vidar | hxxps://idmcrack[.]co/

Analysis

max time kernel
211s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 14:14

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://idmcrack.co/

Score

10^/10

vidar 3b2656dcd01356a64d8b2ad0b1c7ac79 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

11.1

Botnet

3b2656dcd01356a64d8b2ad0b1c7ac79

http://168.119.104.177:80

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 11 IoCs

stealer

resource	yara_rule
behavioral1/memory/2004-2114-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2117-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2118-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2127-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2128-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2134-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2135-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2149-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2150-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2176-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2004-2177-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 11 IoCs

pid	Process
1688	Setup.exe
5800	Setup.tmp
1632	Setup.exe
3096	Setup.tmp
2360	file.exe
5456	Setup.exe
6096	Setup.tmp
680	Setup.exe
3664	Setup.tmp
4056	file.exe
6132	file.exe

Loads dropped DLL 2 IoCs

pid	Process
2004	MSBuild.exe
2004	MSBuild.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

pid	Process
3040	tasklist.exe
5092	tasklist.exe
180	tasklist.exe
5952	tasklist.exe
2300	tasklist.exe
32	tasklist.exe
5148	tasklist.exe
2684	tasklist.exe
3468	tasklist.exe
5828	tasklist.exe
6076	tasklist.exe
4316	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6132 set thread context of 2004	6132	file.exe	197

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6000	cmd.exe
5728	PING.EXE

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1752	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "157"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	mspaint.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!.zip:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5728	PING.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3096	Setup.tmp
3096	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
3664	Setup.tmp
4688	mspaint.exe
4688	mspaint.exe
2004	MSBuild.exe
2004	MSBuild.exe
2004	MSBuild.exe
2004	MSBuild.exe
2004	MSBuild.exe
2004	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	firefox.exe
Token: SeDebugPrivilege	2712	firefox.exe
Token: SeDebugPrivilege	2712	firefox.exe
Token: SeRestorePrivilege	3872	7zG.exe
Token: 35	3872	7zG.exe
Token: SeSecurityPrivilege	3872	7zG.exe
Token: SeSecurityPrivilege	3872	7zG.exe
Token: SeRestorePrivilege	5128	7zG.exe
Token: 35	5128	7zG.exe
Token: SeSecurityPrivilege	5128	7zG.exe
Token: SeSecurityPrivilege	5128	7zG.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	3040	tasklist.exe
Token: SeDebugPrivilege	4316	tasklist.exe
Token: SeDebugPrivilege	5092	tasklist.exe
Token: SeDebugPrivilege	32	tasklist.exe
Token: SeDebugPrivilege	5148	tasklist.exe
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	3468	tasklist.exe
Token: SeDebugPrivilege	180	tasklist.exe
Token: SeDebugPrivilege	5828	tasklist.exe
Token: SeDebugPrivilege	5952	tasklist.exe
Token: SeDebugPrivilege	6076	tasklist.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
3872	7zG.exe
5128	7zG.exe
3096	Setup.tmp
3664	Setup.tmp

