nitro | b346bd42d2892de01d3d271994d425617e4712c5d08a8637046f1406ab6f1ba1

Analysis

max time kernel
322s
max time network
317s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
19-05-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Text Document.txt
Size

45B
MD5

23a1a78d0b5351de1748875c282f8496
SHA1

ac6bfb0816ab0e6fa0195fce7d3d3fd4362715eb
SHA256

b346bd42d2892de01d3d271994d425617e4712c5d08a8637046f1406ab6f1ba1
SHA512

46d46751ee80eaa6f12e5ffd410e6687f54354cd23a947597e6a38daf1e67e545d517dc1114cbdc6c5a0d8e6a03beb0c67e2598126a413b8cbb0b7ea4a4c1ca0

Score

10^/10

nitro persistence ransomware spyware stealer

Malware Config

Signatures

Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
ransomware nitro
Renames multiple (76) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
2012	winrar-x64-701.exe
212	winrar-x64-701.exe
1424	Msi.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Msi.exe\""	Msi.exe

Drops desktop.ini file(s) 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\Pictures\desktop.ini	Msi.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Msi.exe
File created	C:\Users\Admin\Documents\desktop.ini	Msi.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Msi.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Msi.exe
File created	C:\Users\Admin\Desktop\desktop.ini	Msi.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
123	discord.com
125	discord.com
137	discord.com
150	discord.com
151	discord.com
126	discord.com
127	discord.com
128	discord.com
135	discord.com
138	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
121	api.ipify.org
122	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png"	Msi.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\19-05-2024_M7LTf6GHV14Jgch.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1424	Msi.exe
1424	Msi.exe
1424	Msi.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
6064	7zFM.exe
1724	mmc.exe
5424	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeRestorePrivilege	6064	7zFM.exe
Token: 35	6064	7zFM.exe
Token: SeSecurityPrivilege	6064	7zFM.exe
Token: SeDebugPrivilege	1424	Msi.exe
Token: SeIncreaseQuotaPrivilege	4352	WMIC.exe
Token: SeSecurityPrivilege	4352	WMIC.exe
Token: SeTakeOwnershipPrivilege	4352	WMIC.exe
Token: SeLoadDriverPrivilege	4352	WMIC.exe
Token: SeSystemProfilePrivilege	4352	WMIC.exe
Token: SeSystemtimePrivilege	4352	WMIC.exe
Token: SeProfSingleProcessPrivilege	4352	WMIC.exe
Token: SeIncBasePriorityPrivilege	4352	WMIC.exe
Token: SeCreatePagefilePrivilege	4352	WMIC.exe
Token: SeBackupPrivilege	4352	WMIC.exe
Token: SeRestorePrivilege	4352	WMIC.exe
Token: SeShutdownPrivilege	4352	WMIC.exe
Token: SeDebugPrivilege	4352	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4352	WMIC.exe
Token: SeRemoteShutdownPrivilege	4352	WMIC.exe
Token: SeUndockPrivilege	4352	WMIC.exe
Token: SeManageVolumePrivilege	4352	WMIC.exe
Token: 33	4352	WMIC.exe
Token: 34	4352	WMIC.exe
Token: 35	4352	WMIC.exe
Token: 36	4352	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4352	WMIC.exe
Token: SeSecurityPrivilege	4352	WMIC.exe
Token: SeTakeOwnershipPrivilege	4352	WMIC.exe
Token: SeLoadDriverPrivilege	4352	WMIC.exe
Token: SeSystemProfilePrivilege	4352	WMIC.exe
Token: SeSystemtimePrivilege	4352	WMIC.exe
Token: SeProfSingleProcessPrivilege	4352	WMIC.exe
Token: SeIncBasePriorityPrivilege	4352	WMIC.exe
Token: SeCreatePagefilePrivilege	4352	WMIC.exe
Token: SeBackupPrivilege	4352	WMIC.exe
Token: SeRestorePrivilege	4352	WMIC.exe
Token: SeShutdownPrivilege	4352	WMIC.exe
Token: SeDebugPrivilege	4352	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4352	WMIC.exe
Token: SeRemoteShutdownPrivilege	4352	WMIC.exe
Token: SeUndockPrivilege	4352	WMIC.exe
Token: SeManageVolumePrivilege	4352	WMIC.exe
Token: 33	4352	WMIC.exe
Token: 34	4352	WMIC.exe
Token: 35	4352	WMIC.exe
Token: 36	4352	WMIC.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	5424	taskmgr.exe
Token: SeSystemProfilePrivilege	5424	taskmgr.exe
Token: SeCreateGlobalPrivilege	5424	taskmgr.exe
Token: 33	1724	mmc.exe
Token: SeIncBasePriorityPrivilege	1724	mmc.exe
Token: 33	1724	mmc.exe
Token: SeIncBasePriorityPrivilege	1724	mmc.exe
Token: 33	1724	mmc.exe
Token: SeIncBasePriorityPrivilege	1724	mmc.exe
Token: 33	1724	mmc.exe
Token: SeIncBasePriorityPrivilege	1724	mmc.exe
Token: 33	1724	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
1768	NOTEPAD.EXE
6064	7zFM.exe
6064	7zFM.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
1724	mmc.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
2012	winrar-x64-701.exe
2012	winrar-x64-701.exe
2012	winrar-x64-701.exe
212	winrar-x64-701.exe
212	winrar-x64-701.exe
212	winrar-x64-701.exe
1724	mmc.exe
1724	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4616 wrote to memory of 4076	4616	firefox.exe	75
PID 4076 wrote to memory of 1288	4076	firefox.exe	76
PID 4076 wrote to memory of 1288	4076	firefox.exe	76
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 3672	4076	firefox.exe	77
PID 4076 wrote to memory of 4528	4076	firefox.exe	78
PID 4076 wrote to memory of 4528	4076	firefox.exe	78
PID 4076 wrote to memory of 4528	4076	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1768

