vidar | hxxps://www[.]dropbox[.]com/scl/fi/56blt3d0860v1uhbbybdl/Unlock_Tool[.]zip?rlkey=b64ioeyp70sp9vgmjg1qe4top&st=ts5zyjii&dl=1

Analysis

max time kernel
218s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/56blt3d0860v1uhbbybdl/Unlock_Tool.zip?rlkey=b64ioeyp70sp9vgmjg1qe4top&st=ts5zyjii&dl=1

Score

10^/10

vidar 23a142269e47ce1692ccc9fb68473bc2 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

11.1

Botnet

23a142269e47ce1692ccc9fb68473bc2

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 31 IoCs

stealer

resource	yara_rule
behavioral1/memory/5288-1408-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1410-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1412-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1419-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1420-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1428-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1431-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1439-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1440-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1456-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1457-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1479-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1480-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1485-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1491-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1486-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1492-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1500-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5288-1501-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3576-1514-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3576-1515-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3576-1525-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3576-1526-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3784-1535-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3784-1536-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3784-1544-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3784-1545-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/728-1663-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/728-1664-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/728-1674-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/728-1675-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Unlock_Tool_2.1.6.exe

Executes dropped EXE 11 IoCs

pid	Process
5408	Unlock_Tool_2.1.6.exe
5256	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe
2060	Unlock_Tool_2.1.6.exe
3596	Unlock_Tool_2.1.6.exe
3736	Unlock_Tool_2.1.6.exe
3576	Unlock_Tool_2.1.6.exe
4604	Unlock_Tool_2.1.6.exe
3784	Unlock_Tool_2.1.6.exe
664	Unlock_Tool_2.1.6.exe
728	Unlock_Tool_2.1.6.exe

Loads dropped DLL 2 IoCs

pid	Process
5288	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5408 set thread context of 5288	5408	Unlock_Tool_2.1.6.exe	115
PID 2060 set thread context of 3576	2060	Unlock_Tool_2.1.6.exe	125
PID 4604 set thread context of 3784	4604	Unlock_Tool_2.1.6.exe	128
PID 664 set thread context of 728	664	Unlock_Tool_2.1.6.exe	151

