d60555269a7aba90ed5826f2d9ad4d71a7ae02e455cdfe72da46af824e51c768

Analysis

max time kernel
1044s
max time network
933s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
14/08/2024, 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

simpleunlocker_release.zip
Size

1.0MB
MD5

73689b4624afada0ed9e96d36ebd49d9
SHA1

bb37634ab933864c0c188e48431c926631fffcdc
SHA256

d60555269a7aba90ed5826f2d9ad4d71a7ae02e455cdfe72da46af824e51c768
SHA512

e15296c8197136c2ca038176278c237ecee5658452eadc3dc03c60b0772fa0b3cc17c84b753ecb74625a8db551fd1959f4bf2a9547b84064496d28e36628fcc1
SSDEEP

24576:8+FC84VT/W2aJLq//5Pb9GHC+31ZyEjz7NhrWQKUc8Sqiv3/Ns0:8L3Vjv2Ls/5z9GTlZj7OQKUc8S7lD

Score

9^/10

credential_access defense_evasion discovery persistence privilege_escalation stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
5460	7z2408-x64.exe
5836	7zFM.exe
3652	Orcus.Administration.exe

Loads dropped DLL 2 IoCs

pid	Process
3300	Process not Found
5836	7zFM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
117	camo.githubusercontent.com
109	camo.githubusercontent.com
111	camo.githubusercontent.com
112	camo.githubusercontent.com
115	camo.githubusercontent.com
198	camo.githubusercontent.com
206	camo.githubusercontent.com
105	camo.githubusercontent.com
110	camo.githubusercontent.com
113	camo.githubusercontent.com
114	camo.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
163	ipinfo.io
164	ipinfo.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zOCC69C243\Orcus.Administration.exe:Zone.Identifier	7zFM.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5952	5832	WerFault.exe	89
5888	3652	WerFault.exe	118

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm V5.2 Resou‮nls..scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Orcus.Administration.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\XWorm-V5.2-main.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\OrcusRAT.7z:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zOCC69C243\Orcus.Administration.exe:Zone.Identifier	7zFM.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5836	7zFM.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	5656	taskmgr.exe
Token: SeSystemProfilePrivilege	5656	taskmgr.exe
Token: SeCreateGlobalPrivilege	5656	taskmgr.exe
Token: SeDebugPrivilege	5832	XWorm V5.2 Resou‮nls..scr
Token: 33	5656	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5656	taskmgr.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: 33	3000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3000	AUDIODG.EXE
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	5460	7z2408-x64.exe
Token: SeDebugPrivilege	5460	7z2408-x64.exe
Token: SeDebugPrivilege	5460	7z2408-x64.exe
Token: SeDebugPrivilege	5460	7z2408-x64.exe
Token: SeDebugPrivilege	5460	7z2408-x64.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeRestorePrivilege	5836	7zFM.exe
Token: 35	5836	7zFM.exe
Token: SeSecurityPrivilege	5836	7zFM.exe
Token: SeDebugPrivilege	2904	firefox.exe
Token: SeDebugPrivilege	2904	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
2904	firefox.exe
5460	7z2408-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 4088 wrote to memory of 2904	4088	firefox.exe	75
PID 2904 wrote to memory of 4668	2904	firefox.exe	76
PID 2904 wrote to memory of 4668	2904	firefox.exe	76
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4536	2904	firefox.exe	77
PID 2904 wrote to memory of 4180	2904	firefox.exe	78
PID 2904 wrote to memory of 4180	2904	firefox.exe	78
PID 2904 wrote to memory of 4180	2904	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\simpleunlocker_release.zip
1⤵
PID:3328

