7c743696036e554e095a5b00c44ee873004567457082e02a9099d000a4d829e5

Analysis

max time kernel
402s
max time network
404s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HDD Regenerator 2011.exe
Size 6.5MB
Sample240302-vt7ecafg75
SHA256 08d95e46cac1a5e1ecd1db39127a01f6351016bc24d11e2c3d6fddd7e0b78183
MD5 c2a112ee6b86cb98b0bfbd6ae2f8fd06
SHA1 b396891d09416fc58930193dc594ed774d8f17f7
SHA512 638ea573d48aeacccb80ed8cb00475ad336a6b522235418ddb2e3637458119dc2c0d3420e11c410f6c74cbc22a7d721f4f68333da405e0884f8a0a0b1b340ede
SSDEEP 98304:IEyiP7N0bjKAyu4vjMplwU+Xzrism4CHhp+DqfE+40XmjV4XqTz1ThtjqFGqW+UW:I4BGmAyXixJpdosBXuSXS1TGFojjM/lj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6056	HDD Regenerator 2011.exe
5372	HDD Regenerator.exe
6040	Shell.exe

Loads dropped DLL 6 IoCs

pid	Process
4472	MsiExec.exe
3344	MsiExec.exe
5372	HDD Regenerator.exe
5372	HDD Regenerator.exe
6040	Shell.exe
6040	Shell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HDD Regenerator = "C:\\Program Files (x86)\\HDD Regenerator\\HDD Regenerator.exe"	HDD Regenerator.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
30	3464	MSIEXEC.EXE