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_2.1.6.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_2.1.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_2.1.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_2.1.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_2.1.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_2.1.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_2.1.6.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2280	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e80922b16d365937a46956b92703aca08af0000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me).zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Unlock_Tool.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5160	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5288	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe
5288	Unlock_Tool_2.1.6.exe
3576	Unlock_Tool_2.1.6.exe
3576	Unlock_Tool_2.1.6.exe
3576	Unlock_Tool_2.1.6.exe
3576	Unlock_Tool_2.1.6.exe
3784	Unlock_Tool_2.1.6.exe
3784	Unlock_Tool_2.1.6.exe
3784	Unlock_Tool_2.1.6.exe
3784	Unlock_Tool_2.1.6.exe
5864	msedge.exe
5864	msedge.exe
5508	msedge.exe
5508	msedge.exe
4416	identity_helper.exe
4416	identity_helper.exe
728	Unlock_Tool_2.1.6.exe
728	Unlock_Tool_2.1.6.exe
728	Unlock_Tool_2.1.6.exe
728	Unlock_Tool_2.1.6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
868	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5508	msedge.exe
5508	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeRestorePrivilege	4000	7zG.exe
Token: 35	4000	7zG.exe
Token: SeSecurityPrivilege	4000	7zG.exe
Token: SeSecurityPrivilege	4000	7zG.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeDebugPrivilege	868	firefox.exe
Token: SeRestorePrivilege	4664	7zG.exe
Token: 35	4664	7zG.exe
Token: SeSecurityPrivilege	4664	7zG.exe
Token: SeSecurityPrivilege	4664	7zG.exe
Token: SeBackupPrivilege	3104	svchost.exe
Token: SeRestorePrivilege	3104	svchost.exe
Token: SeSecurityPrivilege	3104	svchost.exe
Token: SeTakeOwnershipPrivilege	3104	svchost.exe
Token: 35	3104	svchost.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
4000	7zG.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
4664	7zG.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe
868	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 4996 wrote to memory of 868	4996	firefox.exe	84
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 2204	868	firefox.exe	85
PID 868 wrote to memory of 3356	868	firefox.exe	86
PID 868 wrote to memory of 3356	868	firefox.exe	86
PID 868 wrote to memory of 3356	868	firefox.exe	86
PID 868 wrote to memory of 3356	868	firefox.exe	86
PID 868 wrote to memory of 3356	868	firefox.exe	86
PID 868 wrote to memory of 3356	868	firefox.exe	86
PID 868 wrote to memory of 3356	868	firefox.exe	86
PID 868 wrote to memory of 3356	868	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.dropbox.com/scl/fi/56blt3d0860v1uhbbybdl/Unlock_Tool.zip?rlkey=b64ioeyp70sp9vgmjg1qe4top&st=ts5zyjii&dl=1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.dropbox.com/scl/fi/56blt3d0860v1uhbbybdl/Unlock_Tool.zip?rlkey=b64ioeyp70sp9vgmjg1qe4top&st=ts5zyjii&dl=1
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2008 -parentBuildID 20240401114208 -prefsHandle 1936 -prefMapHandle 1416 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e39c6386-57b2-4ac7-a40c-1d89fe06d09d} 868 "\\.\pipe\gecko-crash-server-pipe.868" gpu
    3⤵
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2448 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d302313-727b-489a-9e10-89e6ae25176c} 868 "\\.\pipe\gecko-crash-server-pipe.868" socket
    3⤵
    PID:3356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3340 -childID 1 -isForBrowser -prefsHandle 2936 -prefMapHandle 3356 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6382a3e-902c-4cbf-b1de-5aee0249331c} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:3756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3620 -childID 2 -isForBrowser -prefsHandle 3644 -prefMapHandle 3640 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2252288-b615-420e-915c-27a0184f6011} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4676 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4668 -prefMapHandle 4692 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43c03279-3d16-4549-94e2-2a4176a7cf1b} 868 "\\.\pipe\gecko-crash-server-pipe.868" utility
    3⤵
    - Checks processor information in registry
    PID:4456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4912 -childID 3 -isForBrowser -prefsHandle 5312 -prefMapHandle 5276 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec72e2ca-75c9-4d23-b0af-323f1fa52e0d} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:4112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 4 -isForBrowser -prefsHandle 5516 -prefMapHandle 5512 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {186f7a60-625a-42db-8f3c-3a0f104ef955} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 5 -isForBrowser -prefsHandle 5500 -prefMapHandle 5504 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea301ae1-916d-4a17-8388-bc61c64973cc} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4244 -childID 6 -isForBrowser -prefsHandle 1468 -prefMapHandle 2836 -prefsLen 29318 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65c0e121-5a55-4d9c-a4f2-d35eaabd41e4} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3616 -childID 7 -isForBrowser -prefsHandle 1548 -prefMapHandle 6600 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccc167d6-ebd7-4b68-867e-481db2c76646} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:1896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6868 -childID 8 -isForBrowser -prefsHandle 6848 -prefMapHandle 6860 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aba2b858-93d3-4c59-8f05-b6d650662dc2} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:3956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7276 -childID 9 -isForBrowser -prefsHandle 7272 -prefMapHandle 7296 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cf37721-0d9e-46b9-8449-cda1f20c4230} 868 "\\.\pipe\gecko-crash-server-pipe.868" tab
    3⤵
    PID:3368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5060

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap15683:84:7zEvent23333
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4000

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\" -ad -an -ai#7zMap27522:122:7zEvent4524
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4664

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5160

C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
"C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5408
- C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
  "C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
  "C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBAKEBGIIDAF" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6096
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2280

C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
"C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2060
- C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
  "C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
  "C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
  "C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
"C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4604
- C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
  "C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\LICENSE.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0xf8,0x124,0x100,0x128,0x7ffeae7e46f8,0x7ffeae7e4708,0x7ffeae7e4718
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,9661931328166212266,2346429165995900265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,9661931328166212266,2346429165995900265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,9661931328166212266,2346429165995900265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9661931328166212266,2346429165995900265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9661931328166212266,2346429165995900265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,9661931328166212266,2346429165995900265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,9661931328166212266,2346429165995900265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6092

