hxxps://github[.]com/Endermanch/MalwareDatabase/tree/master

Analysis

max time kernel
122s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 18:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/tree/master

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
97	raw.githubusercontent.com
98	raw.githubusercontent.com
99	raw.githubusercontent.com
100	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "198"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\NoEscape.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	firefox.exe
Token: SeDebugPrivilege	1464	firefox.exe
Token: SeDebugPrivilege	1464	firefox.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
2268	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 3912 wrote to memory of 1464	3912	firefox.exe	82
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 4328	1464	firefox.exe	83
PID 1464 wrote to memory of 996	1464	firefox.exe	84
PID 1464 wrote to memory of 996	1464	firefox.exe	84
PID 1464 wrote to memory of 996	1464	firefox.exe	84
PID 1464 wrote to memory of 996	1464	firefox.exe	84
PID 1464 wrote to memory of 996	1464	firefox.exe	84
PID 1464 wrote to memory of 996	1464	firefox.exe	84
PID 1464 wrote to memory of 996	1464	firefox.exe	84
PID 1464 wrote to memory of 996	1464	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Endermanch/MalwareDatabase/tree/master"
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Endermanch/MalwareDatabase/tree/master
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37b953a3-c6e9-496c-baa4-0cad49f03adb} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" gpu
    3⤵
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6be238fd-49e0-4f7a-a538-f4a89b054226} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" socket
    3⤵
    PID:996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2948 -childID 1 -isForBrowser -prefsHandle 3020 -prefMapHandle 2984 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed04346a-281a-49e7-acd2-e020573ceb63} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" tab
    3⤵
    PID:1124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3724 -childID 2 -isForBrowser -prefsHandle 3112 -prefMapHandle 3168 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a7b5f9b-02ae-4836-a997-b2d5d49aa219} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" tab
    3⤵
    PID:184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4168 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4172 -prefMapHandle 4160 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8345f22e-f157-48d3-9ccc-c28f87971d29} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" utility
    3⤵
    - Checks processor information in registry
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 3 -isForBrowser -prefsHandle 5612 -prefMapHandle 5580 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a682702-eedd-41b7-9f38-ba3ec77cc80a} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" tab
    3⤵
    PID:2608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5584 -childID 4 -isForBrowser -prefsHandle 5748 -prefMapHandle 5752 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7a1e314-29fe-4044-ac6d-3c6203b7c649} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" tab
    3⤵
    PID:4080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 5 -isForBrowser -prefsHandle 5928 -prefMapHandle 5932 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14b8bdd3-bb1e-4a06-835e-922c3173b29c} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" tab
    3⤵
    PID:3520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4056

C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2076

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bb855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
d6af3f9cd9c85b13880c511da53814c7

SHA1
c27ffe8f43efce1b318f8d9cbc7694e9349a4a80

SHA256
dd9dc5097b514cad60c6c11dc7fe68157916ddc51c51737d4ade0e3d99477250

SHA512
437731e4b862e5a8e491a191b7038d631a274ea67aa5addb598f69a735b460bb9fa5d888ae3e9df6f4f80de025fd0367ba2741c18d9b638d5c8bec2f339ce109

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0

Filesize
327KB

MD5
ea0b462b777e35cec43cd28685f576f4

SHA1
f49d17b4a1082d8cad1200110ef7a6d47114e2a8

SHA256
8a723e1a791354ca03033bed12fddf6c43cfcf25717994438470fe38f4085338

SHA512
b74529684090f5f7c95d67c3ffab9faeb8c39532effb1fea9482b5f23bfd843018f554124a5ed46bd1b362d6762127b9b6739ba3f85615a01078fd5139ebf1e9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\5EAD13BBB5CBE47846E6C546F28FE2F53142499D

Filesize
78KB

MD5
250a47f2baecd749fa85002859766680

SHA1
ba3596ce7d054fa5273e026920116798099ea258

SHA256
9cb092b2285933acc4e99ba91ad477e0dc56fea0e4721404196ad0ef18e05963

SHA512
77ad10d09833a3bdf1b7d418aee61e481c014cd33e3c284d7913438af18f79d994c4d6af609f4e0084525fc284217ddb9f04bd881c130e789a229d8660c4dcc8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\71A5877A224793604405C071054D003E804BDD71