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\D:	HDD Regenerator.exe
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\F:	HDD Regenerator.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	HDD Regenerator.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cc32100mt.dll	msiexec.exe
File created	C:\Windows\SysWOW64\borlndmm.dll	msiexec.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HDD Regenerator\DSCK.TR	msiexec.exe
File created	C:\Program Files (x86)\HDD Regenerator\License.txt	msiexec.exe
File created	C:\Program Files (x86)\HDD Regenerator\Purchase.exe	msiexec.exe
File created	C:\Program Files (x86)\HDD Regenerator\HDD Regenerator.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\HDD Regenerator\st	HDD Regenerator.exe
File created	C:\Program Files (x86)\HDD Regenerator\Readme.txt	msiexec.exe
File created	C:\Program Files (x86)\HDD Regenerator\st	msiexec.exe
File created	C:\Program Files (x86)\HDD Regenerator\Shell.exe	msiexec.exe
File created	C:\Program Files (x86)\HDD Regenerator\hddreg.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\HDD Regenerator\HDDSTAT\QM00013.SMART	HDD Regenerator.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e599810.msi	msiexec.exe
File created	C:\Windows\Installer\e599811.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{97A39919-9FEA-48B7-AB2B-4F99212D1E98}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\eSellerateControl365.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{97A39919-9FEA-48B7-AB2B-4F99212D1E98}\NewShortcut1_FB676352466A4802A7022492F2B13128.exe	msiexec.exe
File created	C:\Windows\Installer\e599813.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599811.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF038.tmp	msiexec.exe
File created	C:\Windows\Installer\{97A39919-9FEA-48B7-AB2B-4F99212D1E98}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{97A39919-9FEA-48B7-AB2B-4F99212D1E98}\NewShortcut11_0C92ED961D01429CA2B693185F14AB88.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{97A39919-9FEA-48B7-AB2B-4F99212D1E98}\NewShortcut11_0C92ED961D01429CA2B693185F14AB88.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{97A39919-9FEA-48B7-AB2B-4F99212D1E98}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{97A39919-9FEA-48B7-AB2B-4F99212D1E98}\NewShortcut1_FB676352466A4802A7022492F2B13128.exe	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\ProductName = "HDD Regenerator"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Downloaded Installations\\{5153A73C-CEE4-41F1-A222-8C9F3736F38D}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365\ = "eSeller Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40A9417F-F41E-40A2-BAA5-FE0ACB1CF8F8}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\91993A79AEF97B84BAB2F49912D2E189\AlwaysInstall	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\SourceList\PackageName = "HDD Regenerator.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365.1\CLSID\ = "{C915F573-4C11-4968-9080-29E611FDBE9F}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{40A9417F-F41E-40A2-BAA5-FE0ACB1CF8F8}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{40A9417F-F41E-40A2-BAA5-FE0ACB1CF8F8}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\Programmable\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\ = "eSeller Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365.1\ = "eSeller Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\91993A79AEF97B84BAB2F49912D2E189	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\PackageCode = "C37A35154EEC1F142A22C8F973633FD8"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\TypeLib\ = "{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\ProgID\ = "eSellerateControl.365.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365\CLSID\ = "{C915F573-4C11-4968-9080-29E611FDBE9F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40A9417F-F41E-40A2-BAA5-FE0ACB1CF8F8}\TypeLib\ = "{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\ProductIcon = "C:\\Windows\\Installer\\{97A39919-9FEA-48B7-AB2B-4F99212D1E98}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Downloaded Installations\\{5153A73C-CEE4-41F1-A222-8C9F3736F38D}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eSellerateControl.365\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40A9417F-F41E-40A2-BAA5-FE0ACB1CF8F8}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40A9417F-F41E-40A2-BAA5-FE0ACB1CF8F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\36EB8DED78653F64290EE86C78113865\91993A79AEF97B84BAB2F49912D2E189	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\InprocServer32\ = "C:\\Windows\\eSellerateControl365.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\ProgID	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C915F573-4C11-4968-9080-29E611FDBE9F}\InprocServer32\InprocServer32 = 6c007a005b00670058005e003800570047003f003900460038003f005900280070006300740058003e0078006800470039006e003900470065005300390029005f0069006a00510058005e0052002600380000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\ = "eSellerateControl 3.6.5 Library"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\HELPDIR\ = "C:\\Windows\\\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91993A79AEF97B84BAB2F49912D2E189\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{169FBBF8-0478-42A4-B386-4F5B2CF9A98B}\1.0\0\win32\ = "C:\\Windows\\ESELLE~1.DLL"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\HDD Regenerator 2011.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1200	msiexec.exe
1200	msiexec.exe
1200	msiexec.exe
1200	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3464	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	3464	MSIEXEC.EXE
Token: SeSecurityPrivilege	1200	msiexec.exe
Token: SeCreateTokenPrivilege	3464	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	3464	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	3464	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	3464	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	3464	MSIEXEC.EXE
Token: SeTcbPrivilege	3464	MSIEXEC.EXE
Token: SeSecurityPrivilege	3464	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	3464	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	3464	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	3464	MSIEXEC.EXE
Token: SeSystemtimePrivilege	3464	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	3464	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	3464	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	3464	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	3464	MSIEXEC.EXE
Token: SeBackupPrivilege	3464	MSIEXEC.EXE
Token: SeRestorePrivilege	3464	MSIEXEC.EXE
Token: SeShutdownPrivilege	3464	MSIEXEC.EXE
Token: SeDebugPrivilege	3464	MSIEXEC.EXE
Token: SeAuditPrivilege	3464	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	3464	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	3464	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	3464	MSIEXEC.EXE
Token: SeUndockPrivilege	3464	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	3464	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	3464	MSIEXEC.EXE
Token: SeManageVolumePrivilege	3464	MSIEXEC.EXE
Token: SeImpersonatePrivilege	3464	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	3464	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	3464	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	3464	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	3464	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	3464	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	3464	MSIEXEC.EXE
Token: SeTcbPrivilege	3464	MSIEXEC.EXE
Token: SeSecurityPrivilege	3464	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	3464	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	3464	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	3464	MSIEXEC.EXE
Token: SeSystemtimePrivilege	3464	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	3464	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	3464	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	3464	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	3464	MSIEXEC.EXE
Token: SeBackupPrivilege	3464	MSIEXEC.EXE
Token: SeRestorePrivilege	3464	MSIEXEC.EXE
Token: SeShutdownPrivilege	3464	MSIEXEC.EXE
Token: SeDebugPrivilege	3464	MSIEXEC.EXE
Token: SeAuditPrivilege	3464	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	3464	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	3464	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	3464	MSIEXEC.EXE
Token: SeUndockPrivilege	3464	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	3464	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	3464	MSIEXEC.EXE
Token: SeManageVolumePrivilege	3464	MSIEXEC.EXE
Token: SeImpersonatePrivilege	3464	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	3464	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	3464	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	3464	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	3464	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
3464	MSIEXEC.EXE
3464	MSIEXEC.EXE
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe
2384	7zG.exe
2788	MSIEXEC.EXE
2788	MSIEXEC.EXE
5372	HDD Regenerator.exe
5372	HDD Regenerator.exe
5372	HDD Regenerator.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe
5372	HDD Regenerator.exe
5372	HDD Regenerator.exe
5372	HDD Regenerator.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3464	4256	HDD Regenerator 2011.exe	98
PID 4256 wrote to memory of 3464	4256	HDD Regenerator 2011.exe	98
PID 4256 wrote to memory of 3464	4256	HDD Regenerator 2011.exe	98
PID 1200 wrote to memory of 4472	1200	msiexec.exe	101
PID 1200 wrote to memory of 4472	1200	msiexec.exe	101
PID 1200 wrote to memory of 4472	1200	msiexec.exe	101
PID 1200 wrote to memory of 1856	1200	msiexec.exe	113
PID 1200 wrote to memory of 1856	1200	msiexec.exe	113
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3024 wrote to memory of 3128	3024	firefox.exe	117
PID 3128 wrote to memory of 4400	3128	firefox.exe	118
PID 3128 wrote to memory of 4400	3128	firefox.exe	118
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119
PID 3128 wrote to memory of 2524	3128	firefox.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\HDD Regenerator 2011.exe
"C:\Users\Admin\AppData\Local\Temp\HDD Regenerator 2011.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{5153A73C-CEE4-41F1-A222-8C9F3736F38D}\HDD Regenerator.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="HDD Regenerator 2011.exe"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3464

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 49C0FCA234F6579C575C24357DDE2648 C
  2⤵
  - Loads dropped DLL
  PID:4472
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E310E8F96EAB711E83E6F3A3A1EDE8F7 C
  2⤵
  - Loads dropped DLL
  PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:64

