1bb662d598172326e5ddd54f879bae3a6fea58742af0f44bd3934003da625384

Resubmissions

05/10/2023, 14:00

231005-raznlsdd59 4

30/09/2023, 17:52

230930-wf1kbaga24 7

30/09/2023, 17:50

230930-went5aee6t 7

30/09/2023, 17:07

230930-vmytmaeb71 3

Analysis

max time kernel
186s
max time network
193s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
05/10/2023, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loader.bin.exe
Size

5.7MB
MD5

fd2d84bee10bbccb7b590e1025752873
SHA1

c0fbb34903a19dcf4591ba7f88c3995d183fefe8
SHA256

1bb662d598172326e5ddd54f879bae3a6fea58742af0f44bd3934003da625384
SHA512

87ed02ad109845b34f8f70237a2e3a51f607dac89e795f1c3b5fad019630c2a2756c2be51c7f25e04c2d4246b68803ef2b43c002155a3d660a2f66911c891add
SSDEEP

98304:3453W8vYIC+RgZkKIXfEIeYUAlLc3A6fv4i/NTJVLpxrOw1xitse3Jk9yfPDnmY:o53W83p5XfEI5WNn4QNtVLXrOw2TSsfS

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	firefox.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4720	firefox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	taskmgr.exe
Token: SeSystemProfilePrivilege	3740	taskmgr.exe
Token: SeCreateGlobalPrivilege	3740	taskmgr.exe
Token: 33	3740	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3740	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	5076	WMIC.exe
Token: SeSecurityPrivilege	5076	WMIC.exe
Token: SeTakeOwnershipPrivilege	5076	WMIC.exe
Token: SeLoadDriverPrivilege	5076	WMIC.exe
Token: SeSystemProfilePrivilege	5076	WMIC.exe
Token: SeSystemtimePrivilege	5076	WMIC.exe
Token: SeProfSingleProcessPrivilege	5076	WMIC.exe
Token: SeIncBasePriorityPrivilege	5076	WMIC.exe
Token: SeCreatePagefilePrivilege	5076	WMIC.exe
Token: SeBackupPrivilege	5076	WMIC.exe
Token: SeRestorePrivilege	5076	WMIC.exe
Token: SeShutdownPrivilege	5076	WMIC.exe
Token: SeDebugPrivilege	5076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5076	WMIC.exe
Token: SeRemoteShutdownPrivilege	5076	WMIC.exe
Token: SeUndockPrivilege	5076	WMIC.exe
Token: SeManageVolumePrivilege	5076	WMIC.exe
Token: 33	5076	WMIC.exe
Token: 34	5076	WMIC.exe
Token: 35	5076	WMIC.exe
Token: 36	5076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5076	WMIC.exe
Token: SeSecurityPrivilege	5076	WMIC.exe
Token: SeTakeOwnershipPrivilege	5076	WMIC.exe
Token: SeLoadDriverPrivilege	5076	WMIC.exe
Token: SeSystemProfilePrivilege	5076	WMIC.exe
Token: SeSystemtimePrivilege	5076	WMIC.exe
Token: SeProfSingleProcessPrivilege	5076	WMIC.exe
Token: SeIncBasePriorityPrivilege	5076	WMIC.exe
Token: SeCreatePagefilePrivilege	5076	WMIC.exe
Token: SeBackupPrivilege	5076	WMIC.exe
Token: SeRestorePrivilege	5076	WMIC.exe
Token: SeShutdownPrivilege	5076	WMIC.exe
Token: SeDebugPrivilege	5076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5076	WMIC.exe
Token: SeRemoteShutdownPrivilege	5076	WMIC.exe
Token: SeUndockPrivilege	5076	WMIC.exe
Token: SeManageVolumePrivilege	5076	WMIC.exe
Token: 33	5076	WMIC.exe
Token: 34	5076	WMIC.exe
Token: 35	5076	WMIC.exe
Token: 36	5076	WMIC.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
3740	taskmgr.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4108	loader.bin.exe
504	loader.bin.exe
2100	loader.bin.exe
3784	loader.bin.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 1580	3784	loader.bin.exe	84
PID 3784 wrote to memory of 1580	3784	loader.bin.exe	84
PID 1580 wrote to memory of 5076	1580	cmd.exe	85
PID 1580 wrote to memory of 5076	1580	cmd.exe	85
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4568 wrote to memory of 4720	4568	firefox.exe	88
PID 4720 wrote to memory of 5028	4720	firefox.exe	89
PID 4720 wrote to memory of 5028	4720	firefox.exe	89
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90
PID 4720 wrote to memory of 4492	4720	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\loader.bin.exe
"C:\Users\Admin\AppData\Local\Temp\loader.bin.exe"
1⤵
PID:604