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.0.2147128734\1108558061" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbe6280b-0817-4fb1-92f5-c82555075d08} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 1780 12cb9e05e58 gpu
    3⤵
    PID:4668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.1.1368616675\1352794388" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddebdbae-a9f1-4dfd-a0da-bf55dd613b71} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 2136 12ca6871958 socket
    3⤵
    PID:4536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.2.544535509\281514089" -childID 1 -isForBrowser -prefsHandle 2744 -prefMapHandle 2628 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5753e405-419c-458e-9be9-f8dfa67f39e0} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 2684 12cbce95e58 tab
    3⤵
    PID:4180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.3.2082681159\707884913" -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 3396 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {873439cb-55cb-40f0-8481-77db61d9cf32} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 3424 12cbddab758 tab
    3⤵
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.4.674101004\873669573" -childID 3 -isForBrowser -prefsHandle 4324 -prefMapHandle 4320 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04e0e1a1-983a-41be-a3d6-eef9050fd5ce} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 4328 12cbedaf758 tab
    3⤵
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.5.1162635192\1715783965" -childID 4 -isForBrowser -prefsHandle 4864 -prefMapHandle 4860 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8d48e9a-3a43-4494-9bc9-dcbfff05771e} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 4872 12cbf1efc58 tab
    3⤵
    PID:2596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.6.883901113\1783304012" -childID 5 -isForBrowser -prefsHandle 4964 -prefMapHandle 4968 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {136a956e-3183-4407-ab65-1ffa874803e0} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 4956 12cbf1f0b58 tab
    3⤵
    PID:2600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.7.1603816273\1036027812" -childID 6 -isForBrowser -prefsHandle 5144 -prefMapHandle 5148 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d968df6-0996-493f-bf69-2e8675432aae} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 5136 12cbf4cbb58 tab
    3⤵
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.8.1014162159\1637476431" -childID 7 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5626693-7d62-47f3-82ae-a525f4237fbb} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 5652 12cc0ab5258 tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.9.958897806\304822273" -childID 8 -isForBrowser -prefsHandle 4396 -prefMapHandle 4476 -prefsLen 26830 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {46150ad1-992b-45ce-b6b9-85e31ad703fc} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 4404 12cc0c70758 tab
    3⤵
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.10.1271208694\1535816722" -childID 9 -isForBrowser -prefsHandle 5864 -prefMapHandle 5984 -prefsLen 26830 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1ecc2f3-939a-45b7-b12a-3e42411d005c} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 5972 12cc1691d58 tab
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.11.25167358\1312591451" -childID 10 -isForBrowser -prefsHandle 4660 -prefMapHandle 6216 -prefsLen 27570 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b8ea33c-8481-490f-8513-63b112aa2cd5} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 5580 12cbb497f58 tab
    3⤵
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.12.1192595697\898332192" -childID 11 -isForBrowser -prefsHandle 4016 -prefMapHandle 6400 -prefsLen 27570 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1d86a66-14cf-42da-a356-f50ce38fe5d5} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 5216 12cc302a858 tab
    3⤵
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.13.435584167\1232101437" -childID 12 -isForBrowser -prefsHandle 5336 -prefMapHandle 6032 -prefsLen 27579 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5910e5a-3d5f-4f4e-9391-325a90f67751} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 6132 12ca6860158 tab
    3⤵
    PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.14.2024611926\907752628" -childID 13 -isForBrowser -prefsHandle 6988 -prefMapHandle 6380 -prefsLen 27579 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04521b0e-de32-47e8-b409-57a97d3db7de} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 6996 12cbb4e5158 tab
    3⤵
    PID:5876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.15.1209874382\1303345308" -childID 14 -isForBrowser -prefsHandle 6756 -prefMapHandle 4664 -prefsLen 27588 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72129725-3b28-46e3-9bac-6866edc8f484} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 6744 12ca682ed58 tab
    3⤵
    PID:6100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.16.122721059\876837041" -childID 15 -isForBrowser -prefsHandle 4448 -prefMapHandle 6096 -prefsLen 27588 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d76601f1-a593-4a94-9507-1f02a3ac152b} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 4664 12cc2d35858 tab
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.17.318852300\1947359184" -childID 16 -isForBrowser -prefsHandle 7360 -prefMapHandle 7356 -prefsLen 27588 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91a9aca7-f891-4e84-89a8-0bf0d487171b} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7368 12cc2e40358 tab
    3⤵
    PID:648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.18.1907234381\1189251273" -childID 17 -isForBrowser -prefsHandle 6180 -prefMapHandle 6008 -prefsLen 27588 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94ef7a68-85a8-4261-a713-2a61cae1ce91} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 6360 12ca682ed58 tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.19.2109099065\581168152" -childID 18 -isForBrowser -prefsHandle 7520 -prefMapHandle 7068 -prefsLen 27588 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fffe817c-707f-44e4-9791-d44bf699904f} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 2704 12cc1490558 tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.20.1764242559\1705618300" -childID 19 -isForBrowser -prefsHandle 6084 -prefMapHandle 6152 -prefsLen 27588 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b48b3a82-cbb5-45a3-ad65-3da5fc76f329} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7208 12cc167e358 tab
    3⤵
    PID:5992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.21.796469110\670109885" -childID 20 -isForBrowser -prefsHandle 7728 -prefMapHandle 7724 -prefsLen 27588 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a5f150a-4781-4ae8-bc8f-5759812fefb6} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7788 12cc2d3ec58 tab
    3⤵
    PID:5480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.22.199425501\8948868" -childID 21 -isForBrowser -prefsHandle 5336 -prefMapHandle 5568 -prefsLen 27597 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {958d793b-78b2-44c8-9ab1-2db21fc22226} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7736 12cbff05258 tab
    3⤵
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.23.87882551\1719376947" -childID 22 -isForBrowser -prefsHandle 7552 -prefMapHandle 4448 -prefsLen 27597 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {222c4eef-eaf2-4c86-a9de-f6cda5648f28} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7016 12cbb4e6958 tab
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.24.159772397\1309379768" -childID 23 -isForBrowser -prefsHandle 7444 -prefMapHandle 7400 -prefsLen 27597 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3e54885-6e44-49a7-8358-5c7220e064ca} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7416 12cbb4e7258 tab
    3⤵
    PID:5980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.25.589001742\1993451150" -childID 24 -isForBrowser -prefsHandle 8180 -prefMapHandle 8184 -prefsLen 27597 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4706741a-be1d-48aa-a1ec-67b149bcec90} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7400 12cc0a61a58 tab
    3⤵
    PID:5728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.26.1282035884\658585883" -childID 25 -isForBrowser -prefsHandle 5988 -prefMapHandle 7284 -prefsLen 27597 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e26a573a-0098-4206-9c3c-62e66dc6d532} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7292 12cc0a63858 tab
    3⤵
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.27.1942797711\192263471" -childID 26 -isForBrowser -prefsHandle 8236 -prefMapHandle 8240 -prefsLen 27597 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e98d240-4eda-4927-a90a-b78000aee59d} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 8224 12cc0a97558 tab
    3⤵
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.28.1046838957\338895349" -childID 27 -isForBrowser -prefsHandle 7336 -prefMapHandle 5988 -prefsLen 27597 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bbd6650-bcd3-4e82-9c42-bd5acacdbfec} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 7612 12cbddaae58 tab
    3⤵
    PID:5736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.29.1696759035\158225137" -childID 28 -isForBrowser -prefsHandle 7536 -prefMapHandle 6776 -prefsLen 27606 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4dfe1f3-bc44-434e-9f94-fb3db5b77c46} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 6964 12cc0a60258 tab
    3⤵
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2904.30.625645463\235592085" -childID 29 -isForBrowser -prefsHandle 1316 -prefMapHandle 3896 -prefsLen 27606 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b899131-4655-4c9e-b09d-a14bbe63d341} 2904 "\\.\pipe\gecko-crash-server-pipe.2904" 6936 12cc167d758 tab
    3⤵
    PID:2448
- - C:\Users\Admin\Downloads\7z2408-x64.exe
    "C:\Users\Admin\Downloads\7z2408-x64.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5576

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5656

C:\Users\Admin\AppData\Local\Temp\Temp1_XWorm-V5.2-main.zip\XWorm-V5.2-main\XWorm V5.2 SRC\XwormHvnc\XWorm V5.2 Resou‮nls..scr
"C:\Users\Admin\AppData\Local\Temp\Temp1_XWorm-V5.2-main.zip\XWorm-V5.2-main\XWorm V5.2 SRC\XwormHvnc\XWorm V5.2 Resou‮nls..scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1920
  2⤵
  - Program crash
  PID:5952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\OrcusRAT.7z"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5836
- C:\Users\Admin\AppData\Local\Temp\7zOCC69C243\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCC69C243\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 796
    3⤵
    - Program crash
    PID:5888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
963KB

MD5
004d7851f74f86704152ecaaa147f0ce

SHA1
45a9765c26eb0b1372cb711120d90b5f111123b3

SHA256
028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be

SHA512
16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\12661

Filesize
147KB

MD5
ad4ca68ff3f072d66113db517ad71017

SHA1
1763ad24d8f90e57d7c0103392d16bf67309dd82

SHA256
a164f21211730edc3aad115c842cc25d3bd8625809ee7290f6ab651caa3cab2f

SHA512
7b5d915c0eaaad5a4dfd27af4a183765b97c4e2dc3e43dd0daa46694d6c052315c61d35536d8bea68e354838206dc071dbb46ae8c30014502f57aa5a605f57eb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\13374

Filesize
9KB

MD5
99094609a809126dd49061174b6f9e24

SHA1
66d3890a97923a8912adc3313e1aade33a9c533e

SHA256
9a3fa4b0d5db12d59354ba551a46ee99364a26ea9f48e043bed4378105e74558

SHA512
97c81f9863dc96d87bffd42f6963d778c7851205fa31a3529f1ef6f6aad308f4267f2f3dd53dca9f4f6af19691756835fb19c685cbf1376a6ed119cc978f045e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\15861

Filesize
21KB

MD5
9d6ebf54bfe12701a1a5cfffcd7396ff

SHA1
6fbb5f25898472b885ee9ca6bce101d5cd851256

SHA256
cf9ec2d84c7bdd83cddb1e51d6d19dbc82a8639c8cd67bdfd57cdbe10959988c

SHA512
f628add3da583c227cbf7e88983fc9865dcf4658edd248b238ef423558d1d857e4a327b24a5fb0fbab2b685c221814d18e5efd3412d7a0232d863454fb212d2f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\19393

