af20e3fc55ebdfc15301d03ffde22f58be7efbfeedfdcb678be8e3740e8878f1

Analysis

max time kernel
657s
max time network
630s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

free-download.html
Size

72KB
MD5

012407d6d260eb06919f9b56f6f3f28f
SHA1

df320eea95d5d9b7cb707e74e42cd17760f5e66a
SHA256

af20e3fc55ebdfc15301d03ffde22f58be7efbfeedfdcb678be8e3740e8878f1
SHA512

b14f222f967c6249554f955c096e1fb8c7f38f1549082627c3b371a9b78d2f9c904e55a16ea9adfade97e326b9346f48b99a2191b04f8c6f64570ffd2536407f
SSDEEP

1536:UV8toKJvdkT4Enje564mv8ZwrgIQpjRBf6aY+6Ptt0rGxvQBZP:UaoKJW4Eje5o0ZYgIQVgxvQb

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\eventvwr.msc	mmc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\he.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	msiexec.exe
File created	C:\Program Files\7-Zip\History.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\el.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f78decb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f78decb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe
File opened for modification	C:\Windows\Installer\f78decc.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIDFB5.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f78decc.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File created	C:\Windows\Installer\f78df1a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3652	4040	WerFault.exe	64

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\PackageCode = "96F071321C0420722210000020000000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Program = "Complete"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000\96F071321C0420722210000010000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\PackageName = "7z2201-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\LanguageFiles = "Complete"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\ProductName = "7-Zip 22.01 (x64 edition)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Version = "369164288"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media	msiexec.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2201-x64.msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2201-x64(1).msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\2024-05-23_15_07_29.297_1.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
4040	XmlPad-Installer_273425.exe
3688	XmlPad-Installer_273425.exe
3860	XmlPad-Installer_273425.exe
3200	XmlPad-Installer_273425.exe
2328	XmlPad-Installer_273425.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1560	msiexec.exe
1560	msiexec.exe
4040	XmlPad-Installer_273425.exe
4040	XmlPad-Installer_273425.exe
4040	XmlPad-Installer_273425.exe
3688	XmlPad-Installer_273425.exe
3688	XmlPad-Installer_273425.exe
3688	XmlPad-Installer_273425.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3688	XmlPad-Installer_273425.exe
3820	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeShutdownPrivilege	2260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2260	msiexec.exe
Token: SeRestorePrivilege	1560	msiexec.exe
Token: SeTakeOwnershipPrivilege	1560	msiexec.exe
Token: SeSecurityPrivilege	1560	msiexec.exe
Token: SeCreateTokenPrivilege	2260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2260	msiexec.exe
Token: SeLockMemoryPrivilege	2260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2260	msiexec.exe
Token: SeMachineAccountPrivilege	2260	msiexec.exe
Token: SeTcbPrivilege	2260	msiexec.exe
Token: SeSecurityPrivilege	2260	msiexec.exe
Token: SeTakeOwnershipPrivilege	2260	msiexec.exe
Token: SeLoadDriverPrivilege	2260	msiexec.exe
Token: SeSystemProfilePrivilege	2260	msiexec.exe
Token: SeSystemtimePrivilege	2260	msiexec.exe
Token: SeProfSingleProcessPrivilege	2260	msiexec.exe
Token: SeIncBasePriorityPrivilege	2260	msiexec.exe
Token: SeCreatePagefilePrivilege	2260	msiexec.exe
Token: SeCreatePermanentPrivilege	2260	msiexec.exe
Token: SeBackupPrivilege	2260	msiexec.exe
Token: SeRestorePrivilege	2260	msiexec.exe
Token: SeShutdownPrivilege	2260	msiexec.exe
Token: SeDebugPrivilege	2260	msiexec.exe
Token: SeAuditPrivilege	2260	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2260	msiexec.exe
Token: SeChangeNotifyPrivilege	2260	msiexec.exe
Token: SeRemoteShutdownPrivilege	2260	msiexec.exe
Token: SeUndockPrivilege	2260	msiexec.exe
Token: SeSyncAgentPrivilege	2260	msiexec.exe
Token: SeEnableDelegationPrivilege	2260	msiexec.exe
Token: SeManageVolumePrivilege	2260	msiexec.exe
Token: SeImpersonatePrivilege	2260	msiexec.exe
Token: SeCreateGlobalPrivilege	2260	msiexec.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeShutdownPrivilege	2804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2804	msiexec.exe
Token: SeCreateTokenPrivilege	2804	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2804	msiexec.exe
Token: SeLockMemoryPrivilege	2804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2804	msiexec.exe
Token: SeMachineAccountPrivilege	2804	msiexec.exe
Token: SeTcbPrivilege	2804	msiexec.exe
Token: SeSecurityPrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeLoadDriverPrivilege	2804	msiexec.exe
Token: SeSystemProfilePrivilege	2804	msiexec.exe
Token: SeSystemtimePrivilege	2804	msiexec.exe
Token: SeProfSingleProcessPrivilege	2804	msiexec.exe
Token: SeIncBasePriorityPrivilege	2804	msiexec.exe
Token: SeCreatePagefilePrivilege	2804	msiexec.exe
Token: SeCreatePermanentPrivilege	2804	msiexec.exe
Token: SeBackupPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeShutdownPrivilege	2804	msiexec.exe
