asyncrat | 20ef76c154dc7e7ebb7a1dc49590fab234f0f082133ed085bd834f89bd16c66b

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
26-07-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mia_Malkova_Photos.zip
Size

683KB
MD5

56364382f90973b12ef1104850e9576c
SHA1

4a97da530553906de8c4ea6d91e71a18fdaf1968
SHA256

0cb5f0585caf83de99654973aa72d0dc89ab7a38877695e13a09e909ca5341b0
SHA512

91b9fe6f7c8bea6f27c15ce030abe2baad46a0ba7c3b3870e1ddf2b3c2d9ce29f224d7d02787d2bed8a3370c43e7e356ea20324579da903f4d393f8259860640
SSDEEP

12288:rdgMjgPFqxvy+nlygSH5e3zbm2ECy734LUou6616ZefekcbO/o1f0LPOeqHPXA:rdwPiy+05e3zyF9Yxu66oqcqwiLSA

Score

10^/10

asyncrat gb discovery persistence privilege_escalation rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

141.95.84.40:3080

Mutex

XXXXXX

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Drops startup file 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs	wscript.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 12 IoCs

pid	Process
4840	regsvr32.exe
1400	wscript.exe
3624	regsvr32.exe
3924	regsvr32.exe
2396	regsvr32.exe
1676	wscript.exe
4708	regsvr32.exe
4672	regsvr32.exe
436	regsvr32.exe
1456	wscript.exe
1900	regsvr32.exe
1420	regsvr32.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 3804	1400	wscript.exe	91
PID 1400 set thread context of 3392	1400	wscript.exe	93
PID 1400 set thread context of 2268	1400	wscript.exe	95
PID 1676 set thread context of 4352	1676	wscript.exe	101
PID 1676 set thread context of 4680	1676	wscript.exe	103
PID 1676 set thread context of 2276	1676	wscript.exe	105
PID 1456 set thread context of 3884	1456	wscript.exe	113
PID 1456 set thread context of 3944	1456	wscript.exe	115
PID 1456 set thread context of 1984	1456	wscript.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3816	2276	WerFault.exe	105
4164	3944	WerFault.exe	115
4044	1984	WerFault.exe	119

