21c88ee24cfc26b4ba4ea1dc24d31dbadeb20c87dcb19966d99c443c7089e233

Resubmissions

20-09-2024 23:13

240920-27saxatcpa 8

20-09-2024 20:18

240920-y3p37swclc 8

Analysis

max time kernel
256s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

783c4a9cf616f01dbad0fc49bb49d61bb6f9fb95c1bcafacb9529198fc0b77a2.exe
Size

3.9MB
MD5

88eac956a4fece558db3280a977b6742
SHA1

e106164356d948d05b204a2e47e64a80000db61e
SHA256

783c4a9cf616f01dbad0fc49bb49d61bb6f9fb95c1bcafacb9529198fc0b77a2
SHA512

3f6f62053cbf9eccaf6157220a17a4354eb696200847e0c1c0904bc7aedeed1425e8d79829f8a6deb54c8220983d4cd198163aef83849cbec8c4b0166790aa18
SSDEEP

98304:KCtlY3/JaXu7ouSnvOV05O9M57uRleMbGv:RjY3/JaXu7ouSnvOV05O9M57uRlerv

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nvdrvsvc\Parameters\ServiceDll = "C:\\Users\\Admin\\Appdata\\Roaming\\nVidia\\nvsvc.dll"	783c4a9cf616f01dbad0fc49bb49d61bb6f9fb95c1bcafacb9529198fc0b77a2.exe

