redline | 9a45aaafd757934f43e03dcda557f0e137e96f4ad0da840c47add939b32b4978

Analysis

max time kernel
371s
max time network
384s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Melonity_Installer v3.6/FieroHack.exe
Size

769.7MB
MD5

111c3d3a001af71753927bb01386e48f
SHA1

0b28e2a008c6ed100bd6a8b233adc91458b49fae
SHA256

1db9b30bcd0570cb1630625f1f0ac82a02cee2cf38a026ad32d83947f76320c0
SHA512

d8d267ec5d5c34c31619c5f961394ee252ffae3ab29d3c94470ca62033782ca8ff7c9466260af9f2d24b5fd82a1dd1cd49b9b695436cf679257b4876a6443368
SSDEEP

98304:CrLVoBkwXnc+AdMIm8r3ctMmKCOQhMCTgeZ1lcvdw:QhIkwt+x31/CICj1lgw

Score

10^/10

redline xmrig discovery evasion execution infostealer miner persistence spyware stealer upx

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/1972-32-0x0000000000A90000-0x0000000000AF2000-memory.dmp family_redline
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

resource	yara_rule
behavioral1/memory/1972-32-0x0000000000A90000-0x0000000000AF2000-memory.dmp	family_redline

XMRig Miner payload 15 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2712-497-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-500-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-499-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-498-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-496-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-489-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-488-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-544-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-545-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-923-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-924-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-925-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-928-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-929-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2712-930-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4828 powershell.exe
6124 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 6 IoCs

Processes:

WeMod.exeSirus.exeleirdnhqqedj.exewinrar-x64-701.exewinrar-x64-701.exewinrar-x64-701.exe

pid process

1796 WeMod.exe
1972 Sirus.exe
5280 leirdnhqqedj.exe
3488 winrar-x64-701.exe
3764 winrar-x64-701.exe
1796 winrar-x64-701.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4828	powershell.exe
6124	powershell.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2712-484-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-485-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-487-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-497-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-500-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-499-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-498-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-496-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-489-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-488-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-486-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-483-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-544-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-545-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-923-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-924-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-925-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-928-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-929-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2712-930-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

2280 powercfg.exe
4676 powercfg.exe
6120 powercfg.exe
1960 powercfg.exe
6140 powercfg.exe
6132 powercfg.exe
648 powercfg.exe
4480 powercfg.exe

pid	process
2280	powercfg.exe
4676	powercfg.exe
6120	powercfg.exe
1960	powercfg.exe
6140	powercfg.exe
6132	powercfg.exe
648	powercfg.exe
4480	powercfg.exe

Drops file in System32 directory 6 IoCs

Processes:

leirdnhqqedj.exepowershell.exeWeMod.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439}	leirdnhqqedj.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439}\5280.obs	leirdnhqqedj.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	leirdnhqqedj.exe
File opened for modification	C:\Windows\system32\MRT.exe	WeMod.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

WeMod.exeleirdnhqqedj.exe

pid process

1796 WeMod.exe
5280 leirdnhqqedj.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

leirdnhqqedj.exe

description pid process target process

PID 5280 set thread context of 1292 5280 leirdnhqqedj.exe conhost.exe
PID 5280 set thread context of 2712 5280 leirdnhqqedj.exe explorer.exe
Drops file in Windows directory 2 IoCs

Processes:

taskmgr.exe

description ioc process

File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe
File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

932 sc.exe
2508 sc.exe
5152 sc.exe
3036 sc.exe
1356 sc.exe
5160 sc.exe
5732 sc.exe
3052 sc.exe
5916 sc.exe
5880 sc.exe
5848 sc.exe
2140 sc.exe
2348 sc.exe
6104 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 5280 set thread context of 1292	5280	leirdnhqqedj.exe	conhost.exe
PID 5280 set thread context of 2712	5280	leirdnhqqedj.exe	explorer.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

pid	process
932	sc.exe
2508	sc.exe
5152	sc.exe
3036	sc.exe
1356	sc.exe
5160	sc.exe
5732	sc.exe
3052	sc.exe
5916	sc.exe
5880	sc.exe
5848	sc.exe
2140	sc.exe
2348	sc.exe
6104	sc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exetaskmgr.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies data under HKEY_USERS 47 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry class 4 IoCs

Processes:

firefox.exefirefox.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Melonity_Installer v3.6.rar:Zone.Identifier firefox.exe
File created C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Melonity_Installer v3.6.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WeMod.exeSirus.exepowershell.exe

pid	process
1796	WeMod.exe
1796	WeMod.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1796	WeMod.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1796	WeMod.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe
1972	Sirus.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

5480 OpenWith.exe

pid	process
5480	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sirus.exefirefox.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exefirefox.exeexplorer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	1972	Sirus.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeBackupPrivilege	1972	Sirus.exe
Token: SeSecurityPrivilege	1972	Sirus.exe
Token: SeSecurityPrivilege	1972	Sirus.exe
Token: SeSecurityPrivilege	1972	Sirus.exe
Token: SeSecurityPrivilege	1972	Sirus.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeIncreaseQuotaPrivilege	4828	powershell.exe
Token: SeSecurityPrivilege	4828	powershell.exe
Token: SeTakeOwnershipPrivilege	4828	powershell.exe
Token: SeLoadDriverPrivilege	4828	powershell.exe
Token: SeSystemProfilePrivilege	4828	powershell.exe
Token: SeSystemtimePrivilege	4828	powershell.exe
Token: SeProfSingleProcessPrivilege	4828	powershell.exe
Token: SeIncBasePriorityPrivilege	4828	powershell.exe
Token: SeCreatePagefilePrivilege	4828	powershell.exe
Token: SeBackupPrivilege	4828	powershell.exe
Token: SeRestorePrivilege	4828	powershell.exe
Token: SeShutdownPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeSystemEnvironmentPrivilege	4828	powershell.exe
Token: SeRemoteShutdownPrivilege	4828	powershell.exe
Token: SeUndockPrivilege	4828	powershell.exe
Token: SeManageVolumePrivilege	4828	powershell.exe
Token: 33	4828	powershell.exe
Token: 34	4828	powershell.exe
Token: 35	4828	powershell.exe
Token: 36	4828	powershell.exe
Token: SeShutdownPrivilege	648	powercfg.exe
Token: SeCreatePagefilePrivilege	648	powercfg.exe
Token: SeShutdownPrivilege	4676	powercfg.exe
Token: SeCreatePagefilePrivilege	4676	powercfg.exe
Token: SeShutdownPrivilege	2280	powercfg.exe
Token: SeCreatePagefilePrivilege	2280	powercfg.exe
Token: SeShutdownPrivilege	4480	powercfg.exe
Token: SeCreatePagefilePrivilege	4480	powercfg.exe
Token: SeDebugPrivilege	6124	powershell.exe
Token: SeDebugPrivilege	5332	firefox.exe
Token: SeDebugPrivilege	5332	firefox.exe
Token: SeAssignPrimaryTokenPrivilege	6124	powershell.exe
Token: SeIncreaseQuotaPrivilege	6124	powershell.exe
Token: SeSecurityPrivilege	6124	powershell.exe
Token: SeTakeOwnershipPrivilege	6124	powershell.exe
Token: SeLoadDriverPrivilege	6124	powershell.exe
Token: SeSystemtimePrivilege	6124	powershell.exe
Token: SeBackupPrivilege	6124	powershell.exe
Token: SeRestorePrivilege	6124	powershell.exe
Token: SeShutdownPrivilege	6124	powershell.exe
Token: SeSystemEnvironmentPrivilege	6124	powershell.exe
Token: SeUndockPrivilege	6124	powershell.exe
Token: SeManageVolumePrivilege	6124	powershell.exe
Token: SeLockMemoryPrivilege	2712	explorer.exe
Token: SeShutdownPrivilege	1960	powercfg.exe
Token: SeCreatePagefilePrivilege	1960	powercfg.exe
Token: SeShutdownPrivilege	6132	powercfg.exe
Token: SeCreatePagefilePrivilege	6132	powercfg.exe
Token: SeShutdownPrivilege	6140	powercfg.exe
Token: SeCreatePagefilePrivilege	6140	powercfg.exe
Token: SeShutdownPrivilege	6120	powercfg.exe
Token: SeCreatePagefilePrivilege	6120	powercfg.exe
Token: SeDebugPrivilege	5332	firefox.exe
Token: SeDebugPrivilege	5332	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exefirefox.exetaskmgr.exe