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3452	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4612	firefox.exe
Token: SeDebugPrivilege	4612	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
3452	OpenWith.exe
4612	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 1400	3080	WScript.exe	89
PID 3080 wrote to memory of 1400	3080	WScript.exe	89
PID 3080 wrote to memory of 1400	3080	WScript.exe	89
PID 1400 wrote to memory of 4840	1400	wscript.exe	90
PID 1400 wrote to memory of 4840	1400	wscript.exe	90
PID 1400 wrote to memory of 4840	1400	wscript.exe	90
PID 1400 wrote to memory of 3804	1400	wscript.exe	91
PID 1400 wrote to memory of 3804	1400	wscript.exe	91
PID 1400 wrote to memory of 3804	1400	wscript.exe	91
PID 1400 wrote to memory of 3804	1400	wscript.exe	91
PID 1400 wrote to memory of 3804	1400	wscript.exe	91
PID 1400 wrote to memory of 3804	1400	wscript.exe	91
PID 1400 wrote to memory of 3804	1400	wscript.exe	91
PID 1400 wrote to memory of 3804	1400	wscript.exe	91
PID 1400 wrote to memory of 3624	1400	wscript.exe	92
PID 1400 wrote to memory of 3624	1400	wscript.exe	92
PID 1400 wrote to memory of 3624	1400	wscript.exe	92
PID 1400 wrote to memory of 3392	1400	wscript.exe	93
PID 1400 wrote to memory of 3392	1400	wscript.exe	93
PID 1400 wrote to memory of 3392	1400	wscript.exe	93
PID 1400 wrote to memory of 3392	1400	wscript.exe	93
PID 1400 wrote to memory of 3392	1400	wscript.exe	93
PID 1400 wrote to memory of 3392	1400	wscript.exe	93
PID 1400 wrote to memory of 3392	1400	wscript.exe	93
PID 1400 wrote to memory of 3392	1400	wscript.exe	93
PID 1400 wrote to memory of 3924	1400	wscript.exe	94
PID 1400 wrote to memory of 3924	1400	wscript.exe	94
PID 1400 wrote to memory of 3924	1400	wscript.exe	94
PID 1400 wrote to memory of 2268	1400	wscript.exe	95
PID 1400 wrote to memory of 2268	1400	wscript.exe	95
PID 1400 wrote to memory of 2268	1400	wscript.exe	95
PID 1400 wrote to memory of 2268	1400	wscript.exe	95
PID 1400 wrote to memory of 2268	1400	wscript.exe	95
PID 1400 wrote to memory of 2268	1400	wscript.exe	95
PID 1400 wrote to memory of 2268	1400	wscript.exe	95
PID 1400 wrote to memory of 2268	1400	wscript.exe	95
PID 3544 wrote to memory of 1676	3544	WScript.exe	99
PID 3544 wrote to memory of 1676	3544	WScript.exe	99
PID 3544 wrote to memory of 1676	3544	WScript.exe	99
PID 1676 wrote to memory of 2396	1676	wscript.exe	100
PID 1676 wrote to memory of 2396	1676	wscript.exe	100
PID 1676 wrote to memory of 2396	1676	wscript.exe	100
PID 1676 wrote to memory of 4352	1676	wscript.exe	101
PID 1676 wrote to memory of 4352	1676	wscript.exe	101
PID 1676 wrote to memory of 4352	1676	wscript.exe	101
PID 1676 wrote to memory of 4352	1676	wscript.exe	101
PID 1676 wrote to memory of 4352	1676	wscript.exe	101
PID 1676 wrote to memory of 4352	1676	wscript.exe	101
PID 1676 wrote to memory of 4352	1676	wscript.exe	101
PID 1676 wrote to memory of 4352	1676	wscript.exe	101
PID 1676 wrote to memory of 4708	1676	wscript.exe	102
PID 1676 wrote to memory of 4708	1676	wscript.exe	102
PID 1676 wrote to memory of 4708	1676	wscript.exe	102
PID 1676 wrote to memory of 4680	1676	wscript.exe	103
PID 1676 wrote to memory of 4680	1676	wscript.exe	103
PID 1676 wrote to memory of 4680	1676	wscript.exe	103
PID 1676 wrote to memory of 4680	1676	wscript.exe	103
PID 1676 wrote to memory of 4680	1676	wscript.exe	103
PID 1676 wrote to memory of 4680	1676	wscript.exe	103
PID 1676 wrote to memory of 4680	1676	wscript.exe	103
PID 1676 wrote to memory of 4680	1676	wscript.exe	103
PID 1676 wrote to memory of 4672	1676	wscript.exe	104
PID 1676 wrote to memory of 4672	1676	wscript.exe	104
PID 1676 wrote to memory of 4672	1676	wscript.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Mia_Malkova_Photos.zip
1⤵
PID:3968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1944

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Mia_Malkova_Photos.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\syswow64\wscript.exe
  "C:\Windows\syswow64\wscript.exe" //b //e:vbscript "C:\Users\Admin\Desktop\Mia_Malkova_Photos.vbs"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3804
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3624
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2268

C:\Users\Admin\Desktop\hi.exe
"C:\Users\Admin\Desktop\hi.exe"
1⤵
PID:3640

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Mia_Malkova_Photos.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\syswow64\wscript.exe
  "C:\Windows\syswow64\wscript.exe" //b //e:vbscript "C:\Users\Admin\Desktop\Mia_Malkova_Photos.vbs"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2396
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4708
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4680
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4672
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:2276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 92
      4⤵
      Program crash
      PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2276 -ip 2276
1⤵
PID:3872

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Mia_Malkova_Photos.zip\Mia_Malkova_Photos.vbs"
1⤵
- Drops startup file
PID:2412
- C:\Windows\syswow64\wscript.exe
  "C:\Windows\syswow64\wscript.exe" //b //e:vbscript "C:\Users\Admin\AppData\Local\Temp\Temp1_Mia_Malkova_Photos.zip\Mia_Malkova_Photos.vbs"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1456
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:436
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
    3⤵
    PID:3944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 92
      4⤵
      Program crash
      PID:4164
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:1984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 92
      4⤵
      Program crash
      PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3944 -ip 3944
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1984 -ip 1984
1⤵
PID:1488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3452
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\Mia_Malkova_Photos.vbs"
  2⤵
  PID:1576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\Mia_Malkova_Photos.vbs
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240401114208 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 25749 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d850c9b-dfd5-4726-aab9-ac1af74f68d6} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" gpu
      4⤵
      PID:4724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2356 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 26669 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {977b897b-cc9a-4394-b4db-85a90f203a27} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" socket
      4⤵
      PID:4060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3456 -childID 1 -isForBrowser -prefsHandle 3468 -prefMapHandle 3464 -prefsLen 26810 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1962d287-053b-40fd-8d61-d3bddaea5b78} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab
      4⤵
      PID:2280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1468 -childID 2 -isForBrowser -prefsHandle 3384 -prefMapHandle 3080 -prefsLen 31159 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {488a6c35-d387-489b-99a9-042019da0f3d} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab
      4⤵
      PID:4656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4696 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4740 -prefMapHandle 4728 -prefsLen 31159 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30485dc8-e1a3-472e-9e99-1a8abbdce15c} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" utility
      4⤵
      Checks processor information in registry
      PID:988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4372 -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 4736 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38a84eb0-8cb2-4bc4-b056-1719e4cb81c4} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab
      4⤵
      PID:1572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 4 -isForBrowser -prefsHandle 5408 -prefMapHandle 5416 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9a6c051-097e-482b-af4d-466d36beb6bb} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab
      4⤵
      PID:1500
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 5 -isForBrowser -prefsHandle 5472 -prefMapHandle 5408 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1196 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35e9acdc-b5a2-4bb7-a13a-0678dcc9b43e} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab
      4⤵
      PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cvtres.exe.log

Filesize
425B

MD5
bb27934be8860266d478c13f2d65f45e

SHA1
a69a0e171864dcac9ade1b04fc0313e6b4024ccb

SHA256
85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

SHA512
87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
f76cd3afaf6e2f3777cffd629e40b003

SHA1
5beae21011cdfc342cfd0bd29354229924de376f

SHA256
409820736275c8336589964a15287baf1861c1d51a647b3b87e72b7aa5fc536b

SHA512
8a9e704093ece6fefbd1637f099303167b4fe3a50a6e6fa9678882971160c5a78a1457ed208149bbc4f52fabe6cba6f24bd10d148487f583f043f30daf7751de

Download Submit
C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll

Filesize
13KB

MD5
e0b8dfd17b8e7de760b273d18e58b142

SHA1
801509fb6783c9e57edc67a72dde3c62080ffbaf

SHA256
4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379

SHA512
443359da27b3c87e81ae4f4b9a2ab7e7bf6abfa93551fc62347a0b79b36d79635131abc14d4deddab3ace12fdf973496518f67e1be8dc4903b35fd465835556b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
7KB

MD5
21a3ee897a3de04b1bff2a62b83c7ee8

SHA1
930ce07df401c8e0b5e8017d5d3490a3e84e7be2

SHA256
479dd87c79008d5bf846fca1f870fe48564d1cb05d6b41dd955693a3e2eb4e32

SHA512
76d912bff561ef1275715a19cadd890067b6e1d02218ca7d037ea435e16c41feff59693d248dc39f6ad0fa3304b913ded113dc4b0ba3c0a56958c86b5b0bda2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
7KB

MD5
d7bf3973a8a89bbf3fbee9eac270ae6e

SHA1
1959bf55dd9500ceb0ccef4d86037fcee9db39cd

SHA256
f38bde17a05ce16de0c8d0608b95999afa94ae911cc46f3f63fe55a05201395b

SHA512
56b3354d49dbda529282ade223c239ef28304b93e999b32deb0dcab6e22ceef15e362d778fb83621bd784ed5c5fe1fbbc4d822eff6efe41755d94d8101836e37

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
7KB

MD5
6046099cc452aa61dafbf9609cbb1e7d

SHA1
51dfad1fd2ecfe7791f2cd8677e5ecf5f4d01ab6

SHA256
1a424bb547886db2743f4709d95830774db76030b8166b7bcd7c66edb70fc85a

SHA512
5b3d20bcf152d86940459885b9a65705afb78d7d5844feffceac3fd6ff048a46bd0c3131c5cc553fb2a1010cc436a46db0089681837222c3e60da0e4a2d2bf97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs

Filesize
4.0MB

MD5
83959ea07eae4d7f08fb11862ed707cb

SHA1
80f40a35bde7a1500476bb17401948f4f811c7b0

SHA256
20f8f27cdfbd0a0346a2e43348b3ae626d3aa4712ab559dce8286b74a58ddeb8

SHA512
16faa156267bd072d9c889c951a109c827cc61d01b5962a74c912a8a63d5582802a6d1cb78875294ee3cb1fe361cfc41545837c22a4f76765f74e9b609942d05

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mia_Malkova_Photos.vbs

Filesize
4.0MB

MD5
6d5f19e149820c95dc0864664202e3a9

SHA1
af553dcb57f7f4426557dce05b37a9c4c57cba96

SHA256
cc9349b2649bff60946ffa0ba9733d57ba5e34bfd147691a9f8d78bfa627cc78

SHA512
a5f6d52d822ec9fe82ca1e1bdb4e9853f2e18eb23f6ed052cbf4397da06384e4f6c539d031afd3b3157a3e0472f109cdec476fbafb10a06565015063880de222

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin

Filesize
8KB

MD5
612f674f46f6c1f2f2eb2b0c15725931

SHA1
19395a447ee9f0131a570972cb80c079f16a42b0

SHA256
18f0bb26d00864b54d9a2fad32d607099e1cec9a677b12c63af7c81e195e191f

SHA512
c836a4ce03f9e84713aaa6bcd02226add21741f54981b5f03e1d0e27a39cb7f7ec1c41fecf7ee2aa5e29a256b3c45b643a73c4a91cf0a488f55e57c98d990a7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
43db28d1fe8f334998bb398c4dad59a0

SHA1
79805bfdd5a432f427b6ca186c31044651dbe90e

SHA256
7e15e8f031430c5a15a0d2c81f606d8c67976b08dd0d0144215ffe6c439032c1

SHA512
8a46a8006064f03ba333d792d1eb3f825e12d12082f1a632f40507a5671c198ff20d1cd81cf4c9f4bed0c22a771751de96e2da9be6ac734051924a44b31537e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
7aa508afd1049b246d47fb518e3ae9f1

SHA1
fc1a47b6e82c8e15587c75255c651eb2da58bf49

SHA256
79aa71d30fb5fad88ab5cd766efa5e6056fa4f125ffd3bca5f0d886dfb7bdc7b

SHA512
2b26af99456cc15fdf67c5131654af65d9979c9b0f26b48e9c84dc3743d3672cbde6b46372d4cb860f0aaed36e1bceeb3ec14f236c16de114c3a17204ce33024

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9eb335391f1c378e868cf0a52a6bbd60

SHA1
f9550b9c0967c8a0ee625069c905c5df44435710

SHA256
181803b3b7ff8723eaa7c7854007560e2c96a2e0f74af3e3371451ac868af315

SHA512
1fdda8dbc4b5814d9264684b090a05c98b6dd74444399c308789ee0ab3c6d0ecb62f5dce52e4d9635f7a70ce3706bfd8938c59b425452a24d1b66a81e7bf687b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f368e97a854abc91e9054b991c484191

SHA1
cf7abde3be1d0a41df0a78783a6102fab67da18e

SHA256
e141a5d913555de2a06b4030c817ac430c4d33be93843aa442ad89305c6139e0

SHA512
22e5394b966972cbec9d6e180ebe76beea18485ccb9a3382e5674f7f1bb7581e212dfe440d6ad33ecbf4841910123ca9217d79439a2e595fafa8f12b44c0b7ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\13bdaa6a-4fda-4864-a9c2-4b2dfc563c51