Filesize
14KB

MD5
15563c8ad2cbd218310a9610530bbfd9

SHA1
0c7a5eed3a3e34c7393582a730aa39c710e0ce7b

SHA256
ca2a69cf2261dcc9e12260122052dd0cf83f6b1c34c5afc496ac01144236f341

SHA512
946090563f10f45aba364aa69d129b3ab5e1e4b29a66877d47a2e8c4544f9f0ba91ce5aeab42abb09db7aa143b981eb4bc448bd2484cad18fa780f4c07e30058

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\19851

Filesize
13KB

MD5
f362dfc9bb143e8707e931309472c035

SHA1
14901c09e96b64808751c767bf150ad84a4f1767

SHA256
17a5489c0590cc4b115c77a8ebf546964c1e5b81ccfd51a9e5ac3d1da4c0baef

SHA512
36b1beb80848b36fd3b2c9bda0cee4483d02be2e0266d8c05986e2dd77704cf33c9851e199ae426e0022e42c5116053a6e668a7e518fbb335304f85f57081518

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\22578

Filesize
12KB

MD5
a4e29b77f2a272270c280f1aa07e9618

SHA1
87c78b2253b6f4da7fb64bce4560a90549145610

SHA256
c6cb90113f0a23f9817c9a18f45c0f60a680112e8ad55bbb828a527315d49c59

SHA512
295d6d93fdf86abfc0ee3e187d7d41dbe4330092100228cbe2b103471b64b7a9a460fc2041b478b834306d3c69d2acfd19cbf98dba287cba9f9eeef124ce01c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\25452

Filesize
8KB

MD5
28ef6110d791e469bd5affc2ec6aa16b

SHA1
de67b4bfa51a25fdb6a3c3a86f7caecff52707f3

SHA256
640da087026512ce597b6d31651cf1bba0629eb7d293bdff749dd3295df975ab

SHA512
fbb8ae77a882bb9c1a036f1a2155c27288c93d767b13332a3e0537a65381f1e20aa2897fcbcc10f4bd8fe16ea165fa892bab0d8b9d6c8c79c98b187c4dae68ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\28065

Filesize
9KB

MD5
b002aa7f3d87da9899e14f199f52e342

SHA1
b4d50dd923adc228d80a39ac3cdc9d61660e2e0b

SHA256
05e5068b5af054e6b094594f8535f036b09f4a8c3a002708b978f0dd681de83e

SHA512
f7b4f13cb963c5a25a6a72175a20bc63c741be0543cb75ff5dc92727a75b6db6e4e189643dfa1dc4d3ba18ef338eb399162150d9d7e47469a0d6af09c84867cd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\5569

Filesize
8KB

MD5
e51a4b640f01d9c5aa5213df177e6f70

SHA1
6ab0532ba7f717ae1b4a9b1bfbb435fba19564fa

SHA256
84166ade8533d6d9e9bfb38009bd58b334eb43feb27e924ca77ecac9ec2460ce

SHA512
bd09d3acfbefe472b4907f8b1720482732f18d416b487236e24f00128298b26597b60ef7ae95db12f2d107ce0d73b56d8f4013aaea37fc48fac5efc4e0eff319

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\5770

Filesize
15KB

MD5
b58ca9d9f6f908e60d2e0fc28333206a

SHA1
c3c3c0737b09c6e7ca257bd0af32e0a60fd26647

SHA256
9694d78aaccd85c77100b885cfa04101d9fb9c93a42dd0fb7b5d2e461cf8c980

SHA512
8c505b15c17489ebdd4d1d00c9ab479b0452b28e190b78cd1efde4dc3dc834d9c25180e3932833b1c5bb2089ad651210738c408caf65a12954cf445d93de71cd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\8139

Filesize
63KB

MD5
accb6a2a81c1a52b89dbb185765265ac

SHA1
f04f2f7c038338ce4c4e0fbdffad0df88d100c31

SHA256
4c5c4358fcfe998f8b3d1b3940f275f5700d79c83ac9ca9bf645d14700808eb1

SHA512
660d778d84d8ff54590c5442b6722b72f689a4debd45cf7f1699933f9e7983b8a0d3b921ba40d957b668c2b512d7ae317a98bc6f86060f18d5cdde6390ff095a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\8231

Filesize
12KB

MD5
d1cb0d03dd99f6f4c687a8a34bc6e75e

SHA1
4fe9edbeccc6062091c2bf47d7775670b6d1668f

SHA256
31ee8c5199b4db671360b04ff0d7f14b5149ad002b2c909182df168313d2dee4

SHA512
66ec99021fa60d29753ac277494115be099942419dc825ef4887f13328569aa8109b7c9b50ed576df21cde7b873b3aae303f48f2d0448486e61964d865956efa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\03C5414C101F2F03E0251F68E14AC8998D89E1D8

Filesize
18KB

MD5
81f6aae7bf2b63d2f52491f9e366b867

SHA1
7ae160c038a04da935c70cd14edfc951e39bb2f3

SHA256
78cf47febb6dcd4488b7de87ed6cbc0fc04e8b78a98ac5baf7a58b45df6ba28c

SHA512
8707196e2b19e0c58016b76d7bf35d4e697dc5a1e1af630f7746e1304c375b70e07f1792819506991a15d24ecc0074fab173f635b79c7a3283b42ba2e232e7fb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\0D60E1A8A70CB4B33134DC478642BD47BE246D4A

Filesize
218KB

MD5
5a734de9cf57510c8634401f72c4a618

SHA1
f529e51c7e3e013be873a9d10328bc00df850689

SHA256
8988efb632a7c269952b7745ae176188a08de09fc62b99a7b68215191fc2cd0c

SHA512
96fd1a92e703d744370b4b42c328ee9c2cc5455ba7e30bc40f2350a26c8d1631f0b8325b6e6b481a7d18c11ff965648c9111c200ec724b9840b339bc09e6f04c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\0DA8E3CCBEFD3FB45A22D2C49FC763AE23AA30DB

Filesize
16KB

MD5
1859ce84f1494b9de3395bbb9b7eb98f

SHA1
a6d25897f939065ec2417c1ff6e3d05c9a6a6313

SHA256
2dc3e251fb99f7615e761dc270f2082ace4383b7d8167f7295fc27dc158bdbfc

SHA512
ed42284a01b88353170e6c126f77f8eec6c2f0d96269cc99c6f9cee2231f9d3d0f04aaa23fd59256317649b86c82fb7c467312df95aee7ffa29d1b48c19776fa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\166C7CD42D77DCA59102CACBFA6286C8B1656A3C

Filesize
19KB

MD5
5d9138c01db3546832d51c04b4efec94

SHA1
cb69ecbc85c9917cef841016e6417cab33c6d2cd

SHA256
e24b8e0671a4917d6050bb256713188ae9d0901e86a9a5e8694129b6b0f8cc89

SHA512
b4df407db0ba2b58d4ff2715de28023ad49ba54deb53ec3d862c331718ed270d130d7b23702826f7030595aab6e89d09489ba0de6858871e0c0b06e593b6b26f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\32BA73306F5A78994FA95996539E1BED87DD9622