pid	process
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exefirefox.exetaskmgr.exe

pid	process
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

firefox.exefirefox.exeOpenWith.exewinrar-x64-701.exewinrar-x64-701.exeOpenWith.exe

pid	process
1728	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
744	OpenWith.exe
5332	firefox.exe
5332	firefox.exe
5332	firefox.exe
3488	winrar-x64-701.exe
3488	winrar-x64-701.exe
3488	winrar-x64-701.exe
3764	winrar-x64-701.exe
3764	winrar-x64-701.exe
3764	winrar-x64-701.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe
5480	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FieroHack.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4500 wrote to memory of 1796	4500	FieroHack.exe	WeMod.exe
PID 4500 wrote to memory of 1796	4500	FieroHack.exe	WeMod.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1784 wrote to memory of 1728	1784	firefox.exe	firefox.exe
PID 1728 wrote to memory of 1512	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 1512	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 1728 wrote to memory of 2320	1728	firefox.exe	firefox.exe
PID 4500 wrote to memory of 1972	4500	FieroHack.exe	Sirus.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Melonity_Installer v3.6\FieroHack.exe
"C:\Users\Admin\AppData\Local\Temp\Melonity_Installer v3.6\FieroHack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500

C:\Users\Admin\AppData\Roaming\WeMod.exe
C:\Users\Admin\AppData\Roaming\WeMod.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1796

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:3064

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:2192

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:2140

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:3052

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:3036

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:2348

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
- Launches sc.exe
PID:1356

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2192

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "BFFESVJT"
3⤵
- Launches sc.exe
PID:932

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "BFFESVJT" binpath= "C:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exe" start= "auto"
3⤵
- Launches sc.exe
PID:2508

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:5152

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "BFFESVJT"
3⤵
- Launches sc.exe
PID:5160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WeMod.exe"
3⤵
PID:5168

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5288

C:\Users\Admin\AppData\Roaming\Sirus.exe
C:\Users\Admin\AppData\Roaming\Sirus.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2344

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1728.0.1852415212\1827515472" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20636854-3efb-4b1d-a841-59c760f82460} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" 1788 17afa7dad58 gpu
3⤵
PID:1512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1728.1.136480434\379426844" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {069493bd-e3ab-46ca-93cf-c844128af4a2} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" 2180 17afa6f9258 socket
3⤵
PID:2320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1728.2.49709143\857259907" -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 2992 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eea32538-6da1-4889-9644-742b2ac9c7c0} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" 3008 17afe6db258 tab
3⤵
PID:2324

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1728.3.1067118208\2133583324" -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3336 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7467737-2ed7-4026-8a23-aab2b7afe0ac} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" 3652 17aff78a358 tab
3⤵
PID:2944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1728.4.1332672737\1697003901" -childID 3 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efa14870-ef1c-4602-b1cf-56fac21a1ec2} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" 3884 17aef75c158 tab
3⤵
PID:1148

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1728.5.403123301\578233969" -childID 4 -isForBrowser -prefsHandle 4796 -prefMapHandle 4832 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4d09d1-dd77-4c00-8e39-b88d73acb916} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" 4844 17afef82b58 tab
3⤵
PID:196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1728.6.669363051\744259505" -childID 5 -isForBrowser -prefsHandle 4880 -prefMapHandle 4884 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3382d394-b73e-4cb6-a18b-158fd3bd625f} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" 4960 17b00fa7d58 tab
3⤵
PID:3416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1728.7.1743739139\1951612065" -childID 6 -isForBrowser -prefsHandle 5092 -prefMapHandle 5096 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10b8a6db-bc86-4ab8-83fc-d9b31a89c4ca} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" 5084 17b0174c258 tab
3⤵
PID:2284

C:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exe
C:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:5280

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:5752

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:5820

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:5732

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:5848

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:5880

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:5916

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:6104

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:6120

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:1292

C:\Windows\explorer.exe
explorer.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.0.2055138850\604875021" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1688 -prefsLen 20804 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb644022-b951-4d45-9c63-0367eeb5d399} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 1792 24abbcf5858 gpu
3⤵
PID:5528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.1.1959568316\820009062" -parentBuildID 20221007134813 -prefsHandle 2112 -prefMapHandle 2108 -prefsLen 20885 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f44f285-a637-4ad8-8baa-ee7ef089169b} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2148 24abafdb158 socket
3⤵
- Checks processor information in registry
PID:5596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.2.1771029312\709588463" -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 20923 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38355262-1ee2-4c91-8e6d-25ba981b6d79} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2980 24ac00e8858 tab
3⤵
PID:5968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.3.310106096\1733196301" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26109 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {854ba380-7c13-4125-a01b-07d570e6737a} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 3612 24ac1acc558 tab
3⤵
PID:4876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.4.648122158\882032176" -childID 3 -isForBrowser -prefsHandle 4592 -prefMapHandle 4572 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc09532a-9a5b-4dd0-a119-61013c475c41} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 4604 24ac081ef58 tab
3⤵
PID:5296