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4832

C:\Users\Admin\Desktop\loader.bin.exe
"C:\Users\Admin\Desktop\loader.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4108

C:\Users\Admin\Desktop\loader.bin.exe
"C:\Users\Admin\Desktop\loader.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:504

C:\Users\Admin\Desktop\loader.bin.exe
"C:\Users\Admin\Desktop\loader.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Users\Admin\Desktop\loader.bin.exe
"C:\Users\Admin\Desktop\loader.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get product
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get product
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.0.333074557\452708190" -parentBuildID 20221007134813 -prefsHandle 1568 -prefMapHandle 1564 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24ae1f4d-90b8-4f9f-b3b5-d3c9372e2a9f} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 1780 289ee7b8e58 gpu
    3⤵
    PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.1.770101320\1535598105" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 21017 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea2aff44-7fd8-40a7-9b6a-b8b503fa41cd} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 2136 289e3672258 socket
    3⤵
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.2.140697307\975031730" -childID 1 -isForBrowser -prefsHandle 3156 -prefMapHandle 3032 -prefsLen 21055 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3664fe5f-d5af-4122-bef7-174c6b98db1c} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 2984 289f29a8858 tab
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.3.1782477283\400519915" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0581d6ca-6c12-460a-9c39-04ec6e70c0f3} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 3580 289e362de58 tab
    3⤵
    PID:4544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.4.1066572040\1593011010" -childID 3 -isForBrowser -prefsHandle 3896 -prefMapHandle 3892 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {054c4e21-952f-452d-87b2-64b9b8347c4a} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 3908 289f3b5f158 tab
    3⤵
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.5.78940448\2117571988" -childID 4 -isForBrowser -prefsHandle 4828 -prefMapHandle 4824 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08c0a7b1-4ac5-4f95-a609-43b2e384cb40} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4836 289f311a258 tab
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.7.708504043\791134907" -childID 6 -isForBrowser -prefsHandle 5064 -prefMapHandle 5068 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7627a10b-9fc0-4281-960d-f9eeaea0bf02} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4836 289f311ab58 tab
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.6.756979274\705324982" -childID 5 -isForBrowser -prefsHandle 4872 -prefMapHandle 4876 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c75ba5b-e7f0-4f9a-ac4d-04cf43661315} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4864 289f3119f58 tab
    3⤵
    PID:4152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.8.1989517852\1169654643" -childID 7 -isForBrowser -prefsHandle 4472 -prefMapHandle 2744 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a86cd114-58c3-4df3-aed6-d4df0f55913d} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5560 289f6a6cb58 tab
    3⤵
    PID:380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.9.476449308\1351644229" -childID 8 -isForBrowser -prefsHandle 6024 -prefMapHandle 5960 -prefsLen 26795 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd3ef041-9563-4af2-a14c-8727760ad17f} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 6032 289f8309c58 tab
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.10.1566903441\422304107" -childID 9 -isForBrowser -prefsHandle 5576 -prefMapHandle 5580 -prefsLen 26795 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {372cc80a-f867-40eb-ac94-7e4ab798d9e8} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5916 289f8308458 tab
    3⤵
    PID:1928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.11.1595206710\1649267220" -childID 10 -isForBrowser -prefsHandle 3720 -prefMapHandle 4016 -prefsLen 26874 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {421fa195-b26e-4c84-bf03-c41f95b5c88f} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4020 289f1137358 tab
    3⤵
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.12.1446599376\767251076" -childID 11 -isForBrowser -prefsHandle 5832 -prefMapHandle 3964 -prefsLen 28071 -prefMapSize 232675 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3630e324-a880-41e7-9caf-81a68bbe82ee} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5072 289f6032858 tab
    3⤵
    PID:5372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
cb4fce223c352f64993c5c13db3bb126