Filesize
140KB

MD5
cad37aa1111139122d1f2e4783c12dd9

SHA1
7a573bdbfb20994ab73ef247541cb932da91c226

SHA256
51af0f158cb2a57043ef163c4030c68e15cb4422a1d14f009d3531ffea9cf0dd

SHA512
7664387cb4f6d17badf13f034a01ec95be25660a52ff9989a777ce799cb4a45573a4baed3a234a69235b19271b3e84bf624b946833fae577b5a28e246069c47e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\3499E0CDB4968FF402067428EA75B46BFF8FE5DE

Filesize
147KB

MD5
95841a64fafdc56ce0bc352cd6424b2c

SHA1
047d06ff4136d19d3eb6b42aee5a50012e217971

SHA256
c17835c52a69259533fa1b0fac8f239a9bfd4099f8a1f0e5d3d364c211345d6b

SHA512
d3edab0829be86f2c905c70b1273fc6acc83667a7b8c517bd626ebfff0586ecd0520167703d000d5cd2c2d3fa85e7ff812a0737b400bcb5a34999c08bf503765

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\4BCF7D608B2663D7D1515223C0F13E5D72484770

Filesize
79KB

MD5
a1c37a2d6c9200374c870b73b6dbd8de

SHA1
ec354e72998db18546b6c5a8030be9cd2f7c35e3

SHA256
02080e46decc6934fbe4c16251312bddaaef7d2dcfe5a8d70ec9af923c4e4fa9

SHA512
e00eca439f0ffb1e83640a5bddba7a9ba738840946ef5b3f037ee8d8b9788cf753304a3ae8e05ed4d509680a4cf3e229fb30996e53d4ecdb8d28821024fac197

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\705EEC7711E1081A5A4278AA905A36700F726042

Filesize
217KB

MD5
53f5c370034abe11cfccad26ba5701c7

SHA1
68f64cb6dbe16ce567d02829790fec24aa87d646

SHA256
7921c3884e33743aaa8922a89a39edc64527011ee1d48a050867fd22b57b0243

SHA512
681c3d0bdeaa62c77890939d43425acf3cd19c6e37641607bf755f460d69e0a1250a3bffbb646197ebce17514ba7d2cae75dc3a25c1df62917bb012ababc3cc8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\773718B8955FB5EA41BBFAAA0D1EEB9EFB905D8E

Filesize
76KB

MD5
a44a804dfbfbadbbd3d56e3ae2077bd6

SHA1
94b80361d4ae77079bccf77f3d038a62bc5b163f

SHA256
7866f5c583cc62b03446d92379cd4f6d607d94cfb7656a905740261bff71f59f

SHA512
21758c9c6ee17af6483309b72ecaa11aeac9787656765e0b6b43a6c16e9605c82f60ebacb283d556a4645b1b74b37ad90ab9be62f5533e24035825fd1d456f64

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\AF6E7B7DB9908D7B867517AC33D094ABD56E38F7

Filesize
14KB

MD5
e99f49909c393a085324797feaf02f91

SHA1
2c3bab237b0a7ef146da9f94a361f64479ea44fb

SHA256
141b20dde94222c3e82dcceca5b2eeeb4b8b439c33fc2bdbdd67f7399786f6e1

SHA512
9de37f105141ec3231c3a149ccddb06b54436866c058527209f52338472f928c487ac4bbe0f7069405455f0267be3a92bd89338aeb73ec1052baf8ca13e1b2ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\B6112E34CEA1F7F53B6C52D3C5799C6C2B45B8BF

Filesize
159KB

MD5
c6e5bb80165bbb331c37f7a6137d65d7

SHA1
f792c77c965a28247109a436e57a223f0b615de6

SHA256
89a1aa30227da7b53376d1d836a4c533e05edf56f68ce732329f84e0cdd8aaf1

SHA512
3443f6c38f4495c1419da865e444902b245b9062a83fb5a61a290bba73e16ebdb6cd31357d143a8fd887e8e7b8d15e900b5063b840bf62d4551b6956beb1072f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\BF0923D6C9AC3F4148AB74C98E937ACD57DCEAD3

Filesize
97KB

MD5
9c8cf59a37d1f80ff8730442077ccef7

SHA1
17d68944ce08be1817a2e7d5b58bdd03e32bfdb2

SHA256
ad0f1cf28685724e3e5ac56c5dd350cc5394d6390aa4e9d989a4e98d5fa8810a

SHA512
55c6da94895146ed9102477c90568ce11f0bc676c1e6c320a76e32b13c414acd8dce29609abf335778375c69ffedd5116acc47b2bf5b9da9b7be47f762f976c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\E6C22A3DFCD18E3C6145370266896FF76AE3F7EC

Filesize
90KB

MD5
2f9f0dce6c0c96e91ed5b02c2ce844c0

SHA1
be59684df3ec2fe089fe6945f3534221e9107f50

SHA256
d62eefd0c984629f03a48b5942245234c6d548a3d79c830c82b72b1facc7b5d7

SHA512
4dd28eccb62f9f6521f03ebd816fb59c477d4b31c454dee4149a9ceb5ce6edacdee9d5b85875364135e4501ae08161bf3f6b963ad06a6831d6da078f3d6ce103

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\ECE281212C7D34C2D33214DAB8505B450499A76C

Filesize
13KB

MD5
614a09ea0d57a4d3158df8c9c919e65b

SHA1
551e192fc42bf9df664153c519c57e5df99c715c

SHA256
352ae134919f7b1b653b2380e7b3163955850094eb2658eedefe7c169ba3d8d2

SHA512
90be597850ec2cf75174c4744379665d42fa9fddd7c467f915fd9265afaae0752fc0187636dae36ae1b0d681840bb44b7bf89dc4592143ffd6e5cd0ab08ab457

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\F042D0F0CB1D03F626670DE9F0BE80F1C09C7CB5

Filesize
16KB

MD5
457dc997f92548bec51ddbb75bed6eab

SHA1
95fb6369aad4a4552191122ddce4e5c3d713c41f

SHA256
52b0a43877b79d1b65310342d9450e7b6cbefe1f57664c1e88efa030bf5093ae

SHA512
76cc9b25444f56681b6a06bfd48afc349201fc259d76c1611103a261cbfbf7d84e41b45f65c02d230e76a074e8924f57084a7ce13cd6b7e6dd05acada6950c40

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\F5A1FBDEF4E6F115791D6C8EF1598942067B8080

Filesize
14KB

MD5
3489e72715183e9caa1da920f213a496

SHA1
6732c4761bde2fc5761426e5b2719fce00b88696

SHA256
ff4061aaec7f397b21c61df576c36c4024597190f242af03e0696ecd91232366

SHA512
464a18f9cfa03986c85b331bf29aa384a6af4ba102c83932d5e6d2462b37849c85edc10daf5fc8a0afb16bcb4cade70bdfac52b53a39f18acac6a9e4e3a5bda8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\jumpListCache\Wh1YAsl3WJDzRTiCtyXhbw==.ico

