288b3b1487ce1900e1a267781032f155a644883efbf64161477674759b27778a

Resubmissions

21/08/2023, 21:46

230821-1mnasage65 1

21/08/2023, 18:59

230821-xnfesafd55 1

11/07/2023, 20:52

230711-znybpsbg7z 1

Analysis

max time kernel
362s
max time network
433s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
11/07/2023, 20:52

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Apresentação 1.pptx
Size

44KB
MD5

78e0a92dbef282bcbad4b3c2f19e0473
SHA1

76d9a27a3f1b60901d3ff03042c1c3c39f018601
SHA256

288b3b1487ce1900e1a267781032f155a644883efbf64161477674759b27778a
SHA512

94daa98046942bbfc7ad3ba6dfd2e41c9f0e364493df4c44ea307b02b9ff8ab91210bf2475cda14563684365942983b2fb662476c16121930ba7d4d4fb24b491
SSDEEP

768:/tWS3NZcR2HFxrtkecj2VpG1elzf4f7aHTDczWdBtn0afX4XMSuY2S0dS04S03SS:yOdRePzmvAlvQNbj68g

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1953053732"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dadb3f7dcfb5ec4ead74ad76a77486fb000000000200000000001066000000010000200000003b54405965c52846e4989a4166c1c3a0364ca8621c5cadb7f751deea1258f5db000000000e8000000002000020000000b086af80cc02f17af145dcf2218c56db1de90a40283df1389c5db61764ac4a6620000000a4c99677ffedd80e52d9ceb0ca3722849b241799c7039e66bd2af36d07fe3d5140000000358d7e06699942d8055ec29fc8dbcac71ae3f99635e2c6f340fb0cb9938071c9dca665aba1f3b273c97c7c74b216a4547f1eee285b9cf334cabe6f223ed2cbf2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044378"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7478C31-1F0D-11EE-B102-FEC27B3A2868} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dadb3f7dcfb5ec4ead74ad76a77486fb00000000020000000000106600000001000020000000d65c01ddd879bf8712675fc35b5630e0013c3ec22148444c1d64416b47108269000000000e800000000200002000000091c7e22aaa7e8d64adbcb2c1963222a89fdab3a2d4d547fae4636cdd2985bc8620000000cfedc8a8688051860acd1e191fea52904754eda212f3c8387b205ac0608fa127400000005d4d7eba8a8ef1c244ae81fb7f91586fdb32cd5c8ebfd6bcb09db1ce0c92ab07e8867f063cecb5e43364a46fe7d43466e14004bc720f008b63b83ccfbc4aee93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1953053732"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FE73828-1F0D-11EE-B102-FEC27B3A2868} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31044378"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dadb3f7dcfb5ec4ead74ad76a77486fb00000000020000000000106600000001000020000000baa0afda6705871cebd7435d3a267ff9cf7e7366821c07a619572f1a46c0630a000000000e800000000200002000000030cf07a4db7b75a7ca875d22a1bd696d1db82f5f25bad814fb1e5f2b74db228720000000a559551cab3426076bdfec58763305318ee2bb2cd06034e79acdf52a3b324a7240000000fcaf6eeb5fee2f0f266f710a4923f49160ddb5bdfd46561d9ad1d59de106590cf6b743dfdb77b8edeb58621635f80567aca32b14e64f267dd55f51b236517394	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07888751ab3d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c078da7a1ab3d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a091751ab3d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "5"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 5000310000000000e3565b5a100041646d696e003c0009000400efbee356374fe3565b5a2e0000009f5201000000010000000000000000000000000000000ecb0300410064006d0069006e00000014000000	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 7800310000000000e356374f1100557365727300640009000400efbe724a0b5de356374f2e000000320500000000010000000000000000003a0000000000d705c40055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 5000310000000000e356545a10004c6f63616c003c0009000400efbee356374fe356545a2e000000bd520100000001000000000000000000000000000000208bb2004c006f00630061006c00000014000000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 0100000000000000ffffffff	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 5600310000000000e356374f12004170704461746100400009000400efbee356374fe356374f2e000000aa52010000000100000000000000000000000000000082cba9004100700070004400610074006100000016000000	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = 00000000ffffffff	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\1 = 8400310000000000ea5687541100444f43554d457e3100006c0009000400efbee356374fea5687542e000000a85201000000010000000000000000004200000000004f40280044006f00630075006d0065006e0074007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370037003000000018000000	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1640	POWERPNT.EXE
4840	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1640	POWERPNT.EXE
4840	vlc.exe
2636	firefox.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
2572	iexplore.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4484	iexplore.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
4840	vlc.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe

Suspicious use of SetWindowsHookEx 41 IoCs

pid	Process
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
2572	iexplore.exe
2572	iexplore.exe
204	IEXPLORE.EXE
204	IEXPLORE.EXE
204	IEXPLORE.EXE
204	IEXPLORE.EXE
4840	vlc.exe
4484	iexplore.exe
4484	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
1640	POWERPNT.EXE
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe
1640	POWERPNT.EXE
1640	POWERPNT.EXE
2636	firefox.exe
2636	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 204	2572	iexplore.exe	77
PID 2572 wrote to memory of 204	2572	iexplore.exe	77
PID 2572 wrote to memory of 204	2572	iexplore.exe	77
PID 4484 wrote to memory of 2868	4484	iexplore.exe	80
PID 4484 wrote to memory of 2868	4484	iexplore.exe	80
PID 4484 wrote to memory of 2868	4484	iexplore.exe	80
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2632 wrote to memory of 2636	2632	firefox.exe	82
PID 2636 wrote to memory of 1264	2636	firefox.exe	83
PID 2636 wrote to memory of 1264	2636	firefox.exe	83
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84
PID 2636 wrote to memory of 64	2636	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Apresentação 1.pptx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4380

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Documents\Apresentação 1.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:204

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Documents\Apresentação 1.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4840

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Documents\Apresentação 1.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4484 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.0.948887510\1931612733" -parentBuildID 20221007134813 -prefsHandle 1624 -prefMapHandle 1612 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84690281-b69d-4646-841a-a18622e873a8} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 1704 23d27eda058 gpu
    3⤵
    PID:1264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.1.453911547\493551417" -parentBuildID 20221007134813 -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 21017 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe6fe4dc-f54f-4460-b39e-2e886be854a8} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 2088 23d1cd72858 socket
    3⤵
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.2.1732102072\521858940" -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 2716 -prefsLen 21120 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dfcc60a-6f4a-407b-9973-d28ba465fe63} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 2988 23d2bbe9258 tab
    3⤵
    PID:2680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.3.1769068582\1681985411" -childID 2 -isForBrowser -prefsHandle 3380 -prefMapHandle 3376 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aea34456-6114-4039-8f33-f7dcd33eddcb} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3388 23d1cd61f58 tab
    3⤵
    PID:1416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.4.1084367025\188452116" -childID 3 -isForBrowser -prefsHandle 4208 -prefMapHandle 4204 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3d4d682-5625-48dd-ba62-84f4ba002d8a} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4220 23d2c9a9b58 tab
    3⤵
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.5.1231607249\1826111252" -childID 4 -isForBrowser -prefsHandle 4700 -prefMapHandle 4752 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2498631-8a2c-447d-804b-ffe3a2765b44} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4760 23d2da63358 tab
    3⤵
    PID:1520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.7.463615511\705531367" -childID 6 -isForBrowser -prefsHandle 5084 -prefMapHandle 5088 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bbaa959-eefe-4d48-b94b-8562a6c11251} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4656 23d29319258 tab
    3⤵
    PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.6.884174113\1727315654" -childID 5 -isForBrowser -prefsHandle 4896 -prefMapHandle 4900 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dff9092e-b2bf-419e-9cb5-9c0b22cd93f7} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4888 23d2df57258 tab
    3⤵
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.8.841433747\2056080231" -childID 7 -isForBrowser -prefsHandle 5448 -prefMapHandle 5424 -prefsLen 26699 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb486fdc-332e-44dd-b3af-e343360f9db1} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5440 23d2df35758 tab
    3⤵
    PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.9.1886003675\659165728" -childID 8 -isForBrowser -prefsHandle 5448 -prefMapHandle 5440 -prefsLen 26874 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddba6fd4-4841-4034-8187-3bb4d65b4218} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 5712 23d2f6ad358 tab
    3⤵
    PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.10.1342809763\1159186305" -parentBuildID 20221007134813 -prefsHandle 3360 -prefMapHandle 3748 -prefsLen 26874 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e84dfb6c-f927-4814-94bb-d769ff096fd7} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 2604 23d1cd66558 rdd
    3⤵
    PID:4504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.11.914133672\291493734" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4312 -prefMapHandle 6092 -prefsLen 30326 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7d50e22-cc2b-4129-a95e-6a5857b40646} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 6052 23d324dd158 utility
    3⤵
    PID:3404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.12.2100722374\438229784" -childID 9 -isForBrowser -prefsHandle 9532 -prefMapHandle 9468 -prefsLen 30326 -prefMapSize 232675 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba3dc572-960c-4eb4-b754-d31a41aa3834} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 9576 23d2939e258 tab
    3⤵
    PID:1948