C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
"C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:664
- C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe
  "C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\HIDAAKEGDBFI\GHDHDG

Filesize
20KB

MD5
b4c86ec64ee889e03940ea911062f290

SHA1
e15d9f1c48a8ca393e8216f64803f2dd82b547d8

SHA256
e96c3f82b9cc8bf2da55323bddff04f7293c3fa3c661b8df39335b63b797f6be

SHA512
f77315d2df4507679bd93cc422bcea53e0ef8c11525bb8031793d36621a296f5eab735670f2c35e0bfa7c79c710d52a8e023afe23cb8437b4022f791beeae8cd

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
5e0f552cb0e4465f66f7854f5a7985f2

SHA1
6420eff61a28a709f178465adaae78e726876516

SHA256
48e34986fbc4efdb1dccc8ca2062c423f4cccf3d54aba4d4395fdca88e8274a0

SHA512
14687e140a0562e394377169c140b20b5e83cc9d0d5bc4819cb965a7a2424c76f024ddde35f773a6becb5d5461ed4fa00ed51f3d4b0feaff017ff8a69f88f243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
1d8dc0791fd26097ead8399047b589e9

SHA1
99ca408068ed0d2fbec45310e6c3d7ba337a5faf

SHA256
222dccd01f392e3178f8527f74be6fb3f82c40566cc308a5c36ac318013e24c6

SHA512
9e1f0d2fb34efcaa3aca5d0268267a4598937f20d7828acf04d124915c4b5ca4bf15d30d7d1ba8ca137f008f736822b6973171906e6d0d11047b56c8a0b7de38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46e299d61551b0ba46669513660b9ad6

SHA1
7897de3f8eb2934a85ef323b2a2009e1ad8ffb53

SHA256
99c8d632ebdf095b31097303ee3316862d97b713858d50ac22ec9e632f79904e

SHA512
319283e5ab4b61a3567ac8b382f04d64c069084c2e93187a9fa03a420001d2b7a468919564d1c60c6cb31018609b276552d9f59762140fa3671dad62685ea611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5441ee7460b84b6df859122a604d173c

SHA1
10221f23fd794b0ac2f9d66f3daa0121f7ba0b0c

SHA256
65676209f5a59629be0304ee038a585ace6e5a938d589899da32d8dd8071b343

SHA512
63f4b0634643b1fbbe9593ce1af39c5c135c3274965e603b583a9e0c4e0e7b43f9d92840c9ce798e06f319231604056fe17099840faa9dc6a8c9cdbaaff18764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca6a5a97443735540e28e882fe7b9683

SHA1
9e2d5957d144eaff54b7a8787759a3611219d809

SHA256
3344d09a53610e92490412ae8443edd46edf6b7aa8b8783575423e0afc06aedf

SHA512
0ac057d5be3b2825d6cfe1313bfb93cc0c74e3c3a6e15615dca8eae888daaa4f92291a0921c7498bdad0bd62557d8f9ffaf7a29a9d027fa3dfc51c302263163f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9MFSIIMR\76561199786602107[1].htm

Filesize
34KB

MD5
c8c1a8fc10db62992ad9b6a2334bb3a8

SHA1
fab9be242abbb674914b8a27a9926191caa966df

SHA256
e41f8a31515be823685a789c6d95600be5bc40f342d9377af91ce4a8d7109f5f

SHA512
e066ea05fe8ed662c3a0649491ec7a5e03a017ec5341109c3e698932ec30d1e0ad582bac9469f43db00c35d353249bc0b2b055a7462cad1ac3ad3647a7a117a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\76561199786602107[1].htm