Filesize
965B

MD5
c9da4495de6ef7289e392f902404b4c8

SHA1
aa002e5d746c3ba0366cd90337a038fc01c987c9

SHA256
13ec8c9e113de6737a59d45ea5a99f345d6cba07f9a820bb2297121b8094790f

SHA512
bb72f0cc815e7b4c44959808b153aad28dbced8d97e50f83ef90229d19ea1c4b3fffff650bf49efe562451fcae0325cdbdffc1a5c4ec5d2c7c70ae9d1a0d8a16

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\thumbnails\9712299b0ac7f41303daf98d1d5391ab.png

Filesize
2KB

MD5
80dd029677af1c32d7bacb717f072a02

SHA1
8bbc34e6d90e5ee751bf07b4e9d5d663ac4c1fd7

SHA256
efcc5215cb1e4147077672fe8cd7db77113f3f7b67f3ac501cdc0a853595ef72

SHA512
66ba134f7df67b9131eb2253b2438aafbd338766415c2ae48553d45ef42ad8f80e17ff4d9af1e2e7707adf95b5fd9fd6c9d870a2df574564bbe4be9df6795066

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOCC69C243\Orcus.Administration.exe

Filesize
4.0MB

MD5
cc3670f1b3e60e00b43c86d787563a44

SHA1
4f1f8908f0ca7dc5ad01c3029206cc8c9d735e09

SHA256
9ca18641bc6b48708e4314b3f8275860aef6b9ea16cd6230d781f0abaa84c853

SHA512
684e584d8f2c6ace168760faacdd6ef44fbb85ec519805046e7d183ccf9faf4eb6764b84326aba0a90223a5b8354c3f9d055cf2297416b4562ca417924da9442

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
13KB

MD5
ea012795dd4c62bdad0acbd3f5a9b79e

SHA1
e630d98a54c39b295e6fa4873c504d867a80c51f

SHA256
7eb991f4791aa1edd8eee98ba3005511fc9f167a18bf15c3d35e0dbabb74de3f

SHA512
e74af26ad02727da6cca8c4da054596de505c956f08577a1c47e3b3192f521a11fde3a97451c4c0a4f6a521440fee9f9c1a106e279f0fccd4676fb3fd4d7ea1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
7560154564b96943471dd402b6eedfb6

SHA1
5a577be61fd28ad8b84c1e8990c12744f1c8b9a0

SHA256
6440d82c1e094e666b970abfa2c895f62a289dd19a836cfbc2dfdb1ae4e67000

SHA512
6777340d34bdb1d31e2b40cf9d677d44528f1d1624a1dc62ed8140bd5617dea15327db1778fd779a0ed5861d8fae54693c8c953f27eb798da8a23ff1e6dcafc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\54fe32c4-6dc5-49e9-bb2e-96716662832a

Filesize
10KB

MD5
caa60a57441d4b22bf0aca48c1e3a1c9

SHA1
40fe5e6f23cc1957648db5acf0bd7639d57819c3

SHA256
aca8b96545d5ef8f69738616374a8ad78fe92b45f12b7fa453f7affae72add30

SHA512
05084e1711e9689ef40d7f176adcd2f6a8475c42d2d6714fbe4780a94b6624afe90e5ba7a00826419712c1bfb1a5ef9734dd534ab73315a7aec7c16b0fe8a480

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\81952d03-ace3-4002-84c9-9dc69f0affac

Filesize
746B

MD5
feeba1eaea1176a9cec67d7480064efc

SHA1
44c2a6d23ade561d66066a0053d6aca7883d7881

SHA256
eb301e9d70486e678790be24cbaf884c54c5f28caf2af34d724aa1486e36ad35

SHA512
1826d2ff0528e5778778f615a611f6443ba1c5d9f2025d8ca424ee7cc136b5911fd411555a7bb55c6c929db9c2e6132b9cbe5597a4c1bcfedf455f5973bbc6c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
858ce8bec2806974c076e36c6e04642f

SHA1
1fd9d618db81a6215de0bf5573284ef4e07e1b6f

SHA256
fcc98d25c2d4c485b8836a6235c556107eb616d34220d8e8076748b5188c5b7a

SHA512
ea570284f8548376d6cb1f239e88331e1caf600bae2803498a378f59cc2ddd5ca9ef2098a156f38771078f40c1709456d031932c3c96501b7d96498d47da98b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
7KB

MD5
4abd166faf05c474c44a525c1f6fb35c

SHA1
82e47a3fc8d2ad2c4a9642d5ed2ec2ad8f812849

SHA256
37c06d24628cdf5ddea93b9dab48205fd9d14886c5b06639d0ea33c099c5f350

SHA512
5a4f086f07137e28c4d3bc70bb56fc2c7b506beb5a6f98c503224e695cb8a8951b0cb3b4fa39b3385822e064abfa1c480c667d31afbec875afc9c7f6baa5cfaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
a47d33c61f8cbf09806081ebf6926da9

SHA1
3a66268f6a2570ca4359dbac77af6ba74318c5a2

SHA256
bb572352eeb61b478e8f43fc287c828c44a71630f293da19514e464782245bb7

SHA512
b3894639fef0814ec640e61bfaecb9d611a24aa41d333bb0fad884570021a2e32f8dd95fde7bec11e4a15834dfd86eaaba8803c3749a3fa6d483ac5e84467672

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
15e474a2e72c59b6b87fe25286d318f5

SHA1
bc457e69b3799516e5a06a4371e0947ed2c7974d

SHA256
55de88d09765175a7843adcb7e7dbdc60c1adbbbaf63b2e518fba9aa8ec736bc

SHA512
b922374931da1939f2728609a4077f27f9b044678a80fb42caffbc10f544c662ed7893598e2fa59a4fd58d09711aafa044ecab930fc78c6431866f9b0111bb6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
77adceeeca56a9e2851b83427764c30f

SHA1
428eee228ce7d2885061a79986609b48b070e095

SHA256
a32c5942a289750dbc47c74184c101ffe10117976b995b3dd7610c889d980bbd

SHA512
82176b827f056d1e192afde253be82bd9df14ec137b433ffc9242e030f7d64f312c44ad86376faf0df74f3ffde138e49934530d59737181016e697780bf78688

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
673b2bd9fd74d1495eb6d33afab31075

SHA1
d56c4d2be30d65c2c8e7ef504960e540db14b621

SHA256
2591a5fe71c6d256603b73f120641375b06a47ab60bd0a1e6ac325a0f5d1675e

SHA512
cb5a0d079d6af0f164bc4a2f1f9c706682f8f97c54a1db73d94aa4d4fcb0811ea488f36d4b230bfc5fa113ec28be3dae917c51f363d1570dfebae0660ae62775

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
326261dddc97c380fefc9ef69088ed9e