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.0.1160958465\370023748" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1664 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f15ec618-65ff-4c30-86a2-f2a1657d447e} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 1780 11bfe2c1758 gpu
    3⤵
    PID:1288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.1.1726025653\723482923" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f98be75-b90b-497e-8843-a9383d508c8c} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 2136 11bfdc30e58 socket
    3⤵
    PID:3672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.2.1720586197\473179196" -childID 1 -isForBrowser -prefsHandle 2784 -prefMapHandle 2904 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {42773373-a29e-42f5-875e-7dd84404d8f7} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 2940 11b8a199a58 tab
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.3.199665412\1836256870" -childID 2 -isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {46f4ff2a-5501-46d0-abbc-4461ab59fdb7} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 3440 11b886ed758 tab
    3⤵
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.4.1181040475\2143778191" -childID 3 -isForBrowser -prefsHandle 4428 -prefMapHandle 4424 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b7d2797-5e60-4ea2-90ea-85f9f2a3105e} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 4440 11b8c19b258 tab
    3⤵
    PID:3172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.5.351015529\1799132490" -childID 4 -isForBrowser -prefsHandle 4764 -prefMapHandle 4796 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c276efdb-1136-4a96-b77f-fdfae6426dae} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 2584 11b8cd92258 tab
    3⤵
    PID:536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.6.1010450465\1230299136" -childID 5 -isForBrowser -prefsHandle 4948 -prefMapHandle 4952 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fbe2d8f-d7a9-4f8e-b2a7-46af417de496} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 4940 11b8cd90458 tab
    3⤵
    PID:996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.7.80542592\1295314055" -childID 6 -isForBrowser -prefsHandle 5144 -prefMapHandle 5140 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e43cade6-d7bc-4d97-9397-d52672df4262} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 5128 11b8cd90d58 tab
    3⤵
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.8.249371534\1034951191" -childID 7 -isForBrowser -prefsHandle 3084 -prefMapHandle 5216 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f267b106-60cb-4b2a-9c5c-b69f7be45d41} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 4712 11b8a19a958 tab
    3⤵
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.9.447585350\1646246483" -childID 8 -isForBrowser -prefsHandle 5756 -prefMapHandle 5572 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fe9c812-0492-49e3-81d5-66236690d2f6} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 5784 11b8e693258 tab
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.10.1371829047\943127233" -childID 9 -isForBrowser -prefsHandle 5936 -prefMapHandle 5940 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e9109c8-ea64-4a5b-ab35-aee52f516d1b} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 5928 11b8ea5c358 tab
    3⤵
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.11.2147130093\70742252" -childID 10 -isForBrowser -prefsHandle 6132 -prefMapHandle 6136 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd5c33ab-8f1a-4031-bd9c-6311d4c4432b} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 6120 11b8add8858 tab
    3⤵
    PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.12.2140538956\661241746" -childID 11 -isForBrowser -prefsHandle 6524 -prefMapHandle 3076 -prefsLen 26543 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c235ec4-3de3-4f9b-8ea7-b02a653a5e47} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 3048 11b8a19af58 tab
    3⤵
    PID:5668
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.13.1557297732\689331735" -childID 12 -isForBrowser -prefsHandle 4988 -prefMapHandle 4484 -prefsLen 26873 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2735d30-b8b7-4838-8729-a7a143194fa5} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 4540 11b8bd70b58 tab
    3⤵
    PID:2164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.14.170043966\266664161" -childID 13 -isForBrowser -prefsHandle 6004 -prefMapHandle 3440 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6cd8524-ade1-409f-91d6-48709c2f589d} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 6300 11b8d9aac58 tab
    3⤵
    PID:2360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.15.171973448\716406373" -childID 14 -isForBrowser -prefsHandle 6220 -prefMapHandle 6216 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0f7bc3a-f620-45dd-b8c4-331ca31097c6} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 5656 11b8d9e1858 tab
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4076.16.506051620\1835209659" -childID 15 -isForBrowser -prefsHandle 5916 -prefMapHandle 6212 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da30e8e8-e55c-44c2-a7f4-fa3eeb273ad9} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" 6256 11b886b2c58 tab
    3⤵
    PID:5540