Filesize
34KB

MD5
e3a1aca6960db5bc4aa089647a52a164

SHA1
d791c4da85d4dc32cc4d4789facb092e59931661

SHA256
156f707eb66a82bf9b09344faa14e706a3ba7d3fb1e96e6e98d4b982b7db0cb8

SHA512
8ab65a0550dd80e9f2596463f9048331582fc9ff3ff96772d69874d3b6451a0eda8314283b10fc57072b104a4b0d43e31def76476281d7ab0117bc5e026ee93b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UV4TX9UP\76561199786602107[1].htm

Filesize
34KB

MD5
a79aa1632a071a0a8631c4b5e4cda1f4

SHA1
8ca42d2fc4c52846d37a30cc096a21658f87ec6a

SHA256
868077f793f2c82d9d2bd81cf09f7323e078957f7c0f8583b9343af8b5c4e693

SHA512
2b7042f596dffd6fb98c51624c254f54452ee8069f6b62b419f44ffa91b2f1d86b3ee44d197ee562fcb7b5a0f86b1cc4c71a629925199941adc24bf3010a001a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
1c09ce86b72346d6992a544fe7dbc700

SHA1
39d4846741d4d5e29024b23cd80a7dedd8c6e32e

SHA256
9249649dcd8afdacb8c0ed95b340a69296aab5e38ed74b72beb77f15aabfa83c

SHA512
cecfe74f7ae14546e9708f46a14f3474aa5419b40c49d5903ef790e93230c2de17700e349f4285d2e8231b865dcbe5e104d0a576e827d7e08307f579043b3ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin

Filesize
8KB

MD5
c361fbd7aaa28c2a91e5f5b7e41d7c15

SHA1
579130986a2889b98174f00160b309d60e5bdc08

SHA256
143e02b3231a71ea42ceb6d10f9f98298391b728961a66a02d91c72c10736a6b

SHA512
a45cb7dd48345d7a17ec29c6b3fb922c41f7ea243475c59bb47fe904f2b327df6d1affab1ecec41110a090fb6dd89340d799aaba65a01daf8c89a8db233a9e8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cookies.sqlite

Filesize
512KB

MD5
8238b6aeb2e505566be07cb3cda3bb64

SHA1
130315c708f281b30a522406c7b2c28fd203c6a5

SHA256
4587eb4a42e4ebde62765a88faa86f13f4a8f3abe862c9c04c5a3daac87ddc28

SHA512
cd9204563c09ef95ea66f74cdebe7e12c69d055aaf99ec142ff88afcc44e1841b23a7d8157c7d8a6674c20a1fa9590f528794ec0e99e483d9cdddd776e23dcba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
47967440992c2119e68d711f781e8944

SHA1
3ae56238533b94075f61b934dadf20821a4abadc

SHA256
0ab3e8bbde3bdadc3f234ff2bf8bd9be540aad4439c3136eebbc9a2dd71b03af

SHA512
4d9d4e70ebb75c70248abaac6c985402b338f466cd1daf975a9d4b1b0abf83f4297372d4203f4a691b7860726da92415f98d261a6b7684c328f71c0fe92bc146

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
dd770e99524e3290860cb07811b7199c

SHA1
9da98ca5f03da07af10c9699dbf25381372245aa

SHA256
5edf51937374d1bfdc880fd5817154a1bda7b62a405a239a4b244965c8131540

SHA512
4ad8ccc4195e2c1d8fe052c5a207fc7e58a8c8eef5bf05615ef38d155ddcdcebc5eace84327692f5d333718717f325c68be91554d8fed0cf7699308ddd05aded

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b94ba8e0d2e61b828e1dffd870be0252

SHA1
91c7d75bcc3f90628a3872cea2e46e2fed7ccb07

SHA256
116d09d5f66d62332d59496e3bc66277c46f61296de89b000123ba3f5e0a5468

SHA512
1d2395e71994a0e6ce67b8205cf093d7da59ff5a953adb75ca337e2abce740ab697b4d26452426d460b4cd67f196864bd3ecf9d1dc7fbd93ce753e6816eb6220

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\445e9533-3a9e-4ead-96ac-83348a6b463f