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
2712	firefox.exe
4688	mspaint.exe
4544	OpenWith.exe
2376	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 4588 wrote to memory of 2712	4588	firefox.exe	84
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 3424	2712	firefox.exe	85
PID 2712 wrote to memory of 2460	2712	firefox.exe	86
PID 2712 wrote to memory of 2460	2712	firefox.exe	86
PID 2712 wrote to memory of 2460	2712	firefox.exe	86
PID 2712 wrote to memory of 2460	2712	firefox.exe	86
PID 2712 wrote to memory of 2460	2712	firefox.exe	86
PID 2712 wrote to memory of 2460	2712	firefox.exe	86
PID 2712 wrote to memory of 2460	2712	firefox.exe	86
PID 2712 wrote to memory of 2460	2712	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://idmcrack.co/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://idmcrack.co/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {503ee68e-fa4f-49b3-8c6b-a90f9ea131cf} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" gpu
    3⤵
    PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2488 -parentBuildID 20240401114208 -prefsHandle 2480 -prefMapHandle 2476 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20b7b6f3-6509-46db-a501-3739484da337} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" socket
    3⤵
    - Checks processor information in registry
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1672 -childID 1 -isForBrowser -prefsHandle 1648 -prefMapHandle 3356 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9d6b5ec-4851-4e42-9b91-104223198482} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:3080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3668 -childID 2 -isForBrowser -prefsHandle 3644 -prefMapHandle 3648 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ee0d345-ab33-4b6d-a510-4b29ea6cf616} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:1636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4420 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4424 -prefMapHandle 4416 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fdaef6f-32de-4ccb-bd77-f54a464227cd} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" utility
    3⤵
    - Checks processor information in registry
    PID:4720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 3 -isForBrowser -prefsHandle 5388 -prefMapHandle 5368 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09407e5f-ceb3-4632-8498-94c5be8641ea} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 4 -isForBrowser -prefsHandle 5516 -prefMapHandle 5084 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05715131-1c19-4c26-be6a-f5f1de14117f} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:3780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 5 -isForBrowser -prefsHandle 5740 -prefMapHandle 5744 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f3a1310-992d-46da-858c-841150d5d9a6} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2960 -childID 6 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4c571f5-df01-41d1-bb03-42f4764d3913} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 7 -isForBrowser -prefsHandle 5996 -prefMapHandle 5992 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df1e4140-8d59-4189-a129-8b7f84baa8b3} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6320 -childID 8 -isForBrowser -prefsHandle 5328 -prefMapHandle 2716 -prefsLen 29604 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4158dbfe-f9f1-48ed-8b7d-d182653f0e3f} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 9 -isForBrowser -prefsHandle 6632 -prefMapHandle 6648 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1332 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83c0e124-3332-4c06-95e4-b5716dcc2d46} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" tab
    3⤵
    PID:5268

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5400

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\" -spe -an -ai#7zMap12377:114:7zEvent16290
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3872

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\" -spe -an -ai#7zMap29001:168:7zEvent23888
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5128

C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe
"C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1688
- C:\Users\Admin\AppData\Local\Temp\is-R5KGQ.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-R5KGQ.tmp\Setup.tmp" /SL5="$901C2,1809912,795136,C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5800
- - C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe
    "C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\is-6L2OC.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6L2OC.tmp\Setup.tmp" /SL5="$D02DC,1809912,795136,C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:3096
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        
        PID:5208
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
      - C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        6⤵
        
        PID:1908
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        
        PID:4652
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
      - C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        6⤵
        
        PID:3212
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        
        PID:1900
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
      - C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        6⤵
        
        PID:4156
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        
        PID:2772
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5092
      - C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        6⤵
        
        PID:5108
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        
        PID:4220
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:32
      - C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        
        PID:212
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        
        PID:5864
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5148
      - C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\micropegmatite\file.exe
        
        "C:\Users\Admin\AppData\Local\micropegmatite\\file.exe" "C:\Users\Admin\AppData\Local\micropegmatite\\fatiscent1.a3x"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2360

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\PassCode.txt
1⤵
PID:5656

C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe
"C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5456
- C:\Users\Admin\AppData\Local\Temp\is-GIBH9.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GIBH9.tmp\Setup.tmp" /SL5="$110206,1809912,795136,C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6096
- - C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe
    "C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:680
  - - C:\Users\Admin\AppData\Local\Temp\is-TIVN0.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TIVN0.tmp\Setup.tmp" /SL5="$120206,1809912,795136,C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:3664
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        
        PID:4676
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
      - C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        6⤵
        
        PID:636
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        
        PID:3780
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3468
      - C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        6⤵
        
        PID:3656
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        
        PID:1952
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:180
      - C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        6⤵
        
        PID:2964
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        
        PID:2312
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
      - C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        6⤵
        
        PID:5824
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        
        PID:5884
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5952
      - C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        
        PID:5944
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        
        PID:5956
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6076
      - C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\micropegmatite\file.exe
        
        "C:\Users\Admin\AppData\Local\micropegmatite\\file.exe" "C:\Users\Admin\AppData\Local\micropegmatite\\fatiscent1.a3x"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4056
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && file.exe C:\ProgramData\\1Z7DhPiJ.a3x && del C:\ProgramData\\1Z7DhPiJ.a3x
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6000
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\micropegmatite\file.exe
        
        file.exe C:\ProgramData\\1Z7DhPiJ.a3x
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:6132
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        
        PID:4724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIDHJDGCGDAA" & exit
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        10⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1752

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\Key.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:6056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38f0055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
0b62e4f38f7fe1b3a4606975dbea9665