Token: SeDebugPrivilege	2804	msiexec.exe
Token: SeAuditPrivilege	2804	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2804	msiexec.exe
Token: SeChangeNotifyPrivilege	2804	msiexec.exe
Token: SeRemoteShutdownPrivilege	2804	msiexec.exe
Token: SeUndockPrivilege	2804	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2260	msiexec.exe
2260	msiexec.exe
2804	msiexec.exe
2804	msiexec.exe
2804	msiexec.exe
3820	mmc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
3820	mmc.exe
3820	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 1888 wrote to memory of 2196	1888	firefox.exe	28
PID 2196 wrote to memory of 2636	2196	firefox.exe	29
PID 2196 wrote to memory of 2636	2196	firefox.exe	29
PID 2196 wrote to memory of 2636	2196	firefox.exe	29
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2572	2196	firefox.exe	30
PID 2196 wrote to memory of 2728	2196	firefox.exe	31
PID 2196 wrote to memory of 2728	2196	firefox.exe	31
PID 2196 wrote to memory of 2728	2196	firefox.exe	31
PID 2196 wrote to memory of 2728	2196	firefox.exe	31
PID 2196 wrote to memory of 2728	2196	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\free-download.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\free-download.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.0.232471627\2031661464" -parentBuildID 20221007134813 -prefsHandle 1260 -prefMapHandle 1248 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc70c086-44b3-43a1-8da8-3fb9f67d7b3b} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 1372 111d8658 gpu
    3⤵
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.1.1671386910\1800647669" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1520 -prefsLen 21610 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d50ef108-1d14-4b38-b92f-e6e6dd924196} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 1552 11103258 socket
    3⤵
    PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.2.926678296\555519795" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21648 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {069da476-0a7c-4326-85bf-fe4375dc2c12} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 2104 1117a558 tab
    3⤵
    PID:2728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.3.119616261\1197369549" -childID 2 -isForBrowser -prefsHandle 2868 -prefMapHandle 2864 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68bad5a1-ca74-45e7-bae7-cd35fb4e519c} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 2880 1cd27358 tab
    3⤵
    PID:1092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.4.1056778680\2056474634" -childID 3 -isForBrowser -prefsHandle 3820 -prefMapHandle 3816 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82e8a460-efa0-4d27-9ee2-988707702b05} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 3832 1eb5a858 tab
    3⤵
    PID:836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.5.1120002129\1955623698" -childID 4 -isForBrowser -prefsHandle 3940 -prefMapHandle 3944 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3485d25b-87c3-41ff-997a-7bb448276d8d} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 3928 1eb5ae58 tab
    3⤵
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.6.680706399\2027496517" -childID 5 -isForBrowser -prefsHandle 4116 -prefMapHandle 4120 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4b17b55-127e-4745-a960-9b1e951ea7e9} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4104 1f954b58 tab
    3⤵
    PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.7.366991261\577238613" -childID 6 -isForBrowser -prefsHandle 4424 -prefMapHandle 4420 -prefsLen 26426 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2c7b154-2de6-4059-9121-f9fce219af2e} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4448 213f9858 tab
    3⤵
    PID:1708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.8.1507403262\130831659" -childID 7 -isForBrowser -prefsHandle 4568 -prefMapHandle 4572 -prefsLen 26426 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14d99c62-26d4-4f70-be22-3a2b2d545860} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4556 213f9258 tab
    3⤵
    PID:1040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.9.2070815417\1799330572" -childID 8 -isForBrowser -prefsHandle 3680 -prefMapHandle 3608 -prefsLen 26731 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06bdc7ea-cb6c-4713-94dd-3d1b0699ba11} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4728 d61a58 tab
    3⤵
    PID:2780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.10.2084929614\596175470" -childID 9 -isForBrowser -prefsHandle 3096 -prefMapHandle 3112 -prefsLen 26731 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9093d624-2794-475d-bf13-f3d075477327} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4332 d65158 tab
    3⤵
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.11.659249973\321806747" -childID 10 -isForBrowser -prefsHandle 4500 -prefMapHandle 4508 -prefsLen 26740 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48d7ae4a-6067-4172-8fba-f33597735e7b} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4972 1d1ebe58 tab
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.12.2820662\2073730718" -childID 11 -isForBrowser -prefsHandle 2696 -prefMapHandle 2688 -prefsLen 26749 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {231cc04c-5765-40b9-9ea8-95dcc4a48a66} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 1060 d2de58 tab
    3⤵
    PID:3988