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aee055 /state1:0x41c64e6d
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{B712CB3E-1989-11EE-B0FB-FEA4FD5E34DD}.dat

Filesize
5KB

MD5
80d6be2498dd42c5cc1460043ca27cc8

SHA1
e352a2d16e64885985c45e103ed5f80b89a8f96a

SHA256
78c0f3b93521b625f53b831d00c73aeeed35b8dd293a466cb1eb4966e66b5b70

SHA512
7552213a4e38718fd9c235a38615d7498c8baf1c4c95639dcc1692052c46377938b01e777722d8c69e9da4b0743b80d4ef2e61dba9460466aacbc15118b60726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{A699772C-1F0D-11EE-B102-FEC27B3A2868}.dat

Filesize
4KB

MD5
19b3f51fb7e651915b262604c8f2ae2e

SHA1
e3eac80d041cd1e477a8c863913d6764d3d2574e

SHA256
81ff26e52567e43e8460304b6e1223c1882aa02be0729635ca03cd9a5ffce1dd

SHA512
f6e79c1091d802ba82844f59a7601028b6591009a020708b8e157ea9482172cbf9d5f87e083f09e9c7f8b817d146bb22ac349b039b357f547bd08ee2a4bf7d75

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16tg48g1.default-release\activity-stream.discovery_stream.json.tmp

Filesize
153KB

MD5
3812fb03ef35da9c548255df5991de35

SHA1
e7d9d827ba943ed863fd87a141a3e63a3b985624

SHA256
47d4f445741134b06da5ec3ed338d91c73aeb31dd6ba38cc23ac28c74c7542d6

SHA512
3fb6a280d8dc6595ae81618aa9b71c10c6e826df0f232cf927584409b1499827b763310c2a32bcff202f0d0bdfe57a1f9f72a008feb098539e8ee86dec29820d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16tg48g1.default-release\cache2\doomed\27505

Filesize
30KB

MD5
0b7b379b5deecb98d64cba007e25d8ae

SHA1
140ed2a1f4dde4e2b825d081502ad66e8d30617b

SHA256
3333cb1b831d9c71dd89206430b5f0e121b3a8a2c22eb9e9c15b5bcbb131ed75

SHA512
ee2be5ad8d0260a55a1da52c82159cccd2ee3936c36076f9ebfc30ba63d367780a0ded4c3864c8af4db536c9f600ca44806638bd6117e898f5457ca61e9a180a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16tg48g1.default-release\cache2\doomed\3387

Filesize
9KB

MD5
ee982fbd52dd0aed4c7a2aaece5c9008

SHA1
23da7ed0b3e26dcb56bb1e970b35708c261d0d15

SHA256
ca4b93cfc0ba92c6e7d108981b947722f53a37c04865c90a7e206b3849e6c8a4

SHA512
3a291dee39e516e61ccb7965479b1fbf1bc789090683aa80142d4c26a998b09f17beec763ca5bc611bbaa5cfb0008054d21350a18f0c63cd95fd7234f8aba169

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16tg48g1.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0