SHA1
05ace76b8dd945ad2032af86af3fccf01f183a8c

SHA256
95ec10d5be003b1415035509a807aa22a5dee07830ecaf6b76a94cace5218f21

SHA512
d1db3ed0bff4436c7717d3df8b329bb3fda2e0a72602bb6a15f5b847eded79a4779f4bb040ba78df17ac7a26f4a382ce100801e582bc827c9c34840eba087a29

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\doomed\10674

Filesize
13KB

MD5
34174ca25c91370829f7ad52ec7f3b35

SHA1
6eb22c06978adaaed5ed9f890c287d920271136f

SHA256
0ca842a414adfe2185616b0555edb273ae1b877dccfa1b72e77d2df99d77e447

SHA512
a26f1ea347229e443593217ddc7f8a48eacdf4776691699394264332dc8cb62a53947a99f00b16743784a30df4ca3507ad4f06b386b1262773552e6fa0b3ca0d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\doomed\17002

Filesize
42KB

MD5
ce1ba2c2a32298c421801a4ae6961054

SHA1
6a76abf05ad0a7cf5bd98bfd4d8b87440afd6b5f

SHA256
de0402a3d53c01b824c1a0fbd2fdcb3435193db5bed55a369dd94b70d6c2b4dc

SHA512
3ef2a431c875cf71de2830e88bfe8fea51595b91541ce9e1583a2b22d9902b3a612d43004b6d986f2fc017a866f66cb8c16ddf98c8508928cb01a9f830553d40

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\doomed\18338

Filesize
17KB

MD5
9751c8e74c61f0ac8667d89664e90a0d

SHA1
125acc9d4bbe8b116eca84ad0503966f8fc586bf

SHA256
c0f5efbfb278a54117e1a3e57477360c665bae874fed20365802b6d9f997cd05

SHA512
d4861848a0e1b1dbdfd1ed28ebe5b8f81baa67679eb747449d478bbd74207e767e9ab958e9b8fcd2e8e1f4dff38ece9c896a4eb6e7ac2e5a5856ed5bc4b2566c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\doomed\18663

Filesize
7KB

MD5
87421cf00d498be00c7df5904d8ed3bb

SHA1
5ff8b387d07b477b5998dfd15949f0f6e06bf26e

SHA256
df6e04dd0bab9976cc690447e7bd856c044f125ccb0a06d3d5789a0ca67650b8

SHA512
f223f9376c6c4f5d5358c70139e0225c82f52094e60f64efaada98eac220a1b495c30dbe879b7a36306a155ff324b39c12c3cfc6e030c1f214c5e3032c8f2df6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\doomed\31183

Filesize
12KB

MD5
8daa869ed737b01846e258cc525f72bc

SHA1
a894ccfb2c49c6afb4ca96d5864490dbdeb9b0dc

SHA256
2e5c8c25ce4641a5ccc4f318a6213b2ce26a3575d1756cd8ed2ebf55cf16b258

SHA512
7d9c904fd3c4d8a6d5beef9d04c2c918cec32acc2abe5968de9baa89ca9db708085e82b71eec47bdbb92f2aabced0f1082bd210fd6760cfc9f43f78592a2b627

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\doomed\6446

Filesize
18KB

MD5
8b5b35f99a7ff3d273cdf67fa1829c5f

SHA1
981d60fb3f7eb44006434b88448351ce49ef6cf1

SHA256
2820879931186f2d2a12fe07b359f1f7a5877f1d9a9a1d8773c3a68398a956ac

SHA512
1fd58819c34644c7ee6a7c5ce6107b3a0fe93302d75a6692fb710a26db35e95a9644ff3ff09715f899b4d9a1aa80b6e1293bdbdfc02fc489ea06774e237f2522

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\doomed\9907

Filesize
7KB

MD5
2e9efa65d62e5f17be7e819da4af294f

SHA1
b58692a543ad9deec0a27fda1373162b33773e0d

SHA256
d52fc5811eb5c949297dd38fc37bd8fafd2fe9e427c76d2f091d9b96cb221529

SHA512
6ca0721b6ee28be880f29882f9ba3aa3d5f7578ebdc0fd0de44ecfdc4449bfdfe561da29c4499c89ce0e58becf96aca42119759c35366c5fca3e94c4e06b744f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\entries\3D1339565A2C7A95B097D97B7372A0877F72E01E