SHA1
9e2b2b2b40a83707e780f722bfe709eeac3bc1b7

SHA256
0b6470bafff239f9ec4e57e019e3f91034f2490af0404388269b9a88c583a1e7

SHA512
af1488717e2d55be4c4b4615d0a8ffe0d792902d957111d64d9e6b16a215ccdba38d358ef907bf5fc3ce0b77e3f9f49e2da6e3118fd34b04379fd45255d6c7f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
9c31a165a3e37c3aa6bb8b3f282f5b3b

SHA1
f488f2e345b8fafb24e2ed45fa0bf0e380cbba9b

SHA256
96e482d47ba3930d4bc9afe036510822244d3f5104a623269ed677437da16fee

SHA512
05377bc1fb96e23aa637e9da29a754006d7fc0f2ffc5cb83619721c5ab5e6087bf1903a168ea15d5a4a501fab3bfc471d24ba004c3bdcceca1ef02a9aba1bf1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
6671ff4b3e206dd41e7226feceb93dea

SHA1
da407fb8464e39a609cc6bb3240ef7aa0098ac00

SHA256
cd2f86fbcf262bba4546ceaa2efb79f4aab0f2fa93b67fdd6702731fccb38d66

SHA512
100ca194dfd119fb6f6beab47ceb23dc03a2e3d093825873bde6a84ffc58625774ea536c1b1821287da687c6556729d06393239c500a953945a5d09c8ccf2cfa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
ec085fd5484e3810378133dd6b121e11

SHA1
6ada28c88279b806de0d1a03d811baddf845d40f

SHA256
d0dcd3b6be5fdfa4b29f652a8d5120baff906e0cd23fb8fe799165488e9ab5d8

SHA512
bbefc6fb8c6576f40cbc790119af077234e1255e40946201b9934d3c883960e4e07aaffcb9d88bbf4350482944b0ab76e487fdd9fecb2aa84deb9f848088bd40

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
49ba9bb932fbd05c7abade7e7402d04b

SHA1
0fd1cf63e3f3721f13f2f15266b52d88185f4f72

SHA256
3b4a69fdc8ee9af5030812eea50b1f56bd130fc6da181563880825062b57e60a

SHA512
806c56a532c45b8828d3deb7da947dbe337a0bda88592421af5f595cc49c04ea1c4587251b044d46b10173bc349367d326066557a2d58074d38a6a63827dd3b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
aadd87ce304c9bd4146e83ff43f6262b

SHA1
96185e8c4bba513532886c892eeeda479f564704

SHA256
db90c8051d9b6706c43e0612c837c1c36646f2b35fed033a8ec7ba9c322e9436

SHA512
f89195205eb1005f69ed2172a0d05a6f76eb837675e4564c722b880b9d48e890629ee005f8aa8e1a07a4291d09a11822a10ac10462b1c6db1ccaa610eeee0556

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
4de428220b1a1cab07a6dbbc8e278e0b

SHA1
1f750180c799eebd8440c1ae36535698c1b89181

SHA256
377b50cd402f44ce7cc0dec54185c98458a033bcb1d4f69cd5d90020a8d73439

SHA512
1442f41920daeef33cf5fde904093117315689a37cd9140d5603d5e6fa63a27842b5c58ae0d089861924f683e013c615363edcd92b959283958afc0e26431f8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
60abe95319735bd8390b1313d5a55331

SHA1
cc0fcf51b66acd623e6bd8ba88c05f24803a5b5b

SHA256
8ad11ad72834104686c42d26cf4d7c1d857db82cc4bf8e8c0babc03d32fda6e2

SHA512
4caacbbe48dcf71f9a8eba37cf3de01801977d0124f2c6c976430da355f5704d753a8b9ddd9202c5a5c8a59444b2d2889f2ec3626b7ca53dc1688dcd8474e332

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
c8503fe2de919066603c6eacffd1b146

SHA1
c87893004de7e3f36dbb58a02836ecf2ea366bf8

SHA256
376f27b3668fe3089168f7a2298a2e558d74d0407592aefca006bc7e7eaa3bfa

SHA512
208e4e8964b4a38c9766140b9627becd72667e85c17469c0da412c96f96ecccea3c0fe4fa12f71f79d54baf62e249a1301080f45e6c665b54a71ca0aa24646c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
de7035ddb8a7fdda31d2bbef0cc130c5

SHA1
ef50d8ab067d859e3bbb545070824ecd35be2d07

SHA256
46a9d11cceeca77644861a0cac1d246205a978e3054e904b0b2ee9a6c5ab7415

SHA512
af825ee35fe478e4db702b03a95f7ad21c555e4d2e05e08beab893d2871fb1ba96aadb884e35bf35fcebcea66545078c238f587423ae6df8b0cdf1d3527b0809

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
599adc6a552d14303eeeecf4361802b9

SHA1
475db99c4c29e6d35b4367b36639c4d8f52d8474

SHA256
f07e47bb5904f0a66adfc970b71da6b348c174e518fa2c864d36a8cdff89e862

SHA512
945086ba55af06163f646295201bc0eb78fd35d703011176c0b7535f40344405f29fc754c474b61efdf5c8903448598055a8159a82e40a839b3044cc8d4cb72c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
ce83368233bc7505bac32a47a3267cfe

SHA1
de69a97bf44a37213fe4a4bd0a299afa566aef01

SHA256
27a351b73f273b2103176ad5b421b6d9683c7bc9ac21195f7900e636c0216702

SHA512
ccdd87aa14262d04a13b793fcf5af15601ba93429ada4911f5e43ce7184ebb2fc291fb41a5b3be1d3a6f313877677f902d053862b05fbc12ab7a7e632857ae70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
3b0a1e9401b40db425d69a305d20743e

SHA1
fcf6172e13317e46213ffc8cd9d1b5f458337195

SHA256
c0b2663506f1865e8564d13fe4966eb4b271596258539ac14fe7eb9e3098d2da

SHA512
cef1e28c41dfa6bd5fa1c666dc826fd697359082791ced9081e26b5a9a84cb27e5e280cd1524a3762c9a3eb7b7ede7e9459c228420493b2e4074ff3128505580

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
3a5626f11f5e8cc31c6cca787e5ace37

SHA1
f7b8361a6490501d543ff3d3768ba45531e99285

SHA256
d2b8a2b285b33b7783760f715f309a5cea2d0df41bd4ec3dd4ecc3dfcf760f1b

SHA512
dc436166efa65741f434716752b46a1645d097b9885307aedc2ab5b8f9aa6555ba7242c6ac21d114ab6a01af1841525dd27dc50f9469e86fa64d4c1c53d8e104

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
6f1babef2b5010d00a164fb3637f0f2d

SHA1
4cc71634deaa8109f885d772da56bb84430d4dce

SHA256
5cfae5465feb7f0983123bb45d2c66a3adf33ad6161f16d3aaa5f749743a276f

SHA512
ea03bbf6b0479ee5ed08c3d4e94300881390f7496c0b2b44e647d05c1b69f48c1dccc03e340fc66bb04ab5d7fd2916f595bacccd4e53cc29ead3da3ae745c6f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e9ed92ab7612f498f0fd04c5ff3c0e1a