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3304

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B8" "00000000000005B4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x558
1⤵
PID:3636

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:4060

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe"
1⤵
PID:3288

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe"
1⤵
PID:2036

C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe
"C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:4040
- C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe
  "C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe" -2 -1
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 572
  2⤵
  - Program crash
  PID:3652

C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe
"C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:3860

C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe
"C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:3200

C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe
"C:\Users\Admin\Desktop\XmlPad-Installer_273425.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:2328

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f78decd.rbs

Filesize
26KB

MD5
213ca1e84b33b9611f55bfeae6fb530f

SHA1
0b1dad93bcb4bc63a2783d28cf9fd10921efb765

SHA256
435a33cf44b9f0e01701e4d47f2de123fb324e5221a6ec234f3bc5da23420c8c

SHA512
5517366e5717c2d5b3246718dcd91a76581dfa605459c2102b1828602a938421ba4632ac55b30a057adcedb8dcdb11cdbcf16a5b2c33519014ad4b14abf047ca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0rowjuc9.default-release\cache2\doomed\12836

Filesize
13KB

MD5
0794f634903a8433c6fe5580e336e1f9

SHA1
197fa51ec4f645f54673dc473e57cc5acf5deb95

SHA256
2ceac69c56ff35f40f773e55d37cc032b327491be52dd10d78860d622e1cb1eb

SHA512
bb147fe3cece7c416812b7bcc31f996739402fd090452b32a4b66ced270bf98d49c043791f65c22d0042a3a55336c80f2a4736bb3c202f2410743363e5857054

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0rowjuc9.default-release\cache2\doomed\18783

Filesize
7KB

MD5
e031390c550f3d1b9ff158fca0ec4675

SHA1
f70ab75448fad3713846b3de6e409fe39c705186

SHA256
f8835943021f140f0cbc5dcbffa0df118779297c056af0a4f93035677fc952d9

SHA512
970c165321b5fce8b9ad1b401844d82e3cca4c0474b22bf29c68593772ec2c3360edeeb86643fe6ad9ef639f4f8959d1d248450371fde6d0cef142471e5c2be4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0rowjuc9.default-release\cache2\doomed\21812

Filesize
8KB

MD5
7d1881977a4dc7d936b433ff9161baf2

SHA1
fa7ef0c33c8276ce73c3821cad1abaa72fe4f135

SHA256
53c3053b1948285ebc02f3b75e8d4c1f68304996ff26f534bc433f25e8407b51

SHA512
b03f2e216393009d8fa99ee2c0b333a7439e5a47cf9aabb534fa37fe2e4bf76e16edc54416ddff905225e49d08036cfb02f5255c1901ed49e4ee026b9d8dbe5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0rowjuc9.default-release\thumbnails\30aa228e86e349a5f62832b52d7640e6.png

Filesize
9KB

MD5
ae005a4698e710c233918d3310e00cd6

SHA1
78bffbbcc5262ee40184885424e9478f039ff881

SHA256
ae2cf3dda66153acbf335d2358352d77dec0440bc7fad2c412d6bd45ac5fc5c6

SHA512
875c08f30c41a81ac5f5919d96e3494bdc94581f07eab42b9f768bff36216ee6b89f1627d383a155281698005d7a16e0280ae0ea65235a507cb7b268f62df02c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0rowjuc9.default-release\thumbnails\afcdff366096cbf0be5b89a807df1ad5.png