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\ed2ea6ee540d4507a0c48daebc594f63 /t 5200 /p 2012
1⤵
PID:4088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5768

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:212

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4b040b22958c4f4bb17c5e7126258b99 /t 5816 /p 212
1⤵
PID:5976

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\19-05-2024_M7LTf6GHV14Jgch.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6064

C:\Users\Admin\Desktop\Msi.exe
"C:\Users\Admin\Desktop\Msi.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4352

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5424

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\79B0DDE3FA8DCB1BD2B4CA2ED3EB8F3088226A6C

Filesize
412KB

MD5
6bccad312b04497d142bd9b58c0123dc

SHA1
db1b516d2f3e3f1dd876d98e7dff69465fefd811

SHA256
4580ba118456ed73c36124fa7bd627672a4f13bcfe17b908ad882633cafb8c59

SHA512
f713270ac8b6d16ad7a5e61221dc0e4d0c0287eaa714e0a8887d4a61a5b023f564fcac837cc78be61e3d1a66ea7b9203fdd8ccbec873715cedef726add388074

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\D9CDCD14623DDC7510DF95F6F21DE65AD2FA14F3

Filesize
214KB

MD5
cd10dc7fadcefbba98bc596df6f9f9a4

SHA1
33961a11dec6fe3a63107fdf740c7549462022f7

SHA256
5e1e66ac43565130a1102065b36a5ec2627100a64f87fd057fe5ffd6bcc3780e

SHA512
90eca2a20de203a48a82b722dd1aca069c0faabef667d8cfe01a3f994f84fc00ac22b87fb31c1a8bb70c8facf4eee1f9105937229f988ff15bf9aa9f3e853aff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\thumbnails\23a1a78d0b5351de1748875c282f8496.png