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.5.736839793\1282304443" -childID 4 -isForBrowser -prefsHandle 4748 -prefMapHandle 4752 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {950b5fa9-e78a-4de1-ae45-edf4082b4f1f} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 4740 24ac369ee58 tab
3⤵
PID:5256

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.6.803975627\579473680" -childID 5 -isForBrowser -prefsHandle 4932 -prefMapHandle 4936 -prefsLen 26247 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01c2bb1b-cf6f-4cd1-a259-6e0db6bcd7e1} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 4924 24ac369d058 tab
3⤵
PID:5268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.7.898503433\1829356" -childID 6 -isForBrowser -prefsHandle 5276 -prefMapHandle 5272 -prefsLen 26422 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31c098f6-7b0f-4882-bd8a-c5ebaa1404b5} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 5288 24ab0272258 tab
3⤵
PID:4684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.8.1704380848\874697986" -childID 7 -isForBrowser -prefsHandle 2792 -prefMapHandle 4764 -prefsLen 26687 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d8aab9b-d553-4ee8-9526-10f4af99f084} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 4608 24ac362a858 tab
3⤵
PID:5832

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.9.301324458\657546707" -childID 8 -isForBrowser -prefsHandle 2816 -prefMapHandle 4612 -prefsLen 26687 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49bf0be8-d74c-48e2-85a5-7a68804be476} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 5288 24ac59fb858 tab
3⤵
PID:3260

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.10.1082460143\1507447261" -childID 9 -isForBrowser -prefsHandle 5668 -prefMapHandle 5672 -prefsLen 26687 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c99c06a-0fd1-4f2e-8e64-8130233363fb} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 5660 24ac5903858 tab
3⤵
PID:1460

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.11.1669444482\1853792453" -parentBuildID 20221007134813 -prefsHandle 5724 -prefMapHandle 5728 -prefsLen 26687 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4d4b4c9-256c-4545-a731-027bf76dd56a} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 5700 24ac1778858 rdd
3⤵
PID:4832

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.12.1509736817\653597240" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6040 -prefMapHandle 6036 -prefsLen 26687 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e01ca47b-399d-4fb2-a1aa-dfbf0a072d4a} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 6048 24ac369c758 utility
3⤵
PID:5044

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.13.447407734\40780787" -childID 10 -isForBrowser -prefsHandle 6560 -prefMapHandle 6556 -prefsLen 26727 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8164562d-af0b-4811-96ef-c1c9e8412ee4} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 6568 24ac175ec58 tab
3⤵
PID:5116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.14.1781869058\588097256" -childID 11 -isForBrowser -prefsHandle 5468 -prefMapHandle 2744 -prefsLen 26727 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c000d559-076f-4c3c-9ecc-f938d316c051} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2612 24ac5837058 tab
3⤵
PID:1532

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3488

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
3⤵
- Executes dropped EXE
PID:1796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.15.159818486\881698011" -childID 12 -isForBrowser -prefsHandle 4860 -prefMapHandle 4876 -prefsLen 26801 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed47d2fd-13b3-4f17-8e90-e1307ab17f48} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 4848 24ac3984d58 tab
3⤵
PID:2384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.16.2103397086\264430660" -childID 13 -isForBrowser -prefsHandle 5944 -prefMapHandle 5932 -prefsLen 26801 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a67b139c-2089-4b3a-bf39-61a077c1a44c} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 5508 24ac1cd4a58 tab
3⤵
PID:5220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.17.552786207\663261234" -childID 14 -isForBrowser -prefsHandle 5948 -prefMapHandle 5732 -prefsLen 26801 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5eabc3b-8056-4adf-94d0-0bcc4a56b229} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 5748 24ac59b3558 tab
3⤵
PID:4372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.18.26744114\2079520753" -childID 15 -isForBrowser -prefsHandle 6636 -prefMapHandle 6588 -prefsLen 26801 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {744f0f01-61c5-4044-b7e0-0aafcdc33f1f} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2612 24ac7195158 tab
3⤵
PID:1568

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5332.19.777258001\854147929" -childID 16 -isForBrowser -prefsHandle 11400 -prefMapHandle 11432 -prefsLen 26801 -prefMapSize 233496 -jsInitHandle 984 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f1f709b-82cb-44ec-a6a6-9a2aa4058355} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 11448 24ac780ce58 tab
3⤵
PID:2876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:744

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3764

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4420

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\35731bba5bdf474c88839061d85403cd /t 216 /p 3488
1⤵
PID:5008

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5480

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2360

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\3b3405bbbd0c456da60bbc7a0e680d4a /t 2988 /p 1796
1⤵
PID:3412

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\9e6025fe978944a88f2a707bd119f9a1 /t 3980 /p 3764
1⤵
PID:3092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\14205
Filesize
17KB

MD5
559f612533905cacc51ed4f2a4dcc3d0

SHA1
194ee0f85f7e93ff0c5c1d38723e115e9407bbb2

SHA256
738ba183b22771d1aa163cc021e64f880e55d1849116f28fdf316c786ca7c614

SHA512
159d136579fc4081e37224efc9904d04318b4bd45325a2c395c3c599dd36c24252ade2e113155ebfe17e0d9b6fc8978f78b20607639080dece55db86f7cdee99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\19042
Filesize
15KB

MD5
9b91a8aafa4f25a3360fca984f12b35b

SHA1
be486851fbec3ebd6219e4cb9f20a076c2229190

SHA256
3bb56e6d2a0716faeab6acb3a05fca998d182fbff4cf00652cccd0c59191b745

SHA512
8285508d2b3c4aca29282944b8c5d8de6a0f428c273d477278ad5f162b68711bdd12007f62bca4e9752f003d8ef51e87d55ff36e2668703febaf9f7662a8e538

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\20107
Filesize
20KB

MD5
35c0774b78a086da431761d8f338bd20

SHA1
9991bb00a350d43b47a10523c84c4cbe8a68a9ec

SHA256
ad4fcf9ecba19af63308226ca666687bb661a0abce34717e171f78cff2dfcc35

SHA512
2c15e7e1bbc7572e087c3fc204d6fb43ffa6ec98d694c45c1eeb131255285fbedcba509a21e46110df7402b246f4d03c1a5af14563701f1201099ab9bbe6d282