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.0.1392842222\1721249269" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e29e37a7-7d49-4d55-9e7e-265f0cecdb87} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 1980 1e4fe3d7d58 gpu
    3⤵
    PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.1.1024748615\1168357038" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0aed12af-94f0-429b-817f-1078f294cd32} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 2380 1e4fe30a258 socket
    3⤵
    PID:2524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.2.1147650575\1863790657" -childID 1 -isForBrowser -prefsHandle 3368 -prefMapHandle 3364 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39f949b4-faf1-4ca7-a203-e0d7c5c6f8dc} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 3376 1e484f9db58 tab
    3⤵
    PID:1960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.3.1252470409\1106676902" -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {356f014d-45eb-43d3-8292-0eb5b14f21c5} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 3684 1e4855bb558 tab
    3⤵
    PID:616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.4.1613014232\1167303064" -childID 3 -isForBrowser -prefsHandle 3964 -prefMapHandle 3960 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {859c0965-559f-4fda-b91b-fce5347f6eda} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 3952 1e483807658 tab
    3⤵
    PID:4412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.5.1944918615\635798910" -childID 4 -isForBrowser -prefsHandle 5116 -prefMapHandle 5100 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b41b477-cc8d-4fb0-abde-bdf928a5df76} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5076 1e4855b8e58 tab
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.6.1983889693\1368163854" -childID 5 -isForBrowser -prefsHandle 5124 -prefMapHandle 5128 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d8001f7-ef07-4316-82e1-6184febf1751} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5064 1e487599458 tab
    3⤵
    PID:5676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.7.1745730687\2130125389" -childID 6 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb02da3d-a443-4c9a-a575-9afdd39195a1} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5312 1e48759a358 tab
    3⤵
    PID:5684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.8.968928108\1528009108" -childID 7 -isForBrowser -prefsHandle 5672 -prefMapHandle 3304 -prefsLen 26550 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e87ae8e5-a327-4d4c-ab57-4ca92916a741} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5684 1e4871e4c58 tab
    3⤵
    PID:5756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5648

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\HDD Regenerator 2011\" -spe -an -ai#7zMap7878:102:7zEvent11583
1⤵
- Suspicious use of FindShellTrayWindow
PID:2384

C:\Users\Admin\Downloads\HDD Regenerator 2011\HDD Regenerator 2011.exe
"C:\Users\Admin\Downloads\HDD Regenerator 2011\HDD Regenerator 2011.exe"
1⤵
- Executes dropped EXE
PID:6056
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{5153A73C-CEE4-41F1-A222-8C9F3736F38D}\HDD Regenerator.msi" SETUPEXEDIR="C:\Users\Admin\Downloads\HDD Regenerator 2011" SETUPEXENAME="HDD Regenerator 2011.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:2788

C:\Program Files (x86)\HDD Regenerator\HDD Regenerator.exe
"C:\Program Files (x86)\HDD Regenerator\HDD Regenerator.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5372

C:\Program Files (x86)\HDD Regenerator\Shell.exe
"C:\Program Files (x86)\HDD Regenerator\Shell.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599812.rbs

Path C:\Config.Msi\e599812.rbs
Size 16KB
SHA256 ffa4fe7fe7fba6ee18f7ac49a7fc89f8af2988c3919112735b83bc794bdc1085
MD5 e3066a0e172ba99f6f58c95627ec5143
SHA1 76cf8f48e968f4f2105e8274523e7cdd35fd4801
SHA512 a1e5701f20fbfd1ccbf772fa7fbed328a2364d153a739d684cdb21d1928f09c64fb74313ae0a0e100ed4ff5d137d8018684d45f9158e3f5074b9382511ea6057
SSDEEP 192:NxXq189UBW7Pf5xfgnrCH3gbe0HvwMdDXr6IPMdDXr6CWHyGmp1dDXGNdDXF:NxWW/yFHoMd7ZMd7N1XdgdV
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDD Regenerator.exe

Path C:\Program Files (x86)\HDD Regenerator\HDD Regenerator.exe
Size 4.1MB
SHA256 79ced6d8c45567923b13ef115a4523895b0226a6c9c208812edb8ca6320f8d81
MD5 1e3a00b0e80446ef495b499fd43379b0
SHA1 243d5daf8a509c43f59711c02311ad9b6f6b7e30
SHA512 8e5a97f370867d301a30e04e6b475aa9e0705582fefd29a7d686bfcfd18d753783497528a00f9f7d264769a6a9ba89ab572e6f889bdb446d4fa2c3b07ef2b19e
SSDEEP 24576:eGN0E3l1cCgbBrXThXYGBiFTwtS8ViVrMdrflfBLSVYVpZxUEoHORW9lvC0D:L3AbiiTVSCNz8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shell.exe

Path C:\Program Files (x86)\HDD Regenerator\Shell.exe
Size 799KB
SHA256 a98c63c4e6330816ada51a2070cc0aaec07d2c439e34d8862ce7a31edc0469ec
MD5 39d56f273b87387a36c9e64086e215a8
SHA1 bacd4194b7836a9f7b2c203fb486ceb9ca561676
SHA512 66942fd72cbbca41c2a28a7600e6ffb8fc04f46d107e0ca73115c603b1a8717fb14446cc527bfd23ec15f448b0df23e090c219a3eee93c5bf91b5ce5522309c9
SSDEEP 12288:zpB+hx7w4LjeUTmcW8928BXSWM+YY+ShTONXf9HjMJOfL+AiEsK888888888888o:07wMeUT/WwBXSWM+YY+ShTOZiOvspBLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shell.exe

