2fed09c8225b81f260bc0f3ef29ca802ad881d408a7ea9b81b9fcbf15783c0ac

Resubmissions

06-09-2024 19:14

240906-xxybystcpm 10

06-09-2024 19:08

240906-xtlhzstdmd 8

Analysis

max time kernel
117s
max time network
266s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hel.txt
Size

406B
MD5

15da365f4f090a3e38d8329e6860ba83
SHA1

093b8444b4d0bb1e91255b5cd9e875738c2ce916
SHA256

2fed09c8225b81f260bc0f3ef29ca802ad881d408a7ea9b81b9fcbf15783c0ac
SHA512

316daa931daeb1c60b970363d1d6269f52ff7c7e829e4c3e9e90321fc97fc0dc8278de53417765b4d3372eb8da1e6bbb33bea9e2f1f7be4b588ba5acd36811b7

Score

8^/10

bootkit discovery execution persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1172	Monoxidex64.exe
2568	鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.exe

Loads dropped DLL 8 IoCs

pid	Process
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1172	Monoxidex64.exe
1196	Process not Found
3196	MsiExec.exe
3196	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
67	raw.githubusercontent.com
68	raw.githubusercontent.com
69	raw.githubusercontent.com
70	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA759.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f79a5d3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B84.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA17E.tmp	msiexec.exe
File created	C:\Windows\Installer\f79a5d3.ipi	msiexec.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSOXMLED.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5064	NOTEPAD.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00004109511090400000000000F01FEC\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00004109511090400000000000F01FEC\SourceList\LastUsedSource = "n;1;C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.exe\:Zone.Identifier:$DATA	Monoxidex64.exe
File created	C:\Users\Admin\Downloads\Monoxidex64.exe.vir:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2320	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3096	msiexec.exe
3096	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	firefox.exe
Token: SeDebugPrivilege	2296	firefox.exe
Token: SeDebugPrivilege	2296	firefox.exe
Token: SeDebugPrivilege	2568	鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.exe
Token: 33	2864	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2864	AUDIODG.EXE
Token: SeShutdownPrivilege	1292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1292	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.exe
Token: SeShutdownPrivilege	372	msiexec.exe
Token: SeIncreaseQuotaPrivilege	372	msiexec.exe
Token: SeRestorePrivilege	3096	msiexec.exe
Token: SeTakeOwnershipPrivilege	3096	msiexec.exe
Token: SeSecurityPrivilege	3096	msiexec.exe
Token: SeCreateTokenPrivilege	372	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	372	msiexec.exe
Token: SeLockMemoryPrivilege	372	msiexec.exe
Token: SeIncreaseQuotaPrivilege	372	msiexec.exe
Token: SeMachineAccountPrivilege	372	msiexec.exe
Token: SeTcbPrivilege	372	msiexec.exe
Token: SeSecurityPrivilege	372	msiexec.exe
Token: SeTakeOwnershipPrivilege	372	msiexec.exe
Token: SeLoadDriverPrivilege	372	msiexec.exe
Token: SeSystemProfilePrivilege	372	msiexec.exe
Token: SeSystemtimePrivilege	372	msiexec.exe
Token: SeProfSingleProcessPrivilege	372	msiexec.exe
Token: SeIncBasePriorityPrivilege	372	msiexec.exe
Token: SeCreatePagefilePrivilege	372	msiexec.exe
Token: SeCreatePermanentPrivilege	372	msiexec.exe
Token: SeBackupPrivilege	372	msiexec.exe
Token: SeRestorePrivilege	372	msiexec.exe
Token: SeShutdownPrivilege	372	msiexec.exe
Token: SeDebugPrivilege	372	msiexec.exe
Token: SeAuditPrivilege	372	msiexec.exe
Token: SeSystemEnvironmentPrivilege	372	msiexec.exe
Token: SeChangeNotifyPrivilege	372	msiexec.exe
Token: SeRemoteShutdownPrivilege	372	msiexec.exe
Token: SeUndockPrivilege	372	msiexec.exe
Token: SeSyncAgentPrivilege	372	msiexec.exe
Token: SeEnableDelegationPrivilege	372	msiexec.exe
Token: SeManageVolumePrivilege	372	msiexec.exe
Token: SeImpersonatePrivilege	372	msiexec.exe
Token: SeCreateGlobalPrivilege	372	msiexec.exe
Token: SeCreateTokenPrivilege	1292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1292	msiexec.exe
Token: SeLockMemoryPrivilege	1292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1292	msiexec.exe
Token: SeMachineAccountPrivilege	1292	msiexec.exe
Token: SeTcbPrivilege	1292	msiexec.exe
Token: SeSecurityPrivilege	1292	msiexec.exe