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\22509
Filesize
15KB

MD5
24c92227ff04c036ec7faf92c939a7d0

SHA1
95963f9e28ddefdfc6062a19c6686f83b726a6c0

SHA256
f5180bda65a8389932a92d359f065cc036551695c5ba012bf1feaf434e12e16f

SHA512
96b6f800412c5f78147d63966132da3fc47e3327de45412a50eb55a6c2b34bf474a22bb942024395f00772db564f5fcffa99715d57f6abbae17fe51140b9f85a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\23453
Filesize
16KB

MD5
32729e4b51b65ef2bc2b494551d2b034

SHA1
bc1eb6e5407fbfaa526122fd69720c07b74f0d62

SHA256
a6ecca922ec947ef09ae5169fe07931fec6ce6093f7964a51a0a20cf0b2707f0

SHA512
e5dad082e8f38c0a3eb3e7172f8cf15cb8bdda0c3f89ff663073304e234d9148309a41e7f7689aa42a6b20adf4242b5d409b56ff8f8758785899e8c98637dacb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\28070
Filesize
15KB

MD5
569ddc38bb2ce980b324087c0e401f47

SHA1
21edd52613396b0cee8d7b6a7b5bf9a68ecf21c6

SHA256
2b5f3a41e1a8abb9c9096c7d135fc8416f8381690c344a8f5f8d80bb6f8bfae5

SHA512
d933b2d4a85af2c572f50af2f8488f49b7459006fa44fd533bfc8ab697a2e5276276a90e4cc50b4e4b221238d22d68aef48b2c5b77c19984cccda01e6bf1d767

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\3752
Filesize
20KB

MD5
895801a0b3c156458555b66c92375ae1

SHA1
71089d0138aa5c2d2fadad5c4003e519771556a0

SHA256
f9d7007f064e0ccf383acf9bb7c3a0cff6d9343bebf8c49ab3b0328e42cd65ec

SHA512
91574338152c2675ab2adf92a7792bed6cb189e9a72553d29136ef73f788b1f214e116c6e4bf3abedbbab012256c123fef9b3e67df3807f0430db45f055fd010

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\5036
Filesize
16KB

MD5
500c76fdb5a24ba85e1d5504cd24dc8a

SHA1
7465579a10c480f7b8bf81cce034c9b90c066b0b

SHA256
bf8739a9e2f1fbc5a24e2c2f54bfd61ebfebc2ce1ae4b4e4774783aa10eae713

SHA512
27448b3393ec51c8a2792aefc602f1400329a41c3bec772c3bc2d7befb84cf8d95584bcf8b96c1b6acc0dd468291aab35de79588cd88a2fd42a1afa2af768590

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\8503
Filesize
15KB

MD5
e2c86a102b8d8e7bec394439cd98f5f9

SHA1
a58f7c83d88a611a720b6ed4857af970c0eafa1d

SHA256
16a6d3940bcb4927b9192bf52759c88d2cf0333b8f9adbde64a8edf4c6421fbb

SHA512
c13200e623af1128ac1fc7f26720a56f312340fe4b76e78b0902c416021b6694429b86d384cf4d93ec0a1a715838aaec34e7c1c01e3f92549b52db4cf62dbaed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\049B95616AE07437A9FE8A682BAFA35FC3CD13D1
Filesize
4.8MB

MD5
6718b9076f6b1c21e7db51bb88f63936

SHA1
4267404167dd009e24f80049ec01df1e14511193

SHA256
d4d3446a9c9ed5f0fc8b521d1a4b5c1fef989b194a0a991d8cee8e89e73071fe

SHA512
31be956bf2183a9cd11798680069d4392f46ead8d1023bdc10538fd210bbc4d159b7d9e54bc21f65157d3542f54db172ddca86684bd5affded7f697862eb089c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\0577022279E460734F9FF943A2F98802CFBDB3D5
Filesize
121KB

MD5
a1cec947a2e9e567715ef8a17024324f

SHA1
2ff6db9337ba354ce87b54aeb1216384f0aaf5e0

SHA256
ab8cfd0c1e2c743166f02dffaecf06e630b3755a0b33fc46353c38ebb51930d4

SHA512
c72dd5e36571aa2fb732fe6947b7d45f22d566b48bf658c739a586f441f3890327643a73418548ae7ecf3bfa2e725829215631b905c3a5d190546e18cb7a1abb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495
Filesize
9KB

MD5
4c9288c0fd502a9204a626ae53c3835e

SHA1
9bae46888e887a5a894f0741785cf001ab9aaccf

SHA256
ec82645a3e489fa11c8e11d57635233427f174a034bf2f5a8228b412673eb639

SHA512
07a1f9a605540e6ba9abf553cceb8e20536deb8f0508be95089f217460fd667342600b643a8e71810f2c354a6a1c2009df76ecad95d0b80f8a872e67ff6c7a71

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\5932A00535DD4D44EFE39BFA0DFA865E5D718649
Filesize
60KB

MD5
13fc8431fd1ce575861022d4d1063d56

SHA1
24d77657deaa908ccdc7f83729f929bead6fa9ff

SHA256
ca1140407d8d6ca6d82c5abd40b4014b40324f38141c4642005badf856d86f98

SHA512
33c103df4cccba8b0e5f1b9fadcdb8da65fec2249c1dfc3d39967cb3099ca63251a6274ca7e5a5b73b71518fe634e30ad7b60d39d974f2644db248fea03872cf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD
Filesize
32KB

MD5
1bfb8848de589a498704836ffc0d2dbe

SHA1
089e4db13ca4edced3aabd2a1afd58dc640aa289

SHA256
251e4c05ddf29af68f034f499ea19202e6788e2a0e53b340fb7479febe5a6469

SHA512
83485bea4aa96d59583191c33a9f26909a5151df5b6d0631f306522a006883dcd52074190566f45a44638f0288fdba34471dfa2d41e0ca7316eafffaad44174c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Filesize
11KB

MD5
41405bc727dbd567734975f6b3858464

SHA1
bde34ae1ff0d58858d05f8db847465eb475aa3b9

SHA256
011b0349817b8b0b92423c991d7c0de1006718d42dfe30213538748497a0b31c

SHA512
d448bc7fb8d6b2240a9a38e8d0f95012f4c90e8b3339fce087d88a9b05d5dcf98f91281e35a2ee04366e21420adc81732c4b4deb06cbfbac75b05c0071159308

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\79B0DDE3FA8DCB1BD2B4CA2ED3EB8F3088226A6C
Filesize
38KB