Filesize
14KB

MD5
6af3e500d631d360d8f6ff61254b6fbd

SHA1
2a3491021190ff23f091eafa9df442d96681fe84

SHA256
486d826973610168e84fe36256f9c1a4babca0b81cf818db5f63b01ad490e201

SHA512
ccab1f55fb53011d6449a4637fdb2ae0763121bffba78c0efed12ef7b4f40c7dcb4573f2a2efe7ac6bfab60af5294c8ec4fe95a9c04fb978a777cab2cd40c9ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16tg48g1.default-release\cache2\entries\9FC8C85689D31525EACE26158B83B464F43A027B

Filesize
24KB

MD5
da9501b70d77de98699e37bc9cf987bc

SHA1
db487ddf1b94552473781835d0d065337bf9ba53

SHA256
7bae32e0406d1e13f56d7a0e5b649a0b4327d5927d42d91d2d0d8b7de16d7fae

SHA512
e19ff0874a6f5bd8d6e348589802a4b5339b9d6f8617678badcf55892a0768a7d29954b4bb71c234188dff495e0c9275e7d2981a9a8f12bb1fd22766e0c6e303

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16tg48g1.default-release\cache2\entries\ED9826654AE8BD972BDE17A9E0A449D3F881E430

Filesize
14KB

MD5
7b47c6cc1795bbac738ca196712c9eff

SHA1
39f478f47c98e645bf374ab921a521056af321d1

SHA256
3fc05803b36aaeee24281f873fbf1f46cf953fe22c56676ca97482f171c6d35b

SHA512
5a4d872f88e8327aef0b80e42df106b42aba1407886f7810dd3d7cb8447629f92c565d911104c971cfc929db8aaa5b952b7a3dc9920d586a2a275a6d8f553466

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFF8767913B8F85A5D.TMP

Filesize
16KB

MD5
3626ec900ed26dfc938b316288b82470

SHA1
67de833ce9f915b8dfe4dad6f4f9688421f1923a

SHA256
759f533e40f3663d017ae343d20e0af5c6c97743f495558442818c95a820845b

SHA512
5235e982e7b08445b0ab5179eb01f4e251d2704b70baf4f4c73c346ff51d4a2fab0cdf34da9619488ad8810904fa6ec02409142c7846ca632fcf5dbc7870f868

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\prefs-1.js

Filesize
10KB

MD5
153aee24c4806eb51137a0168884ad3d

SHA1
35264c0674d4a32ea034b6810ffb596dc71cfc46

SHA256
fa0e9a81a294bda5ab1cd8e4e2aa083483ce6a9407248602c6b4e948245e5e09

SHA512
4edb92ddf36ebb6e2c9f58f568c5ae351c12a428364fc5e14b4d4468c80d01f8cce9aa3495bdd2c1e914565b4d2b5750462d32f820936cc1c004bdc844ea3071

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\prefs-1.js

Filesize
8KB

MD5
7157d45e11e84f789f15bfa4823a77b9

SHA1
7ffe795b98f497522e507f6ef8cfe90df2c543fb

SHA256
7183e24f4b2cd446bc41aec71a770e5a677dd9d29a8df1f7359e000f7e9186b0

SHA512
7bd12cba102adc441d4ab5af19352af94a123fc4323edfd9c12ebf226e0c76e9a2059ec251172301f1a0513386e497ded1ac61c79743748d960551a2b172b098

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\prefs-1.js

Filesize
6KB

MD5
7da288d0ec7c2e53edb71c26dc8e60e1

SHA1
479dd5668e38a8d58fdbdefb1cc25ab4eeb231bd

SHA256
21523328dc4d1ff2fbdb1810004dab72a21faf80b5877963b6d77c12ccd1a9be

SHA512
74f88a4a34ceb71620c4115bc16c49380dbf5b665eafe36070524bfd990b5aaf0d7cadfbb6d350eea7f31aac0ac1b9140aff1510765bdc8001813b4c79a6917f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\prefs-1.js

Filesize
7KB

MD5
a8ad901355cada399352c3081f512ccc

SHA1
4784b2a91c03af8ef2de73e3da031761531385b9

SHA256
075813a59102b77bb35474d63ac6609902aca620634f50f8f9b7ed4c45563335

SHA512
015674acb2b8b143669f68a685696bb445a836af36a6bfac576c0d5de21c950d6eeac317b727c0531cb458d703f70c5e4a7a8079a4cbc3fabad9539b432397a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\prefs.js