Filesize
80KB

MD5
e9fb0f869454919396f22f8fcc5552be

SHA1
e9bb2c6477949e0067153114ffe5a2cc62ec1d66

SHA256
2b6801a7b95736ec3a92a70dc7c73f8670350bc826b276ddf9ff19392e7c61b3

SHA512
97e8d0c85ec145e738a5660b0450c2cfdf27ca1c70329c5073b466e96957949a350dc23d3b6ba7ebfba4f07b9be71e6d04d313183327b03aa6e2bea09acce1d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rlkz7qab.default-release\cache2\entries\CE9903153881889FBA1A382605EA6F5F0772B30B

Filesize
194KB

MD5
ff6416f6390ce88ea3cdd3abfa4064db

SHA1
0490e6f2cacf8573d91743e451db5830aab212f4

SHA256
24e63566e286b2629445a50d7e84b7a6590e904b40b077e727401c2cc57e37df

SHA512
d104739b1981f569bcc8e6f129e85dbbb5e3ccf207f46a2e5905169acbbef1bb17a3c3fe413f1e960552a490ea85cd848e7fb12cc7a995ca91e5deece1ade6c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\prefs-1.js

Filesize
7KB

MD5
e5e57cae45a3d4afa12dd49b118a51fb

SHA1
c8a88ac8a23307d761b3d33536c94308cff1c567

SHA256
21e4adc82730ff2a0799c377e633319e83f9c6128e7af4120c354fdf4c053791

SHA512
acb6fd76250b7c62bc4de0a69af00532d643531084535655259d073f442b3a4823f3e5486a69d54a66d9441f8f9f5d81497b7256cc5816b29ab8e786a8ad9dc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\prefs-1.js

Filesize
6KB

MD5
d07879e488278a85bd54f0c2c4b46791

SHA1
d766fb56002810f82ef0aad289961d9bac6f2f69

SHA256
0b84683b79d1af922f2f69bfc6377cf597f75a7c7fe6fbf2c1941177b986f127

SHA512
88d79d3cc3182dd37aafce43b32938ad0f176415617b3697ca4ac24c2f40cbc2d24a1f81bff2e51775719306ded4c372606a1cde0230fa1ad7de5b8c84f1921b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\prefs-1.js

Filesize
7KB

MD5
2f690cb12fd5d0b77d03e3894ae04148

SHA1
471237af7fab49d65fd75201939e10fdc872800e

SHA256
53cbfa4a97d145ac182fcbb30fd0904e0f93f9f5030e558714de0d88b16cbe0e

SHA512
87b7c19c4769ae55b80a4020316b41ebfceb51d90eb35f413e8f0b3914e904017d5091b06c45f0e8231114d29f02c1d5943e1fe74c519eb2974b0b6263f24269

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
7d63c82d651cb503a46ef7e5c900d3e4

SHA1
e2d0d09b74d1b700eea509793c48479db5a84cee

SHA256
6536f0278bfe680674c2f16c798f0aaecbca0d785858dee79e19a378303fe18b

SHA512
5e999de251a41faa75334747d9076ec381761f46f1bf92dcbe836e7881d604ab6d0809db7d7f5ef39f5b1b70e915222b33fb8e3b1c5d81a0b3775d10d54d59e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
de933979fe1b6d454e92b4edcd44d416

SHA1
b059c4723d809997790da87b93fbfed2c03c45eb

SHA256
dd52bed70bf61233801f20bc3796170da24355d94c1a42654c2f7cbf026ec32a

SHA512
12d93cf71d508ba05541cc0397aacc68c9b2128f51b203a23438fdbac0b72514d5d6472fe49aff9bf8a3ea26312509d21d9b98aa6da3d5dd7dab1fac1d8d75e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
23KB

MD5
1ed15efe3ec8f42da74689e1c34e90ef

SHA1
f09362c5777630789fac4fd3f76a302177447faf

SHA256
ad441a3752f081c11873897efacafc6b1adf3cf1eab93504058e4ec9fd475dc5

SHA512
cadc27fe8a22ce4b858b18788dffa0f6ab5792c28175b713270faad1eeb65cd5cc898378a5f5e104d21a4824fe447ee57e50aa7a1a05dd23ca897deb50b770a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
ec9b1fec9bc8e60a4fe7137183f99f65