SHA1
b00389d552ea91f3df3f10dfbd5f0731a4a09700

SHA256
ef2fd3b4990058199d6e71d32947ca3a573d51fadf5f2b35eeeb6ac224147a51

SHA512
8e4f283fd854f3a14669eaf6199c11ce77bbe3014cee8577f7230bb21452f9693346b79682191f9f0ed67dc1a5e7dee318c207473facf9b81c5210fc5a84130f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R5KGQ.tmp\Setup.tmp

Filesize
3.1MB

MD5
82455d588415b850159fb5a4bd60ae58

SHA1
4d54a9ba74c3f39037b95fe18d45a9a4994a1c56

SHA256
29d8a9250a3ec59c08d84dbba027b472878148857affe949c5f879bfb1a0dbe7

SHA512
059165a7299942b11f48f15dd7409d55d5d81d7accc2b9a2a0ebe78e585a22f7d1a04372ffb71e9db6148b0619a8dccf98cf3ffa12d8fab7e019aa3406d982ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\micropegmatite\fatiscent.pst

Filesize
556KB

MD5
b289eb4f7367fbf55036362bb9d041eb

SHA1
1e2db681eed75930c8e421f8dabf4199061db2d0

SHA256
405e01f52e6cb445d2bc1df1191cf767ee5e4f7c5ecdce10ba8dd9d7ab89c157

SHA512
04f44f8556986af331c308342621741240e3c12ba26dd1428efaba4aebd79ecc3fd1607f12855f704cf10881eeb90f2e99acbc570be53f5c9d58c81e072618b4

Download Submit
C:\Users\Admin\AppData\Local\micropegmatite\fatiscent1.a3x

Filesize
61KB

MD5
311305da8432836b0f533123f3e0d4fe

SHA1
f262cb8059c0fb771ed58bac5fb76239e4da6919

SHA256
b6ff2f94a90a7e8a6922f53ffed379a9a738e438e2b53718aefa860993843b67

SHA512
2a639ee658ccea7d0015950586a2c2794b352d50c5bc6ee3b576ada08e883276a466e24ea6767c132a53f2eb25070305d8fff34bac4c8e3a4d8086ca6f65e710

Download Submit
C:\Users\Admin\AppData\Local\micropegmatite\file.exe

Filesize
921KB

MD5
3f58a517f1f4796225137e7659ad2adb

SHA1
e264ba0e9987b0ad0812e5dd4dd3075531cfe269

SHA256
1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

SHA512
acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

Download Submit
C:\Users\Admin\AppData\Local\micropegmatite\unins000.dat

Filesize
6KB

MD5
762d3648a0a96e6c196ad8b2079bab69

SHA1
cb66d0488efba1a2b4bccdd5b94cf334b7fc8238

SHA256
f3645b40ba93a5ecc1ba05f66bb6267858929fd7b9107a9babeda538dca8e3a2

SHA512
766e7ff3fe2f6e20311bbdd47dfcaeb20363096ff933ab01792aed1dd24fb86d8ff7d3a43b411b807e8f7367973c30cab57b9a500c85e95a23b5ee396fb36990

Download Submit
C:\Users\Admin\AppData\Local\micropegmatite\unins000.exe

Filesize
3.2MB

MD5
4e4b097ca2e9788a40e87b56dd44808f

SHA1
5a3f7973f552295a78867c6a795c834812038962

SHA256
1de025e10aecbac7bd9a38c18b8e7cbe62398cca09825773cf3a6588f30275e6

SHA512
6ec80dd8635a9b1daa2d263f1bf0d55394382f307822a668cd5e08621683e5c3fbf5f8f2a55534844056af712deb0b279813ebd4eceddf871331b80d85834654

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin

Filesize
8KB

MD5
a5bad48736c00185fe8993d8f8e8c8ac

SHA1
3df497303b7de9f7b111de41e38b4c81b9449b93

SHA256
03c0f2407c9923559a541cd02e69f422d83b184871d91a2fdc95637d5f4b8c40

SHA512
842474ce2737724ea211341e4ce7223ded33e62cdd378373ae4361e87b90bc6711142a452f19d954be96c7b892e0423b0d51d888c9990a82881ff4b410666582

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin

Filesize
18KB

MD5
f6e4de562aa03dc26d92a86847e72a0d

SHA1
9ce3cc2b63d4b0b2ed1ab60184e4223951f272cb

SHA256
77e45645ca9f072ad55755af1aed0581e4e9f7b95d51a704bd4e601ae8bc030e

SHA512
f73ec06f515d5184dfe1abc48826dab936d8aeb06b1d8dca07ef90bf94c9ffe581664a76d5b3404b3c72c261e1c7fe6b60b4f125787543cc0f31366afce1db2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cookies.sqlite