MD5
3e6435851ee9f116b2309099e7e0efad

SHA1
a219b38e392af0b3bdb0d92ae135abe9ce705d20

SHA256
04934be2af64e7d8d236d23301f5e0417012a51009b7b6c023862c9e27d61b87

SHA512
b98e024f80bdb9e9fb30dab5beb389d63965a90cbbcf42b9a80572a2325a9dcb7d5b0fe14b1a0df1f92714204cf0780bd4893720d769c2a4d41e72a63197fb8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\874F18BED7CB5132715B8A78AD866AC231B4B3F3
Filesize
18KB

MD5
c224be24309ec2fbb7847ac2694d0ee2

SHA1
c5f0dcc578b30fb7649306153f0c89c84ea8a04f

SHA256
17bcb34491cf57723640ea458c2feb0105403b42c114c1103950fbd226a2383c

SHA512
d8d06037bdd0046ef3169148b7e2e190ce02225d40db9255614db3d1561eabe126657c81118320b4aa54b9e2e4e8a1144ce412ca56c32053a97fc860bcb11d8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\98548360A42A21A9012B7B8CEF232AD237A057C4
Filesize
968KB

MD5
5d697dd77296af3346314df6dca7e172

SHA1
3ea606fb4a8389a8d971f41e9a13a555fea6ec9b

SHA256
4d2b247b1f38adedb19879580693dc9be19bd18e7c0e0615bdfc04a2261c59fb

SHA512
900aac8216d9831559a6515fdfa35065ce2000658fa6c387c4792aafd84a5e816a5882b499b210e45b81722d08b98316bfd8e42fd62238e99e7dd84f32b31eec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C
Filesize
13KB

MD5
40bdbe5e775c684c04ce2840cb5aafcd

SHA1
ed9c11d556e1cd0bb81095473b06713f8403a9c7

SHA256
99cb1c6793843aae7c3eb0f6144556c957ba0ab991f2d5a34faf0a15d930c713

SHA512
40d0395be8f7191d1b7c7f542cbd28d025e21c8329a92423cc5ad1b95c969924d6cb2d6dcac7e5a87938197b9179141b60ec198fb20e8874905e868eda16f26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4e4r43av.zol.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
18KB

MD5
6acd63f5c556810bf56b7b6ecbee8189

SHA1
b2fe0f10716cef6a983bb81758525f0b8fa44a97

SHA256
41508bbf342bcd5757f25f5d7c260a238f31f04b4f82a16b770d7fd8b4a30057

SHA512
8dff1ffd1d6d3e026ad3fff587b219281b28490244d2e04764afb9428ead619946dbec5514c7db7bea314c02f9af7d0f621e322c0735c9be13e916284b389cd8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\addonStartup.json.lz4
Filesize
5KB

MD5
8e3b862582bf98953dabba277d802b5c

SHA1
1a92a4120f35debf05886100760c8beb789246b1

SHA256
ce3076f8b3f8701e3753c5057df40273b2f0a89fbab17380e183354d5fb12070

SHA512
eaa324d01d729e754b2df95385d4a45d1b7eebb8090d814306f9f736b96b99ff4476095675c4fb270099690adcfc022e2fb5c0fb2f60aa9a184c010aeaaeed5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cert9.db
Filesize
224KB

MD5
33eec4786c7d1548218b27066903d72f

SHA1
7a7176deaa2e631300fcee8784cff1919be5981e

SHA256
8144a642a2a088a0ae4e13c0b6da0511cf64649f5b75b8c60bd70718ae0d7901

SHA512
58f0fe2bddb82c97473e1ee740acb9e148a11e2fc7960d85b03c642dbc1284477c2f95b2397cdf6d73dbd77bd3668119d14d2b4e39af195ea87f553fc8418221

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin
Filesize
3KB

MD5
712c1e9247455aee937c99fdbbe2b305

SHA1
cd75dc3e2254613ac820e20bcb46264af32720cb

SHA256
9b5f78b82c8a50e5413b56309b425ec3dc957cc64793cdbe16bbe4f31208bf0a

SHA512
592216571069f0e2f7cae0d4a47eafcea6a34c96e8b14829800c2289a673fea058fc9f966f32ccf00a9f7a21b241f35a5884bde86d33d04d0069ec863f3216bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
35df51a5ecf58e176e040f4bee69d7f2

SHA1
01567779d40a26ebae3d4e2c7241b69297e1650a

SHA256
68393b6b01de6d1f196617e24b905c3a7bf595ac9530d9c6a8f1d7d4576cc5f6

SHA512
ebcd6f2a1ee0c5be6e1a15d2dc67e4241663ff10eee3c5f19f1633b2a12b59dd1a023ced8b369fbb8fb0391a989de0467ea76ef8374c44c6938821262b37f1e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\075634ca-ae07-4905-85c8-759a1ba339e3
Filesize
664B

MD5
c4c4af83ceee24184cb4fedcb16fb071

SHA1
8c78c1e0545c36aced07d1cb7aea756b1d724479

SHA256
41ccdc68bbac29ea3b0c02a70a84b1714ae5e79bb216bb3f52de7559611318fd

SHA512
dd4574b9f3b0b5d4f6bdcbc3071b4c0dd479f4f009ce4f5c24fe6f929d47e80110af3add7ac8c6afc9d1b286734712fed9886d6872b100c321a6a88afa4bfbee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\40da23be-1760-479e-bba9-ddf3552c3d95
Filesize
657B

MD5
25391c9dcb73b0952e8597b4f089e045

SHA1
3ea4f0a075e1afc86288e63af47688571b5d6b54

SHA256
8b4f3f23e5c3d13c4d84bbd691377f0c24f5891c15734b17b9e5af3bac7b5136

SHA512
76671a72005b7278a54d00a56d58d467cea7e5b03b4e26a3d0292085eb2fbd52946742c9fde6b27beab45750eb2a0f282ed2e4263946ba642f1477406ea8c7cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\abe9f576-6fd4-42ea-a6d4-d80aa26824e1
Filesize
10KB

MD5
f5c8cebb2de12716f4da012b06d489b7

SHA1
f4f6dd35e44b073d7a794e8bf457224623ac1fe7

SHA256
756f7ce95563698ba6c78dd16b0ad03b33c8fbcd22d4c306bb7a71e8ea8e1d68

SHA512
d1cc785eeebf58865f012b714221cbd743da890f0f2ff30361e899b20bf64be8933bf1b9fc0238c715e6e402f9ba4b115b5be3a4827353aba46ed2f3f6869113

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\c7b077fb-52a1-4dba-a5a6-6a68a482086f
Filesize
746B