SHA1
b48b5f21e390dbefde799adf2448d4d51c161032

SHA256
9fb43570f66fc2390fcff64c5931db856945b5db12fdd52f4212f93a81e0ce02

SHA512
5fafb88b9b34cc8c2ccd0f4e3a02d25b8b6c78738a0b66574c9f74b26e0a87a84639e4abc0353295e1f6ec66945939daedb39aed93f6903fa6d6883bddd9d5c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
4c7d40893425bdff966638907068a21d

SHA1
072ad9918b894d324f242815573634ed1cef2232

SHA256
fe8a5372da8ed0c3fc586cfefb5a80005153356b37474eeff3fc00e1e030c990

SHA512
d8c4e917beafc74f8253e9dfed8dce82e64a9029183fe193e155ecaf3ed30cbb40cd86fd1aa4edde942a7497754c92aadfa39c134f1314a787fc7a7d0112d169

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
ca84a07ee071205e95c930cf663b8625

SHA1
9256c03062885f3f24f3e71c9846bc6250ee523c

SHA256
abb1ed6fbf25dd01f45cc5e6bd280be6511f5e2a43a06853692562b58dc33f5c

SHA512
40022e955041b74ddadb71b8dde182cc25cb27f8903b36464b578ce024944e552bcc96ef6a8b28799aa107e9103518f809df5a9cc6eb97103d001c6e13f0cb95

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
14bf1ec3d9b53ba6826bce2ebf3b5f2d

SHA1
0a56dcc216602d85f97b6be8f4d3551c8c436735

SHA256
92af7e308925909e8e20b2ca986a707239b5fa57af5f233c67b45db346644f8f

SHA512
0dc2fbd3ba72a4ba02dba4a844d1f8769b5de03d33e683659f5992730e6b0f3607e2006db74053460537926802999ac13036e3896958577b572f1a1596c56c5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
718b8cb5617a22f021120142ce7bcb1e

SHA1
86ad35cc3c2ef862fb7f653641f131ae712a02d3

SHA256
c462ca6ba4201b046d07ecee0d59ef0cbd23b04c281e64dac28e0544dc700ae1

SHA512
a8f8f4a427d2fab84071907508c219373e77d424622f7d2e534707fff297138d4dd168dbdc6f544a09305ca49f88f63b118969b80603b260a4795fd8d1216238

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
9316732fe9532753d6462e9ba92929fa

SHA1
aa05689f226c8722b4bb6884b8d15cf46bfefb0d

SHA256
8b103a0f32096b84fcb199747535c160bb3dde022ec79c99998e54fa0aaa62d8

SHA512
ecf02c05742ac61c610e4619d6c0aa9a5b92fb45231fd08b436ec4ede0d3bf790192ffcf97a73e428bef13e33d3e4e2694716ec3c779906a7ad73c073e821cd2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
da3dd8bcc8efa67353c2e9d1aef13f24

SHA1
afab05787e8ba5747bcb09997b44473f2b164c1b

SHA256
50fe5a8a2237e3f16d0b2efe90f844f6a477c041bd91e9ceb81e13c94e4b574b

SHA512
c61502a5b66f3b8a95cad3d5f519851d62a28d78e01eaf59cf170c8f6de1a18b80d84bc75b35464cefb48a635c67b56be7b755acd2290d3aa9530fe965f2e013

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
3e83583f7285155a2b08fb8d7c944337

SHA1
94f223ff5d7ebdab4f89b04d58f7fa9bdfd5b722

SHA256
2c4b0065720c2f7f3d021ba47aacd55da532ec74b12a18202344d949413895a5

SHA512
9e080d652937ca9ed4472547d7eaa14e9ea77d07268aacc7ba9fc93ee3adc459f47fdce556ca7b3aedda747ef3b8bbda1553053b1cad21504e979ab94deed372

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
c1c7802528bd1787e781ae20da71a7f1

SHA1
fd5d3219c8e40839c7c935d4bda9cf94bc53b785

SHA256
f5942e1e970658c50edd6f1999f2092b1edfd9a07fe7a654379d8b453d9bdd4f

SHA512
7849e82903ee0720790e9ba0125faf2974925503942f3a36faa2891218a9936d8a3313495ee9854c598f94b353a43e33c7b67dfd7e3c98e4c152ca2914518e22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
5670de4fff789396de5569bb59b889c4

SHA1
bc522e0e0bbbc0cd7f083bddbf26aa074224f721

SHA256
6c61602eb2509ab44f64b15a5509d1393375da36b16a013efbebff46c85a9384

SHA512
2fdb6737a9c4ddabca1047ccd54f9567be8504bb77068563bdb7a5bf7fbf371520a9df10c6c894bb75ddb783c048699d31eaf9708466f177f6e7e30adb965589

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
a790a8b84af89d084b87bd0264c743b5

SHA1
605e92c9ad1f2b01141f97af0fabe47dcc34c6b6

SHA256
c78605bda94ec5752aca3248f487a76c4ba6862b8c916710857db6a4d067cdbb

SHA512
b651f76f4e443a3efe16e09c052f9390cee13f73063ee653e9b38e0e36c4fda28650225bb51e06b17ace6a4dffe68ea5726d3fbc72c7b155f42799afc0deccfb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
bb85c8decb66881a82f5876cd74b8bf3

SHA1
b329f4638d866459668a0bedcb8462183fc0fa6e

SHA256
cb16333f0820f82021a1151215f9253caf8ffee0c707f6c8eabb260b316dab4b

SHA512
96bc888706a97b9e353dfd37bfcdf7d207e81627bfd6e1c02773c6587e73085f239f0277622d798b1e4d88188bb949a346b5c7397dd33a50a128e55f81bd239d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
c3868f6d7d4964c23dcf4db963f693e0

SHA1
24f49fadecb53ba9dc16d8b858ca592c7513ac5f

SHA256
0f1db62f1b4daa435fbb0555eb261cc1df9383e678fede45c7dde06ffd8a7bbd

SHA512
31a9e5357d30eb2db6fb357e86f23edfde60130131e0b69e704df02e94a11526d00b65366f5386998fea5cfb75a75534e9fbc0a4a1eb1fed8730f4719bc63466

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
f8898a67eed4b4f48eeffc0542ee7a23

SHA1
e57e4ea3e39ebca650b4936813396cd3371f30a6

SHA256
60e9ecf5e523c98ee67729b66398673a95d05f8d5c079938fc105a708679028c

SHA512
9c1d07ba63239b3de6ce9c71c8f81802ebeda3519415d74425dba6ddfdbc27a699d456e05765d3d72e93045c3f2f4487c5763c79b6869600706fac8ec1ba118e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
9060ebaa970a795d4e90c2c34c60e0f1