Executes dropped EXE 1 IoCs

pid	Process
2784	drive.exe

Loads dropped DLL 1 IoCs

pid	Process
1332	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drive.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	drive.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Lzma	drive.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Lzma\fpHost\Parameters = 000000001f1bed15440000000100ce017a04d0d19b1b1a971119443a89086cae2a8d6c0e8ca9d761acd71c82ea4c8f0e0dd84f22a8b70e86968d8d5cebc03725c09869d9a84f2cb7849c753634cb82e98ffc2b21a80800000300ce0101f17a21223580dbb02d4fa592b5568b09594b7a90ba21c31534bf2ef7d3082c29746869732069732076697669616e2055584d5250525249000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f43ac4e00000000000000000080000000400ce0155584d52505252490a0000000500ce0149276d20726561647921010000000600ce01000c0000000200ce010d005901000000000400ce11750000000a00ce01827223f59682a53f0a45a268367c1bea652f258c85f4a66da76bcaa667a49e770bcc4917ab6a258290d9a74982a57e5668e0ee09e19f320ad47902419331ffee147bb3606769cfbe921a2a2fd34c821854cd9282a510c00eb250c3233e343e2aeba07115a5c28920e9c8d29492f6d00b29049edc7e380100000b00ce010265635d5782a59bd97012b4828b37c590b6abf99f33b6d445155b1387e79d071415144e94595102bc2b21f974ca994117c7a3a08a72c8ce8cd0235fbf41c0bc7dd23df35ed25530f71974fb6a3002c1e3814982a59bfb9cad0df86aacec4cd97287ed8cca68faad80a56f856a8b6ebdad05e2bc390290d9a74982a57e5668e0ee09e19f320ad47902419331ffee147bb3606769cfbe921a2a2fd34c027223f59682a53f0a45a268367c1bea652f258c85f4a66da76bcaa667a49e770bcc4917ab6a25021854cd9282a510c00eb250c3233e343e2aeba07115a5c28920e9c8d29492f6d00b29049edc7e022e92cd6b82a59b4d8579ccb916e7c3d36451a06ac6c129f85e252ead27e5f356ca3c8c0d1b670250581eb282a5984ab7aaa633d0770438344a0cde557d0b25e17c50c47bb40786a8c9d00b1c2a00000000ff00ce01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	drive.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Lzma\fpHost	drive.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Lzma\fpHost\Start = "977"	drive.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Lzma\fpHost\Parameters = 000000001f1bed15440000000100ce017a04d0d19b1b1a971119443a89086cae2a8d6c0e8ca9d761acd71c82ea4c8f0e0dd84f22a8b70e86968d8d5cebc03725c09869d9a84f2cb7849c753634cb82e98ffc2b21000000000300ce01000000000400ce01000000000500ce01010000000600ce01000c0000000200ce010d005901000000000400ce11000000000a00ce01000000000b00ce0100000000ff00ce01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	drive.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Lzma\fpHost\Type = "1960"	drive.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Lzma\fpHost\Object = 0b0a01004b110a1d4b070c170c070c170c4b0a170265656565656565656565656565656565656565656565656565656565656565656565656565656565656565c0829161cecf79fcccb61804ce31ecea331c5b788aeeb10e755ddcbd478d236ace025d504b5452574b56554b545452656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082eb186ee0fc478a33f7fdd1b704cda9d09bc42adc7bb177c2055f3d3f400ced57545c514b57515c4b5754574b54555c65656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082598b7a6025e482c574462de6d92aa6fa037f30d25352c0c94c58ba7734bc264e575555545f545152555f030703005f5f54555c656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082598b7a6025e482c574462de6d92aa6fa037f30d25352c0c94c58ba7734bc264e545d504b57504b5454534b5455526565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082bf2b2bb1d3f2978cd5658b9b5f51d031c9b6913a39f38f8f4073b81a9cca1e26570455555f520453555f555f525153075f5f56656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082bf2b2bb1d3f2978cd5658b9b5f51d031c9b6913a39f38f8f4073b81a9cca1e26110a1d4b130017010c06114b02026565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c0827937f6cb97742272311e5cbfebc394865480863dd63afe0e3a7c541c74a09c135453564b5452574b5456534b54545d65656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082494dfafa52a7686cbfe63330edda2c0ace5201e05ac6e424e41f178694efaf6e575555545f07065d5f515155555f575455555f5f54565f5154016565656565656565656565656565656565656565656565656565656565656565656565656565c082494dfafa52a7686cbfe63330edda2c0ace5201e05ac6e424e41f178694efaf6e525d4b51534b52564b54515465656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c08267e519919ddeead6f5a952f1d8948d21fbffe6f7a0b69745657cbffa7be44b23110a1d4b0c0b0c1117040803164b0c0a656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c0825a6f20c70d53197e8f004a40e9e091c308c20eafc302c1fb126ea92c72ce0f4051534b57575c4b50574b545c5d656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082e459ea24e2e65b95003e7592104424c63741e107c00237ff5dd3de925bf2f662110a1d4b0b02064b1f0a0b0065656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082708ca66caaae1c98ba6bdf6018ced1fa843a5d66d4da950053cb4b3ec0810c6b5451514b5754524b5453524b52566565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c0821b330d858b6c84fa576fb11c6724f6549a8b711ed605020caadbf77f4f4ab629110a1d4b04070c090c0b160e0c4b060a086565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c08275a56bd735a6465b515b4f8ec51470c0a7ec458cadb7f1f793b56e4c61fbb91b1108101d4b1710656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c0821102cac343b6410626726e55fec0d8ac10ba5c4199f81f3c729e9ffa39b0a85d56524b515d4b5457574b575765656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c0827e3fefd73a9ad30345c054a1010e2295964e11a022d66f9dd8e703af35c6ce3c110a1d4b0b0a13024b0b001165656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082b04280e11ae655b34dbfd4e42a6f274a08acb5c66583a632062b87bfeda631065c504b56544b545d4b57575265656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565c082401221be901e8684729b60b420d09d636df14db1b98186b5b06373cf73bc241b545d504b54514b56554b575456656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565de0140301359e92361f0d42432b751b833dd0665c75c3031d9cb2344c9513ee97e7e	drive.