Filesize
7KB

MD5
b7cd65b0f7dac36c837c242d4462c1fb

SHA1
11f01acff4193857febc33baba57605e6cf96898

SHA256
fc3c9631a02f02af68c94f127d63e63d04f79483dd1339abf578781f94c070ac

SHA512
41d5d958bc94b1ccd4c04dda2d296d26a52c83b6ab3ed7d67c12e7053d251b0c5f2a75862c53d2851cf48942d68cf8d172a8bb26e5e1fb93696957baa3966947

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
10KB

MD5
82bdab2fb77586b8d640d91425423559

SHA1
86974b3c76169ebebe043a46153d8b32920ba51d

SHA256
c269b2f6047419f23857c9d3dabce030b57ff7820fa721175bba5edd055eafea

SHA512
9b3456a46a84afb45bc99dc92a172640a83640fb1f097604af9bd6e0be1090d8769c24220639f599f78d7bc65bf8cf4f9668c9ffbb7df4dc8d078b56457cc563

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\db\data.safe.bin

Filesize
1KB

MD5
75d132a5c7af8e1c5f710b002159d8bc

SHA1
345a362d6c128f3482d431cb1a84c57b24f7ca5a

SHA256
007f8acdccf668b942eb74ff0ffaaac9a08a38bc3da3d2d5b20d12ae5ff06197

SHA512
f6f4f2d6b21f654985780a1c3e12aee9b76f31a52d867c453c923a196adba72bc6688c20371fd5e8613d053b79e7f2d65e389a41e4528e32496a5f0b8c5dd4f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
6e422165f6bfe245b82c1c0918486077

SHA1
65d87239c1188350ad7098df098576f6cae2f4fe

SHA256
bd50a33727a4a26c886709a5caca61b06287d90ae7916f552b77b3da44ae2741

SHA512
85d1223b80cf525cd9263748d63e74cb9a1d8a784730ca456dc65dd1a1477f2a28f9e3710ae090261a8deb528c912610abd6cb2fb5e37d7c65ebd6b77e09991a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
df883075d6cbdfc57fe99464ccb93776

SHA1
2b901250b04bcb93e38809adc0482a959fe3221c

SHA256
1ce32f20fa6fc5d4213140d72594de599cb2e607401367bba5dc5a0be814f694

SHA512
0d6b9cdaad30625d0b1f6ba398a044ea33c9278f447cac554bc47ef96bb048d0cb8e6f76385772833f557b19acdebdfb3c93d3533a2d57f905de8b39aa788fbc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\pending_pings\47975f12-9329-4e14-a6b1-63bfad6815b7

Filesize
745B

MD5
1b61ffa7495ac02df36eced48b41d1fe

SHA1
2813b9d0f248267a7730a5e01a0ff8d0b974c1f4

SHA256
8d7e5a79da99ac6debcef871dbc0bdbb04987b7d6321ac241be8d853c3fea597

SHA512
a39e88a2bc8f2650f59d1cc079a587d7f6c3b9e06c2ca93620e549929e94c828411ac90c2b7dc9f1f16d30ac471a6701d3c93cdd4a39394edfde19b56bd40bcd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\pending_pings\4e830474-fb34-44ec-a1aa-31ea38aa976b

Filesize
11KB

MD5
cb38ae6f4c8867de1a0d5bece9cc29dc

SHA1
775d96ec14e17a3df359cd2ac61aa32725798295

SHA256
91237c7388ce14b2d6c0584506f5a4ac9f0ebbf4dbfec3be828494731175bc3e

SHA512
2992df581fda863487533dfd2b1470b167423c3da6dd70e3d6b78ff97e5733c36ad0afae4cf4c8e182a1b4a374c3cf297c0b398d685a91a0a5111502934781e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\pending_pings\79adde70-12f2-48c2-a69e-b5d0c402d61e

Filesize
594B

MD5
4dc4959437798a1adc4e733453d9b0e0

SHA1
d23731bd1c09d6a21677db00ea2a604e307e8da5

SHA256
e7924ebf73eb6ce1bf2eb14022c1562b4425d79d9d13664e4994d4cfec984107

SHA512
cc5afa69ea9438d040292b1661d61f2d08831f8e2479b258efdac6d9a0b77550b1c349a8870b93ee9ac5b8199429be1ee1116d58775b49e8a6bb77c048292e06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\datareporting\glean\pending_pings\95a5a0b8-b680-4ad6-a8e7-6f1b8f350e13