Path C:\Program Files (x86)\HDD Regenerator\Shell.exe
Size 156KB
SHA256 208498b1fcccb8e6e38203241194325af01ba705c70ad17246e47583d77e6fec
MD5 b4c336f1613fd5c9be9b9df7bd54c766
SHA1 8b9aa736e4ead5a09c87834ec2bec6f41418e5b5
SHA512 2c8fed0aa816bcae1a0191bb5197b1d2da807e7eba4446420c995fcea94059f7b362e51fc358dd2f9a126d7aba6afe63620ce82c10ef86507a96f6715c58c544
SSDEEP 3072:zkMYhblYB+3kpa+9kLeo1iMpCeftiAHLjeMxr/0Wz5RpGV:zgbiB+pLxEu/Y4LjeMxrTQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shell.exe

Path C:\Program Files (x86)\HDD Regenerator\Shell.exe
Size 51KB
SHA256 c1e53fd9b244607ffb7f158a4897699d832920db87f2adfb08823889999f9d4b
MD5 b94ed2372f5c69902d290581b735567e
SHA1 6a28c1edd7c7336a4b635f678a0df2c1302a580f
SHA512 2faadcc98d8a823ee090a9a8e7e0e06e02e331afd1e252d19d72d51cfb6316c609e006db70f4dfa7f696e4ea945aec8b7fce991e414d007611cac281532ac6e9
SSDEEP 768:5yDnWkVVRAx92hblzUyDLYB+Up8zipKFeAn2P1eCgq9ti+Nlj:5YWkjRAxYhblYB+HsKFeA2P1Lz9ti+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

B90B117906B8A74C79D1BC450C2B94B1_06FCBA75457E8A37375276D2E16B0870

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_06FCBA75457E8A37375276D2E16B0870
Size 1KB
SHA256 8ed95c5cf2b09394dad58e06ed4447941ba27c96106853ef50b8a78d3e4d92bd
MD5 db02087fd093207b89ebf24e9944daea
SHA1 c95aefa224d819cbefa89e5a883e94afb0c20fcc
SHA512 6c5a1df42b8f73412ca4acc9427c03881c2b135511ca7130d40b7c52087f70a228d00d7dfad3fcd607b695aa418394a80bba04c6124c0a8c791990fe880435ad
MD5 SHA1 SHA512

Submit Download

B90B117906B8A74C79D1BC450C2B94B1_06FCBA75457E8A37375276D2E16B0870

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_06FCBA75457E8A37375276D2E16B0870
Size 494B
SHA256 edd568ce3a8ec208e4b1f46df32d4e2688c9b1765220b8e93c3d9d0dd3facb8c
MD5 711585012b67bdb11a7b24c8952ad357
SHA1 1704824dd942433c6d45b3103bb8b68691af47f8
SHA512 20e3402bb183ec4eca7bf3fb163a893b704129ec57f1dd974f01dbcbe6832ec5dd53865d9466ece6290f6b1a422f4a7ea5ab29c8bb9e153e894db4c5deb5c3fa
MD5 SHA1 SHA512

Submit Download

HDD Regenerator.msi

Path C:\Users\Admin\AppData\Local\Downloaded Installations\{5153A73C-CEE4-41F1-A222-8C9F3736F38D}\HDD Regenerator.msi
Size 5.4MB
SHA256 c4bc18b4c0526b219a4303d70a536de1f0a8831b6a21b40f8c83ab5fbdb40d1b
MD5 dcfed4dd4c027c08e43d442349cbde61
SHA1 d8e668c5f71b9e88ac87df48188f690aee910cb5
SHA512 21883f9b72fabfaa1a3f55bc4c73a20cc4afaede1e42d5c4b8837025e71390479838c3c51d89b29661c1ec48668bc3fd231e0bdfea6171e036d7ff03aa5a935d
SSDEEP 98304:RYy3beIkGAs21h1mx6kRo9NkawyKX+wvokCK5W3sSM7HbOPEAsQ5j6Gf4FyWs9/B:SMAX1hYsGo9aMKBCK5W3sJb4sJG59J
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDD Regenerator.msi

Path C:\Users\Admin\AppData\Local\Downloaded Installations\{5153A73C-CEE4-41F1-A222-8C9F3736F38D}\HDD Regenerator.msi
Size 6.3MB
SHA256 46ec8aa252338d576b15fa191245a61892e1d95cd959173c386be34120a955d5
MD5 38f53db4059ed882bbf08e78450186bf
SHA1 30766d0f58edd6cc24bdfd1845b8a7d810f1082c
SHA512 69157ecc3660e81e3d82de6abca2471b0cc045bd11b1de7b85034faf7d9e8cd7af367ef47eeaf437536034dcc22f6e68409a0f552f33642fc791f5edf6405f72
SSDEEP 196608:SMAX1hYsGo9aMKBCK5W3sJb4sJG595wK0no:J+TYhitY5WCbcVwZno
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDD Regenerator.msi

