-8b5c-7bc98021f4c0} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" utility
    3⤵
    - Checks processor information in registry
    PID:720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 3 -isForBrowser -prefsHandle 5452 -prefMapHandle 5448 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb3eea1e-df38-4bf1-9e05-e65af2a42e05} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" tab
    3⤵
    PID:1476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 4 -isForBrowser -prefsHandle 5584 -prefMapHandle 5588 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0fd0930-2eec-45eb-b393-b253b82671cf} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" tab
    3⤵
    PID:4292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5796 -childID 5 -isForBrowser -prefsHandle 5800 -prefMapHandle 5808 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0d546e5-3d1d-4abd-a395-647afe2c8ac0} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" tab
    3⤵
    PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6096 -childID 6 -isForBrowser -prefsHandle 6088 -prefMapHandle 5644 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {986b728f-74f0-46e3-8d5f-57144bb4296b} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" tab
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 7 -isForBrowser -prefsHandle 5472 -prefMapHandle 4660 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d226bfd5-e979-4e59-ace1-f291ff5e78d8} 4408 "\\.\pipe\gecko-crash-server-pipe.4408" tab
    3⤵
    PID:5068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\activity-stream.discovery_stream.json

Filesize
29KB

MD5
16ea4b3877a5b0ce90236123e5b0860f

SHA1
8ec47ecfe756b846a9f2a7dc9a20150ce2537247

SHA256
145334f0dc988493e75498e05ca24ae54118cb25fe78dd9ee566de920a393f3e

SHA512
a6e4ccd8fdf1dc753205e832df3a5a3757cc9434c39aa0b53784676f61b02ccc1723d101af972408e4e0f310c34295dd2252f971f6416cc3da593d9d6c87d6bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
508KB

MD5
da9e9a98a7cf8da14f9e3c9973328fb7

SHA1
42e37cbfa37877d247ebd37d9553cb6224d6bee6

SHA256
c1116053bbac19ab273dc120c2984c235d116cdcc9e3ac437951b55465fd7063

SHA512
ce98f1984a3db301df7c1078dc6014fc1a03a1643c5635ef59775ee8019fbae4e07c16e99ec3d1998f45947d57493ada96e5116c359a590b14573833eec17343

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMR\uqtavzboeoapfnvu.dat

Filesize
161B

MD5
c800879c1c73dbbb198fc42669646aa7

SHA1
ab63307099961d43ebb2b64809b7f39d030bab7b

SHA256
4c4dd62b579e43dc1c4cf859299df3023409492281f173bc5c3d2cc00bb782d7

SHA512
0bc20e0c61f46a6c8eb0d8c276edc1f1901ac2f2800199d78490ba0b3c096e4cbf08a175ee19f663d7c13d56e7b6852f32478ea6c85f7829f6fd2880023213df

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\AlternateServices.bin

Filesize
8KB

MD5
c485bad110ecfa6d21d9f5e8246753ec

SHA1
240de4d4312a0facf53c5af52d42d3f70a6b7bf9

SHA256
3a48dcc01779d70725f9db4d48e79ee352e59f6d9755652ce6a6ff2bfdba4897

SHA512
9000dc79294df0d8b5333e5adf36d9dbadb0cb1e5c8efc398551605cd5d696ca3fd1d23687428b1aa042dee4a81954f7763e3c8827ec0c38d839832122c2b4f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\AlternateServices.bin

Filesize
12KB

MD5
99ae07f381818adbbb1b7c96ea26b11c

SHA1
86a6c31ee1c5ee527b50ef9cfead70e2283a3e14

SHA256
fc5dcb3994d0e6bbd944a83f028c1663ecc5995c23368aff6b021cee401def81

SHA512
e1a3db0b03e9530fcc86737cc21a7ce9beb94f3f4d1dbf2bc3685e3dd94a56e8851f95272d1d383bd4fe54e03dc10fbbe3ee535a0ca991f506953010980916ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a3b042d77d2ed769c0fecc36ef964195