Filesize
854B

MD5
4f086ba4bc2380e13edbaa3e79399a1b

SHA1
0a21a4f41dd83a246ba4447c1ec91f8d5b2e3c00

SHA256
bdf292cd74ae23c27fabefecf9cf0c140c99deb3d83fdcc670cedb4cb8ac6225

SHA512
d3eaa107ae5fc4d63de5011c1d38f9bd8d5a19ec675e4683ba076f6632dfdaefc1e0afe1bdbd3de1dc1900de7600a6b4ed0793044547b9bfedb9d924c790f880

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\prefs-1.js

Filesize
7KB

MD5
68e12a765491b5417cc37c3f649c86a8

SHA1
5170884674544d796e90eb97f2c674d5f9edee81

SHA256
85c86cadb3bc0d693a1e76357ad3dea063a7343c565881dfb5802b8ed3d95e41

SHA512
e09fac4534a29ed5a8a9d1d92f5e3c7d2ae0725232e1e76092eb1c9fa7c9a3a57afa635ba9ec5cea61e18f62a297d14e4b2c10005da5f98e0a90b4bac47b3359

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\prefs-1.js

Filesize
6KB

MD5
6568cfd95be9f872833f92e0553d373b

SHA1
4d98778bdccb86fb852c04818aea22d4d7610148

SHA256
d30c6eddcb9d7a0093836a7a5b0205a8095a92d365d7f545908580faeeb1856f

SHA512
9f05a9bff3c584a4d529cc115730a77bcb33cf8dc4b6405c41681506b7d1f51b3f689441bdcfe0108e93b403cbd50384aa132f2b4552a8cca8f53280473a9b46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\prefs-1.js

Filesize
6KB

MD5
e8ba3c290b65910621ec4e4ee93ffeea

SHA1
51807a745c160aea44bbeeaf4ce82307c558a7fc

SHA256
0ec93ec161b53f3a24a6f2922e5556c301867729a0ab7c9690bb1679e6dea947

SHA512
e179794a3a2ca62f666a04f9db7ae42518ca1c7260f653ce815c0a207dc4bd095a0a76359a7232b672156d1c92b873c73987629cd4b61dfae06c4b8e7090737f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
c43a94ef01584edb28d186bbdcfbd141

SHA1
5e49b6c912e6bef5d2501bceb53e2fea6464e2e4

SHA256
c55f6a5e7a23b81190d10203b33cc14231ce9d5c0d48d04b9db969ed09fe6d79

SHA512
798768671a02d5bab9c27b634b425c2417b938336e4ee844e5b21b0baeabfd0879f0afe78f4e77a0b7e59996d4f36c4d11d6f67d0e2cd72d7fe97221ed56e6d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
876d2be727dd0b2cfff463b9ae6fd378

SHA1
327c5d658d1edc0890d93827f135df93d751c679

SHA256
3db64d3d232d0113482a904ee53e4b79fa0ccf5a757d88e9619556f7b22375fe

SHA512
a7ec5a5f81b8ea0debfad2cadadae6127bae466a233a84ee2d119b3bd18b5680ec512320c62994855538bfee7fbf5cc4dde156a6e41dc8035c4ac846a094de92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
84793deb71cc9599d787bf3e60ab58be

SHA1
085a0430127fcc5eaf3513407544f5b8704327f1

SHA256
aeb68645ba7ae550578c98fbb726c682a88bd4dd2cb958cc4e2a7f299d64eca8

SHA512
4c31b1674e757408b8010edfeb155fb11cc6f323c77b7ccee4f51d860b037a3c155b9e24324a77ba127e536faa926126f3ae3407a0cb450831e7437e0752f603

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
56af7ec3af2e43824ac8d2edc5cfe28f

SHA1
36301b0e2dbcaa43a9c182643c9558909b78cec2

SHA256
76b84ee0b591d18f441ca3d80cc70c8f4a9c65d3e090487ed05f265bcc9bef57

SHA512
c8ec7fd3c8867effd08ea24961f9ea82b3e2b29bc6415d8d45bca008a22083f4fdc0dce85fa40f7c59e5638c422004848a142daa680e2e1884644337c5b3941c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
c32930a4c32b2299e5555b7363b0c8b3