Filesize
48KB

MD5
3a0dabe8f17a436adc2e3a29fb5b99ac

SHA1
73f04e10c22ab47572c173c841a79ca23321dc63

SHA256
ddb638ce7f8313a2fa35cfc53c8ccf872b500a8cd65ab26c026b1a0efac0c055

SHA512
5b4db83ffe9954f804fa3f7d60281247eb06127809e5229cea8e6a8f8391659a9111a64d96e2039456614c8525f36f6d5c3faa4e5b59710e93654492042d138d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\7F30F53457983F11F2D61636C9FB5706ED9AB60D

Filesize
49KB

MD5
6433022e650a24c5d23035f2fdb47e49

SHA1
8fa8d54f4ca49700a190773b547b9387492ecc33

SHA256
3dc36cd9a8d824ff1f9ba9a85ad9da08d34e8ddbf50c56c3e660ec46d7583437

SHA512
9844d050dfcb96185de46eb16b380035ea06bf68246453077600103b31060f1b64eb7e6fa935fd8f7ca97178263d2a83b26542cb4ae0d7234dbeec9f012d886e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\8D9D13D2F1E22A996B4AB1AB746108030CA8BFA4

Filesize
40KB

MD5
d6e32da04d90857dbadd725a3647a39e

SHA1
c9b524eb9c7f6dc8f7bd27970af6a23223fa9d4d

SHA256
6c0de380fed04181b85bdf63e9c8e1a18702fd50e4efe62ed1cf9a463bc89d48

SHA512
de2deb361d663ff9740d6510cb11c7d96698de3baf215adf31bf1774039cfc7fa9e0c755e87f6d4c7d8c5a2b6e2726ea495b53f6c3ff82bbc42b3600bc1839ae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\B6D346E7FDEE29ADD23FD681F1C2114B175F41DF

Filesize
40KB

MD5
0732740a2c1b6b97ce9c6fbb1a46cdbf

SHA1
37a33b758606ef9b55a2259bb7e98714c61b3ee3

SHA256
ba3d41bf403d60b0aa5f05db87eb7a7a2aba13e2e8389d1916d30ad0b15de006

SHA512
c07c68c88d9c3c8d142cca78862d8d102d0f1243c40205e0c89f48713d76833f6dc74cd98ae0666bb9180d217be182eaae57f6183b305b1c9a3cadbf73c939e6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\CDB21C981CC9D3BF2B4FAF854D59E2DFEA293406

Filesize
998KB

MD5
4b541789eeb258cd33f7147d7a9fb05a

SHA1
cf6a13f8d327110f72a3d5e670af80b9aedd08c2

SHA256
37c0117bd3b357c2b113dfc14cda766d6e3fa871fea66f77aeebbe4af7463fe1

SHA512
c32d72e05a9a093baab510244cd251df5dd60ff9c23e417b67ae2b61e3af0ea9868897260c65a852d4f0c860bb05ce85ad81a12f95269698646dbf35cdabb309

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
6KB

MD5
e78faf2095c14ae69faf616dad63dc42

SHA1
3ed636df529ec818815b7dc462693ec251f3957d

SHA256
305afbb85bb0da63227c88715ad80d574ad16ff77d924fb614a8a84bec3a4b60

SHA512
0110c180adebfdaef7a2374637c1ffa1e216de6f62e1d5b04dc8b1fc41acab13cac3e21cfc05a25c5126800474851834bc935de19bb1ac64e2fef21a295c7d97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
6KB

MD5
916576d14332b8a26a4b2ce92dcc9377

SHA1
ca71328c6499ed32505adc79b0a183bdefcd5332

SHA256
8b46c281b6828c9e876c8cf4eb3712a2fb9c8d68b2c3f5d9240976a1800e54d6

SHA512
7b04d0bd28a3b62e63030b7b0f4bf2e2e23e7c0f2a9b28ab6d4bfe45532eb931a2655c64541328374d2d25798c713912c7387e4381439e89113d8fc564f4c41c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
8KB

MD5
697a03a14986ffc8d13fa2098606a9d3

SHA1
610a884505187242afa0118231fd9c65446ebb68

SHA256
90a88db023b0c7287d4f7bc693cae8135d7a9b9cbecb6d088db53e4434a31c33

SHA512
adefc9dad7a03583f993b452ec31d7d836b628fe90a97cfd2f13e1b2cb303409ae9b9d980630acd6b651cd86e7cb3c1f3184f700de37c527e88caac5c17ea987