Filesize
27KB

MD5
611d3d8c86bbb9fcd077d98da2f2b261

SHA1
01243fd52423c59d9d552947083e5a168e0d6f35

SHA256
923b641ddfced1a129d38178ffa5fcb99d20b71e049de94e7f7e3f1b497ab386

SHA512
08ce4a9d6c2b3b46abf3cf7eddd0e53b0c11456323302a9e34ab4a4c90810d691202998b0c609313f2f92c86eb6fd15fc364673246733e4ed101454214f69a87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\d619e9a3-4128-4fa8-920e-31db30ad4a31

Filesize
982B

MD5
065832badbbb37f1e2142a5d07a1c739

SHA1
aa5c27c4416e36d64f91650133df508d4c60cadd

SHA256
bbf934648d455b41e6556aa1b57a62d799e6ef7227f44e1be4a3ffcf448ffbd5

SHA512
1022a0fbef97a53b25cc1b0615b2bc0575e4216d71410e632b2dbfe57759ae8b9405aa0523d65550f4ec24f1b25f6eebf5041ae86c5dcd88c0f36756a7d42b55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\fd4141a7-c875-423e-80e2-03274022485e

Filesize
671B

MD5
75cda5a1253e2b18e90376da83aa733a

SHA1
db23f9de471ea84b14cc88b694673cf837d7012f

SHA256
1818ea7af1545505869fa118c640b34a57a4ae4103bac1669d40d1d2e726acb1

SHA512
99b265fe196c176d1bc98851b91f847b73689e4d895056b05e291968a973bda19e894d5d37fd653e4a18a9080ee98de4b5bd23b625c20ec7398ccd96ca17f5e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\formhistory.sqlite

Filesize
256KB

MD5
5c869937902db2a08708bed2830b4c5d

SHA1
7b5827467842a55536bb3a95cffb86fc1d6fd50b

SHA256
6776cebbc5934b96f3abc50ec7bca10059e9220bb70633afc31340929356153f

SHA512
9f577336ebe5dc099ca761f38d4c37e542c960a1fdd05280e3b7dde6f7f25b14f6ff6b5c62431db89ce97c183559726e839e1195b79fbe2698d659620e68c492

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\places.sqlite

Filesize
5.0MB

MD5
3a7ba5154ac5dfa6b20ce7d1f98c83e4

SHA1
b031d1b440c4c31bcb6005efbf58d4a2fec28a07

SHA256
e4f0d26103e43b2de1a955a1be38170b80bea37e147ca097a11644396f89d2da

SHA512
a39a9fa97c0064565fbdca68cc16ab5da2d97b97a2769e67538f6239f697ffd382ce3a4f6ac461cec344a3c8e48931b30924b370a6767ad06edf3609fef0602f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js

Filesize
11KB

MD5
988ebb72d55e36bf101a5a65378d7bb9

SHA1
8861ed4731a3dca6a7c71c41c86652063c801d3b

SHA256
9f49ab309de1f77bacb0f6c39fbd700348be37be3563ff4f7951c344bde501e6

SHA512
b726c170f2f0178b23f881fff2d24a7eeb074f3687593737de547bd39f27f87d6a69ef7fbe7ded48691020e3efb973da8ab5fdc8f59ec10923b6bb5a9d876e88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js

Filesize
11KB

MD5
f62d7f29c294292ac3ff036f8fac95fc

SHA1
577d7f47ddfa0a4fd9d47c29d7e398fd3e6cc427

SHA256
b32e8bbab5bb1f26b4eb7a8f27421828f68d6e2a307f590b3f8ae384fa2ec263

SHA512
4e15db67ace91df4c4ba40e268a24a5ed91f148651bac0434274e83c670b9348e976d493e537488cc89e802b6deabfd6eacd9cbd4c8e816292e4a06a6806f082

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js

Filesize
11KB

MD5
b8e343fe41bcf10fd8ff04a3ae4aa688

SHA1
9060e8a8c81b74144b28f5cfc5a3506a0ad40afc

SHA256
34a4b9cc9586dec76aa76fb59578fedaddc9f5977e26833a18ef111300f536ca

SHA512
a702103be70a115bcc888122e41b079a9c2d12829e4208d81ddf55358d821d5d5b098d70d244d3341fed4d69bb0cb174804e5d261a665d9e04b4f6de15c46e39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js