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Lzma\fpHost\Start = "3211"	drive.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "7"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2240	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1048	OpenWith.exe
2376	firefox.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeBackupPrivilege	3448	svchost.exe
Token: SeRestorePrivilege	3448	svchost.exe
Token: SeSecurityPrivilege	3448	svchost.exe
Token: SeTakeOwnershipPrivilege	3448	svchost.exe
Token: 35	3448	svchost.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
1048	OpenWith.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 1496	4172	783c4a9cf616f01dbad0fc49bb49d61bb6f9fb95c1bcafacb9529198fc0b77a2.exe	88
PID 4172 wrote to memory of 1496	4172	783c4a9cf616f01dbad0fc49bb49d61bb6f9fb95c1bcafacb9529198fc0b77a2.exe	88
PID 1332 wrote to memory of 2784	1332	svchost.exe	92
PID 1332 wrote to memory of 2784	1332	svchost.exe	92
PID 1332 wrote to memory of 2784	1332	svchost.exe	92
PID 1048 wrote to memory of 2240	1048	OpenWith.exe	101
PID 1048 wrote to memory of 2240	1048	OpenWith.exe	101
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2440 wrote to memory of 2376	2440	firefox.exe	104
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 916	2376	firefox.exe	105
PID 2376 wrote to memory of 3956	2376	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\783c4a9cf616f01dbad0fc49bb49d61bb6f9fb95c1bcafacb9529198fc0b77a2.exe
"C:\Users\Admin\AppData\Local\Temp\783c4a9cf616f01dbad0fc49bb49d61bb6f9fb95c1bcafacb9529198fc0b77a2.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xnyxrp.bat
  2⤵
  PID:1496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "nvdrvsvc"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Users\Admin\Appdata\Roaming\nVidia\AppData\App\drive.exe
  C:\Users\Admin\Appdata\Roaming\nVidia\AppData\App\drive.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nvsvc.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98b25cd3-7e08-4e00-8e72-6cc7d4c3348c} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" gpu
    3⤵
    PID:916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4daa4c1-5f68-4b50-bab6-2f86d2833440} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" socket
    3⤵
    - Checks processor information in registry
    PID:3956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3104 -childID 1 -isForBrowser -prefsHandle 3108 -prefMapHandle 3068 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1105c50f-9b9b-4fee-9e6f-98c10d800e8f} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3536 -childID 2 -isForBrowser -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b820b667-b766-4059-b5a2-d80c7cc305fd} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4976 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4968 -prefMapHandle 4964 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7aa92b1-2497-4ff7-a625-95742097401c} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" utility
    3⤵
    - Checks processor information in registry
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5404 -childID 3 -isForBrowser -prefsHandle 5380 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c879fbb-bcf6-490f-87ad-8277083709d7} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 4 -isForBrowser -prefsHandle 5516 -prefMapHandle 5520 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43fc91af-394f-4ba5-980b-a2ccf95ffc16} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5708 -childID 5 -isForBrowser -prefsHandle 5716 -prefMapHandle 5720 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f28dded6-da31-4ef5-8b44-20593307707c} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:1048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6092 -childID 6 -isForBrowser -prefsHandle 6084 -prefMapHandle 6080 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2063c047-d1ab-4c93-a71e-7889e0bf8f47} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6388 -childID 7 -isForBrowser -prefsHandle 6396 -prefMapHandle 6392 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a3518ae-4b59-44ed-bc3b-a7327f5eec7d} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6532 -childID 8 -isForBrowser -prefsHandle 6540 -prefMapHandle 6544 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {120378ce-5f4f-41a8-85ef-694384347ea2} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4620 -childID 9 -isForBrowser -prefsHandle 7048 -prefMapHandle 4624 -prefsLen 27919 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {742003e3-e5a9-43bc-967a-de94fbd8b412} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" tab
    3⤵
    PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