Filesize
6KB

MD5
1f30b326dc797caf80bcf37963ff91ea

SHA1
23983b0d166291552369882d3247f50ffb4abb91

SHA256
ca57cbbcf90bcea2187f81f2a5d88be0beb0d7aa2885d52baee670b9382a6449

SHA512
8dea6b0c68ee7b44b77ab1f4b63b8e1a000ea55c521cae9a8fcab76e9cd4645738bbfe19e98d1d4994b255a33b40d6f68737026ef7fc4e2c6f23548218762296

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
d2cc36f765835b232be9ab63e42cdaa4

SHA1
81646e6787fbe6f7bb1ea3eb2b060ebd8b05b264

SHA256
1378fbe56b6ca1baa50106cb1c7bcccc1e13bd8eea8f2afa7960c48eed269283

SHA512
1cb481476e3d272c3619d8de034050f06436e7bdc16bae939cfffe808d2d10c4707034a668b3be63764b5c11f33bdc173cc075e0613013dcaa3287cd1fcdaa81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
ace55b10d49a25c1be0852456bebe51c

SHA1
277499fafb60b9285df9da930081a8de309a03d7

SHA256
2b798a8b7b92f2e83b8cee3777c91c9de80e5de8e6bf79adde7d88b779285993

SHA512
4e3c8e4938be00358325e254550c9039a088f25ef075450fe1ba519fbd7f6b5eb223451a21873fefd216aed7b37d908f744e7145ae11ee3a8067636d9d30f0f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
27KB

MD5
b78957f7fc1203b87beb2db3dae8f6ff

SHA1
a4704178b30887473051c91f6906d4da251d46c9

SHA256
d81e03a87492469f9755cbd20e5019efc0e989c2fc7c68d09a84e229d2820bde

SHA512
6b974335a101c389bb8e78ba90deaac5011d176cc30fe61cf03700ee054310554d861decfe93576468d412241504fe84856dee495af1fdc74da0c0d6ce43b291

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
943dda18bc0101f7d1867a1dd00ae75a

SHA1
7c4c3d0e8fc3b0486499d316a967c7fe0f9466f1

SHA256
9e74e3b967b211e29cb86cd50d54d53f1efe16d002240d3744e9b160953d7300

SHA512
70f75199c3d7779435274adf5f1ad73733f87e6f0c0396a70f58b178699a734b280ff6c3a6875ef6f13394e6b92258a54272a5244fb8008e431b8f0eab8a44e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
27KB

MD5
65c60e61577369294c2e70b85500bba9

SHA1
efa19908b4e0a9b65d3c53bc950d8cc342d57519

SHA256
059837ac6e0433e4a61a742eca5280613210cb157525d52b44a5acb2a85b3171

SHA512
7c01ca8b2af3f4a5185f2b5d368d8ea6fdec700b728a8d0a04f2798f42c45191cbfcb0466ae816b0237eaf096da2715b96447589a32b82bb48061ef773218746

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
27KB

MD5
eba3a4e03e6976f35723b03bf8afd07e

SHA1
e592eeafb419f0cf8956d60bbd7d6dc96edd25cf

SHA256
f50986624566d8dd8d2d1ec488b9ec181cb8338e66e2183d2e7d9adda9bafec6

SHA512
4a547a3e1bda7cb0bcf814195652eeb760cd1a7693a75d1fa3cfbb542d2321cc11e6e95e1a18cda5c9b57df58cf554c33a745eda0180bcfe45dd3e3cdc8ebe62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\sessionstore.jsonlz4

Filesize
26KB

MD5
e88c76f52b58a625413a5def4afa151c

SHA1
959ab99ac08951f31b4226462d9426f130502969

SHA256
fc2a399684f5d04d6ca2568956636ad191a9db8f826372759802d04618f250bf

SHA512
e1c053db0b742cfda893368428bf21abd5eb854aaeff0396691879487e5b550644070d8250f7396da83e680dbf3b51706a1b965b7b00a854db5acaf3a0729794

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\storage\default\https+++mail.google.com\cache\morgue\122\{3f1fb730-5061-4811-9f92-c8257e2d387a}.tmp