SHA1
f8b404b0129e1d4b244b1b13082f1b20521f838f

SHA256
e7078b0631130812c1f86ded7d44574099283433e4da23e4449d84d05d4c6ff6

SHA512
fbec681a650340b65f42f6cf0595aaa95bc2692776a3407db0b50949988b41e7a0c4f936b41aa116e32e788e6c91d3c34287f5af3f5a84db1229f2e0537c8b35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
77f888467bf0ef049535a6c73b12a708

SHA1
eda48bb53fb0a13dd6b5bec035daed4726260fb3

SHA256
e8a7ae0291e5a86b8378acfe44a92b4906453bbaff274988637794d0f7954642

SHA512
7ee7a0d8deb6517fea6c2d961331a0a8a61d3d142d72b7f378ab8679c82a49b224293ef5f36be971dc5a09de890750e6733773e62493406a910fea4c701c6d30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
fafd5d2ffa199cf862b5e146030829cc

SHA1
2f81e754944fea20dad7fab13772d3ecf3bd74af

SHA256
a12c241d4f9465b19420d40b6ef640d57fd67fad03c7698f811eda2b8e572196

SHA512
c35ca0b09ea8c716db8cb22813c32eec07f4cfc04f83b7e8ae1b181cd01008bfc32337e82515f359b6fbe963f7b9697116d2046ead7a54a586936e1b91fbf035

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
5d6bc15791c1d0427bd5bd9a091233cb

SHA1
f1ed64b4b2e07ef6b0f362a4ebb8c742a7b5cdc9

SHA256
e36f2129a3e9f48ea2e1cd16341c34338b15329837bea357cc419b6f06933821

SHA512
5a4936c700bb7d79df82b40a51a0ce394324d2250982c9097033ebeb7447de12f0693f6461ffc09d44180d4faaa402db72fb3b7412ceabf5e0f42ad0c8a2eb01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
930ab385895cdcb86b5676e1d1ff7148

SHA1
23736d116e15bc7dbd1623c88029f9647bb802ea

SHA256
025dcc902a9ef7bf8fc28de7b4330e0e84fa3e23d92a0d3d28477efe9a39ba5b

SHA512
a03fc7979d8a8543f3e0fd5a468e025d23d8283de0657195e5ffb255a1828cc8b23ced2509ab8111e90ad5053c560c02ce013af7b7ebc09c59038834671970ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\default\https+++mega.nz\cache\morgue\182\{cbf41c02-d212-4923-9758-1ff8e8c70bb6}.final

Filesize
1KB

MD5
3efa9abd92666265dd81c4f4311a96f9

SHA1
41b6b716d67b93555e444cd453f3c6e3f8c9522c

SHA256
5066b1841e8877db31312ef3af86f9bc9234c95071119e025764f45241a4e2e7

SHA512
5961950f077501608a0f2975e7f69c483eeacc4eec4ac77fd650cc1131609501f87819f93ed23aa508a90426156abf038a859fac4112d2d4435bbb634027cd6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\default\https+++mega.nz\idb\1409365021%s2p4.sqlite

Filesize
48KB

MD5
4f41e502d6f382e388553ae8fe07a73e

SHA1
a453f1dc2add75a704356143d54f5bc48410134f

SHA256
cdaf83b1e776d530c4990b7bd7fe280cc8f676cf3bdc8339d8f25fbaf988a0a0

SHA512
ba027ba4dfcd1473357be8f3db0db2fa4fb20a0f343460d0b176655980d89c6bd4ca213dc08a7d9d8efa0883b224364d267e33411d9d8a6301630e1233a06c53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
95d0a053301d69fe5f8cd629ecc5528b

SHA1
dcd3848e2d3d2dc27727b6672665e75584d3d16b

SHA256
51c42892aab620c7fe3f34358c499dcaa00a1e334d3af912193dade3fca1b41f

SHA512
1490b73543f87cb0d5be552cf12fd13d2a0b8a3c716c3f71236d0c60bb881b0da68098f99cb5f6b96ad646f87d8edc4a03e5d93b7c799c1b0914a4101c1f56ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0ed2663971e8051b2bcb574926400fa8

SHA1
467756bf41c377bdb07c8be10d5391f1df1d80a7

SHA256
0c44c9887ebd30506041e4f483422673660df0b74c7468b0cab2c69bee1f4e8c

SHA512
e521f02d0a4dc70e3bb33747c5113c76f18f15b4370826ef13700c4f559c8b158ed1d8ef79d7d88794bfea61496a75d653237391f2f8b5e53d8574a21f113898

Download Submit
C:\Users\Admin\Downloads\7z2408-x64.exe

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
C:\Users\Admin\Downloads\7z2408-x64.wurjGmc3.exe.part

Filesize
1KB

MD5
759ba9ac622302eebe7c61d272b0c3d5

SHA1
67fdb9f704dc0bada1b670fcdb710c815b2c147b

SHA256
b2d4fa77b70ff332feee689f002201bcb4978a379713bd9e68cb97386cc80399

SHA512
959f1cae4aa38dd4af05cb39aacbc86a3834740ecf6c2e5a04e0a92223c2cb7e55c6462922c1c9f872a0121f6a1c51b0c5041fec8aad4683253cf45007adc325

Download Submit
C:\Users\Admin\Downloads\OrcusRAT.K2j81HNG.7z.part

Filesize
21.6MB

MD5
56b267c137ae52bb5bfd01d62e6e9f95

SHA1
dbca02d965c3fb4ee40de6572016a389be2ee2d8

SHA256
3ad5f2990414da79e320ea8f2ded41993adf0e2d0e0eefb11ab085f7e55f320c

SHA512
e0707e843eed02cc54326c85c0caa1b1006569f8f1f8ad45fc39d7504d8bde6e422b746c599a6ae2d78fda941a4d444d343510a2e0eb95a86d5d8c3780f6d286

Download Submit
C:\Users\Admin\Downloads\XWorm-V5.pXbzeCmu.2-main.zip.part

Filesize
752KB

MD5
d67b6faa2bd31c7c127ce24d1edcc7f6

SHA1
21a884b3250e057fdf6ed606ac66d48caf234240

SHA256
7addbdb45f2109db217069a796ebddd84afe897d03f0b26e1106542e21bd5722

SHA512
3cedd8f33efac84ff4a150c59d760f4380883ef19c41e336fe61c1c4324cbf890041a870bb0bae133e75fa3fb523b2fb70d58f99ceaf23448700a8aa42557f69

Download Submit
\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
memory/3652-2499-0x0000000000D00000-0x00000000010FA000-memory.dmp

Filesize
4.0MB

Download
memory/5832-681-0x00000000058A0000-0x0000000005916000-memory.dmp

Filesize
472KB

Download
memory/5832-680-0x00000000056F0000-0x00000000057A2000-memory.dmp

Filesize
712KB

Download
memory/5832-679-0x0000000000E70000-0x0000000000ECA000-memory.dmp

Filesize
360KB

Download
memory/5832-682-0x00000000069C0000-0x00000000069E2000-memory.dmp

Filesize
136KB

Download
memory/5832-683-0x0000000006A20000-0x0000000006A3E000-memory.dmp

Filesize
120KB

Download