SHA1
4d61122821d5d44f484e455134bb9998f9ef755c

SHA256
34d9617bcf1f5acf9485db74c1cee464bc9147033524be7ca8a93303bbb31a24

SHA512
08cce2a2bbdc8358591df34633f49662d0fdd6a4b54f95e83c3f1ba895b97b7624cea87cec8b34ade19c1c449167b89df10954264105bb2761501c7054567016

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
1034ca5ff7827fbeaf299f143fe0f3b0

SHA1
a7e0169952b2a96634d5748e7badf80bdb6cec62

SHA256
c4e0832c127499860de470578e179d33c41c81642b2e7a46e209f6bc990515dd

SHA512
8f13260442bae400b959bcb6ce3efa8fac663aa909afbe107ae11e4fd85cbda7d203578f799affecb3714ee9a21fd58fd4ac00ced22d804d9ca777d5ae7d577c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
dc2e642bae3e13d3f670a808a9f9b49c

SHA1
be8c517821b56ae27d07bf2a5212acd5f70026c2

SHA256
f598362b5b744dda15781f05f46b87cbbd7ac6e5595ce8de05d27edf278e0bb1

SHA512
bd232a9f642434d331c92f4ef0d49cf7425d4af9f7d81095e704599fc4e2e410be8b7f11337d6ec6ae7b8a4e3a6cde590c98bc2e40f25045729d336302a779e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9bda2cb5e8df7c952d2e2b1d785e257f

SHA1
1f820cd5a1ce1ea9f68c6d4f5956e9cd5009d043

SHA256
3d1a633d4e677fe97df0f966a03348d7109c891e1ac64df6d29dbf894e4d9c76

SHA512
e371cbdccabe0dca1437af645191fc9331cba2811b3116437bae911c481f455075d573f10263f95838e267a933cc91c414727b66a36949772e5b74ffb54d9b55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\3d2807d0-3afe-4e02-a5a0-6da977c06bb9

Filesize
982B

MD5
fca7a2de3fb35982293340d6733a9724

SHA1
84e0fb80082283cc95ec8ea19da2a565e576de4f

SHA256
4b073fa15bf02f3e1b7b1d8d7193db6d6fe9baebf8354b2e4434b9d640331e4e

SHA512
af7422133bf4e1be79dceb2ff2b2520021cf385b56b959f68254cb3ec52359e57ba4e9bd36a8902f3607362bf98c089c45b71c7f8f0e5afd28b1eb6abbe715a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\3ec1a474-364a-4ed8-9038-d26981712d28

Filesize
27KB

MD5
49b0952468b8bdacb32ee9326d919480

SHA1
dc6fc87928e449647926eec2588ad34e6f779c36

SHA256
db17438e8fd79571acf285880484fd600573b61ebfd8eebfb88f668924a2c51a

SHA512
53ab6cd2d687a977d502d21e9247863b5610de401a93e72e2530d265ceb06d32dad90e7719e54a262da02340c57e1de9281b99dabe1c942babbbb2f8394e143a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\44e51e9b-66b4-4018-bf12-d5cc2691e1f9

Filesize
11KB

MD5
aedee85e1144d98f5c0f98f5d72f0cd2

SHA1
8e75cc46adbb2d246679cc1273db3f4e43dbf89d

SHA256
7d1b01400840690ecd453c84a3134e9417129eed0845fdc18dd697a44fdca9b3

SHA512
7b9bbaa1bd2626f288be9b972fb6a0983484f99c2b4861bf69bb3e3e54b52e9ac232e1e9911dd1ffa5d9dcc5a676f99400563a55d2d685cbf78fb3db639b53f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\d56c3727-5833-48a9-a32b-c36cc9acc711

Filesize
671B

MD5
0118cb92231c476b56a74f3749caf411

SHA1
516d231baa2f9a31b531e46100da99af737c6443

SHA256
492f0fcbdd86c466a818edceb505638766fd9bc514eb58e1a15989c16d8090da

SHA512
597047b4a68e06189e3a8ce865934cea89e5a76e2dea09fbdf3317d3a2b3dfde088c85dc99a566bbb406d93ecbfa00149162f8e540800cf7dbf84bad2f4067a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\prefs-1.js