Filesize
6KB

MD5
bc00d2303074920f9f8c226c31ffbb10

SHA1
0281b0ce1fa1caf59a4ce017be0ba8dd6c39ef66

SHA256
79646b7a2c95339048d6f7fece1714967f9897928e785f7d596a8c2b9628f99e

SHA512
79ba3c14fdec69826b8f73d1f1a97fe80de8b462142cecd7c367b914569abcd1215c273c06538867e1e71ebe04da9d0c0ff8f8adf68edbff88a719507a7e24da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
9635c55eb0a1a31d8c30d004b91c3d85

SHA1
72a26dcccb90e21aee220acb1f79417720e9145f

SHA256
8b43e1ae75385f7314b231b01fa40274ac25d66819b8cadf9887622ee3ed7677

SHA512
ff1bfca554b83c5aafd23451dc1292914bcd2616dbbf408f1152fb42fea7dade1259c20607466dff3306e74cc562726f202e9b68fe9327e0cdbcfd42e4942340

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
73ebd4b7048cfb906f87a6a27ca164f6

SHA1
78d631124c89988abf907a1ac009a7bc0f6d3d26

SHA256
00a00a57dc95aeef6abb656b9ccce17c788842ea1fb1475b0db380b5b0edebab

SHA512
e3286f0fe9ac0b6c403a242109e4c31d9506076e071feec6bdc0f10837f2c5de65288a4a821d1fcfce6660981c090f40e4fb9b92d0072dafff95dbbff0e3ebe8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\81b3beb0-9e45-4ed2-946a-f9e48b7d035f

Filesize
746B

MD5
244289069e2bf7c4709b177bec8c1307

SHA1
3e826ea5671c5e2ab8422623a3430beb1e7a8988

SHA256
a6b42ea54ffe09e8e2f0e04a4dabad98fc8ebfc4b0f26ccbdad9165fd3235a35

SHA512
55bed54a7050552ff19a9d41eab6d44c88f3bc5b288c5d2c28669b7de5e67b3b091487b0be88dc560885066ffd6f8aad57840769ab15bc6421e0a4b2b1d50ea3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\c2d1bc5e-e601-41a3-be6a-fcc63333ab2f

Filesize
10KB

MD5
1a088f8c1c7da47d3222a42a37d2ab41

SHA1
1d79e66058f53e20d4d0bab19e255491e31f4a0f

SHA256
f3986bb00cda30cc7ade14c7aaf432796217a534b0a4f9a79eb2b04212fd6fdd

SHA512
7f80e843467f969fe9536e2743046e7936f0b21bbab00a56f97d73faabe7a66dfb7520c733be0fc4aca6fca6a968b023b63ecc3812862f71a447936784690a06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
f36ca69d1db0d0807e81f902e362aca3

SHA1
cfa06a718d47b9ce6344ca949bcd94633042f5ec

SHA256
675ff1825faaac5e7d8a375ee9d70a68e1099a05ecd331eac5280ac2c4db37c5

SHA512
5e31ef862cecb32d79d5f2130b6d954368725be4efe7a39cd10d23970430cc23814779229955129d02764efd3e38078f995ad91dac8bcc131344262bd07090d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
061b55750257052522b2198825f590fb

SHA1
b1c703acafd229b036b4b61394560f4249667a61

SHA256
e2b614b21dc794790375557e22ce82e7b0e8c3be1d003a3fa76045116837b418

SHA512
0e242e7bc4753b927b087463992023491834a33948f4fc185bf02a52d2b7031e547105b4a35e835d3b5369e1f04179c5c758c1e181a94471da3b84d0c78aa5e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js