Filesize
512KB

MD5
7e12d73d119bd4bf236e67cba1273598

SHA1
22862c9ee6b5a52294d9c2718124f366f7a4e200

SHA256
96bd57c8123f2fa1aefa5156a3b8a10f23b4d06ceba6d33bba8ff978d27e7795

SHA512
a87825658a6687990ac5c158dbff2a1b507e23e88503cb905fc483501688f38f26b918411dc6f9fbbbb125ae5df1e537b6bc56a33331a61f0e9d15439de75f66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
f6a4467403457580e8c91c00dee8f4ea

SHA1
af09a4b5142a6ff53e9d92b60774c5e9e0882a9a

SHA256
9847f883eaa72bf4c58c59f75c8c62989a03408e9bbd07ab687500785762f5ad

SHA512
a9c5ea8bb2e0ddc030a799a894f246564d9beb2c117dd3e61fdd64bce93a9f832dd23f20983ed5c4b72021b1f802157a931eda6f04dc768097df079871185d63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
82f71c5d98eb6120afd10f334b504198

SHA1
0b38f1c576a7669a2cbd130b111580b7392a4725

SHA256
37b05700b968317854a5023ddc49d80a6e4991816ea3764707dca051749f579e

SHA512
e3eadcc70b3268b2e4d331f2327941136130540d53d5bdf9527c0dca7f451851c6a1d6e56e581d4c3171f9607750e25e2415d18a69722a6d53edc4aae2282911

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
814ad1405c5a539139b6a17314efe413

SHA1
5d9bd1c3f6a5e1db56fa6ffc2280e293686eeabb

SHA256
d4dcd3f45a234fc612f50033aff781b1b2566d7d771b144f7261a712784bcd63

SHA512
b37faf46c44641f80cfa8e8b98bff25da5b329da1ebdabe15e737bd5b04dad22a8beba927a4e2971af793fbcc1af777e930cc8c3c96a50a8438623b862911364

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
0fe995ee7ba5e3fb508206a04462fb45

SHA1
13ede464a5e4aae2d1f1d00d2c2132cc9d97afa7

SHA256
a8f794effe2d7a3855bdd0a3359004ddb656918f855c664927b863509257b7e7

SHA512
ef3a496025e34fc6c4777f69307346536fafe22ce58ad2b52178f0839583d250ed2a607f0bb73d98c351c8ee999de8c397a7c7f28448ccf66d1df6c688e37085

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\038e8c51-4a8b-4ba1-9cf7-b935b512341e

Filesize
26KB

MD5
70fbd613c879c5778f27d18b433b6446

SHA1
9e390ec723e6a34588c9d87eccf73b43234775fd

SHA256
519c91f1eba91952ddfc6e878aa7a7c31114712808724862066bb9ea279d5fe1

SHA512
60097e6af07fe7cde6c6019ab3584dd0844c6df59877902723cba78629502fa594c15c08244d77ef5d1db081af33d1ff6a1ec6a2b0001e93e7f3e120c3ee8a5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\310fcd4d-e190-4ba1-bd03-854feb900a16

Filesize
671B

MD5
eb3c4628147ddf96ab0af27cb9926a47

SHA1
2285db76bb1ef8d331b282d056cdec5d603ddc4d

SHA256
36c559c2d1b391f8f1a39a3d82b6663e1e3415589ce45e4c0a7e7cf5aeaada42

SHA512
8a270b31d22509dc0484b2b7675297bbe18e1a66203294100eebec336adb5d5dae29f278081110cccb4ce29feba11aa381f68c2ae67e206eb4b0e959b2292cca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\9451addc-7856-47f3-b247-039f517a1fed

Filesize
982B

MD5
45d1dc46bba4d568f0d1bdd9e4eedd30

SHA1
90c6286eef1c01e15e22b6df0ddd351fda1753a6

SHA256
9e20dad4574c61acc417592d9a345c14af79e1b6b989f889609d1f0ca347125e

SHA512
5fafd0006b325b477749c22adb6e1ded282c39e57e13ff03d8ca8ad955958219ec583be58e3f24b8986d7f57e4e589599394d47da5fb9153596f4f1b3be220b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js