SHA1
8f82965329430ecd38d7f1989593b960ded247df

SHA256
9cd4c5e57b04c0cbc3b9dda506bf1fecc6ccf477588f99cd3f16b58c4b6612cb

SHA512
e754323ac4b283576154563469414910968c5f2608a3ab947062a22115e111d4aeea3bb7d94890369985f84827d8260b65d810b51c9bb35b592421225cf35f5b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
9779c16b22dee82ffd5d058c07a7574e

SHA1
4cdafe6366e6b614e3238099385c7a1477dd7f7b

SHA256
a5467fe3e58f2ba5a9ead5b3061efb4c4c1b1f8a8409d9d2e18f96b42ab7f30d

SHA512
cff1dd3adabcf8eb981d5c67ddd91a6bfcabf06eb60353e5ff3e047974997bae8ac59f7c121c43dfec79ab055ee6fa5753229da33844e88e8c4db3f46fbe76eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
4c7fe23dc238c1befacc6ac1415f815d

SHA1
d33e987a333b67f4ae135b2ac48e7c860406d6df

SHA256
ccb0e12f65480cb0ce0c20247cee6a6904b17437c55c407ee4557434c8fae275

SHA512
185896f480701abf03649433e48b3514a37c298329c3763e106d8eff6b31d10aedade9628263920edf87d14b239d0b1933009cd916e2dce1f23760d7dc0ab0e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
f6bfb9a9391dc5043e912f6fab4e136b

SHA1
6ef8c513233507fbadea12ca19d0fa79ab70abc6

SHA256
ab7056b9d9797893d58947198521da4e3b15d14081489cb487fa83a855fb96db

SHA512
f63f0468eae3c54ff645d1783b1fe898571f32c3d503d10b5134330bee47ceb0b9c782680c7f81c6ec059dff03f7c63a731879f722e1846776ebdfbfdd90206f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
0fa24c0682b64ea8e22895470a3b8179

SHA1
f908fa77f64e4ac39e17f8de4e6969de9492500f

SHA256
f90af62db88b98ffb18a9479d8d46638fbee2a694b0de321ad4a47df03ae00db

SHA512
f7a0adb80fd1ae9b3bca77eaef363e7c4ef8ecdfbdf2bed9f4086c550611a4fb7c4cf836b394596d10957047648d0425149de95545f4a6ef0974503947603016

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
84a62b25af95b4a3dffff1b54638ebb7

SHA1
f54da1aafde91ea6dd059dd0fe505bc5d4d2cc64

SHA256
0cd03b9dc403e2aa1a0f8ada81a333941c397e12b652af9548817ff6c910a8c5

SHA512
294b1b15206389b0204007d372e2e73542b4d0c8fce182ef7cb33da8d127d1a56390b9aa782a577a8eb68b848e3ba2442a894990c8accf87d726160b98844f19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
7890eec6cf1d64918d8f281fd5d9b588

SHA1
8abb02c2b9d0f2ada7163cdb6b44ce0908d69da2

SHA256
6e71fa17e0cd47c311c6657e1d5488cc179a41b3c2b68ed1a93aa7308e0c9874

SHA512
e1561fe156d6f5ccd2460e55ac66164c68ba3e458b8f2b23841d1139136f17ee681de313b9a303cbd8e7ab9c25c9ce44d28e970b4c17f9cdd37706edba324865

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
58957cfe536a4d1c958ab0e200e46089

SHA1
fc28ac97185d970c783c07059ed3500355c63b34

SHA256
d1ca5128298c05197ed186ff5217f765f031d2ab725ed51c4bf373f1cc0e618d

SHA512
af54ccc3a85e6e9c5780126d232afdd3b3fdb25321721647bfeacfc98952e2e006523a8db8551dccceccb284b806fcb06513e068f4d321ee9454a0ce8287f705

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
070a8c402d14f196afb51ed01e5273c3

SHA1
f76b6b0bc943e3746ab99176e5852458f361f1f1

SHA256
7224af307e259a4744c8ada9cd1e8e108a6b3d283267d45d6203d2d150c3c328

SHA512
63ab73db8e4c5524bd8f4c179e17fdc66712a743236a5729fde3616de913493e4e4915f593ec28bb695446e468700a1707aa5f128ec9fbe21bd0cbf7813324b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ea35a2992da38f536503eebebd513b1f