Filesize
6KB

MD5
8a43e3aee21f57172fac983737a04376

SHA1
6113a436d107d4fcc0478ff13ed8d8f248ddf7a0

SHA256
7051cea2a4ebbd8e731ac2a9f245380670324348ddb947cf231830e0d959220d

SHA512
f0c03554975df3f124523df17a7668e778f8ad2c093204a980495fd21437f7405abfec74a29821759fa35510402875b03e07a5d40ecbfcccbb59350e22756831

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js

Filesize
6KB

MD5
f18ef3942b10ecd8bd05244b5e0e05a9

SHA1
506fc7e8a8893335c28c463b305cccf320c2c3de

SHA256
c7b956ed8e8fc77f2707d31d4e38f96cbf8cebd228810c5441d6a868c8dc89bf

SHA512
450671fc2f525fada8c8eebf6456ba18826f03cb1745c7a03b2bc6216d74615dd1096c0beb81b77163fc90cbccf5d4f9d9bdbaced70288eb8406370a3a2f9c81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
570b5df53ef35f82fe23dd27dc34157f

SHA1
0747c3154a8617c607479680326288187dd66e16

SHA256
b4d8d3ec7da79a625f9c5d0facfee8e2a4354b5f2aca570acb645dc69be48ea4

SHA512
c4d43ed66443d31330f6c4e7039210a7f23e38968d8edd344f51497210523fcf2d6ce32af9e4989501e20e8bc26f90b895bd0b59657373b0803c94f87b91aaed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
e74d500d043021370a8f544aa72ac41a

SHA1
71087a397d7aa0c9ba63fc0056d1a38bb8634886

SHA256
efd0fb8fe435ab1d7d7d74ea326db5623424bc5cade42398a92d99e5a16f7210

SHA512
fd3f375d913d9e67c2fe8519d456c93f2a163ab08b3524b78eb15599089f627a33255ec958d539d538db2b33a67b266741b8691e71e25b75934c962f37f9e568

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3f1aadd296ac263e85cb15db4f010abc

SHA1
ca5fd89b99544bd74a4157c5091fcc92d029f176

SHA256
316dc19fc7a52aabe0b7750096b2ebe7587fb52f70a2d08452c66047abb5c017

SHA512
2dab6e0ffb273114a81cc554662c64ffeb25dc4a3b0707fc4d2a6ee78720ec8494777dcce077728e094b94c1bb3b21cb8dbe4906bc1b47a34c9887f5e58e3999

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
5cd70d21f5aa70bedc4eb1c4d05407bf

SHA1
e850fa21adb643113fcfccce238bcc37baefe934

SHA256
9f46451b1bf46f3c91616dafe16a5f4dad5dbd3e9b879817775db2f4cff16612

SHA512
f71568ae64996aae194859b4c1268ba7f94c5b9efd7488ffdb1f9b536243c98bd8ce5a7d97d024bca7feac1d543da466e6bc0603614618feda69adb66fafd102

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
fb312cf9fcaf88943e524c5664bee692

SHA1
7d7921ce98ad2ae20c6436ff03f25bf6d5909efc

SHA256
5b0fbc2f9eec86b56593ffe60030783a1e2a07e61a2ccf740ae8d69914d714e6

SHA512
372c5a9a78432819b627783cd57f938f44d7c7d52c13e747f57de6ab985fd5b6a91ec989fbafe441883916fc0f2bd6b3750f03caf87a1ebef510225408a1d94f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
8adc5d27c353a8f3336f9932aa945698

SHA1
c9344718cef33af9c50237828c89d3b2a3306ce8

SHA256
700c79c272b9dc1073711b99372b5b091b440235368348cbb3b6fbc4014a9357

SHA512
fa52fe177b98e5688bbf8258e96b23dacd0ff0a5f1a8b9b6080f6b551754323e04252e6c88b7d979dab52d6f8f95a450eb29978c744b03ec82759357f2bdb10f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
76193e9ba6f6af9e454de3e3d3e57f24