Filesize
11KB

MD5
8d1ba36357090ec391f0bf81f9dfb889

SHA1
4ba90c72a3a0e836a963bb62397b6d425ad3759f

SHA256
7e390e838c6464925cc2884d919e93adfec1a28288b56aefaeaadb35abdfff7d

SHA512
de2de3727578ced4d008fe677c78955f9cc937be605715b6d5748c516d319ea8d37aca173b85324df9dd506440f7487f5af1ddc22fe7679869e316c7bc5f7d4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js

Filesize
12KB

MD5
4ed9f3733450a5589ffca9558594f4c1

SHA1
29e84dd0aacb1d17885a006b7a3f314b8072d2d0

SHA256
3cb9127b4c7bd02da4056611e6fbe6168c46b65c32be2f6144382d31a65334c2

SHA512
d094759669e13251be8e6428bac169450c38fc6c26c5ac38dde7bc0d6aec66470b64b32eed06e4169a69df96d0e58d15d8306e86e48e80b5372b66e5e1007c89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js

Filesize
11KB

MD5
b9e4c4be6ed9e3c83ea426033ce65068

SHA1
d339e92e028977dd005569cbbb5f72aeaa1d641a

SHA256
7aa4df04b5f55a7e81c0de0b3c2c66fe4bef9465ab297bbf4dd45fbcdeb8e7b4

SHA512
03d0404ca16c070efa180b52a0e75e04c6cf819a7314da87c583594958c9c35ac51eb91b57ac42cfcad2c005eb60a4cc87894b72f909e7dfde48a9e7d312ba07

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js

Filesize
11KB

MD5
c6cd261f18c2f766b42811e1b11c5262

SHA1
1396757e6f125a30ece82b841e32ef84322a83c8

SHA256
e4dc795543d55c785ecf6b3579822ecdfcf21ebb18f9cac365f120e814f93095

SHA512
ce15e6b70ba2caec7275cf038d63bb224266936217735b153d58a863d920a1ebae8f2d6bebbc048c2d84153915caa55784b2f9b039ba2b6b2d645a580eb6feab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
6b77a9f779399e95d1cee931a2c8f8ff

SHA1
826efd4feb0d50fcce5696111af7c811b81adcd9

SHA256
3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3

SHA512
ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
2d3315ea1c550f3edd406b184f2bfbff

SHA1
2bcc7ace8a4231401482f35610680196481a40a5

SHA256
c848d7357fcde88ea1b7bfbfcac39d0641d72855f00b637456b59aac5671ad32

SHA512
f178ef28c719607cb8856fbc58c133ffcf0034a7926c996734a26577fe335095ee0e5ea46bc946054454f03d1309084054868adb7245fb9b5763321a9ae108ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
0cadd98e1d8145c504e8046321a3c245

SHA1
f69567a27fdc0c910b31fecb0a344362b7df276d

SHA256
8950f43162e916636bc92599d1006a7a66fe8b51ea2d5da43429c1f976a0a5f9

SHA512
74fcd93dd1d301f9b73c36d4714537cf937a8cc86d053dc11a4f45e6859fded0aa085b37ceb1cb33d040b48acf5ff2a786428148f7941975ba2858b7483a6a77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
90e4a0fc5d9ec60158b2040c1887e7d9

SHA1
f76f848c10c70d2b3f3b91d49aca5a5b146e2171

SHA256
ca812c57375272194dbafa81e36fc94eed4a58d88e10113b507745701d211715

SHA512
7948bbbffd06dfb5fb2e8b44b08f0722ac8bec3408951ca445d1ae899fc531938d4194ebf4c6bfaa0c551d79766c9038077ff6760f974667772368d11e7788ed

Download Submit
C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!.sfvpp0Gs.zip.part

Filesize
31.6MB

MD5
f4f88594945ea7ddf91f5f8c0990e646

SHA1
336af3820b2a3e546b7af0b324ca66f5ee4d0788

SHA256
7443da9e16f6f12c19e93df8b91e1e37466d4e5dd84c41631959b53270223f61

SHA512
cf2ea4b0dc85c9a76c43816443c2d099126f099ecd7c1e5bc0521fab6f8a8cc45047b2ce3112aaf95d3030ef4c8daaa8fc14976bf3e1ee751c29ad9d3e8b04be