SHA1
f847bcdbe6042ca3aec17860480a34e726e0e564

SHA256
cae3adcb5790eb4aad0a5424b5905e155175d1431af090a7f1818583767b8e94

SHA512
359daf3e2a349b58cac6b36b7bc479e448db823c410fd8fec50d80fa1ebb9c494651687c4a7714c5acff3923274917a1200884f46dbc8471503420ad93191234

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
d366335ae287b2737d1ee3ad2048414c

SHA1
ed8128372af3f38cb418cd3283e7c33731d12756

SHA256
ca8103382403dbcfdfdfd92bad9945de27d00b661cd6b97b732b9d4915a1bf54

SHA512
545a4aec0c77616abdf626096514cdff3bd16463b89e5ec7f2b0f75f58687bddb529575711cddae492c26d4f18173773749a6c5cce2216e97129c9083423bfe9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\storage\default\file++++C++Users+Admin+AppData+Local+Temp+free-download.html\ls\usage

Filesize
12B

MD5
797198f7b479238c1bce8b4f83958e44

SHA1
a1bd21f7263762af6cfffefd8f8508b937bd5a4e

SHA256
c22a8fbea2f5ab78f6331e65987a28c33d50e0c6c2c186b719897d3f1567f9ab

SHA512
6ebbe219ca408bfbb7c62d73bc957ed5d63d7dbecaeb64e09e962ef367d13e300909bddc4a95b0f1f82bfb2c5bdffd4d338e11e18b917513c45cd5518df88299

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
4dbb6fd82eddbef46d53f6866ef4f262

SHA1
934007db198252324a01e431afee929413f23043

SHA256
552620d88e5a2bf4fdb168439d43270f75f6ad03fa3eec8c1c99b368c3562887

SHA512
c4d59f05c6c2bb6519ef49f7a87369c98d16c3d4bbdb8ea839be12f0a2bcd364e649f5a3b8bc336c31773ce2036727bc245bfd7e28e3d0fb66759854f0ba8fda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
65a881191b54c0fac2da189f713e0f5c

SHA1
74fff2a03c4a936edaf3bce91c527c590a8ef7ee

SHA256
a2f8a8108edcf65b274ce69327c484e59dea35d059e3279b6b50b06071d879ef

SHA512
f384f0c72456b1175768d1631ecbace356288e5b3c5a582f10bea01ab60dfe00b6daad97dc9d096de9f99d3a8380032205ac5ca191e05195d2dd0a73a67d75f6

Download Submit
C:\Users\Admin\Downloads\2024-05-23_15_07_29.M1pltMSU.297_1.zip.part

Filesize
8.2MB

MD5
e4d207a1ee6ec0590639e9fc13997b97

SHA1
786ca6f5d1c7e5387b7fe130b9c345a9548c2d12

SHA256
bb1dfb652d2f57da1293858b4f80abd59a52c78b9261179590e742dc8d4ae541

SHA512
b2b6d1f819ead684baee87a73b0525b439897b66381ec4401ad47dbb0b025cff48454afb1be1d4147fc26e52c31b45054f4dbe088b6f3eff38199c8c899bbf14

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.WzkHxAVd.msi.part

Filesize
1.8MB

MD5
50515f156ae516461e28dd453230d448

SHA1
3209574e09ec235b2613570e6d7d8d5058a64971

SHA256
f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca

SHA512
14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

Download Submit
memory/3688-689-0x00000000000D0000-0x00000000000DA000-memory.dmp

Filesize
40KB

Download
memory/3688-687-0x00000000000D0000-0x00000000000DA000-memory.dmp

Filesize
40KB

Download
memory/3688-688-0x00000000000D0000-0x00000000000DA000-memory.dmp

Filesize
40KB

Download
memory/3820-825-0x0000000002880000-0x000000000289E000-memory.dmp

Filesize
120KB

Download
memory/3820-826-0x000000001D410000-0x000000001D756000-memory.dmp

Filesize
3.3MB

Download
memory/4040-686-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/4040-684-0x0000000000180000-0x000000000018A000-memory.dmp

Filesize
40KB

Download
memory/4040-685-0x0000000000180000-0x000000000018A000-memory.dmp

Filesize
40KB

Download