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b7b64d8910daff301b828bd93cb6821f

SHA1
7dede5b21a4b198fe0e10b36cc2b15d14951ab05

SHA256
89a32db0cfb81df4213dcd284d95d4986d30e421ec93e7208259bf2c69e9714b

SHA512
dedaf783838d3e03b5a443ac74be938906cfebe7baabed5ddd7ece38d9ff94f75939e6277548c82945d989aca86c01be036a76fedad633a7737f58ad76fbcbaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
dff3f56cf469b816321d432513cbc4f6

SHA1
aaf86cbd2bb4b24c02bae9685f529626156588d3

SHA256
c36f6506f8b4223d0527c964f4c6b80f735a12f157437e7d0a26700294047dc4

SHA512
8e08f06c35d5a484fc89a9e83b0167ba6ee223b131df80b8f04c37dcb666cf0ca14eaee17a4838f552d80a9783f87a5646a82c7a85e1b5c22589b5ae0a5a0c21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
06c8503ea991219c81f05a26213006fa

SHA1
b323cdbd9831243b39b3f8c21717a4e0a386fd01

SHA256
9b22a057386f88061139a96a59a07781f4ed2bfe00ddd5f3a43141ad634df77a

SHA512
0285b1a5f7b0980dcc1896a5187fe9854678c559433c26eee5b490e8fb79de3d0b4d7acc946a5a65b4518bb401907d05474bba9c7abba06203baa9f6283e4bdc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\6d65ef3c-ba0d-4e8f-b036-6052b2a8fb7b

Filesize
27KB

MD5
4d32f7cd1ece51663e4ad40950c86b30

SHA1
8a6317faf3ea42d0c8aed7d278c6a75465b1fd45

SHA256
5a05f8b4b408dd108578c3780cd481016baea792ccf3f1bc49bbafbd41b28c1e

SHA512
8c4409d71b2b05461d7b02f726dc50bfcc2edb1d3a4a9041cfc38e67cea2218451670b4f97713116f0ea84e92bb48be23595d18764154554f2b07f142fb75093

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\c58c235f-eae2-46e6-8242-9d0a781d1198

Filesize
982B

MD5
7c032027f554fe3d9693777a531ac50a

SHA1
67006391e19fb25f3147308e0f51c19106e8e130

SHA256
ef7811b66518f4b6edaea227fa1e701ccf9b8159d94265fc13e1cc03adb8c0aa

SHA512
c412e371efda5fd6bb124f2e02fc1ccca424df42a9ed2d5dce93ab8aab5592bbb10edca7e7f1403b75cc948b27aa278b6a67a1a0b86566ff7883439361bf3a7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\fda98521-08b5-4e0e-8f2f-915a5214aedd

Filesize
671B

MD5
47f3ebf11303fd7a82f327a5bdf6ebdd

SHA1
0faa579e1558aa048e1e2ea1b931486b9b587774

SHA256
56e981f5bf3806d0ef59ec301f9b09ba090b75cdcbe1866d8efb04d869310828

SHA512
ca06576d95c4c1948f8d49befc5d5d6eabb44e8edef75689a98239beba7fd2d5b7c970e822ed10e8bf280804fef9cd9c20453a82f9733e87a991486676c6b4e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
11KB

MD5
cb5768c0863594d38032deae4587af58

SHA1
7086ef32c1197d92be82878875cfb5c7ed73a176

SHA256
8ad3a185afec143467a9aba3cefeeff2496ea3444d3dcdd24b82c73187ea2fb7

SHA512
21f2aee9ff3a37e4c38d94bf5ba4ff123c6e4087af41654ab236bf7c0c90c02e662c7391569ef2e8f3de6472aab97809ebafdd8131777b04bc2b9af410508199

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
11KB

MD5
1375f245f641730c80f1a3be9156d852

SHA1
b6db96bd27b04f2563921f07a88cad21f5ba1626

SHA256
78828dacf512c92a8bb6d76d42be45d1a2e89f697d27c0c59840c70f56a5a22f

SHA512
b00628773fa8136664877a7a2af2545cb3d69e363e011915bfa3c084ae0b691bc7d00216cd4174221951e86cdb4cf51dec1d8320f9f488cb4e63f1b2210b3511