Filesize
32KB

MD5
93f18a9b705780e14d6b9cda09b26e51

SHA1
09361d61ef31f41e6518e0166c215f08da5f8020

SHA256
043bdf280ddd3e6e1d7b67888bc20e8c34ead7414ebd1a855ec4652901d0bc1c

SHA512
731891fdb170be4c1f39a6b5460d81511d33dd899fd4d48479b95a24168cca32e0f6e347f257b3bb8a30afee4fef73e5ec38e7c094c7f46ac5562add0530524a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\A2112F271D335B8D36F00D6B2B40FA6BC464D6EE

Filesize
221KB

MD5
8f18fb97119ab81175e97081517e544e

SHA1
2d730cd48a5ba393ee2d8b05736f8ebfa849d19b

SHA256
09faed16cfa39474e8993baa91395761ebf58ed765e7f108ba97a3832ad47064

SHA512
45a84018d98b1631987c277149f4528c6ed7eafd246f152cba4c92da24a24f8f5c913831dbea97cb9c48dee0d44cc40d76d6405ffcb87a732966c2ddb31c0ef8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\jumpListCache\5BTyx82zh3UcvtrroLGHwmCEQNWK_Kx+Fv_iuraNJw4=.ico

Filesize
15KB

MD5
a3c1306e53848dce3a3c2fec6e1cdff2

SHA1
87f8463535c624202f9b6efe26e993b0b1f3157c

SHA256
d2d32f8573ccc7ad555d258c8362cfb0b699eb4b004f93dbeb171f3510df055f

SHA512
871e877c73990e372a7a41d9851e9dcf301efdc543696aa4dbc35b8a121e24b7fcdf76d426b5f90fa3a14253440697de01ffa0d82d417e5490560ce7d9740aa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xnyxrp.bat

Filesize
248B

MD5
b6849e0440ad49764a90ba27e49acb6e

SHA1
f38e867744611e505a37ffba8d1258b652fd1723

SHA256
276c468065e7a6d7ee8d8a8191d986a8d923f9b46df6255681a9e6ffd5699172

SHA512
401399bc980e51c8a86e29da5807ec9a079f20fa3934109a9e6e2d82814767718abb90d770fd4faa80215c92623f590f7a3c133db832c2787c281a91ee1644af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
6KB

MD5
8f80250316bdfaba7e0cb18fa18b034c

SHA1
bade8eb90002abb532c001097aea54b7343397d0

SHA256
c3da822deee0cb05e85044596e2992197add1dcb4349a640d102b9bcea945cfb

SHA512
8af382df0e5112fd6f10145677dc13fff43744e3b59793c962a8b12f843982da4017866ec561606602196f298add23b900941cfd6613ca0bc301204714f22f41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
20KB

MD5
352ee5880624721190af208af621d04d

SHA1
a6fe230c2c8c3bf5880c88321cc46952eba36f96

SHA256
58c27ecc92678951718acc1b3de4d6f26ccf6d99b4f8c5459d933146c815ac02

SHA512
38c88c338ab908bb60455a318b7016d598ebbdd6e00a53d94f57bc28ee6f3eff998abe0e2b7f7500018da1873132f06e131ab0e8bc0580636d73ec32a9ed267d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
f9af713027ca1bef46758f144b3f1c68

SHA1
7907449bcdb7785c4787055342686a3f3971dd65

SHA256
67433e1eabe148d02d51d0be0aa271be37bb132d12e7c32b768505091b3e71b2

SHA512
3074992aedb373e533e3c55e63165352387018979308c40453b8fff22db9a21e357c912c0a5090b08c1f781f90bd0669ee357dcc318dd53de85ca12372be836b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
87232f29c4bc001edc5cef3b5b9b2d47

SHA1
def475670090255bbfcf5a4bc37fb270e31644e9

SHA256
b113f971f37e0d614233c124f82a7707a22912e5114bb2c4a6a5ece31ad7563a

SHA512
0dc9ab85d39ab1780a3339b8e9ae0bc6f5534eb5cb6d8f87de1de460f5ad3b65d04fa897ac5dc9762b752537548eaacc3238b720a5d4aa149bf6d0b8bbf6f714

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
2c73ab10893451af2554cec85bbcbb33