SHA1
26dc589866e9c477e2c9f5efd8745a1f4430a9fd

SHA256
433c8bc207ce60f0b265ae0c1f1ddc3a4aa73f1e1d885829cb342a36e21bc3aa

SHA512
998c0c6258a0d20ccec4987072029b5b9dd2ab51c00ea9c6780f2d10cc541bd149768caa0184c676692f5662ba7ad4b3a92af7c2134991b28c4e9fabdf337c4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a7d99ee7ab4eeb8fadcd712502b3f8f6

SHA1
591f2017ea0c8b3eea126e94b21eb0e43d461a07

SHA256
60f05383db05bcc3a32c10befadacd3f2508927d6d5454fd1b7b839c962d64aa

SHA512
e21424c6f6442421a03ea1400b9f238816e4b7a5d024161dde9579adae03d233aa30e3f62a9cad0e368d6c3352723f6ddf25a6269689f473570bc75cb4db896f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
66KB

MD5
cc44c7d83602b9c61eaca90855c5467d

SHA1
da1b7b69af7556cc51c0ed7b4b4026407d424265

SHA256
81d91018782ddab940298bb1cb350e83d9d22fb3dde63f60b4fc9ab0d44939f2

SHA512
e9fd722a223c2ca669c1299d20434dd0eb332b1e910d4a7076788b15d933b2d13d6f7c39e5d679e0937b620f82fb8a96e0ad4cac24036a776d201c26146f4d62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
6ca94d50ce4bc7f6cfecca93ab22dfe3

SHA1
18857d64d99f307e54619b721ecc6b2493f740f5

SHA256
0ea8e5df4fe3350700d90809cc834ef5ec0684e76f979762b07ec7f2531861da

SHA512
db2221e9710b32c8b7b2107091eb6039adac8679d90c6f4bf36a14951ff93cf5e8f46c1576e1150c1a1a084c4cf32f4d91392279a0e1b5c95293df11aa00528a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
b3e635ddf1eefd266e9dddbdab644c8a

SHA1
0e16559f1c4d28f9ff863b64e9cbfff04987b5da

SHA256
5c51069b68ab58c17eeb918899c1954e8ade2de96dd403771d9cbe0f16191dd6

SHA512
7a1fee3d5229fe1cb2e0af49dd1e9a0768890e961370d8d86e0558ecd3d8e33869ee39f91c41d2bc9057c14c169b88b9b195781f25eb6f190c19f238f395b98a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
25KB

MD5
80dfed9f2ce400844a52a8345b617786

SHA1
d2c9f19181a1e64f35dd9bb4f33e823cf2544826

SHA256
d2a50fb983e775c5b5b4adfcb3934465c607fe6242c19af40d37c12b611f7aed

SHA512
7f9a9c3dfc569513027bfd4748a587e5d5f42700da0dbe2dc7a8ae5971df9dded8982efabc823eaa87885ee755bacc56f456444c449d9f60f2c1baf712a5ff0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\storage\default\https+++www.virustotal.com\cache\morgue\189\{0d947042-cc90-4b83-b325-424b5b5d35bd}.final

Filesize
45KB

MD5
f678b4d734cc8ade6d9d796c8a9202b5

SHA1
3b14da9e5462a089e16776294e012e22e703440f

SHA256
7c46eae379d1fdfa1933319cdf74f687c3547fe0dddde5e8198e500926b9cbcd

SHA512
5d6a08a725063d1d6a78d028dd1c2ffa6ca6b1f4e1c7112a9c674c95ea8bdbefbfeab41bd37369d54ac0b1e7aa876bd51b114fc997424c780308fb78d6116bf1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rlkz7qab.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0f97521924f68ef5a424a0f036449be9

SHA1
f4f817b35ea3f42eca21db7770e40e9c2054e782

SHA256
f3f306d21ed645b1a357e3cc88d53d602e9f52ed50e2f7e87594b09eb05ebb81

SHA512
0082f7fc1a35ea8ec80b5148660e5f409cba0af32b6e06c50d78c76a1201249aedba01aa2acefc33f671a0922cde7af19768635046fa63a122aaec542c04d7bc

Download Submit
memory/3784-5-0x0000000002080000-0x0000000002180000-memory.dmp

Filesize
1024KB

Download