Filesize
10KB

MD5
a7339dcbaed9414d95fe1359ec1517db

SHA1
1380839724a9c6fecd321bb2bf48fb4491fe3e20

SHA256
7741cd2eccbc1fa2d90de41adeeeec6fcc0dc8a03456c0cbd216cce546390206

SHA512
97a6344f70038090cb1d6935648abdc9ba40508e75993a31ced8292b7fbf6c406bf9b1021a2b436475d9892f0c7cfee58718275171737b756907b3aa9ece1aed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js

Filesize
12KB

MD5
89b12b4b9ab510ae3a077ddd2c2f1b10

SHA1
ea4db5bcd8a65324e986ba19d80cfab6e4c103a4

SHA256
4392a81aa60791e9771010d7c3b3e092a1da28061494c72ba746eafd05fd0b2f

SHA512
8dbf33674baaed698f0c66bf49764a27c6e050a3028f148b9ffb797c6ba2734285002f8afc63b079a39279326ac127a9c50ce0c9c9dca8e3fecd868c87fd74e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
a116eee34c04778a2c3f573cf6a2ee13

SHA1
6a2414f60705ab34fdd2723a1256b6a3f12d1fba

SHA256
a3f4c52a7e1d4b9c3aa0ae613ebd3877397e0b0969cd122205a8e14b2b95966c

SHA512
402c5852918c59d4b126e0e14a2f3711bf6fbe3bc4e20d4dff7788fc7234c39d51d750796bfe8735208df4bf3f8122220eebc81a8dfce2c9a5f9d51f7034dceb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
d93ec6fc4eb1aa913f314ad6dda975a5

SHA1
6601c108288545cbeb54a5eb2e65c0c7b335f112

SHA256
5d88d30e4b93b9a8a8791872c572e01561e3fe6dbb2fa599a8e0d377f91275ba

SHA512
dcb00025f40a6d2508f1ca20679d08b15aacc5a5a2ab71ddb6cda04d64d46367c7a60fb260d62163befef9de2bec2e5a863f37ec4fe9466c1ab7b120ed451f36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
00d72ecc4b3e948d6b95d22b6ce9bf74

SHA1
5a3c795efdac9f6db632433f39924accc536ec18

SHA256
05802fa0075012045bbe899983cb8ed3ea59cf3eced490fdd6e5aafe82171abb

SHA512
f1a933ff61eb3fe3aa5e738c8dbfcd7b5f65cf101261143b212125ce6b28c9cfbc8f8e435e87165caabe88752e083fcdbcaa48cb1aaabf3909365b883a211223

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
c715a28856393538ac6ade6a1789b1ae

SHA1
10bf356be1e7443320b8bf36fc2ab911e59fccae

SHA256
7ef9d6d6a889dde5b753bd4b5cc5a09ddf25bccdac5aa2f445fecf14af2376f4

SHA512
2310894e436225477772a6b0c994b3bebf841f6254e7baa2ebde5144bf71ad8168e7b555956baf1bb0c41f9bf2aba7395a43ea1bff6d34816e2726032b63f1ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
207b34388497e392252e9e1bb7c7d3fe

SHA1
8bf632fd569e53dd745f949d922479186e6ba7ab

SHA256
ee886e5e8303d3579a6dfe0292987d20671ca39d1cdb3bad0c3973f72a7a4fd1

SHA512
8d66a86c1c9e12e04463042b4d52f1221abca2ad6484953a4425ebdbaf72bf416c11c3caa72b1088dbbdd3151346acf81bdf16a9c6a22ae6eeab8fc1cd48c431

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
62b153d651c4ffcfc7ff96a7200c5a4d

SHA1
a13ec13743cf0aa78ca3356230d4b465fe71a9a6

SHA256
673b5df5da3cc66ee4dea815a6caf2c53226397cd86c5665e4fe3b87c22c7587

SHA512
a0e3f58005f0d92bca5b704017888b073c8624cfd06892b2dfab37c955c12d7d099af904fc698810dc89258c59026f355cedee67a6683fab7735a60df06a65ed