Path C:\Users\Admin\AppData\Local\Downloaded Installations\{5153A73C-CEE4-41F1-A222-8C9F3736F38D}\HDD Regenerator.msi
Size 4.3MB
SHA256 9751702184a0da3e61ce36dc4524de326e41b35a5dd0f566ce996e0d75b3c3fe
MD5 2889e04aeadc949e0cc86171d04abbf8
SHA1 daaa9034c7cc6a7ed23f735309c19cfd4dd21638
SHA512 557c9f63ef3211715a95aaa66336249772b4132d02127bcf4e5e743462961fa060989d80c10437b12ad08be560e7599cfb0544d3551022f9e85a680cfc4fc581
SSDEEP 98304:RYy3beIkGAs21h1mx6kRo9NkawyKX+wvokCK5W3sSM7HbOPEAsQh:SMAX1hYsGo9aMKBCK5W3sJb4ss
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI1F4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1F4B.tmp
Size 97KB
SHA256 2ac85d37dcace83fe72f960bac4ba4dfcac65ded2242c63261d227c9a7a22e4d
MD5 30c906ddc7aee8899414f98fe9034132
SHA1 171f5d3379779ee165b4ef614638b75cf44f29a8
SHA512 b2eadc0ac2d4c0c8787e6aeafb526b6e8a96e987b5bd22b5bae5fc932b0a9ea05a929fa807f48a8929b7c00184601c5d73afbe5971295f1fc373178f583f5754
SSDEEP 1536:UVgNTb67hb2MwFTKySgE6bSKycfyc/jVdATF+1o:pb67hvw++SKycfyc/jVds
MD5 SHA1 SHA512 SSDEEP

Submit Download

_is476.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is476.tmp
Size 1KB
SHA256 4f016a224471e92021534a362d93862cdf6b5ca5508c713ac85525fe23fd5b7f
MD5 5269a443cbead67c36e4f6f4de3cbe76
SHA1 5b029bf05ee1be05f5af36d9dc8588dde29c3925
SHA512 3deeed4a17fb40a5b932622d146539791e0b8e9cad588a4e4ef21ce4266d37314a091bff3a11d6303e99d5c26803bc8616273041c1e1f2a72e24c30d08d7f250
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{8A65D863-5513-447F-BE55-09804474CF3A}\0x0409.ini
Size 13KB
SHA256 bad3b2e854149df9413f06e6c1c7b7c875545393877f59b59907f6b083ce5825
MD5 758747727e96a23c7c5a5bbb011656e4
SHA1 51cc637e7eb3451d6dfa9465d949d6dfb2cd65c9
SHA512 21ff9d365beb1b7809b89d540f41bf330515f05f6211c8327be43baf1f050e46ecc1654b0696e7c82a2a803267e38d780ffd83dea7448861f6e3b84838685627
SSDEEP 192:4QGTmyunVn//BTelD/SQI1xVwCtH8LXAd2k9Kf61Ua:PGTmyuV//BTED/9Ad77Ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.INI

Path C:\Users\Admin\AppData\Local\Temp\{8A65D863-5513-447F-BE55-09804474CF3A}\Setup.INI
Size 2KB
SHA256 d58ee55c472a3a22882cfc52ed1e02877c123b7dfb398240811e6b9eef5bf325
MD5 87dd0fc1d5c5f47b978b9037d7ea106e
SHA1 f662a453f4de04edf130bd5eeaf4b6941ebd716d
SHA512 205b4d12aa42458a2c83580c5d8d14f28b5e59c30f714a0966bdfafe8b4dd4384ab1df4f018ded2a3cea8fbc1af8a3a3a600f0f1a067c7c3070c721ad1bdc0ec
MD5 SHA1 SHA512

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{8A65D863-5513-447F-BE55-09804474CF3A}\_ISMSIDEL.INI
Size 210B
SHA256 eeb2a151634a652189fc8c80b0bb498b5f145bd0086f0184a0a6347f7ba1fea4
MD5 9381760e8e1b28690a0f1154bd4ac9a0
SHA1 d80dbef6b03b9b42cbd24c8390fa709f3ece2cb9
SHA512 e069cf850ac7156cf94e2f22993cde180484c07c17836bb8a8394010210d60fcb2047993fac60ce9dbf1531b823e13017adb1a70b738c04b4cbd85d40ed84ef8
MD5 SHA1 SHA512

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{8A65D863-5513-447F-BE55-09804474CF3A}\_ISMSIDEL.INI
Size 22B
SHA256 55fa3d1388e8f2da8e7a35a2e809ca5924077a3c40eaee561c1e3686809f63c2
MD5 8fef5f010ed3aaaf74d3214334be4088
SHA1 fa90e59e675de66d246d697a868edca1562f9d30
SHA512 c2a5ba5c311c016779a3024ae9600b29e718afe2b01103206bec72719b5e0e47bb1096cbd3b389b00a0705c565800a740a7003e4f8705e00fbfe0f2e2d3318d2
MD5 SHA1 SHA512