SHA1
8568754fe5412c15ac2d44c633a6126f403a3ccd

SHA256
7583de7bea58e5e9883ff7be4b74d06be90ca825ad896495a714e912f40ab89a

SHA512
551ef639291454265fa9dbcead96f28bf09c49f72938e9dfb8f27edde53baff622a84c4ac9aea5e1efee44d26c7ee9648853201b3277eb0544de523676b802ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
40KB

MD5
89c23ef7856ab6659e508fa9ef14521f

SHA1
2009949851f8cce52f11da7afd2a5f50341dbca3

SHA256
be18c0c18fd6b78dcd94553225c94740ad6c1ee626d557eaf0bf7f4ff7a72e17

SHA512
2f93800a09bcc771e60616b12f40c85850629fb6daaf1ca64cb736f48b5984edd676021f66a9f341167454dcaff88917c3ce013043dd5fd3c96821759b2bc6fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\0c223da4-bac3-49f0-bbb8-b8f172d4dbbe

Filesize
26KB

MD5
c035cf9e447e12f9822f405d0e53c4fd

SHA1
45e30a49f61296c0fb020f2d5f8402b27acc0f48

SHA256
d97a10f30d287158711002adba2173a0f97de8786ead43271abb8d0ee67a54a5

SHA512
59d29b44a983215692fa46b432556d41541c937c3eb28cd892435101d884b317b198e4cf9f9ec78153cb81ceb693efb4ee597c932e2db4113b057ce07f55efeb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\6455bc0e-6b5e-469b-a959-17d818bdaa7e

Filesize
671B

MD5
b5174c1fb8ac5c0d450054de7f67db95

SHA1
3932cbde0037f3ce72600554dfc24da8c18312cf

SHA256
261c02663c6b35248530fe05d20236e439123214e004acf733fe776191d4bda5

SHA512
f62ba24cee3e35e991eb7cef10bc9084811250864328306aae7ae0d30c7eb996780f0c6875501f6f3aad36a9dd941700293de59e0e972dbbab270825b85ea4a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\6c078a45-6efb-473a-86d3-173c55eebfaa

Filesize
4KB

MD5
14831e928945fa97fa8f0ed09bdbf45e

SHA1
eea40c3842eaf301bde5dc8c67db5a5ca4c60185

SHA256
8d514475284bc0da083e86c5f76f685c33e57c463af3e3fc52cf062b5bd484f1

SHA512
1a30ff74fe25b24837a0552bbce531a6e9b35d36d4143a68eac31d877534db0de6369482bc8839e2f17065cc6a4a2c650a42492f55b6e130b57a442e57636d89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\70283dee-836f-4308-bb1a-844174c226c2

Filesize
982B

MD5
24cd648d2f80d7b5ceaccb94ce85c011

SHA1
d7b117b6bfe604c58953fcaea2402e8d00c29c91

SHA256
03adf9a23771bc07304bd825eeb553fced3866417b500fde30c0dc2ad43be751

SHA512
fc300f9536bc7a7b359ae2ecef76948d79930953d7dfd51f7ceda54f25e4aaf65c4a5c1943fe05d4d1d410cc20b1bd10f253cb1c7028b6ec162008ed6a37d78c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
11KB

MD5
08c44856144a14759bc00f9ec1764ab7

SHA1
699849389ba03b9712a95c6b9170499893c5b973

SHA256
394fbae5aed29ac2b7b9319ca84120a4aad5b6b5628501e2e3c54fecb9f4c81f

SHA512
b420c839b96fba0b983958015424dd4378abd3990c325ec19dd40f2d1fd57c350d7e8ee771aa18863bcbdc6d5c738eb62ecc4f1d998579de4ae121a81361f8ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

Filesize
10KB

MD5
91cdbc4dae9cc4535650ea830a71700f

SHA1
080545b6d53040c8cb614f7839a4069ee1039b6a

SHA256
934a59c5bbd43fd1f0d0087f0f9ddebf26628b2272593d8688fd60cf19b1c642

SHA512
d22df2bba58c14ce037f6a21f51af626875fe3c5a6a7d50513f69a196b5d5911844a96fbe3b76a2d3c3302f0ec48fbcd7b17bf5184e7f9c9bb9cbf84733b7d5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
30348314ddf6b409b8f8ab2675a2bffd

SHA1
64a0a82c7bb1f11c71f6cf937808c6091f271e2d

SHA256
e6e1249ebb15c679f4e68bdd2dc2140f2d4ec9371fe7ac469498cd71fb2850a2

SHA512
a783d85c26fa469c6d7a9936efd340ef24fcb86130d463d12a8ab7a666e28c18eda77cab1d562e591153398d9cafa74335bd10533652cd04d1a1796be2be0297

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
a99f3b357918e6e58a0396a8188afefd

SHA1
6a4da7ff97d788d1c740234b766ad6f30990c469

SHA256
ef19f37b7c95125d0889e7dc3b883c4e03325d5fcb1efb35fa42fd33ef6469d9

SHA512
c961f64eb914f5e87b9a0b8cd9863889ab45025ea7be29d5a5845e5c25149d0d94b1bb2ccba4102b4e2ba8a5758eadc9507a1ac1d841948d12bf48efe86c897d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
2dfd306229f6b3fa7af91f84df75ed10

SHA1
71076cf62b00d00b057cdcabe66554a7f0cfb083

SHA256
97b959453dfb5708f70881482e4060c557e07c954c34d9dcc880ff2e5d01d670

SHA512
0884d012a314387302e8de6e9e56635aa5e27b0dbd49f5b575c16254152bf0820b8c7a544de7070eef77e7990d0bb1031a374fd9c8943c8275827641ea89cf92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
bdeeff2c36d63dcd452ff6540cef6e4a

SHA1
cc20083958ced6ba8c807dfca42fb6abd1321ca2

SHA256
6025088a40b25f6ae288e1ea8d7c779c7d7fc27f604a20e2ccc5bd1252134715

SHA512
69668d3f48e2df223d9b7440f2dec27380cf19965711a5c48b3fa286924ecf0cc448a604743e52e014d25fc242bc5128f0bf4cc8ec885d0a70ef05397d064b56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\default\https+++www.virustotal.com\cache\morgue\26\{7f00e5a7-3b96-46c7-a6ce-24ad6fba581a}.final

Filesize
49KB

MD5
ae3136806876dce3fbc772a3e4278c1e

SHA1
6214c61fafb3a0240953299f40acbe46c40c1c6b

SHA256
ac8b36b79194a970be2f36de751d1fbf91833428e27233b6764e6f8305225a6c

SHA512
c4a3726b655e36212337b304ac2ef31b638ae228e0a842a55b58061ae1570ac56ec3168e1912c72fa3bdf927060f2aabfd18c30584f3c0c70ba707f5cced98b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
68854ea5cee03148626a8a006fbb5a56

SHA1
77a208f16976b8e46fe2b52b2fd0534e1390dc1e

SHA256
3dac566a39fb52a0f333cfaa19b47be69d09b3930ec1c30ddbe5b3979a0993e0

SHA512
1bb3ddd303481992161e595e10c11043e447a2d8b04c25ec35ee8cda3cef87045285185f0c16a3898151c788cedf42764e3770f473f366bb6424f8264fd3c239

Download Submit
C:\Users\Admin\AppData\Roaming\nVidia\AppData\App\drive.exe

Filesize
362KB

MD5
3390b1cf547908806edabf4042c55b8c

SHA1
14ad9063206ab7b85b98acab71c01ebe0e867d1c

SHA256
1cdd2148987df49d80445e2021ec84c1a45d01b8d0405cd4184b28cf6c6fe120

SHA512
1ff761679643aa524d3a2c1271b8fa3efd590dc03ddabb20a0b35a12491a731fd3abdc0a6d249ec99d9eaadde93c4a9be4e366b9ddc1d690c866993a4bd750bd

Download Submit
memory/1332-11-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/2784-638-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-774-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-658-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-695-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-498-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-725-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-751-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-652-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-826-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-12-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-846-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-612-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2784-463-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4172-4-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download