Token: SeTakeOwnershipPrivilege	1292	msiexec.exe
Token: SeLoadDriverPrivilege	1292	msiexec.exe
Token: SeSystemProfilePrivilege	1292	msiexec.exe
Token: SeSystemtimePrivilege	1292	msiexec.exe
Token: SeProfSingleProcessPrivilege	1292	msiexec.exe
Token: SeIncBasePriorityPrivilege	1292	msiexec.exe
Token: SeCreatePagefilePrivilege	1292	msiexec.exe
Token: SeCreatePermanentPrivilege	1292	msiexec.exe
Token: SeBackupPrivilege	1292	msiexec.exe
Token: SeRestorePrivilege	1292	msiexec.exe
Token: SeShutdownPrivilege	1292	msiexec.exe
Token: SeDebugPrivilege	1292	msiexec.exe
Token: SeAuditPrivilege	1292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1292	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2296	firefox.exe
2296	firefox.exe
2296	firefox.exe
2296	firefox.exe
1292	msiexec.exe
372	msiexec.exe
1292	msiexec.exe
372	msiexec.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2296	firefox.exe
2296	firefox.exe
2296	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2296	firefox.exe
2296	firefox.exe
2296	firefox.exe
2568	鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2608 wrote to memory of 2296	2608	firefox.exe	30
PID 2296 wrote to memory of 2820	2296	firefox.exe	31
PID 2296 wrote to memory of 2820	2296	firefox.exe	31
PID 2296 wrote to memory of 2820	2296	firefox.exe	31
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 2828	2296	firefox.exe	32
PID 2296 wrote to memory of 1740	2296	firefox.exe	33
PID 2296 wrote to memory of 1740	2296	firefox.exe	33
PID 2296 wrote to memory of 1740	2296	firefox.exe	33
PID 2296 wrote to memory of 1740	2296	firefox.exe	33
PID 2296 wrote to memory of 1740	2296	firefox.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\hel.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.0.195148691\1038879239" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5aa51198-4fe8-4e36-9ed7-9ff8a67001ae} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 1316 11fd8b58 gpu
    3⤵
    PID:2820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.1.1078730561\1549656038" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da7ac71e-a689-4bf7-839a-ae843efa6f32} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 1496 e70158 socket
    3⤵
    PID:2828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.2.1723811916\1550734250" -childID 1 -isForBrowser -prefsHandle 2052 -prefMapHandle 2024 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {921c14af-c554-4dd3-8846-ceb849e44364} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 2064 1a48c358 tab
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.3.10907761\711281981" -childID 2 -isForBrowser -prefsHandle 2372 -prefMapHandle 1120 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {188532b3-31c4-4dea-b4ee-0f0dc712b434} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 1692 4032958 tab
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.4.386817848\651758340" -childID 3 -isForBrowser -prefsHandle 2804 -prefMapHandle 2800 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22f4c097-2357-4d37-b3e4-4a1042c8c7f6} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 2816 e61f58 tab
    3⤵
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.5.978332563\1816593236" -childID 4 -isForBrowser -prefsHandle 3864 -prefMapHandle 1072 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b047697-d072-4def-a422-8b11ece2c71a} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 3892 1dbf1758 tab
    3⤵
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.6.229046453\1562894705" -childID 5 -isForBrowser -prefsHandle 4000 -prefMapHandle 4004 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edcb17af-8a26-40c6-bd23-ef3687d9c565} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 3988 1fd42558 tab
    3⤵
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.7.1985087837\1566182437" -childID 6 -isForBrowser -prefsHandle 4180 -prefMapHandle 4184 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9d52379-74f0-46c4-abe0-361325d85b04} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 4168 1fd42e58 tab
    3⤵
    PID:1824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.8.1575812621\367289917" -childID 7 -isForBrowser -prefsHandle 4052 -prefMapHandle 3596 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {262618d9-1631-4127-b9df-5e3f96df9db5} 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 3584 21c43158 tab
    3⤵
    PID:2168

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:932

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2712

C:\Users\Admin\Desktop\Monoxidex64.exe
"C:\Users\Admin\Desktop\Monoxidex64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
PID:1172
- C:\Users\Admin\AppData\Local\Temp\鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.exe
  "C:\Users\Admin\AppData\Local\Temp\鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2568
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:372
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1292
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\zh-tw.txt
    3⤵
    PID:3356
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3388
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      4⤵
      System Location Discovery: System Language Discovery
      PID:3492
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        5⤵
        
        PID:3500
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3500 CREDAT:275457 /prefetch:2
        6⤵
        
        PID:3600
- - C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe"
    3⤵
    PID:3844
- - C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe"
    3⤵
    PID:3872
- - C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe"
    3⤵
    PID:3884
- - C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe"
    3⤵
    PID:1816
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe"
    3⤵
    PID:4044
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt
    3⤵
    PID:3688
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html
    3⤵
    PID:3828
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:275457 /prefetch:2
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:209927 /prefetch:2
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:406533 /prefetch:2
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:406539 /prefetch:2
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:603152 /prefetch:2
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:537621 /prefetch:2
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:537642 /prefetch:2
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:668688 /prefetch:2
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:668691 /prefetch:2
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:28324866 /prefetch:2
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:7222281 /prefetch:2
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:7156742 /prefetch:2
      4⤵
      PID:5216
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css
    3⤵
    PID:3956
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml"
    3⤵
    PID:604
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml"
    3⤵
    PID:3316
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml"
    3⤵
    PID:2468
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml"
    3⤵
    PID:3860
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml"
    3⤵
    PID:3164
- - C:\Program Files\Java\jre7\bin\rmid.exe
    "C:\Program Files\Java\jre7\bin\rmid.exe"
    3⤵
    PID:3544
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js"
    3⤵
    PID:3944
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\VideoLAN\VLC\skins\winamp2.xml"
    3⤵
    PID:3264
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\VideoLAN\VLC\uninstall.log
    3⤵
    PID:4032
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt
    3⤵
    PID:3736
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\clock.css
    3⤵
    PID:3216
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\clock.js"
    3⤵
    PID:3932
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml"
    3⤵
    PID:3528
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\currency.css
    3⤵
    PID:3424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\init.js"
    3⤵
    PID:3228
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\gadget.xml"
    3⤵
    PID:4028
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\gadget.xml"
    3⤵
    PID:868
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.xml"
    3⤵
    PID:4332
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml"
    3⤵
    PID:4404
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\localizedSettings.css
    3⤵
    PID:4428
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\highDpiImageSwap.js"
    3⤵
    PID:4464
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt
    3⤵
    PID:5032
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5064
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer
    3⤵
    PID:4156
- - C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe
    "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe"
    3⤵
    PID:3924
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML"
    3⤵
    PID:4740
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe"
    3⤵
    PID:4140
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF
    3⤵
    PID:5096
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\RADIAL.INF
    3⤵
    PID:5112
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Common Files\System\msadc\adcjavas.inc
    3⤵
    PID:4324
- - C:\Program Files (x86)\Internet Explorer\ExtExport.exe
    "C:\Program Files (x86)\Internet Explorer\ExtExport.exe"
    3⤵
    PID:3540
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF"
    3⤵
    PID:4596
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF"
    3⤵
    PID:4204
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF"
    3⤵
    PID:4676
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF"
    3⤵
    PID:3244
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF"
    3⤵
    PID:5092
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01168_.WMF"
    3⤵
    PID:4116
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00306_.WMF"
    3⤵
    PID:2696
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00455_.WMF"
    3⤵
    PID:4172
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02158_.WMF"
    3⤵
    PID:3084
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00524_.WMF"
    3⤵
    PID:3524
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086384.WMF"
    3⤵
    PID:844
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090149.WMF"
    3⤵
    PID:4692
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099175.WMF"
    3⤵
    PID:5124
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF"
    3⤵
    PID:5156
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF"
    3⤵
    PID:5500
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105294.WMF"
    3⤵
    PID:5512
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF"
    3⤵
    PID:5528
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107138.WMF"
    3⤵
    PID:5540
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF"
    3⤵
    PID:5560
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107718.WMF"
    3⤵
    PID:5576
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107730.WMF"
    3⤵
    PID:5616
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151045.WMF"
    3⤵
    PID:5828
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152430.WMF"
    3⤵
    PID:5840
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF"
    3⤵
    PID:5856
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF"
    3⤵
    PID:5980
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195772.WMF"
    3⤵
    PID:5992
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196110.WMF"
    3⤵
    PID:6004
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215076.WMF"
    3⤵
    PID:6024
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0318810.WMF"
    3⤵
    PID:5316
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00395_.WMF"
    3⤵
    PID:6504
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02009_.WMF"
    3⤵
    PID:6576
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02041_.WMF"
    3⤵
    PID:6608
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02126_.WMF"
    3⤵
    PID:6664
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00898_.WMF"
    3⤵
    PID:6700
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03339_.WMF"
    3⤵
    PID:6784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x568
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A591F44E00DE31A7F5CF24C9DFAABCFC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f79a5d4.rbs

Filesize
3KB

MD5
b2cc1214175b06c6c56e6c49357cf0d8

SHA1
fe864aa9b0874f90197db54bedd01cf7da5c588a

SHA256
b97795c707d7776698da8ab3b41806c3d3b1704a8c4942dad76c3381c8f9ab28

SHA512
0081dc5fe1ba3ed5f69350fcd6f04417c3803ed688d684c28dec57a159b8059a3a641d5da5a1c5740e852b62988187c1d35de31772bcde6b32ab7974d1520ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acb79de492d3bdfa712a8a40ea0f9692

SHA1
d54a731e2f721a99be6540fa6a8a0ae7696001cb

SHA256
2b841ecfd92726ccc4daa1862bebf162babff8cc3050c9d5823b7f3a313b11ac

SHA512
3df4aae477462e1e1e00ddbd6a00a127ecbefa56a116e3397f18a5b83b104901c8a8bb0393afe4bf4a3ae89fa395e552d64f1d3b987a6b9bd32f69efed3ba93d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b155afe3a9eea2aa09e30ae5b241376f

SHA1
410aebe677692d1d33613844465e0ae3e9b356d0

SHA256
eb1c744a1d141779b3f3b44338b47607b97e818f2315ecb89408a9057619b7a5

SHA512
c198d05980af66d2c856f49021259993ad8eb65f7cdad3256519a68fabc30c488902c26e85f1949248a7f435f460bbe0d98b7c093218784ab831ec55bebe056b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1bcd4c98492e158b8a86740f93992e1

SHA1
0f4a3074f296b7f7cc1ff128c16b270266e5ead3

SHA256
9e3ff216767d109edaf232296600ccb1d3f465d183b9ecfa94d35f3e8ce6361d

SHA512
c0f7536c96f6c8d27d4c618c10b34e7fe1e21cf83d5127b7c61e840df51f523242c04b86bda50bfa3746563ac17d74c9d29f967688a441bc459c3a5fddae9108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92343a21024f15a78f0b2c18a5124868

SHA1
03858b3feff2d0ef7da5b5b67874fd5ecae36eb2

SHA256
558a498b755707f14f19aab2efc971c4eddb0b20d2eee4ca7991616b222c6288

SHA512
35e8be8331a676c6be27b234cdfc0f9b964f2fa969b406ff0281c95717de7f747dd697835b8e4934415f46093cfdd07b5b1c43b490e694003a3f04dcd3b52033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27f86994fae56e8907305d9ce33fc9e4

SHA1
91c3a848e6c50d2dc945b604c610c530fc1de00e

SHA256
96a938631c2f752b8b7146a9ae3bdeb27197846e7725d5a4c3c2005e951fae26

SHA512
d46fd1544ebf5ed3cb84e0cb992be92149cb5c8b647aab3d64a2b303ed32979953a9b1cc2c9853e5c33bdd720594b6e2b2506c4903eb82da778f023fffcaa107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4c3c3567d81b01fa3902d9ac972a846

SHA1
48c10937d6c1fcbb27cece6d588026e9d772d711

SHA256
da14444e8aea874a62da94fb70649767a31a399237f75f8a0895fe486bf9ac6b

SHA512
0e61eeec6879eec9a623cfbed72a471775d312f29d5753a0b3d07803aeb56eadd4e908eadb73aafd1e87744d81a6a286900127c2ea11de6d0dc13bcdf8fbc92a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00d0e18a90ce7ab9039b104082513bd3

SHA1
61612ef413ef7fb10f2c591df04287ee21e8558f

SHA256
fd406e9ca4f1f7d0f6a3f4ca6c98a0fd47cb7e41a285e5462109560eedf9c796

SHA512
3b36a96a47a5a8e918e7245546aae2a9f96cf0f7b0911572cf480d53bb0ceb6aa7e5ac7417284f4205a73c5d8ea92d75e043df2c8a9047487b608bb191c17eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
446f52dab100b3cba7619a4430ae8542

SHA1
00eb0c551d1d44f35746f1b6de6099f7acce8937

SHA256
be5d8ac768cd2b95241e8b5826dc7a7e795ac845e9cddf3fda69669fed70ecec

SHA512
a4c933ea9b7e3837423885de82faffbba383058ec058f98bd00442c8d60cfa26e363e9b4e97c0e003fae5cc3fb1371264fe49998ad39f14bd319bdfe2797e548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BB5C9081-6C83-11EF-9DFD-D67B43388B6B}.dat

Filesize
4KB

MD5
963de430d4f906737286f14c49c0e3e1

SHA1
486a4e7e59e52f9ff7ab390d3040731d0f80115f

SHA256
1c74ca54efaa06e8b589e162fe4bab14edabd03e310629f6adafec8c61ad1591

SHA512
e4d596e457070478c7f7c3724f8799fb0ac79c93c7f613e069bb6aed0d5007ccf28d182566f27578ec7787f15ba875f0d16c7c050129e0404e282abdb315585d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\xmltreeview[1]

Filesize
16KB

MD5
407429efa2eb0d6c50c930c7e1367daf

SHA1
0fb34d09426168cc2b0753a8f39851b071275cba

SHA256
75f2444fee7ad83ad241d06c21244173cc282c54daecce1b23ac4c435ef3f6a0

SHA512
4e8a8f9a772038c8d17af1e86460af8524c983969422673f7474d93ef893c3cccb48cc7b4f15cf3edf020b768e05ff9f154f19ec4b36bb0f400be49b8549e9cd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp

Filesize
35KB

MD5
a09f1c609f83e77f2d71bddb72bdee5e

SHA1
697a7e28fe346b22fd572d76994593bc744b320f

SHA256
1b122f726339c638b8399098f54e7f6523580c410d1484dd8deeebcd6b3ba148

SHA512
b6b6cd88613079af715dbfa4ab2773a33a3b648562a2670a33c6dac265688023eb713d8e5a79b14fa251f794b29c2c14951a480b6f138772a311633e2de5604b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\cache2\doomed\7687

Filesize
13KB

MD5
461dabaf0b4ee63430b2f404c0ae8362

SHA1
3b43e7ceba4bb31e05df478184dbcdba23818534

SHA256
2569af3c6a80b6f0f0060e6e2e2a8e3f079a77d9604bf4936cbf2e37b2f76c27

SHA512
651feaf14e94decdce608b8fa71db804b6e1220abeef09529854b5536aa6019c0980c1a19748776a45e5945f3f6b09cfd10da801b6b630c47cd4fc3ae432d96d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41F3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B87.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\鬀黆璃艷劑剬暢魚鳈祽僨羬慝糂跚驽.txt

Filesize
260B

MD5
07c10d04c00ac1c64a2a5efc6aad64dd

SHA1
3f3058ea2ebfb62751899b212ecaed297e41fffe

SHA256
691082e4666fe1a1d5a9762cc18804991e4eb6b59b685506da98269e34462ef0

SHA512
e4257e1ea30b1c8c3d1a12f2b5cc7f4c6879f860389c12ced71c6271299244104e9f34f18b692d7ca3669349ec6603ac9e45d71719697b865812afd089bb1f42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
52d9d874f4f5af6925e6deb519a1c2d9

SHA1
d52c0328103e9ab4648aa920bd4ebb4a359f9251

SHA256
b1d45b0d0aed46d48d7afd2227278a5d6bc135d2aec3e0632d31bc37c3d25503

SHA512
68969b1b34c3f5c57c3fa032291b677669e9706de1e413e58caff66a083877a29ef940e9b59f41e7d6079c3ae8e027f2b7b0a05266bb07ae1617514904e2501a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\549f2efd-f514-48d8-8a57-faa340c7495c

Filesize
12KB

MD5
4e6130bbc62be53f7ea02bce43b9120c

SHA1
4b0041e6f2fec1c341b30f7f2244d98eb6cabfe2

SHA256
bd4fcdff5b1f14dd864ddc5498d851308d2a201a82fecd5c858e447380f8ef03

SHA512
44a0c1cc18d0aaa2d98ecd8e53943328241c0c30d75b4ad8d8fda5ee9d5425bd49f3bcf4c2247bccaf86be8e159ea9a0eae11b2b065c5288b874e0db479ea52f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\cd708555-6a47-4963-9dd9-d3189df4523c

Filesize
745B

MD5
78737ab9352eef60b26d9b0be11be569

SHA1
afc629cb08b40c46dffbaa2e407722b3d83a719c

SHA256
c44e492a33f906eadca009592154c5ef155fdbd652cffd227784f38ad218f8b7

SHA512
f4d447b2b7568b5de6a13f69a99454023996f243efc56a17b2c24e6aa00b65bb001c1b35aec95607fa979c7ff3961a3b79187da6d54ff5467a2ad58bf4fea767

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

Filesize
6KB

MD5
a82a6b0ffd70351a67a88a82ff5d8171

SHA1
f1e2daf5645a421c6b6e51507c3c30a82649e252

SHA256
d222467a1ac59cc39a9c12b7a307fba745036981e2b923123d21a7aba9911905

SHA512
6681a0d2c1ed7d9c432166d55a907aff09957b1f3d6307263863bdc6b8de11c5e9981fac3a056b61c7aca19874500b0c81bbc75fcc9bc76e1b4e72a534f89f4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

Filesize
6KB

MD5
0a6bcb110be82b1f59d80e04d4ec1fc8

SHA1
738fe58ba0697200c1d8ef50459efec0eb0430a5

SHA256
13d825692801cdead4f43e5c5b407a6fe5b2402f7e6e1e4bac638c6257e7340a

SHA512
40067487ab34710a27f11d496f69a6fda88cd7df88d346acd75a4c7f43523f9d56b1675c525fed7527a6c989890fa251a01e0c62acc6503667bd42242eb07139

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

Filesize
7KB

MD5
85794703cfa0e4c66f5783e133e671ac

SHA1
b83651bb248ecc86516067ab5da866dc916ee650

SHA256
ecf43f144f00854d893106e9a072872f5fa793dcb025ee833f0f21528c9d1c27

SHA512
434d04cb00ccead9bdc0d35c48531e60f702d5ddf2cc0bad3b007e842f97308c2c01786fde6c8cbc5c72293b9c4e2223545b9b71dce2e192140f901fae21233e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js

Filesize
7KB

MD5
b16cf5198aa11849b660f47f54391777

SHA1
e733c742b97fdc2bea991cc68010628cf16f8cc2

SHA256
63e25749526fbe220c2102ed5e2eedea88b3d221dac78416a8b0da39bce88d22

SHA512
49a415d92f8161ce3eeae41bca28e4cd9512b02471af80bde16d4f20676f05ee431567e0b25b423f1ce81fbd84c0908b71c7bc105b48ecca63ba1beea2b9e780

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
23dabb442a9e10f066013c7354fd3db3

SHA1
f11ec8d03cd33f970a788bcdc72ae3ce3d42f8c8

SHA256
6472e9a8b005350c55b65002291a53215ac5371bb4cade2d96dbf06e63ed0668

SHA512
bb72f05a8e831d78a4c8e7b21d1c40daa3454796c25ef8c85ff8525cf4a2e3f7c891fefda4b35d0fa551af0dcaa82a173149d1ab95b77aa5b45a6278c74c01bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
22aecadced2e4e5273806cef121b51cd

SHA1
60488772a405a6cd437685f5ed6d3899a9eb3f31

SHA256
136849ca1b086a405ee03608c767fc29bef76dd8b205abce2017f60f483fb37e

SHA512
e4c400488caddc728a3c4c62eaa7782c89cc47111f86e20ce3e8ebe38d6d31c38f53f6c20c30fd5e4eed05e90c123e92e660db894642a330484c52c8fba6fd06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
92e8ec5aa8036c140036cd9fee54c2e3

SHA1
c2da28589c00b1c2846a6e5c554472d7e93a9f4a

SHA256
78205cd9091d5f354be57f73cbfc010b0b96894fc48e91140b541913b7af9663

SHA512
babd843754d72b10fc7d77ae0465ff3749c4da09e40960d699662ae8c472a8cfebde875f081dc6347d61c5e8822810deefd6437265055584965d660d2c2a7fc7

Download Submit
C:\Users\Admin\Downloads\Monoxidex64.exe.vir

Filesize
330KB

MD5
692361071bbbb3e9243d09dc190fedea

SHA1
04894c41500859ea3617b0780f1cc2ba82a40daf

SHA256
ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe

SHA512
cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e

Download Submit
\Windows\Installer\MSI9B84.tmp

Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
memory/844-951-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/844-919-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/2568-452-0x0000000004640000-0x0000000004650000-memory.dmp

Filesize
64KB

Download
memory/2696-915-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/2696-947-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/3084-949-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/3084-917-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/3244-911-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/3244-943-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/3524-918-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/3524-950-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4116-914-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4116-946-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4172-916-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4172-948-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4204-910-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4204-942-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4596-941-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4596-909-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4676-944-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4676-912-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4692-952-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/4692-920-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5092-945-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5092-913-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5124-953-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5124-921-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5156-922-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5156-954-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5316-938-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5316-969-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5500-955-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5500-923-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5512-956-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5512-924-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5528-957-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5528-925-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5540-926-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5540-958-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5560-927-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5560-959-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5576-960-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5576-928-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5616-961-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5616-929-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5828-930-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5828-962-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5840-963-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5840-931-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5856-932-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5856-964-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5980-933-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5980-965-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5992-966-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/5992-934-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/6004-967-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/6004-935-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/6024-936-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/6024-968-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/6504-976-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download
memory/6576-977-0x000007FEF35F0000-0x000007FEF363C000-memory.dmp

Filesize
304KB

Download