Filesize
111B

MD5
615d9fcb4533363b0032fb2de5ff48ef

SHA1
a36560c52fef423fe0121e3e956148d4d050549a

SHA256
b6e77896c094c201436a553220f57aef336116a0119dbf63ec1bcc196f2b4b78

SHA512
85b64d80cd61aad92e68349c6306ced6fa660e0f891cbb40a93079d9b45257a64260f808e86d936d55ebe9a4c0347b5b91458ab36339d02de776725ad7e3b364

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\storage\default\https+++mail.google.com\cache\morgue\156\{b8523b43-3a80-4080-872a-b86904ae439c}.tmp

Filesize
132B

MD5
8094d7c823758f6f8cb76b9b6c2a2840

SHA1
96faaa2de728a0087192511f90b3156cd8144292

SHA256
45d56f6c912091232a506e6c9c8cf63a614f99aa709979aaafde46eb59f1d073

SHA512
b1d2d783894b4fcde0a74da2d9672388eb2a5ec1b273e638c2c951482146e9cc800ff9509d216d9efe3f76ba9ee0a0c56dd2052248a0bad36ad5798e5f43c131

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\storage\default\https+++mail.google.com\cache\morgue\18\{698c880e-f505-42ac-92ee-f5558d1aef12}.final

Filesize
43KB

MD5
c6de57e57c60a71b64b566a71ca0cedc

SHA1
1917f239be45639e18533dc63e31b5eb60b51cad

SHA256
bcb75cca80fa07e193ba5cc2f7b8f706bbe5dfd02793bc3509c2c5fb487a2fad

SHA512
de13529cca8a37e176680d1c013a45e449aa9d62e483755095d3ebef6393fdd399d8e9a4a51a22c1b7afafba8ad5c77dfe05a4a85cdce4614d8fe1d2e56602bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\storage\default\https+++mail.google.com\idb\953658429glmaaviyle-ks-w.sqlite

Filesize
48KB

MD5
67d8b5ae45cf559e0bce871e7b28f7dd

SHA1
3b78c00bd8b58e0495befe1c55fd820c7f159111

SHA256
82f290530723dd5249f022c27bcc00e3e1f76fd72f63001788e85b1733850c11

SHA512
db8e763a2eb67934373b1c3a6be1760060b0a675d2843e3208cc7795e956c78e98957f53679789ab3b641aa1007e5b5d9733995d6ae1411cdd631a11fcbcaaad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
7.4MB

MD5
cbac693f875491f94a02d36eecc2c916

SHA1
b08a5dcb54c21de152e38dcb43d6a8b97622c1e5

SHA256
88bc040ea4844e136c56138eaca0753537f233cb64cd1a09347bc27922ef5385

SHA512
6fdefd01a6ed828cceff77890b64a6eba4b8b1c9ab8d4b2ca7f692956860c3dc88de74f53e8bd737da286dd30864024ad7d5bf420a5e748266ba9f8e43825c19

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
94B

MD5
0c011084c4087012e661d125fded8db1

SHA1
90417a85af1c07db16b1117c03e10e784d58be50

SHA256
9eb2896698b3574985dc2b14f04ae921dbc9401f692fa2b778fe1e3698516c61

SHA512
897f22007b2506b9eb76631425b99bc1e1e4409756ed4dcd61ff08b1ab9f7a3864b8db49b5a045cc6add671406b09b3dc72c021deffa0cb0379e7419d82e7ada

Download Submit
C:\Users\Admin\Documents\Apresentação 1.gif

Filesize
6.7MB

MD5
1977aad6659099f392393360765c3835

SHA1
66ca388129243c761494918230642d11d64d2c61

SHA256
fcc24fd5d9058a237b8fda64a278fde2d9919e5abb267a9394d0071d1c681174

SHA512
59f569bbe13c2a10b88f85622478c1d6512920bd0c72e5f46c54fe2514993e7c96b50be10b3c5d23214d7ece6e7e5268d15d33908b637f2f3177458e2399eb87