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 11KB
SHA256 3f2bf5e0fe86621eabc419932f8a8041ffa7dc48b4f6fd8bced966ffafb47d55
MD5 eb7356f8ea229425db59cdcca858205d
SHA1 bd29f7a75bd4ef822406f3bd5a6ed823e48e2cc7
SHA512 866e4477673e1327df1a35247c9f6397b18b4b591f9f694694a67cd853cc6a9967bbc5f013f3111d9206a691d4c82f8b8df1b9f547a639c51d31f1a549c516f4
SSDEEP 96:v2m0lm/BNjm/zPmLj+lCsWNPmNV+yvnR/8lvmuwj:+m4m5Zm/rm4fSmj/+Nmr
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 11KB
SHA256 539137b3fbc1b6fe75ae4bf96793982c9869b02760f7eda7e63386a5312cb36c
MD5 53ca1270b47a59c068c2ab8e0c600958
SHA1 0e29ae2441d038d63c29ba7befa6f577215fba81
SHA512 bd4e8a260e89a55a38b3c07eddcd6429d8ea32b6ed4188976df1d81b6fed351abde5478e56e05a15bc4bbc18e6d2c906bfbf156bb27f650c2aa2a0b5ec8c40a3
SSDEEP 96:vem0tm/BNrm/zElvmLj+SNElvmNV+M/Elvmuwj:WmMm5Jm/gNmENmYNmr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 d9256d380f78f1e459269ce7279b0f8909103a8a826a0a23b1efdbff246547e8
MD5 cd693bed032c43d0dbcb215e2dd2d1e5
SHA1 b9526dd26fb31f127a009b85108a7962530c5197
SHA512 8f48f84593cb87487f7a8af2bb32b919c4e7b9bf20e6456785742bb8bb0244fbd0c2f4a470250756acde2f7b488c3002a94785b78450b7972064f322a31db4b4
MD5 SHA1 SHA512

Submit Download

17433427-1a84-4d53-af12-a59169e04b79

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\17433427-1a84-4d53-af12-a59169e04b79
Size 746B
SHA256 0286524ecb9bc3563202c8c587b9d71282cefe39018c69912b8079e3ec99f5bd
MD5 76a378ea441abc244aaff3969d4ffe24
SHA1 8b2fda411e992d13ef3ba63d4bc2591ab94b3720
SHA512 8913ecc1d5fd76f8a05d0b55b6ec7e598d28b204e0bb209c73d90d81323a4e3a174ac9602ab1f5985ff87961430d019a14cea711498c7412693dbb5373eb7b04
MD5 SHA1 SHA512

Submit Download

603d884b-94ca-4630-8cac-86b34a21cf58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\603d884b-94ca-4630-8cac-86b34a21cf58
Size 10KB
SHA256 eab45956bde21dfbd958bf8a0947b63723408ec68ac8234a9e8a37e8259ad064
MD5 cda143dd9e6511d88dda06a5ad185cf0
SHA1 3bd25edfb4ea02a331341abc6839868dceeb936b
SHA512 36f376c1d950a40ab7fe383be20740ecbef3de4074d5f35c274a20bceb22548719615c632485020bc9a278586bb1aea407144b1d97514bc1c81a2d01497c6dc6
SSDEEP 192:8toWMd49mDIM7drmwYV1FB8xeAVBPKc4SWl7Jtr2MKQ2B89/UPvjwB6S7/NNB:8Ad1lyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 0a888227ff8d39e4484618423819aa01906d6b8a6d10ed452eba183dc2027070
MD5 d23ce36422f790783a57d48c55c06360
SHA1 038ad3ed84aee0dcfc40adf84012a692dfc3f839
SHA512 a2818d9a30605838afc8944c8da29a1a65c046623cc8c73792ebd8d74dcff746e554ed20c0972cc599a6aaddad5d28c432d91119d3add8645eac76034e86a0b6
SSDEEP 96:xHGg3EnUTeqGqpdIJSeOTzSdPXAnpjMwHhE2u5DtABw8H7kK:33EnIRpdIJSefPXshExXABw8HD
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 7KB
SHA256 b8e6790fd1ed0c8c759015d56ec75a6378968c51959ed3b0d85dffd50f3f9f5b
MD5 0926473f29702286d7698a06d250086c
SHA1 b782304a99f054e18a8a6fed401a6e91d0b8a82b
SHA512 18b9b692ac7f0d8201ff2371f849651e4cf5d6903bb5687519dc2449be748b9df99aea2f09e9b1a3f93678b8c6caf21abc161585a57184f3ecf13e220e9fb845
SSDEEP 96:xH5g3InUTBPqGqpdIJSeOTzSdPXAnpjMwHhE2u5Dt/Bw8H7kjGS:83InQCRpdIJSefPXshExX/Bw8H0
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 379c0ca4f8853c4aea9e2e88114378a31e4130f065fa656b9ca2067916724c29
MD5 702b97bda3f81643b0376538d22b1639
SHA1 192c5f7f35919382d2f92d8ae0b0800567f17099
SHA512 e3891b5c9db2fb0d8a5cd0f1c25ed8cadda29396ee8711c2348a88bc4dc66259b9d411ae93015b8ac913945ce0223e18b6c819aa84283baffd47dc2cdb3cc6b4
SSDEEP 96:xHGg5nUTeqGqpdIbTeOTzSdPXAnpjBDHhE2u5DtABw8H7k/:35nIRpdIbTefPXyhExXABw8Hm
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 c2f07539de19f4cf63d170adebaff4af58728cf4a8890cab17d624e57c8c4690
MD5 f9801b11a7d62b23d386bcaebea69aaf
SHA1 33014f2789fc49ff6485d284f55032211748aef8
SHA512 ca3adc4d96d31af4506b2e979257c99d3e1ff4d7016c75c3fd7c67c324c70a924eff89bb5e79943d9b7a4f8a01cb476b4947f009f42b6a38318d9971df209669
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 05a013d13a9b908042e4d395a848f9f7610e778780d13ac78b8deb320b38d841
MD5 84ac7b48fccde5ba6a89c28903cffe37
SHA1 3cdff38d5c199d115a071579624049d3efcfae4f
SHA512 8da4cb710cee24f18ee7bc296f4809e2ae11d4b19b6b80ccb2e9924e4f4868c63f94e4d091ff8212fee11e64daa6ab876648717ed208fed7a757b1c6e5b91689
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 3f49848db19d780dc4ed9031f960034648236f1f1ca12526fd4f9af94d411fca
MD5 7039787b9d5882b4f7823f99ce77a880
SHA1 cf0ea736df7e0941989928d0781aa7779f4ed602
SHA512 3e8c5b4df551e926cd9223da9adfff56eb3147b05e1ec415d0eeecad3e12f9e39bc294bbefe4dc1429a4a634a982c49c92a9d4c3aae60a1912dfa5b9bee15450
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 e9ea0fddc7aeb97571ad145cdd168d1fcab171cbf976b09f471adab6251455e9
MD5 748654e61a0c25e7e93bf1cd8e4947b8
SHA1 d60392ec1cb6a3eeb9e6070dbb27214db389abae
SHA512 38d36d898cd3580bf8ad8de828df32f557a52300cd66ff1b66e44816b36618f5c0f58b5436b279c9a1b4ce4484ee9b724d765c50f8c990391f4055221f7cb878
MD5 SHA1 SHA512