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

Filesize
11KB

MD5
d0d603badf0074fbc18e333db263e050

SHA1
b0aab2909c5e26ce39bfef4b89be4f18e31ac352

SHA256
cad3314754d01badd9af9779050699ae9bf05c3f291dd1b9d48636f195f07cb5

SHA512
3b38d30bbd90e02a0b44cbcc5f8e7ada9655b6e88cc1c6a8bddede1df271e952d0b2a9034b56f8326bb03f32cfc9cac1c63ac610ff7f12b3c7fbdb0ebeb06b35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
7c30942e950ef023007c6ef4d7d8b091

SHA1
f583fd750d79105790c7fab71a8f81eea34c2324

SHA256
bb1dedb8cae98793e550c0fce27fd61a35b80e8591f78d8373e5c3520f739bb2

SHA512
5183c3192f97ac343e5b65b3d8b0808032b95f053004b18ec474f0ce6a324a7bc40c6912e62a5bec2bd318940e8a7f15d1e0a26d11a5647cfa51da1e75f16de8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
72faeb65b8ff73989d991d307414f590

SHA1
9457d7e7019b848576aff923fa9c91bdd7d12bce

SHA256
f85145661cd16c89533ae73147cf02dc6507b08b971cf8f1b81e95bc20fbd5a3

SHA512
4d49757c82ffe7380202af6ec55b6075f313c3fda3075f9f69ba16216fe9599fd4aaa8f177d6c2c6c96f1c434eafec4601ddf1e98ab37f2b5bf4f7b5b6f86d94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
544b66fed5e9637372f93ce8c1a14768

SHA1
16e6a48adea3bb432bdd493cbca4dd001ddabc3e

SHA256
f3e8f6ddc9a443bceabf3c811e32c2ddf41f3b2a12ccd2439b9f43d1d9a01c53

SHA512
af597ec83479e7bd1f251278ed55fb9928901e318e963da222fbdeceaa745debd6b5fc6579865560a23edc8a5c6b07c7f8500d99f90b57686816bc4ef0961894

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
aba18a9eb952901da7185c561232fea6

SHA1
49d9108bfa78ddf787cd785baa4ec7a1fb4b89ec

SHA256
346663a2156763950f8273d17014a15bac882a8c797ff32ea66e31b3a4241d12

SHA512
070d43bdb87b3575151c3d656cf51895538c028d733c8940b97cb3472257fa94fd01c22d86698fd01218031ce378eaf6f935b1d7bf5cb9a9391873a57b4c9b55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
af34870601ec0f7cbdc9b603a8b29764

SHA1
f6e862b85f6c182daddf87d8c9262a977a996fb8

SHA256
0e97ed225e1355d636d5f4e74bdf3230297c8fdcb019bca7cc3996f16c5f3c9a

SHA512
0de090da08d66e4968d269ffb424123a9a4e9bc7f83d84e87d62aab996066971cee8190ab1b9575b66a2416b962e104e20b972dff48dcd20acc28bfca98b45d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
338ea86ead3bdc42f13d17d0619b999e

SHA1
a4c8ca6f61301241b6b46be310dbcbca0a117d59

SHA256
056b4d1953862455ac36ef76bc5269d837dfcf366aa99fced53976807131198c

SHA512
aae9f2cb132e27e0673d87661fba902a816892cdaa225645a226cf0f7b15a1f19168c99f133daf096f15dd267a2eb7f248aa3f80adfefc914cce0c495e0982e6

Download Submit
C:\Users\Admin\Downloads\gwuax0r0.zip.part

Filesize
616KB

MD5
ef4fdf65fc90bfda8d1d2ae6d20aff60

SHA1
9431227836440c78f12bfb2cb3247d59f4d4640b

SHA256
47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

SHA512
6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9

Download Submit
C:\Users\Public\Desktop\ឦ⭗ᙔచ⚾⋟฽』௜࿔ᅻ⸌℮฀൝ᇼ਴⒌ሲ⪛ᑬዃᝥ⳸

Filesize
666B

MD5
e49f0a8effa6380b4518a8064f6d240b

SHA1
ba62ffe370e186b7f980922067ac68613521bd51

SHA256
8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13

SHA512
de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

Download Submit
memory/2076-752-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/2076-753-0x00000000005C6000-0x00000000005C7000-memory.dmp

Filesize
4KB

Download
memory/2076-930-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads