2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

Resubmissions

24-08-2024 17:24

240824-vy3xqasfrq 5

Analysis

max time kernel
217s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoClicker-3.0.exe
Size

844KB
MD5

7ecfc8cd7455dd9998f7dad88f2a8a9d
SHA1

1751d9389adb1e7187afa4938a3559e58739dce6
SHA256

2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e
SHA512

cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d
SSDEEP

12288:GaWzgMg7v3qnCiWErQohh0F49CJ8lnybQg9BFg9UmTRHlM:BaHMv6CGrjBnybQg+mmhG

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoClicker-3.0.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1480	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
904	AutoClicker-3.0.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	5048	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5048	AUDIODG.EXE
Token: SeDebugPrivilege	3748	firefox.exe
Token: SeDebugPrivilege	3748	firefox.exe
Token: SeDebugPrivilege	3748	firefox.exe
Token: SeDebugPrivilege	3748	firefox.exe
Token: SeDebugPrivilege	3748	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
904	AutoClicker-3.0.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe
3748	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3748	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 2952 wrote to memory of 3748	2952	firefox.exe	115
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 3240	3748	firefox.exe	116
PID 3748 wrote to memory of 4748	3748	firefox.exe	118
PID 3748 wrote to memory of 4748	3748	firefox.exe	118
PID 3748 wrote to memory of 4748	3748	firefox.exe	118
PID 3748 wrote to memory of 4748	3748	firefox.exe	118
PID 3748 wrote to memory of 4748	3748	firefox.exe	118
PID 3748 wrote to memory of 4748	3748	firefox.exe	118
PID 3748 wrote to memory of 4748	3748	firefox.exe	118
PID 3748 wrote to memory of 4748	3748	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4432,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
1⤵
PID:712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\PopOut.bat" "
1⤵
PID:1176

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x3f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PopOut.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2008 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20d1e8ea-1b75-44aa-978b-d77d1cf7a014} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" gpu
    3⤵
    PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 23638 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66c5590e-9f56-4e60-8824-01a024f1b0f1} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" socket
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3092 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 2956 -prefsLen 23779 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55c4ecbd-4dbc-4c0b-9e52-be4399b30cd8} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:3684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4184 -childID 2 -isForBrowser -prefsHandle 4180 -prefMapHandle 4176 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5aa88523-bc5c-4b04-88a6-ebe2f622bf18} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:4104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 4796 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {063a55ee-da0a-42cf-b6c3-301ecd74d583} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" utility
    3⤵
    - Checks processor information in registry
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5284 -prefMapHandle 1412 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {057cbedf-2b80-4f4c-a899-267503c70abd} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:5684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5276 -childID 4 -isForBrowser -prefsHandle 5436 -prefMapHandle 5308 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30f1b499-5f55-4cb3-bcbe-0b5b11281a23} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 5 -isForBrowser -prefsHandle 5628 -prefMapHandle 5632 -prefsLen 26882 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ebb6106-cc0a-4854-8347-db24621bdaa3} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6088 -childID 6 -isForBrowser -prefsHandle 6008 -prefMapHandle 6080 -prefsLen 27068 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fc395ae-4d1c-4123-80da-d8bc5715aede} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:6056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5324 -childID 7 -isForBrowser -prefsHandle 5392 -prefMapHandle 5828 -prefsLen 27998 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c3c14a7-611c-4f06-a73c-464277ea7211} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6576 -childID 8 -isForBrowser -prefsHandle 6404 -prefMapHandle 6568 -prefsLen 27998 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36721e31-4805-4339-86e7-055cd7dcc03d} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:5192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6684 -childID 9 -isForBrowser -prefsHandle 5392 -prefMapHandle 5344 -prefsLen 27998 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fa0033f-64b5-478a-94a9-c4d4a727a9c4} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6824 -childID 10 -isForBrowser -prefsHandle 3688 -prefMapHandle 3684 -prefsLen 27998 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caa56f02-2520-4ae2-8093-d4ee656132b3} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:5784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7040 -childID 11 -isForBrowser -prefsHandle 5288 -prefMapHandle 7028 -prefsLen 28048 -prefMapSize 244628 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bbc3523-09aa-4011-9a79-83103ffb6a28} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5628 -parentBuildID 20240401114208 -prefsHandle 7184 -prefMapHandle 7188 -prefsLen 30582 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ddeeca8-687f-4a03-ae4d-a4623cd3c2f5} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" rdd
    3⤵
    PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7136 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 7172 -prefMapHandle 7176 -prefsLen 30582 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0181e32-a680-4f48-90d2-7c9f26eb65af} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" utility
    3⤵
    - Checks processor information in registry
    PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\activity-stream.discovery_stream.json

Filesize
41KB

MD5
777e7bdbed2a7f867e89d25df9532a19

SHA1
902b64cf50ae11cfe188da9b80f10907093dbd14

SHA256
79bc336782d35d4cd27f71d98084dbddf1e507822b90cdf40fbad50657cc7fea

SHA512
94dabc96b98e5a2fec369ce6117ab44630f43601eb0c895e2e1b7e39f5ac2567bcd14952f62c45508ea1e9e4ef6eef0888d94935630a42c2b69e98c7185b255a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\cache2\entries\5B43B7E0D98BA1A65CFF8759892104C6BA63C24C

Filesize
221KB

MD5
4579253fad62321a4c330368c62f9746

SHA1
8147bce618c1386b720d818d7932b62d4c240d56

SHA256
3d72963f66cff6b2461d45ab59dc38924805b7d2e5b2adedc3e0eac3ddc5d048

SHA512
41991c13e652885123bb3f8ce3dbb3946065c05d6f6be40a46eddcffebf340429d4cf430f863026d6eb8bcea221122b2db550a9445d9ab557d4bbc235058554d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\cache2\entries\C5F366CFFB359A037E595A6716540D5C5ECAB756

Filesize
139KB

MD5
fc287b0d0e2396b56f76cdce88598c4b

SHA1
bebca815b4e164c14740a474d9f854c1519be535

SHA256
02d0d306bb4fb8354e3d8f9adf0c81d352b5c510fbde97998d6b0cfa41843c4d

SHA512
1908bc16a67c0254aff7e6c798e603be1ae0c9d7c9f28b72be344940835dbe13e572c1cdf77293149ac29069fa788a08291920cfcfbe177a3f469d0769455716

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
8KB

MD5
e32a30c57730c35e119a29c63c05b39f

SHA1
ea5d5643e0debe962e40effa3bc02a336d8c264f

SHA256
589c3b3cf32c11ef2a80d3f5a390bca9b71e4d6c483f514b8fe54133c61ea40d

SHA512
7a11c11251a73e20e27b6e71149e57f14a94f021ed810043e4caaa1dfc876b0e3ae49359fc73add4dd16c2987d440899dfb09b3564df0443f87bb19bd03390e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
12KB

MD5
145f52b70b48dcd680b82308a754c36a

SHA1
1de59dcaf7a475ac7e6f9c1ccb8df1027f1fba5e

SHA256
8033d925a7924bd3fc3084f5b6da60f26aff6693a33bf76bedaf623b261ccee9

SHA512
411d041adc31f107b30d40b6298e4f951221bc7cf72b5f033fb7f65f5f5fcb09eb64965d4b6c8829c49b760360dea27ad14eb4835f3fa06e2eec4197e02e0b0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
7a6d9bc54839df4d3451b38ace20f06e

SHA1
fef4293ede09494b9315319f614a74357c805801

SHA256
10b5cf6e1e9bc368868e46e12594b65026871e1f6f2d272c0e212ed250c04699

SHA512
2a03461926308868fb71037992d92e71c09c8d16c4214ff3e9aa81a87feceade7fc697a59155b02cfd36e690731564a5da10c3634f6d8e38389cdf5a2d66f6ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\42382fd4-bcaa-4ce0-8333-4552fc486e90

Filesize
28KB

MD5
f274ec524d75e2faeaff0952693e4924

SHA1
68c3489697ec1307609d99176936466446a49cf5

SHA256
65117ef734ed09a7b568b44fb5bc1827de341ab368118cf46ecf9ca5068582e8

SHA512
f8801971ae491c42377fa781235d5f118dfad465a29d6b233222844d8d10b784f9091a79a95aa0b8f1492d9fb14dfbf4e58e5b935cc710ca0259c7865c25b9da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\436d5c71-d6e6-4d12-8252-523bf3dce705

Filesize
671B

MD5
747fa27f363434c5ec4e0920064e7e16

SHA1
69cf2781b23cf1087070a7f9873fda31ab5f4f93

SHA256
1898ed41955641fc9d86b104e16598b72297eec8f77f52dd6d98a8dc6c3b30a0

SHA512
9ed9e6b4379314d932df5086beac12b9b155c524176cbf292c43e08cf1cc6365a7470d1c3e06ec4729635fb65aac0e99d8a00f565e99d12963e610158379fc89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\b6f61809-d16a-4921-95d1-46fe6fd0d456

Filesize
982B

MD5
d37caab7121139f98a1e7ac0eb300279

SHA1
5fea07d394630dc346cb6a573df47623c7bae316

SHA256
9506074ba8fcdb5df4e2eec89123015d31eeddc14d331d57d4372a97e7702ab4

SHA512
60f47fc63dcbe7fa50aa94cc29ff55866040a98b4fbce3eb1fad46059ab23c86db1dab45cddde8cc6e23947b86cbf4fec400c079a9427943ff5e9bf2f7c8bbfb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
11KB

MD5
59b2c2191499ce0fe1b3814b7524eb13

SHA1
48fe856495a94f75e7073f2cafc223eebea551cd

SHA256
d6f5b9fff31b9aacc6ec332baa5a5de47b98d20c3f8c6521014ce4424ca72233

SHA512
93674870401a29c04573c60dd90e5ffcf9f3b0af92dbdcc63d0568c48e79ae83d544bc80dd186b4422e8b3e108dd980e13a677b502c9fe2046a0c9b65b033004

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
11KB

MD5
a137a95be5afc03308b0223561946f3e

SHA1
8c8f18946523714452d2d53c60c09e119173d7c6

SHA256
746b0bad139e5f5c06bd74fbaa83cf897a30a93e468eb9c214df78c11c3be83b

SHA512
2ae175e4fad2ab3fbc89d93cab5cfddae648524093d8b4767a1ecb55ac54f3d1e225e06ebeace11b1b6ca1601c8bc5f2d00c08126df03bb18710183eb6466572

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
11KB

MD5
7ab22bd380b4fe00fe772ad78de28343

SHA1
d2ed3c6b27ef3a984c76b023fcd3fe28c3a4ee50

SHA256
9706cec93ab5123299d32c07eba50361d08fb34b0435653ae09ba221560b9c60

SHA512
e36fb9ff9c629494e7da834a0ecd36a4113c82b1e91ea548f3dd9bb6ff5f368bc38f91b739b66a51527047c77cdf5fc78b116566c8830c17eb811b1282ff972c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
11KB

MD5
31b31d2d5f4ee4f2f2d84190def56489

SHA1
485d6f4383c570ce4ae706414a8d96030714896d

SHA256
99faaec691b74bc0e1be49d0a7ae744e0ad746ddde3825bb77dc9ad6879711f0

SHA512
0dad015f9fa1bb825ba34964db0624d450c2ae865f4ed3248bbf4fc30d368904a24530ce0ffa4b4e16b9a76d12b7fce0d9a99fa390216acb29fc1cef858ef4b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
11KB

MD5
1701b1fd93721007e4e07f7c88ca0ab0

SHA1
9b0785e25166eae650dd22ea37772f53011b3547

SHA256
9b3955a560d77f7a942383ed528234737445b3be4bcf667e2bc834f83ee08eda

SHA512
5ae7c87c9962d79c8e530a7b33705a0ef6e21699d37cae0ceca55454771802c7d7ff5d00127acc441db4998e7b18a835af5ab4ae89375acede0b50557c62648a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
eac4ec23318af2b7b55ac521e5bf88e5

SHA1
74422ecf202a3023e1e2c7c7f80858f6014c5371

SHA256
131f3ccf38e141eedad2a5803d1ff8d211f641c210102eb51ba405c02b9b657f

SHA512
f78c3b895eb5010c53807321a3fc76057a039cf35af75a8d9444b59f5749fb7b6a76dd62fe755a02c41f47a20a8c03f1fb0588aa3b76546534d2a1b456136f1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
785162d7242aba99f78f5ff18514ccdc

SHA1
3cbd3dfbcc54dcb20ba8d47f22fb6336f8931b60

SHA256
bd4111e83824013646ee1f7b91cfc7e884a4aa6368521c04d823b2f3f6482203

SHA512
20d3190eabb21c62d85397c7d700da1db904bae5718b5c2f03e37c365681984df3e0f76e5338439b5fa5258e0944183ca979904531f1d86654d3743f359dd173

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
4f6356eeb0197def60b4a88acfb34f3a

SHA1
7df6665432ea9be6254817da7d64847912a35a48

SHA256
c0680bd3309b2c0400cd35c0f2d32e3194e992f1b1628594d8f7823184b7e225

SHA512
5d711720d954a7ee407c6be562ea8bb33202fa37024756c44aef1f2c35bbd0fec89fcc737b0fd9b43d95388ba9a22d2031fd373ad2a0d9ddbf34b17591f37bc3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
1b32d803816c78e4839e9f61455a0d1d

SHA1
502212bd7627f4c01876b028b3703869a1cbec10

SHA256
59ed7c5027b913545506484ee2b462260cf24d2e74b56d6049ae8a6417389a78

SHA512
afecbabab30e86fdd754b4fec019b03e3b50b949e7db6c6b46d796f5cbd4168add8e009409d0908916f5879a8372a05e0fb2f9674449c40f32329ec3a4dbe86c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
b464ac13c7b8c61a7166b51729db8889

SHA1
be8337fc543be48750a7ae849e9b0a57f8f2fd26

SHA256
36a435b070b25189bbf70edff6ff836f36f56d3b21ddfb5da81264d66dcb3a8c

SHA512
047b75a2ff675fa12951e96c38b2500449f06b4ae6e5d376364cd666454d056fc3d76cbe445090ac4a669b3043fea1c151b680e62c93283ee2a355ce55f8abbf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
25ef230aeb06151a741e89647b7a37ef

SHA1
09125f4ffea505837fdf76802571444cd49a51f9

SHA256
726557c33f4617a82c9da0a6c2bf77c8e86a15c27ad31791d0c157aaccfa8203

SHA512
b13d4268ca1e47de110060c3085e52bcdbade5d0e4973f69bed3c1ec1ea334dd7b172481cf751225bf9339c86a9abd25256db1988a5fa36935df04f69b1f8be0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
c69d399ddf01d94d114645d56057ee63

SHA1
554b2d9b9e1c17f714297b27642ca13b39fdea66

SHA256
241897f5a3335068a13822b855ddf01c464cbaeda0b53631505f35b987af94de

SHA512
332d3cbce0878f2a81d2ece25b6b16bd2641b3c26b48a0402c5140b0efbb831be66c0292a534da8e3fb25fa56ead7328638e06a5ba7162eb62575e15f1c5bbb6

Download Submit