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool.aHdINNmP.zip.part

Filesize
43.7MB

MD5
4c6753a31a6988f36f203c3b1223dff6

SHA1
a1762edd414ad4021733973ad9f1cfc45e6fec2a

SHA256
a8e91d0d25166fb84ee1682d2def2edd484e3df1cf8f21b0a98d396a43eebfc8

SHA512
d6a507d49c799dc5451f78ef0e38096cb01baa35f29c0d27369448cd0bba9840d911e058fb696c0077bcdf7aded3eba7312b90ae9156c730703051e45fed404e

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\LICENSE.html

Filesize
6.3MB

MD5
6e638956244aaded2c92b77f9d421a81

SHA1
f5269556b6fe04cfca5a1da21af718641708a666

SHA256
652457f1b5ec60a81c8aff095366bcc068402c21eb380ba8286366bc4e9a029e

SHA512
f0e173761a6acd13b6c1b5eb896c361487a770a54f1842ffaa80c8ff780b37a1e801169786776c4afa7d9c75cd968dbaddabff082de55cf75cc4f9d871d08bc1

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Readme.txt

Filesize
104B

MD5
23df18d869ab4d9c7b158ad347f3f3e3

SHA1
49b6e5ff5d705587d58810905e574407bdfb3b42

SHA256
f1ca1400fc42eecd1086283e5572d7b828d8449f2866961f8e2acd5bddfb7648

SHA512
39b697c77969e23a34ac7155f27d4b35718630d64908b5e5b6fc004247fae598f5cd4ca5bdc4bf1c2feb2d2062da82fe1942351047ddc456170a242fc5705805

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\Unlock_Tool_2.1.6.exe

Filesize
1023KB

MD5
89441ae260ea899240cd8dacdf6896eb

SHA1
242178fc8304b012cda16e92ea12711e3e0bb5c2

SHA256
b2cfe2e23610a43f69cca84e8dcd8e8526c83b63898ae80a690dfc0368bd29fa

SHA512
cd6bc9f99e24b6a26c0c2f4fc8647c94cd84ae15e40baa51df97dff8ebc248a715f7baedb0e3100f908ce2eb4b8f884ccf33a3a75d1aa7b15532eadf30e3ce43

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool_2.1.6 (extract.me)\locales\resources\Data\level4.resS

Filesize
128KB

MD5
64d183ad524dfcd10a7c816fbca3333d

SHA1
5a180d5c1f42a0deaf475b7390755b3c0ecc951c

SHA256
5a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a

SHA512
3cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e

Download Submit
C:\Users\Admin\Downloads\Unlock_Tool_2.1.6.rar

Filesize
43.7MB

MD5
62d2f18dbc05423ad451cfe8c2f21042

SHA1
2720ac35f0d205348e771b3491318d81e0eaeec6

SHA256
971425240938dc2a8f84098350ba0d4e8b71810589a346c7284659c09f13b7dc

SHA512
72b1e6f3cb1abee3f90ca392967227539af00be1f891a6114bfc9b5a0fe327c8cbb535228f5ea2bcfa4d30a3210028e911fd13f730c09c86377d42e03f6a4e35

Download Submit
memory/728-1663-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/728-1675-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/728-1664-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/728-1667-0x000000001DF50000-0x000000001E1AF000-memory.dmp

Filesize
2.4MB

Download
memory/728-1674-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3576-1519-0x0000000020640000-0x000000002089F000-memory.dmp

Filesize
2.4MB

Download
memory/3576-1514-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3576-1515-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3576-1525-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3576-1526-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3784-1545-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3784-1544-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3784-1536-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3784-1537-0x000000001DEA0000-0x000000001E0FF000-memory.dmp

Filesize
2.4MB

Download
memory/3784-1535-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1428-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1412-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1419-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1420-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1410-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1421-0x000000001FFB0000-0x000000002020F000-memory.dmp

Filesize
2.4MB

Download
memory/5288-1408-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1501-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1500-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1457-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1492-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1486-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1431-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1491-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1439-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1485-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1480-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1479-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1440-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5288-1456-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download