Download Submit
C:\Users\Admin\Documents\Oglobo.gif

Filesize
11.2MB

MD5
0e65487a52efb20c921e054c687215e6

SHA1
d2faeab0168fef0ece1facbccf219fc18bec8c14

SHA256
6dd67ab204ff6e9366937601ad01be122ddc2b54018d496b4f2b7465fac71454

SHA512
555170a4dceebf4be6010e07d4ab6809ee5ff79d1027ac73a3d1272357253ad354bc560e6facb881b781f4e0e6b7a5b5445956ae397e178bcb4ef9d3da276456

Download Submit
memory/1640-125-0x00007FF8A04E0000-0x00007FF8A04F0000-memory.dmp

Filesize
64KB

Download
memory/1640-134-0x00007FF89D750000-0x00007FF89D760000-memory.dmp

Filesize
64KB

Download
memory/1640-124-0x00007FF8A04E0000-0x00007FF8A04F0000-memory.dmp

Filesize
64KB

Download
memory/1640-123-0x00007FF8A04E0000-0x00007FF8A04F0000-memory.dmp

Filesize
64KB

Download
memory/1640-135-0x00007FF89D750000-0x00007FF89D760000-memory.dmp

Filesize
64KB

Download
memory/1640-122-0x00007FF8A04E0000-0x00007FF8A04F0000-memory.dmp

Filesize
64KB

Download
memory/4840-488-0x00007FF8B7BE0000-0x00007FF8B7E94000-memory.dmp

Filesize
2.7MB

Download
memory/4840-424-0x00007FF694A60000-0x00007FF694B58000-memory.dmp

Filesize
992KB

Download
memory/4840-425-0x00007FF8CFE60000-0x00007FF8CFE94000-memory.dmp

Filesize
208KB

Download
memory/4840-426-0x00007FF8B7BE0000-0x00007FF8B7E94000-memory.dmp

Filesize
2.7MB

Download
memory/4840-427-0x00007FF8D3460000-0x00007FF8D3478000-memory.dmp

Filesize
96KB

Download
memory/4840-428-0x00007FF8CFE40000-0x00007FF8CFE57000-memory.dmp

Filesize
92KB

Download
memory/4840-434-0x00007FF8CFAA0000-0x00007FF8CFAB1000-memory.dmp

Filesize
68KB

Download
memory/4840-435-0x00007FF8CF950000-0x00007FF8CF967000-memory.dmp

Filesize
92KB

Download
memory/4840-436-0x00007FF8CF1D0000-0x00007FF8CF1E1000-memory.dmp

Filesize
68KB

Download
memory/4840-437-0x00007FF8CEC50000-0x00007FF8CEC6D000-memory.dmp

Filesize
116KB

Download
memory/4840-490-0x00007FF8B6780000-0x00007FF8B782B000-memory.dmp

Filesize
16.7MB

Download
memory/4840-440-0x00007FF8CE980000-0x00007FF8CE9BF000-memory.dmp

Filesize
252KB

Download
memory/4840-486-0x00007FF8CFE60000-0x00007FF8CFE94000-memory.dmp

Filesize
208KB

Download
memory/4840-484-0x00007FF694A60000-0x00007FF694B58000-memory.dmp

Filesize
992KB

Download
memory/4840-471-0x00007FF8B7BE0000-0x00007FF8B7E94000-memory.dmp

Filesize
2.7MB

Download
memory/4840-438-0x00007FF8CEC30000-0x00007FF8CEC41000-memory.dmp

Filesize
68KB

Download
memory/4840-443-0x00007FF8C5490000-0x00007FF8C54A8000-memory.dmp

Filesize
96KB

Download
memory/4840-445-0x00007FF8C5470000-0x00007FF8C5487000-memory.dmp

Filesize
92KB

Download
memory/4840-444-0x00007FF8BE250000-0x00007FF8BE2B7000-memory.dmp

Filesize
412KB

Download
memory/4840-442-0x00007FF8CEC00000-0x00007FF8CEC21000-memory.dmp

Filesize
132KB

Download
memory/4840-441-0x00007FF8B6780000-0x00007FF8B782B000-memory.dmp

Filesize
16.7MB

Download
memory/4840-439-0x00007FF8B7830000-0x00007FF8B7A30000-memory.dmp

Filesize
2.0MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads