Overview

overview

10

Static

static

10

d.exe

windows10-1703-x64

10

Resubmissions

05-08-2024 14:41

240805-r2sdlsyfpl 10

05-08-2024 14:12

240805-rhv1dsyblq 10

Analysis

  • max time kernel
    155s
  • max time network
    156s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-08-2024 14:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d.exe

  • Size

    162KB

  • MD5

    628e4a77536859ffc2853005924db2ef

  • SHA1

    c2a321b6078acfab582a195c3eaf3fe05e095ce0

  • SHA256

    d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee

  • SHA512

    aae3e3e9b12ab7389e5f2eac89b2a306c4d2b91bb4204f83cc7308a83c3dea88bbc2d826546c886fd580c01245a6be5c0aefcd93936daeecb3614935248de5f1

  • SSDEEP

    3072:o5uyulsHwDV1gFnTwn7zwJGJ+3t5kCI5Gzei3N2VzRmK:o5uZ1DPgFnk7EJwaI5gDN2VVm

Score
10/10
lockbitdefense_evasiondiscoveryransomware

Malware Config

Extracted

Path

C:\Users\HLJkNskOq.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest and most stable ransomware from 2019~~~ >>>>> Your data is stolen and encrypted. If you don't pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don't hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe. Tor Browser Links: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion Links for normal browser: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly >>>>> What guarantee is there that we won't cheat you? We are the oldest ransomware affiliate program on the planet, nothing is more important than our reputation. We are not a politically motivated group and we want nothing more than money. If you pay, we will provide you with decryption software and destroy the stolen data. After you pay the ransom, you will quickly make even more money. Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you. Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it. If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future. You can get more information about us on Ilon Musk's Twitter https://twitter.com/hashtag/lockbit?f=live >>>>> You need to contact us and decrypt one file for free on TOR darknet sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from you. If you need a unique ID for correspondence with us that no one will know about, tell it in the chat, we will generate a secret chat for you and give you his ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser Links for chat: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal ID: B30C8622DB53FF59614D4C53BCEF88C2 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They won't help and will only make things worse for you. In 3 years not a single member of our group has been caught by the police, we are top notch hackers and we never leave a trail of crime. The police will try to prohibit you from paying the ransom in any way. The first thing they will tell you is that there is no guarantee to decrypt your files and remove stolen files, this is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it is a matter of our reputation, we make hundreds of millions of dollars and are not going to lose our revenue because of your files. It is very beneficial for the police and FBI to let everyone on the planet know about your data leak because then your state will get the fines budgeted for you due to GDPR and other similar laws. The fines will be used to fund the police and the FBI, they will eat more sweet coffee donuts and get fatter and fatter. The police and the FBI don't care what losses you suffer as a result of our attack, and we will help you get rid of all your problems for a modest sum of money. Along with this you should know that it is not necessarily your company that has to pay the ransom and not necessarily from your bank account, it can be done by an unidentified person, such as any philanthropist who loves your company, for example, Elon Musk, so the police will not do anything to you if someone pays the ransom for you. If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom. The police and FBI will not be able to stop lawsuits from your customers for leaking personal and private information. The police and FBI will not protect you from repeated attacks. Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees. >>>>> What are the dangers of leaking your company's data. First of all, you will receive fines from the government such as the GDRP and many others, you can be sued by customers of your firm for leaking information that was confidential. Your leaked data will be used by all the hackers on the planet for various unpleasant things. For example, social engineering, your employees' personal data can be used to re-infiltrate your company. Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. On another vacation trip, you will have to explain to the FBI where you got millions of dollars worth of stolen cryptocurrency transferred through your accounts on cryptocurrency exchanges. Your personal information could be used to make loans or buy appliances. You would later have to prove in court that it wasn't you who took out the loan and pay off someone else's loan. Your competitors may use the stolen information to steal technology or to improve their processes, your working methods, suppliers, investors, sponsors, employees, it will all be in the public domain. You won't be happy if your competitors lure your employees to other firms offering better wages, will you? Your competitors will use your information against you. For example, look for tax violations in the financial documents or any other violations, so you have to close your firm. According to statistics, two thirds of small and medium-sized companies close within half a year after a data breach. You will have to find and fix the vulnerabilities in your network, work with the customers affected by data leaks. All of these are very costly procedures that can exceed the cost of a ransomware buyout by a factor of hundreds. It's much easier, cheaper and faster to pay us the ransom. Well and most importantly, you will suffer a reputational loss, you have been building your company for many years, and now your reputation will be destroyed. Read more about the GDRP legislation:: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr.eu/what-is-gdpr/ https://gdpr-info.eu/ >>>>> Don't go to recovery companies, they are essentially just middlemen who will make money off you and cheat you. We are well aware of cases where recovery companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us directly without intermediaries you would pay 5 times less, that is 1 million dollars. >>>> Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction. >>>>> If you do not pay the ransom, we will attack your company again in the future.
URLs

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion

http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion

http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly

http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly

http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 11 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d.exe
    "C:\Users\Admin\AppData\Local\Temp\d.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:2876
    • C:\ProgramData\7C84.tmp
      "C:\ProgramData\7C84.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      PID:4772
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7C84.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5244
  • C:\Windows\system32\printfilterpipelinesvc.exe
    C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
      /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{58E485CE-19CB-4038-AD1C-7E238254C2D7}.xps" 133673407542320000
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2340
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.0.949888961\221631964" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {815b1f12-d5d8-402c-9942-2e678f14b03d} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 1764 165d1a16b58 gpu
        3⤵
          PID:3936
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.1.218658457\973837098" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ded5d7d-ffac-457e-80d1-69725f8ea4c7} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 2120 165c596c458 socket
          3⤵
          • Checks processor information in registry
          PID:4624
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.2.282016319\78338548" -childID 1 -isForBrowser -prefsHandle 2916 -prefMapHandle 2880 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {42b284ce-059b-4a5b-af80-e7911037b01a} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 2980 165d4bc9158 tab
          3⤵
            PID:2728
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.3.393943165\290926521" -childID 2 -isForBrowser -prefsHandle 3244 -prefMapHandle 3272 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efdd11f4-1a7a-4c79-9174-1a1be341102c} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 1296 165c5962258 tab
            3⤵
              PID:4352
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.4.1966000968\1855330308" -childID 3 -isForBrowser -prefsHandle 3732 -prefMapHandle 3728 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea33b947-8de5-4fb9-9dfd-00505860bd35} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 3748 165d51f1758 tab
              3⤵
                PID:2100
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.5.2120728992\850047940" -childID 4 -isForBrowser -prefsHandle 4920 -prefMapHandle 4916 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8b8883d-bfac-4d0e-8db3-eef9929e04d8} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 4824 165d65e5858 tab
                3⤵
                  PID:3428
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.6.1775709109\1409681713" -childID 5 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbde9440-4688-4a94-9cb1-e5aa32451b44} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 5020 165d6d3ac58 tab
                  3⤵
                    PID:2740
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.7.604885478\783005792" -childID 6 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d8c6132-26a4-4348-829d-9b9ecd5d1289} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 5204 165d6d3a658 tab
                    3⤵
                      PID:2872
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.8.1433417040\1657177263" -childID 7 -isForBrowser -prefsHandle 5516 -prefMapHandle 5540 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c2ab3ed-1a9f-4c7a-a573-8c3f7a1ee1ce} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 5528 165d4cd4a58 tab
                      3⤵
                        PID:396
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1212.9.313059803\1166566435" -childID 8 -isForBrowser -prefsHandle 4956 -prefMapHandle 4960 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37fafa1a-143a-4c0b-b900-2a6880eb6f93} 1212 "\\.\pipe\gecko-crash-server-pipe.1212" 4588 165d6d38558 tab
                        3⤵
                          PID:5828
                    • C:\Windows\system32\AUDIODG.EXE
                      C:\Windows\system32\AUDIODG.EXE 0x408
                      1⤵
                        PID:5688

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\$Recycle.Bin\S-1-5-21-3699363923-1875576828-3287151903-1000\QQQQQQQQQQQ
                        Filesize

                        129B

                        MD5

                        0a7731b8fc52d654dcb273c9669df2b1

                        SHA1

                        12457a970bf2a25e368f2371c8e9bce0cc65f289

                        SHA256

                        3a2d1c1b18dfddfcaca432fe233bc1ec6ff96bdb2810bdc424ec2ae7a957f75b

                        SHA512

                        28b5c98d6ca2d3514c5aa6e8bd45dfb07ca4fdb7143baa4bd3b191ec18d64b96e245771f56e457a5a57c034be3cec4a8e77a33de4b560017a3e1f81b3478f003

                        Download Submit

                      • C:\ProgramData\7C84.tmp
                        Filesize

                        14KB

                        MD5

                        294e9f64cb1642dd89229fff0592856b

                        SHA1

                        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

                        SHA256

                        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

                        SHA512

                        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\CCCCC
                        Filesize

                        162KB

                        MD5

                        cbb5ad77381679fcc23a03f3d00eabb7

                        SHA1

                        57233a8aa25de0167d18406acc58c200d5c07bd4

                        SHA256

                        cf9c188d4838629457ce14cbdf627a0a7f5c902b5e9c106cdc9de5025afae3a0

                        SHA512

                        dbd9d6d04722ab7ee662d4c8f25e4f25265f473b83bc2c30d0a2394fe868b7cfc44b80f1a099218ebe8251f953956db1089cf4fc527b71ce7c2721bd7155e37f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\{1FA59033-75DC-4EF0-A553-9D60685C8313}
                        Filesize

                        4KB

                        MD5

                        b6229ee292dac5bbdb7819f75ecfb491

                        SHA1

                        981a5269c86c04bd49fbb966116fadc345f40697

                        SHA256

                        4ea1d6278b0d1f1ee64aca8c380afb7fc6b7d3ee22a8f4b8329ce40d6ec3edfc

                        SHA512

                        9dda8c870a848fc9a5ed6d82b84dcce6424b22d6be4e525d173a5fa2375e36591c81e415ced435c046ecdede70d20d842c6242e830ea3e306c9877917b9f3273

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        2KB

                        MD5

                        15851edfd604ed38b1790a17065beb45

                        SHA1

                        21415d41f605b27221e102763adb56e8e440a78b

                        SHA256

                        0cc2b71a5ff86c9197093aaeeeef535e43c4ff0e4581a4927960c10f333dc82b

                        SHA512

                        87484e39526e8c8c4e92cfd998c0b810d19ba06b9c9a21850dba9580e0c288cea7ff5f5d91e96cd2ba2f83fb269b88a79ef113d41366181ecb3eae14633bd338

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\2886a6d1-8011-47b6-b300-d00279506639
                        Filesize

                        746B

                        MD5

                        a1a8b6e0115500daaa37355aa1d38ced

                        SHA1

                        ccb02b0d42a1f3d5136be634092738eb9d87e98e

                        SHA256

                        66917533a39f70898abd83c84646ec8c56d489d40cfe6cbdaf7d0ec5a0044870

                        SHA512

                        2c0d68251b9b839242ebd068c565e79797dca3f4541028be757165be2140a507155ec041fa8d254bfe6817264aab47a619dc1920f424e546e1df0c479055c325

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\81409c02-8f79-41e8-9e91-1fdefcf81441
                        Filesize

                        11KB

                        MD5

                        ac937ca1ce9b1c2474f4b95379100675

                        SHA1

                        e16a2e5f6043d5a0828ac82495537b675d2aa5e9

                        SHA256

                        0f90cefaf83d9d4dc926633a4cc5a48a468ea3a7e43ebd07f12a911c391cc382

                        SHA512

                        6ede0eb9745fc9801620c4d7781c8ca0db31f7bd6436d3027e2c113bf8fb01b5cdaa7680141afce7dac26335a276685b34d08e3d6d16125c0270c16afb25a9df

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                        Filesize

                        6KB

                        MD5

                        49df029c41d6a1bfa0b7873d7a9d2134

                        SHA1

                        1647c4d3cf9d23f7e5a9d08c434fcb78d6178427

                        SHA256

                        1c313763e59ea48c537aa4b28209cc949fed47a95e2e511620135874cb0a3018

                        SHA512

                        2db8a58839d20591a2d05be4f7245ac92ebfaa2d7e7df895564161edd85e225d65f7997dd260b167565d42deddc03165f9ddeb00107ff506f0bfac673608c98a

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                        Filesize

                        6KB

                        MD5

                        1efc1a6fb6a379eb78d9df768db866b2

                        SHA1

                        5a97e01207abb3db33602eddd0816aa518c87238

                        SHA256

                        3423bf4c1181949521ad42008c6b9af0709e2fb30232c7e367dd5d2835764c56

                        SHA512

                        2d346f83fe3e559013c5637a2232c2bef39f7ac8aceda26ca5ca8aaf390ed9f588fd85c7841123ed7bf97bc42d677ecc5b1384804d58bca16bcfbb2b443c30a0

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
                        Filesize

                        6KB

                        MD5

                        cb221f95e03a5023106619de1a04b836

                        SHA1

                        980eba66197f51139965da05ad7e59209b95a5f4

                        SHA256

                        2b071970507bfe1a369ddb927fba5062f6a818268f5854184f7c04bfdc98bb2e

                        SHA512

                        8f05ac29caf91cb5c8c550a71515618be08b0851928e5522ba5d9b6ce5d12a6f190886fc486830f87cf885dd9c1f4039bf3d3ee1cbfc49e76c23e667585afe37

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                        Filesize

                        3KB

                        MD5

                        199dff4dd325642438302b7849cf41fa

                        SHA1

                        8252119fe79a074dbaaf3d9b6965bad7db641a88

                        SHA256

                        28f325c34f23668971c0da650568262ba1acb134cec7eee640bf9c9941abb32e

                        SHA512

                        e008b14bf006c63f2a2230df63d1cd3cb921c23f98ca778bf71d75adb098ffee7cdbde5010fa2f23859e8678484c3e85d8dd4d8731ade9543b2f95d5b4e2a70d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                        Filesize

                        33KB

                        MD5

                        42cec614bb39c5f759dabb8218ec7974

                        SHA1

                        d9c1955b0f50993889f21f96f3c93efca7aa2210

                        SHA256

                        d12820484db0e1846034396f029f69738fa5433a83c2dd48f41cc8fcee611e40

                        SHA512

                        de8c19f810a263cf9cd9de1c3d023f72f09827cb72c88a180f16c46867ba5991ffd7e2721a8a63c57914c82474393da42f6a9436fd5c0ac396d5b0729f366123

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                        Filesize

                        34KB

                        MD5

                        9231d815af8323a061e3fa8a35808509

                        SHA1

                        4623d93ed487f3d7cf0f26a2319cc622e4b0bd0e

                        SHA256

                        b9a833f9dfd42e92faa333a020f672f2189146a8dae8641c6a44b7fe8d3225dc

                        SHA512

                        be845a751cf1ed8af5a662595fde2d08015748af0b1fcef8c60bc545feff5c604e0e26291d5c135013f82993d6bfa56ccb7dd3cc3a436e3750d8446171aa1c24

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                        Filesize

                        4KB

                        MD5

                        c487bc8ec03abbb10edba946b26741b7

                        SHA1

                        69d3741a60ef1b97c5f49005ccfddb5183c0bb5d

                        SHA256

                        df28f78eff9a788da10fc8222e04dd9f4c7a99be77ccfa1776849631cca91d73

                        SHA512

                        ec971794c3c05ed5a2c2b60c369e9eac15cf449b68243f297a56efede525820dfcf803e9828191b4c347476453a920c2a414f4e8b850693bd8cca8c99b0372a9

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
                        Filesize

                        34KB

                        MD5

                        c27254dc90f81e67edf22118f69ef558

                        SHA1

                        d7cc71072a2005d7ca3ca37b225fbee81a639955

                        SHA256

                        697f9fd645ecb0d60608748cefdfd6d5644f42e64c3e026599a29152f6429d72

                        SHA512

                        fe062c52c814ea3522f0d3d84ed2567991437fc7d5cb6190045a30e5f833895108d6f9ddd4750cbb63bd1af6d083e1dbd6dff8ffcb55c79242c6321655b28fb9

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore.jsonlz4
                        Filesize

                        34KB

                        MD5

                        ce3eada8cfdc7b326f06d30b0f834f4e

                        SHA1

                        45fbd70660f585923b9b68605cd1b0b8c97aa5bf

                        SHA256

                        34e8ad8a576b004e6f8b05f9b9a3d38046cb34b56053460e13f1bd1351692c05

                        SHA512

                        d00cea8f7dd07ae022e4aef135de9dfde04b3894957ee8a9b9ff631c6e6feccc0f0a2db26ea6f3302a80e407da1b9929e9b1753f2e6dd7f4830e6f5fb8c41f95

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                        Filesize

                        184KB

                        MD5

                        3b737d182b307176f0dc8099c5a6a55b

                        SHA1

                        11808217dd7290145ba71ba9e7485e6962a781e8

                        SHA256

                        792c2e484271b81a078061b8f475b875cb5bf956267c403ad39e77b5a0f0dd79

                        SHA512

                        e2704e3100447e0d821656989e4b6c88279ea8b5f491f287b5092d11761556ce497de0c5945642dbf516ae1d1e44f12580bee2019b10391dda1b4bc2b72d698d

                        Download Submit

                      • C:\Users\HLJkNskOq.README.txt
                        Filesize

                        10KB

                        MD5

                        f9616cef4c2d9e958471cd4279c6b1a5

                        SHA1

                        7909936b5341e03150d9e4a07750722ef620773a

                        SHA256

                        13d955c9765dd9e61b650f7db0fa4e8b2351c0cf35c5a2e92a41760509709b16

                        SHA512

                        f816fd786a27763290c3e3234de39080b48035846498ac52c5dbfcfed1d1c9ab41a36e346d2de8e13402e3ebde0f0fb01b6d6c6a8a24d74396eeefc00c28f4ce

                        Download Submit

                      • F:\$RECYCLE.BIN\S-1-5-21-3699363923-1875576828-3287151903-1000\DDDDDDDDDDD
                        Filesize

                        129B

                        MD5

                        c7fe43d6ddcb0f01e1895116e49f4e51

                        SHA1

                        f7257833d90ba5ddfec5db0e42bc8e5353f1e549

                        SHA256

                        eee1e20ee66fb54638abf6e526cbd8845afe2106f87211154724514b6a0e563f

                        SHA512

                        5f49f8a2123497d53739978f39becdd6909ba3e53b1bb6b9d559b5b64651bff30536c2faf3a65e2d6e79c2a85068ab7b54936a5754347fa58ff7c87247400142

                        Download Submit

                      • memory/2340-294-0x00007FF81B000000-0x00007FF81B010000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-300-0x00007FF81B000000-0x00007FF81B010000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-777-0x00007FF81B000000-0x00007FF81B010000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-286-0x00007FF81B000000-0x00007FF81B010000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-778-0x00007FF81B000000-0x00007FF81B010000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-297-0x00007FF81B000000-0x00007FF81B010000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-779-0x00007FF81B000000-0x00007FF81B010000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-776-0x00007FF81B000000-0x00007FF81B010000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-319-0x00007FF817660000-0x00007FF817670000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/2340-318-0x00007FF817660000-0x00007FF817670000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/5000-3-0x0000000002550000-0x0000000002560000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/5000-0-0x0000000000400000-0x000000000042C000-memory.dmp

                        Filesize

                        176KB

                        Download

                      • memory/5000-2-0x0000000002550000-0x0000000002560000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/5000-1-0x0000000002550000-0x0000000002560000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/5000-283-0x0000000000400000-0x000000000042C000-memory.dmp

                        Filesize

                        176KB

                        Download