MD5
b09daf53a7171c163418a93c4b88e99f

SHA1
15af3c791828ed492089867fe14cee73480dc6f0

SHA256
71dacd5b7b7369cd2eb766586b870e9cf66e3e8c978ecd37680ff37297bc24ec

SHA512
96b46f8b6993266bb40e297c1544de6541e34113857835d001cae1736b24365d03e866f7b15071f222d69abf3b6379a9dbb1f181a78623d7194c8326a1052785

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js
Filesize
6KB

MD5
dd03611b80703655dd1f8ee7517db1dc

SHA1
cd3d4d9c0d97e336c052d151ccc4450884a28d1f

SHA256
c31944e4c6ce7eb5c9ceca21f61152dd832bafaa3fc578cb6f6ca4fd4b5b8eca

SHA512
19a9e3d1299d960f134a921dc34167fb53a0d8f661a773b4a5e703440816e183a6a94744616e246a5eeb9e293c95687feb0427ba836e0c2eab2847f6f54cd986

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js
Filesize
6KB

MD5
54210cad35993cf5d07903847cabea36

SHA1
974098e97c7ad74cc260b457af507dcb7ff1d6d2

SHA256
87d56ddc6329293ce74a5b6d333fcf3bf409d1103aaa8096c0ef3f6ac75e7ab4

SHA512
c268674738929ca6a9f5b4c5e46878ae1666bd000a8df1f46550dc5c71a511024cfe1564194a5d4bf3711070e00af0c5c77fca74e01e99d1926062576c78c370

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js
Filesize
6KB

MD5
f40f9a3be5c691f2435c62daa35b8d21

SHA1
e3c3ca8d37ab76644fd31c820288801d56389a99

SHA256
bd3d5e9277dbae2c5766b88abea331a30f3b32a69eab5ad4eb36f085360c9502

SHA512
da902c1612e46eeefa34fd9f2291c491681443398c36c8c962572568e8aad4dbddc753f6ac644f72fd7c0bfe29c430e79cf7b1d378edf014737c6b01b5555092

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js
Filesize
6KB

MD5
79e620e6b784a1eac0158cd8a7018bdc

SHA1
6b71b710f2bd4a173691f675d695b6f76b3ec930

SHA256
364377f6e1d8338cf8575ac1929ab0a74996414741e162e1452e9cf9f57bfcde

SHA512
128beed7de0688dfaaaff00ae969faaf99896de217f99d4ead990169f7e8ac6f63aa4af1a5b63e17931a0ea02e711795af5f5afd37c7461d1534196960f5c0d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js
Filesize
6KB

MD5
6838ead9020c786a0b8c261ea643ebd9

SHA1
1057adf3a767f2d6dd7d71130d46afc4692b046f

SHA256
06cb2c074be2a465e8d688e47a637e0bcde5872d5d277117327133886f11a3e6

SHA512
60c2ca91021b2552685bcb2a37462637f0eeab5a39788d2b18d898b3a0100d3565cb93ba9c95e909c9293bb5f288b5b36a22ddf515b36e7b51ad6f8ee36c432c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js
Filesize
6KB

MD5
a134c194dd3151f6eef3c8836e8b17f6

SHA1
65b90b5bf92244825c62330210bee142d1308acb

SHA256
ad2b45edcc3c0a8816b749056a3f19882c37f0e2d025810436d9b1bfed058eca

SHA512
d7dd2ad579fbcc2d1acd02e84985dd3e9e8ff22363f01d9f920298cb69ee3ea4d98fa82e3c5c338d6ed7d3cbab5c2af96f32d3374050b37ee8dc1c0ff23bee56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\protections.sqlite
Filesize
64KB

MD5
49397db0486dc59d607907a086f40c9b

SHA1
08742ce9db9569062def08e99eea8470702feb7d

SHA256
890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

SHA512
fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionCheckpoints.json
Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionCheckpoints.json.tmp
Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
42KB

MD5
cde23e5d96b0b064f8f230348e51584e

SHA1
ad7cc29483de49e8a47143cd0c32edc614ad59bd

SHA256
38bf455224e4535d7b427834741074288f9f368bd081897dea535551df8c9f70

SHA512
313de1eac1f8d8372240ffd56c2da93209ff641523137e2f06a41069e6b51ec3eef720791e6f2981c46e39207e43f82bcaa148148cd4e1b11ac0768ff639be21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
42KB

MD5
73d43cf49a5707414210bbfbbc285690

SHA1
930fd0da2233bb329829150811bd31f6ca11f588

SHA256
67e24a7fd8b73ca9d55841fde3f5ee9e46abf2fd10eedb21ced3ebf8ef7a9a6f

SHA512
ee21ddb2904ded2dcb201865436db04a4a541a5af06b8b6be06d5f72bc5459cfa0ddb8c356533f95f7b38e14870684006aea24053b94cbe72918cfc64820c0d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
42KB

MD5
10db5cfc15e2c6db6788c918ad8415f6

SHA1
7e6d1b62586ba3143369c0c76c0d32c9397282fe

SHA256
45573e7dffb91cd4bcbb732db76c476345a540075a0ab9a4e20fbd8a3fe26b4b

SHA512
bdcc78339213ddb06e2ccff9f01dd2bdae58d5fd66a89544d0963e5c007d26a2ea4f172fb74c6c2a1d4ace02c404a080e322f21f7390c31540657a8238d57470

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
49KB

MD5
4a4da33505a9bd0a3fecb33633985555

SHA1
ebb41283b835d77ac1eaa73e9bcfbfb1edfdd3d0

SHA256
97a9e621d2246bafe1ed130a857f93b4e29b8cf4c73deade5ab1e6e2174c6c7a

SHA512
d04294532f896ff8427d4cd61ff8792dcee19615ee6c4a6c96870fccca5f8a184a50ab7112de8855c2e14c7e86d8b89c52007b54ce1bb8e84ba3bb7d0b299fc8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
42KB

MD5
633ec204b0f9d374117c15708ea1f951

SHA1
bb639ed4d2339f4369d247f8911469c33a5ae25e

SHA256
81fab019af03524b31aa0f99faa0fe9d4e4200e108379fc78b5c38bd04d25338

SHA512
4b8b330150e38df200a5986c6b1fb382901c908221f2658ba4b535f636f813a0c63355266a33c168e828e23a79fe20c8a5fd7167ff78a6cef163109b645faf99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
42KB

MD5
d0ade27afb03cf80023bc23e07994c5e

SHA1
18faaae64c289d283ae87f84a8f0897c8d9c8591

SHA256
751cf7538ea750c79c4daf205b6bf2f99315ba0c1b46e49a260b07f83f63ae26

SHA512
c9ca0da8aa31dc7083f7362f4b4747efb80589e85386787d95d89e1e1a61a2698a47ad211cc9b94ccf03950a7c35fa571d0df5c518c7c3ba7ae6445d651de977