Filesize
671B

MD5
3bc9c82e35a008ad9c60bea24db62407

SHA1
81270bf8fbbcec7b0ceb81e3968e94b72b22cbef

SHA256
89c2e386622f3278a454e911f83fab32d972e967f67d683fae304132b6494ea4

SHA512
fe2e1b366b3702034bc904cb2d890f8d50ab5eaf0ff136ad58d6690dd952b9bbd73ec667682ec705993ad0806dbeaa94737c798d55d02c8d9fe16f000a61912c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\7183cae6-9bbd-496f-ad57-05a8e68d724c

Filesize
26KB

MD5
373e3fd812bd3b07f299011725530d1f

SHA1
fc627d787cf3f6ebdecff0cabff43b07e0363ef4

SHA256
fe985be257dc2bded1cb4b7482a49a17e1371f52958063cc97a3eb33e505fac2

SHA512
c8cd83c6b05261d8dc91fd11ec09a67357f42e7eabe2d30e78e9aea65d14b8bd6ab0be2c95f3809aec0d09364496e2d94861f1c726413c808b1a917c7fefc163

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\9d5704d6-e9b5-40a2-8ecd-2b712efef0d1

Filesize
982B

MD5
3c994608acdb8e2ca9008c48c734feb1

SHA1
8ff22e3f4e8963b52e054b87c693129fe27d4474

SHA256
1523554eafc2ae1bcbca7ed398b1e527903b5de36132800f74b08a60a677d2a8

SHA512
a80afc3787ef9d459af5b513fb941c8cc1a3a6533f93c311844ec1154c3b010ebc8a9660af7bb13569d87a27a81995a2ce5a078a5d4cd44afd2edb57031c0713

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js

Filesize
12KB

MD5
0db0440f7fd5c097bc2652cd323d2db0

SHA1
d687fedf3c4b6095f477e5a15082e500b2929ffd

SHA256
c36dab62615e7be397ca51cf7452c8bbcb5459d61a70b0144d5c7731fdc0103e

SHA512
0ccf8038ccc8560712a839e70d192c6aa8bd11a3a74ee8a24126541901a489ccf3dba5ccbcb05ccae8b1226d070d847ce74cb29a9d6545bb706e3d6f29878e8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js

Filesize
11KB

MD5
c06d03326b54bec43c4c1e912d08092f

SHA1
9cf61d6f15f8158166bef4f30bfba10fc664e521

SHA256
278c10fb9ecf85ca28c947e19b600edd88c56a83584410a11e3f5558546c4ba9

SHA512
70ad3b6a878adf6d0b430cfc63f975981772fc34fff714e0960a410f0b1d20f8cc5fd846825ec80c18d4a9f7038ec5f3293526722b6980aec7fd25aa1620914b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs.js

Filesize
8KB

MD5
fc02eba316c1e66f378c1202ab1de43f

SHA1
0318361333239e970fe643507c38898c76e33515

SHA256
95fb24be0a2363bf3c436c2f83fa25ef5ca3b8d29492c79ae4a2afe01bb5aeff

SHA512
fff52c0e4352327a8248e87c26c878225def4fe2fa19f0c2f156226985e4e4c599d5ee90e4de1267b9c449e55a73515378926e052629e9db9234f5159e945688

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
42c2e66b5f7440dc726e46eb207240c1

SHA1
401211c7129403b21f2b11bd6161e9e0d9d6c541

SHA256
d3f281525fdc4b761244acb7902fe0a5b3995b22740315d609b817f8bb292548

SHA512
dbec39b06c1ffbe92c245a59fea7450d41c68a18efa1f8f64be903673278f65832349780f219bf03ac9a48cdb997607d4357beb7667d396f513b7b9dde335139

Download Submit
C:\Users\Admin\Desktop\hi.exe

Filesize
927KB

MD5
1acefd52b10b834de4e770df29a8e8b9

SHA1
adace06de40d3a81e92e5e5368d0a6854d785115

SHA256
acaa5403a8c73414495693520d7e94c423abc4ae4237eddad8cb0886e6b23724

SHA512
f8206d24e3f370caefe81cea4212581afe33af8867f2647754b5a67b5f69dc472bb4c892d6b048b72685844b8b4865b1f118ceffebb4571146547997d3f9731a

Download Submit
memory/3804-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download