Submit Download

HDD Regenerator 2011.dURPPlvC.rar.part

Path C:\Users\Admin\Downloads\HDD Regenerator 2011.dURPPlvC.rar.part
Size 2.3MB
SHA256 779a2119236f10592b12c131997425ab6198fefaa6bbfb56244083f0a143d32a
MD5 7c689e06427d35cdfc4ff723fb974764
SHA1 18a55f85c859ffecd70bc8652c6e133e450cd8c8
SHA512 24cd7ac1165c56ec9983f63b46505b98b712216c60918f253f3f0e27ea93fcf1700f7cf991f9aaa77e03587ab635b6f24b52d772849adeab11e4535d0a35a971
SSDEEP 49152:WZW04tR4z9xtkADfojeGDBR29kP1d+WVSr8:QWvoJxHD9GDBHX5VSg
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDD Regenerator 2011.rar

Path C:\Users\Admin\Downloads\HDD Regenerator 2011.rar
Size 6.7MB
SHA256 7c743696036e554e095a5b00c44ee873004567457082e02a9099d000a4d829e5
MD5 5144bad49b5c59a31c3c85bb582b843d
SHA1 39a5359d3e9ed000b7270891a73190fc37cbf1a7
SHA512 30b48b57428e73acbfec472eb8a21dca8055d21b2d62b84421efed2fab3d9f0282585081ecf9bc31f1d5a8c22d86318c31adec560c9e6d3ba524117e47983abd
SSDEEP 98304:QWvoJxHD9GDBHX5VSYzCrcuTYuCOXpjdANELYkQ/tDYxPlGRZSUw0H6QZcyJ6pvH:QWaBah54gClvRjACLM/tDWGZvwdoJ6F
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDD Regenerator 2011.exe

Path C:\Users\Admin\Downloads\HDD Regenerator 2011\HDD Regenerator 2011.exe
Size 3.5MB
SHA256 e5fc1c619cffcb8fb1c11272f479830fb33a54e248efe9e5d29bb771f0e94e15
MD5 3c41798a13c79ec644db1f0a323e6f47
SHA1 6d9720da560b8cdc804013bee4378818acb43912
SHA512 ac0fc910035e8c512d9d8ee623344c9846978ea79345dde204966d6ab6bf405a441ea9acbea0c3c4ee0129460ba342ed428e329992274fab95efaf48efd8a052
SSDEEP 98304:IEyiP7N0bjKAyu4vjMplwU+Xzrism4CHhp+DqfE+Z:I4BGmAyXixJpdosx
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDD Regenerator 2011.exe

Path C:\Users\Admin\Downloads\HDD Regenerator 2011\HDD Regenerator 2011.exe
Size 3.9MB
SHA256 b2a4c5cefb43d0e3811bbf998f63849778806f65100072b0efd2f771488927d0
MD5 dd504fc0894a6d4e82b5a5e8234e35d3
SHA1 5ed06e0974e9856b0e2cb24d69a0f8c687820cf2
SHA512 a41bc8473f31be87739f1f50d119e2eb3d7f4243eb9b613fa65a5689edd785d3bfedf541f157d98eca27a78df823e7957ae3640beedf4fd3bcbff727d5d18a93
SSDEEP 98304:IEyiP7N0bjKAyu4vjMplwU+Xzrism4CHhp+DqfE+40XmjV+:I4BGmAyXixJpdosBXuk
MD5 SHA1 SHA512 SSDEEP