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
68d5b239e04d6c64cfe304dce9cec23e

SHA1
160591e98e3e73fca839c6d2164febcf54809ada

SHA256
55619c4dd8e7248b63818c8ed0bafc18906240a85cf975633e0213db170be0ce

SHA512
1e9f9b14e18d9e0aa2d765cbec8f478a6d9de7823c4dabfd95e5b815dfa3397e5c1c256e53004df84c658e4ed94894bc1e98a0dc83c42c444d1cad4d352b7530

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
44KB

MD5
3d44d213843e57ef3837142107938999

SHA1
fa9c18935e5430351ada578cf2fd1ddcd0f369a9

SHA256
e8324f52d19aec11b8e7bbe39f5a348ef799ba82b722f14326e526b705f39cc8

SHA512
46606a010729356081a4c8761d6863adfdc9f42aed586f2a6acb2d0a86912b3c31750ee4c2bf633a81059c487102c6b67bc678b99efc73f4ac757b7caf567bc2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
d8c97885efd400bf8ba70834a0217364

SHA1
d1ba546912bdba6ba01c63d741119c04272f18eb

SHA256
40b3b4e72f49277117a2a4872e1b2b6bd8d4eee23374e96f7d8e29b8284d1e58

SHA512
324be6a7291648de1d31a330e7e7fbf224d3d69f6093c0aa0ba83fe3e428cf13749721a8f424a8f145cc477535ac0d8b1f09ff98fed4e4a6505fb6024d22f49b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
51KB

MD5
797f09a187a482bf1ffd04110ec57eb1

SHA1
b158aea0de4244406456ef4a28227c77d2b0d686

SHA256
6c090564ebba4db900f76cdd4802686f2159e990e3194b35dcd112d45be31346

SHA512
96c21f90395862e3cb55d3418246a887828c9824434d10368cd6f3fc3bcba77938b873309fe030a136f99d913b24faf2a2a023a438ddf15bba1e345fd3bc56ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
42KB

MD5
66833761d30bc78577e9925bbd0173e9

SHA1
9f5a2fbfff24e46548524f3db0cd1475cd18e5fd

SHA256
b1473c46ff843099ae8f482bf59d21a5c17e95ad4b5fd8665e81534c2e36ec85

SHA512
77d542ee177e6725b8f5e43676c4fc95455327be915e5d0a2ccd92a16e6fa2a08e54cb5e9353fd2daf62c9a149bf90b1ed823bcc544797d0dada7c13a8418869

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
42KB

MD5
0abe25b46e1dca5156144b68760531ec

SHA1
524cae04678750c8027b156a01f30cb1d6e42e41

SHA256
42e232b469031dad28866bb011b3c39da470b928b7ccd4623c5f6a27ec9ffee4

SHA512
da86908992ba925ca9bd386082648d975f5126d73ae4e1bc3bcc92cd2928b03c59f4afe84cd1e5eb525cbf7acfb6c781bce57650790f41df2e0404d60c64c53c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
fc160ee709ba6cfe63adbe85cdb6ba0f

SHA1
daeaaa07fef07ec162c4c1e800fe2769d89b8b35

SHA256
14953e04c56ed827dfb7157602e496815761c8b30328b9bc242b9b8d281c08d9

SHA512
c6d049298836db62e3a204c3f1c856f395b7c761a434fa900b26f86c9d8c1bdfaa260be97e21d5627729413738a2c7709c64671a6c2b1d8406a06071bcf820c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
35KB

MD5
bdbe98e899d8b085e2e8671c96fb9e73

SHA1
fac3410a36b33da3234caa9b3ba586c0404cf863

SHA256
b1b057c4d1efd0bdfe975a2e62c72c9456b43caba57318d4b06cdbdbad5bd072

SHA512
1317dfe1b7851148385195152e5c09822e0c6d50a310f53885cb6eb48931e8d930abdf63f466d384b97736671f1828cd8e28ba64bb8366b9cf48b37bd5bac12c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
42KB

MD5
1b7da664dbd5fa21f1f18eee4cf34ace

SHA1
369fc97bd334b10f915719d5f7cbed88d2a064df

SHA256
119134fe8a2f753e8a7a4c6b41483ce94f7e0ce4fca6cd2876533d62302b8a1f

SHA512
d320e70ee2d1b6db092ce2c9044ee0e3120bf76d771da86e4d11efefe922b0d24f895f95da6cf2617e8de92c995791ae35554206b82d56f2331ae6119b79ad70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore.jsonlz4
Filesize
51KB

MD5
1e471e08a29adc7e7981f4533eb4c5d8

SHA1
07069172e051442fdbbe7ec24e5ce9864831270a

SHA256
c3864210432747cdde07b06184beb1be96a4f4d751db3007f18d8803075a0536

SHA512
202f1ba52abedc66e2b0da03ceef2ef529230ac909f0fc69f932b35ae91a90fd5c96668f6419ca45d7723e456d45b8fcb31eeb75351fe257d220acd732acabf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
192KB

MD5
3d6213215adee08ffbf46d5401319468

SHA1
9f547fb707fb7a5737f9093d9bb8dd4b3990adb0

SHA256
1bf9390b6ff0c887087fea0a5c751a4158c66074e8e504a67bd533c88c4efa2a

SHA512
f964958ecfc4addd2f3ce2fd904760c63462345fce56c9941f7edae76287cdc6314b47ffbe19a5116dd61976708c3c5679ea8fe0c96d0ba30d8757fdda7c8701

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
50e719ab1e039303b82a7c1831e4c06d

SHA1
a37e30faab4f634cf81f8e62685971faa8104163

SHA256
e9755a8335cae6eb4911de3ece89756cfee8adf5b29ac8add4477ccc4748641a

SHA512
005ac01c4e998fe54991f1b6d0609d1b89bdd24bda4eed80b9db0868681ebd0caaaa2b682e09be7815a5992ce6d1550a4775da4f7211e537cc64c74805ccb063

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
4285e3f7274fbba9de471d4443eb8ec2

SHA1
15f82ff95571e609e20a511fb5dc52784b57dfb8

SHA256
9294c43b35eba23bb1cc4390ed06948fed6a61b0e7de93d864520af1cd125564

SHA512
ae012f94e0671d68d48a1b2c6eeb25555c79adac1586e7fd0ecd76de822e71fdff7be342de4620a40cc4e6d4fb80f392a56a1b9e48c6e141350e4367001b9a07