SHA1
12a5ba74612416adf65ec8521c567e28655953d7

SHA256
667ede53ceaf470f4a2d2e6dbcd88b98079636d718d5e64e8f01f96516309ccb

SHA512
91fb7379ef403bfb0ebd5cee33e1b9728aa6fb57be7c9e013da1285ea698d4898798524024dcea3c62bf8539a401503afdac646da7a77df8d149d40a03e88533

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
bb4692e0667c9173e45165921a10a4e9

SHA1
167f1d7c9d9d0e922f6fb6a6423b120e8e63bcd6

SHA256
6ccc57425af5a8b8e710056599292588e702af59e4c982d30e8526c77ca99429

SHA512
3ad733258a4c3e702d466bb8d04fe1b140aad93ce1ff809413dd2b8ac16f4681b6bcb9fc306ca89a25c83b39bd3c9641f4c081b6f587cffb23239a539f943a06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
6331f5d74d021c968c4a42105c96e9d9

SHA1
a7f8d0c972b8bbcc82a6a73916eb4285e72bc50b

SHA256
be8e82bd2767a92e1f4814e52ca82baf34a3e9de918834ff9ff81203bbdfb305

SHA512
8af44324505a7bf78488cc2cc345baca920aaa0b031772a854c255603260db3ba1aa6676b6581af28e9c35a60edfe9e8899ad8eee7283a357581c379bd55fc54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
99e2fefce5d807d5abf43216f9c1a31d

SHA1
54ca1f68df82d1622abc1abcc25ea440daf94cc7

SHA256
a3cc30b560bebfc24e0f9db61f0ae3a11b823d4ccc793faf621794e7a4ffa0a6

SHA512
deb1ffe269b56e1237ba63485277d4903a28e566b0b7ac5c9ded99083c7ec4cac2991056490c1717164b68cb702b434464d790bbe93d1c0160c4057940668d97

Download Submit
C:\Users\Admin\Desktop\Msi.exe

Filesize
61KB

MD5
40275c0688b75036545aaf92509906fd

SHA1
9e55b69bfd0120e5bdb90b3ac41c0ae70a692105

SHA256
23be32b33c90d78f59cee0106c85c6ccef2949ce2382ed0282a5ea7b4a25e8a7

SHA512
56d8711393e7d2319e7561adf61d0c00959a4f84dadf5c18f7419e2d06f1330818b371ab1e1f0d1779c8fa3813a57f40676539d8ffff6e8c4e868426ffb79778

Download Submit
C:\Users\Admin\Downloads\LxqjvFgc.rar.part

Filesize
24KB

MD5
efe2f1578c6779d4daba80cba0b9dd9d

SHA1
5ff1bec7115c0a91193ae0c43d3ac6d84e489e37

SHA256
8e6d12932b06191809b1fbda068c7b5fe1158b2307a91ba62ffa4d1d61f86abd

SHA512
2b49e3a2e8a55f6d80773a32f9b127ec93e835f83cf4aa6f2aef2d893ee6757e405ee19c8999e6028173182a869da8da8784071ffeaf609d4f90872617554f02

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.T8f0jVwZ.exe.part

Filesize
15KB

MD5
0768b4e647494f8879e68a78aceec69a

SHA1
ee903db50a63f52087d5cbdf10964e63d9ebd4b1

SHA256
b6c766647c4117e535b85d668da78bfd39e05350ae8582321090684b3ef00be3

SHA512
7f6e0fa7c95f9010566476495c46d6f814c4ec4e9c068ce27ba9244fe833ee001ad507f0ae34a67f6347779033d5ca85698d370d0dc6b7b06f0c74f5c4e380cf

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
memory/1424-490-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/1424-392-0x0000000005380000-0x0000000005412000-memory.dmp

Filesize
584KB

Download
memory/1424-391-0x00000000057E0000-0x0000000005CDE000-memory.dmp

Filesize
5.0MB

Download
memory/1424-390-0x00000000009B0000-0x00000000009C6000-memory.dmp

Filesize
88KB

Download