Filesize
11KB

MD5
417f0266397e9fa0ff87bcdcf637448f

SHA1
7cde6fa0d4eb98b501b1b0a9442fb70543b5e705

SHA256
265aea4408132c7e1d541eadafd0e6b835610a6e445390a4d3fd19998e72bfc6

SHA512
97035f3563f0eb40e22832edbfc1073233af9b725db524d8f4f34226bd739cd5298acc6ea22ce76cd5ad97694c79ace02ecd87027c53e05752aa86c6eaa0bf3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\prefs-1.js

Filesize
11KB

MD5
30cff9af1d50c9201c3b240aa3a92291

SHA1
9337f2570a50565fb0b8fa036389a5166fa3e9f4

SHA256
ba9906e7071cdc7fcbfef42710f167c6ff984e5eac9b9a3b56ca0784a37b2f6f

SHA512
0ffdd541ad80b085f71792c8f994407bb3c98d450de86eff5f3440245a423d891d7308683675177d753b8bdac191d219dd76342b8385e608765441b9f967c313

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\prefs.js

Filesize
11KB

MD5
c6e58622311749efaa7ff319a6a972ab

SHA1
ebeab772771965d437bd56ef587ad57604efb754

SHA256
beb8e27f01339acd2bf679955441b6befb57a4cbce59cc37a1bf7833faaae883

SHA512
1842d52a8c9ab0fc4b5f71498fb015f3455236bc244510e40b047565ec9be10095bfb0875db53ff181d1a9409058c507303ab3f742b078bcfbac191b5482685d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
77c67d2e4bc6f876f29d2473ae20700f

SHA1
6d78062fc23506c5697ea0d8352b44c93c23f018

SHA256
3febe09ffbad40867b21edf1fc395df1aab6186831bfe381ed261465ac77deb6

SHA512
74130e8a05f5a4f39291eab284aea5b6ef0806b6df84744355ebfbee550939bb3f18df36cf7b46614cadc34542f912f0133231ef99dd2d568bccda68bfad44dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
3e82010059e72a23d3dbd3256645ba97

SHA1
8d828495cba2bbbaea53c0cb60cf36d2a4332734

SHA256
15b0de8369a2381ac007adfe7c9973162149557277cf196aeb4051fd29d0d012

SHA512
408c356828af117e80756ad17723757f81b42b47542615417ce1cc8ee5fa320cd1880c138a8e5a556d7de406099d0c67de097f1b67bb3e0914821d529891b483

Download Submit
memory/3592-22-0x000000001B080000-0x000000001B229000-memory.dmp

Filesize
1.7MB

Download
memory/3592-19-0x00007FF9BBE80000-0x00007FF9BC941000-memory.dmp

Filesize
10.8MB

Download
memory/3592-13-0x00007FF9BBE83000-0x00007FF9BBE85000-memory.dmp

Filesize
8KB

Download
memory/3592-18-0x00007FF9BBE80000-0x00007FF9BC941000-memory.dmp

Filesize
10.8MB

Download
memory/3592-14-0x0000000000350000-0x00000000003D4000-memory.dmp

Filesize
528KB

Download
memory/3592-23-0x00007FF9BBE80000-0x00007FF9BC941000-memory.dmp

Filesize
10.8MB

Download
memory/3592-17-0x00007FF9BBE80000-0x00007FF9BC941000-memory.dmp

Filesize
10.8MB

Download
memory/3592-16-0x00007FF9BBE80000-0x00007FF9BC941000-memory.dmp

Filesize
10.8MB

Download
memory/5028-0-0x00000000005B0000-0x00000000008AD000-memory.dmp

Filesize
3.0MB

Download
memory/5028-20-0x00000000005B0000-0x00000000008AD000-memory.dmp

Filesize
3.0MB

Download