Download Submit
C:\Users\Admin\Downloads\Melonity_Installer v3.OQ2DFO2x.6.rar.part
Filesize
123KB

MD5
a82082660da792ace3c9096006870779

SHA1
b5ac519ab774e6cd383558c6dd2961ccd7d39778

SHA256
0938bf35dd001d5321c5e62493195a1339e436ef88c0dc962140521c8a788e85

SHA512
65cefc28bd64902c7516a768471b3603deaa6546d66d7d5d23a08dbf1ba76cb5bcd8167d44df31bb81cccb3dae9c2a80c45f0c66d15cd65e5678b480bbd4385c

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe
Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
memory/1292-475-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1292-477-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1292-476-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1292-482-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1292-479-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1292-478-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1796-6-0x00007FF767081000-0x00007FF767330000-memory.dmp

Filesize
2.7MB

Download
memory/1796-5-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1796-193-0x00007FF9B6D30000-0x00007FF9B6F0B000-memory.dmp

Filesize
1.9MB

Download
memory/1796-19-0x00007FF9B6D30000-0x00007FF9B6F0B000-memory.dmp

Filesize
1.9MB

Download
memory/1796-195-0x00007FF9B6320000-0x00007FF9B63BD000-memory.dmp

Filesize
628KB

Download
memory/1796-9-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1796-8-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1796-4-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1796-10-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1796-197-0x00007FF767081000-0x00007FF767330000-memory.dmp

Filesize
2.7MB

Download
memory/1796-7-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1796-194-0x00007FF9B3E30000-0x00007FF9B4079000-memory.dmp

Filesize
2.3MB

Download
memory/1796-170-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1796-11-0x000001FCEED80000-0x000001FCEEDC7000-memory.dmp

Filesize
284KB

Download
memory/1796-173-0x00007FF9B6320000-0x00007FF9B63BD000-memory.dmp

Filesize
628KB

Download
memory/1796-16-0x000001FCEEDD0000-0x000001FCEEDD1000-memory.dmp

Filesize
4KB

Download
memory/1796-196-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1796-15-0x00007FF9B6320000-0x00007FF9B63BD000-memory.dmp

Filesize
628KB

Download
memory/1796-21-0x00007FF9B6320000-0x00007FF9B63BD000-memory.dmp

Filesize
628KB

Download
memory/1796-20-0x00007FF9B3E30000-0x00007FF9B4079000-memory.dmp

Filesize
2.3MB

Download
memory/1796-18-0x00007FF766DF0000-0x00007FF767330000-memory.dmp

Filesize
5.2MB

Download
memory/1972-187-0x0000000009DB0000-0x0000000009DCE000-memory.dmp

Filesize
120KB

Download
memory/1972-190-0x000000000B5A0000-0x000000000BACC000-memory.dmp

Filesize
5.2MB

Download
memory/1972-32-0x0000000000A90000-0x0000000000AF2000-memory.dmp

Filesize
392KB

Download
memory/1972-37-0x0000000005290000-0x00000000052AE000-memory.dmp

Filesize
120KB

Download
memory/1972-39-0x0000000005B40000-0x000000000603E000-memory.dmp

Filesize
5.0MB

Download
memory/1972-40-0x0000000005740000-0x00000000057D2000-memory.dmp

Filesize
584KB

Download
memory/1972-46-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/1972-129-0x0000000008C80000-0x0000000009286000-memory.dmp

Filesize
6.0MB

Download
memory/1972-130-0x00000000087C0000-0x00000000088CA000-memory.dmp

Filesize
1.0MB

Download
memory/1972-131-0x0000000008700000-0x0000000008712000-memory.dmp

Filesize
72KB

Download
memory/1972-132-0x0000000008760000-0x000000000879E000-memory.dmp

Filesize
248KB

Download
memory/1972-133-0x00000000088D0000-0x000000000891B000-memory.dmp

Filesize
300KB

Download
memory/1972-185-0x0000000009880000-0x00000000098E6000-memory.dmp

Filesize
408KB

Download
memory/1972-186-0x0000000009DF0000-0x0000000009E66000-memory.dmp

Filesize
472KB

Download
memory/1972-189-0x000000000AEA0000-0x000000000B062000-memory.dmp

Filesize
1.8MB

Download
memory/2712-500-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-496-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-486-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-485-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-484-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-488-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-923-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-924-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-925-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-928-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-929-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-930-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-490-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/2712-489-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-544-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-545-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-487-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-498-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-499-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-483-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2712-497-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4828-141-0x0000013AF2AD0000-0x0000013AF2B46000-memory.dmp

Filesize
472KB

Download
memory/4828-138-0x0000013AF2A20000-0x0000013AF2A42000-memory.dmp

Filesize
136KB

Download
memory/5280-493-0x00007FF9B3E30000-0x00007FF9B4079000-memory.dmp

Filesize
2.3MB

Download
memory/5280-221-0x00007FF7B11D0000-0x00007FF7B1710000-memory.dmp

Filesize
5.2MB

Download
memory/5280-225-0x000002118AE80000-0x000002118AEC7000-memory.dmp

Filesize
284KB

Download
memory/5280-224-0x00007FF7B11D0000-0x00007FF7B1710000-memory.dmp

Filesize
5.2MB

Download
memory/5280-222-0x00007FF7B11D0000-0x00007FF7B1710000-memory.dmp

Filesize
5.2MB

Download
memory/5280-223-0x00007FF7B11D0000-0x00007FF7B1710000-memory.dmp

Filesize
5.2MB

Download
memory/5280-494-0x00007FF9B6320000-0x00007FF9B63BD000-memory.dmp

Filesize
628KB

Download
memory/5280-233-0x00007FF9B6320000-0x00007FF9B63BD000-memory.dmp

Filesize
628KB

Download
memory/5280-219-0x00007FF7B11D0000-0x00007FF7B1710000-memory.dmp

Filesize
5.2MB

Download
memory/5280-492-0x00007FF9B6D30000-0x00007FF9B6F0B000-memory.dmp

Filesize
1.9MB

Download
memory/5280-495-0x00007FF7B11D0000-0x00007FF7B1710000-memory.dmp

Filesize
5.2MB

Download
memory/6124-324-0x0000014B9B350000-0x0000014B9B36C000-memory.dmp

Filesize
112KB

Download
memory/6124-377-0x0000014B9B370000-0x0000014B9B37A000-memory.dmp

Filesize
40KB

Download
memory/6124-330-0x0000014B9B860000-0x0000014B9B919000-memory.dmp

Filesize
740KB

Download