Submit Download

borlndmm.dll

Path C:\Windows\SysWOW64\borlndmm.dll
Size 39KB
SHA256 bea67306dc7c419e2291a9647f3f103e3cbb12d6bd05e3b0a8088442602f9642
MD5 8ec7c166dd5a81b8889558459f4c990d
SHA1 f505368a17523f6fb5e208c97a6c4264d56e9ba6
SHA512 008c7f8af8e6eb1f0d4a894c6f67aa2eb63828c7e06e9349c95ec4e47fc402bb6858a3daf3122599b295dc3e5b45203b387d5d618ee2a3ceea9a227aee0f8376
SSDEEP 768:zl0/wxd/ija+1ICpBxbA+JYi1E8KbLb/ija+1ILfQDeIlhS:zlAwQXA+JYi1AbzpITS
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc32100mt.dll

Path C:\Windows\SysWOW64\cc32100mt.dll
Size 1.1MB
SHA256 d221da673572c2d0c8edc23de7dfeea3e6cd6e994427ae48565a16751a3871bc
MD5 1ec6fe4798163c9eab3bc7835fbf4f47
SHA1 98a866e8cd1668032709315998db64fae20b6690
SHA512 5afa699507a790d757d05b251126d2dbf83db7808242586dbfe5d4dabe4b6506f266622f9c36490dcf29d89d78e0b97c2d4b960017255608a2f86e98759a1a43
SSDEEP 24576:476TpkGU8Y5weSSoaX4ripuXQ9hlbyRTzhRaWnEZN1e6HfSDu/hwY:Eejxn6N1
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 17.2MB
SHA256 81e98c688c3ec04529dcf03f8162014d4a2186a2fe5379b37ae422a7671a5ba0
MD5 b78f127427e773bbc8dae559d3469154
SHA1 58918db5a37817ff4d6c0cf0824f70b266898f59
SHA512 dbfa335a2c96bef49df816ebdf4280d759e656efb783e4302af9b7f8fd3b34079d836d78b3da31ea9fc0bf6ed96d24d3d2934b139e1147ab1e290c9abf3eb67b
SSDEEP 12288:kBhSqm41rsCH9QlO/bLnIkjTomktwLoSICza4vXHsGk/XH2lz9H0yo9LCKivAp8b:ESqm41wCdoO/vvTLq++eJXGetdi5cQm
MD5 SHA1 SHA512 SSDEEP

Submit Download

{d84cd9e4-4d8b-43ff-b4ec-79f7d5916205}_OnDiskSnapshotProp

Path \??\Volume{d2bbef64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d84cd9e4-4d8b-43ff-b4ec-79f7d5916205}_OnDiskSnapshotProp
Size 6KB
SHA256 7503cd7b8c27b1cdfd5859fd078be9ad69d19787d729ec682f6d8df8caac18fa
MD5 477ba96b6262b59bd671f28d5432695a
SHA1 dafb54133e878f9b5d9190b221e9fb6902a44bac
SHA512 169b8c41d3ee2d9ba35c810b5c22ff03660c0014de0ee3929e953ed03493412979d829199e90c91da29a1ce0524fc5af59b53e1cec37d06e36469732ce0cc1e0
SSDEEP 96:FvH0Ad6DD84LTHzbOHXOHBlBRQ+8Sc9XE56tOSVQEJN:xIb++3VeN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5372-506-0x0000000021280000-0x0000000021293000-memory.dmp

Download

memory/5372-489-0x0000000021280000-0x0000000021293000-memory.dmp

Download

memory/5372-514-0x0000000021280000-0x0000000021293000-memory.dmp

Download

memory/5372-515-0x0000000032A00000-0x0000000032B26000-memory.dmp

Download

memory/5372-516-0x0000000021280000-0x0000000021293000-memory.dmp

Download

memory/5372-508-0x0000000021280000-0x0000000021293000-memory.dmp

Download

memory/5372-510-0x0000000021280000-0x0000000021293000-memory.dmp

Download

memory/5372-502-0x0000000003240000-0x0000000003241000-memory.dmp

Download

memory/5372-511-0x0000000032A00000-0x0000000032B26000-memory.dmp

Download

memory/5372-512-0x0000000021280000-0x0000000021293000-memory.dmp

Download

memory/5372-485-0x0000000003240000-0x0000000003241000-memory.dmp

Download

memory/5372-513-0x0000000032A00000-0x0000000032B26000-memory.dmp

Download

memory/5372-490-0x0000000032A00000-0x0000000032B26000-memory.dmp

Download

memory/6040-498-0x00000000026F0000-0x00000000026F1000-memory.dmp

Download

memory/6040-499-0x0000000000400000-0x00000000004D3000-memory.dmp

Download

memory/6040-500-0x0000000021280000-0x0000000021293000-memory.dmp

Download

memory/6040-501-0x0000000032A00000-0x0000000032B26000-memory.dmp

Download