Download Submit
C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!.rar

Filesize
31.4MB

MD5
d9afb0714311248038f00eb64900676d

SHA1
8981de8b709e762fb573c976af00b35bbb028742

SHA256
dc4568b50e3674febf57a13b67ace20bffeaee4e7a0dd1e3e95a272c6eb1c32b

SHA512
9585bbe3f0159449d04146363249846f06c428e178a4b34a3967c71256107c7b45f34e8774055f2d31812300b96382b9b73aa6447807d003ce5ec35d59aff202

Download Submit
C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\@!!Se-tUp_2244_PassW0rDSS!\Setup.exe

Filesize
2.6MB

MD5
b58b905323ee060cf353276b89e94955

SHA1
46742736ff7ef1fb35e59a3d283cde5ba531bf65

SHA256
eadfa17e9ad005f8c54c490f0a13e2fd43cb4ccac8763ef5548375869e9a6049

SHA512
ae987bea9c0bfc8f04c0905acbfc56973e5e3a497920842f2fdc55006ad5ab160dd74e40f792057aa5d48d7d87b04be88c5cd5cf8a91ddef085cd3a04d0b65d2

Download Submit
C:\Users\Admin\Downloads\#!!Se-tUp_2244_Pas$WordsS!\Key.png

Filesize
7KB

MD5
e7b140b81385dcfe2f10bc3a7ab27797

SHA1
77627d3761b225091924070c0ee0ba6d9a9e97fa

SHA256
6991524fb4f77f0b62566d05ab00c08632de14a70c73bc78911485390cf6325a

SHA512
6c0eea7d93e065b26a9f5ab58298af9c24c1e1fbafab445ceeedaec681fd99496d797cf75d9165e724afd9ce6c341618585842c9cd687874a417ad1c272cb7b8

Download Submit
memory/680-2084-0x0000000000F70000-0x0000000001040000-memory.dmp

Filesize
832KB

Download
memory/680-2057-0x0000000000F70000-0x0000000001040000-memory.dmp

Filesize
832KB

Download
memory/1632-2045-0x0000000000F70000-0x0000000001040000-memory.dmp

Filesize
832KB

Download
memory/1632-2021-0x0000000000F70000-0x0000000001040000-memory.dmp

Filesize
832KB

Download
memory/1688-2024-0x0000000000F70000-0x0000000001040000-memory.dmp

Filesize
832KB

Download
memory/1688-2012-0x0000000000F70000-0x0000000001040000-memory.dmp

Filesize
832KB

Download
memory/2004-2128-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2134-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2177-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2176-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2150-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2149-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2135-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2127-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2121-0x000000001D570000-0x000000001D7CF000-memory.dmp

Filesize
2.4MB

Download
memory/2004-2118-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2117-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2114-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2004-2113-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3096-2044-0x00000000002D0000-0x00000000005FF000-memory.dmp

Filesize
3.2MB

Download
memory/3664-2082-0x0000000000670000-0x000000000099F000-memory.dmp

Filesize
3.2MB

Download
memory/5456-2061-0x0000000000F70000-0x0000000001040000-memory.dmp

Filesize
832KB

Download
memory/5456-2050-0x0000000000F70000-0x0000000001040000-memory.dmp

Filesize
832KB

Download
memory/5800-2023-0x0000000000DB0000-0x00000000010DF000-memory.dmp

Filesize
3.2MB

Download
memory/6056-2103-0x000001A1BF4D0000-0x000001A1BF4D1000-memory.dmp

Filesize
4KB

Download
memory/6056-2102-0x000001A1BF4D0000-0x000001A1BF4D1000-memory.dmp

Filesize
4KB

Download
memory/6056-2101-0x000001A1BF440000-0x000001A1BF441000-memory.dmp

Filesize
4KB

Download
memory/6056-2099-0x000001A1BF440000-0x000001A1BF441000-memory.dmp

Filesize
4KB

Download
memory/6056-2097-0x000001A1BF3C0000-0x000001A1BF3C1000-memory.dmp

Filesize
4KB

Download
memory/6056-2104-0x000001A1BF4E0000-0x000001A1BF4E1000-memory.dmp

Filesize
4KB

Download
memory/6056-2105-0x000001A1BF4E0000-0x000001A1BF4E1000-memory.dmp

Filesize
4KB

Download
memory/6056-2086-0x000001A1B6730000-0x000001A1B6740000-memory.dmp

Filesize
64KB

Download
memory/6056-2090-0x000001A1B6770000-0x000001A1B6780000-memory.dmp

Filesize
64KB

Download
memory/6096-2059-0x00000000004F0000-0x000000000081F000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads