xenorat | 9c987ba5a2af23422f773779a1b2f492617b8f6e68dba5b4e5684b2152bc6d4b

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240929f47313d903d4a4bcf067567fe0d43817ryuk.exe
Size

6.7MB
MD5

f47313d903d4a4bcf067567fe0d43817
SHA1

08516b4b77454dd4f948084308453d6619d94009
SHA256

9c987ba5a2af23422f773779a1b2f492617b8f6e68dba5b4e5684b2152bc6d4b
SHA512

dce19db50819af430c979a30b0afdc6b48d1b501325f492fb105384039a9eef90d1479284e5c5542b9a3be9d8ec60c4416cc125cbad8c007e0f54ae312179a74
SSDEEP

98304:3ijHdPkLq3Gknso4mDTGVCkaTdKiySh41U4WyBuQhoBCIS+Y:30eL0wcKfSB4WyMQmYI

Score

10^/10

xenorat adware defense_evasion discovery execution persistence rat spyware stealer trojan

Malware Config

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3416-44-0x0000000002A20000-0x0000000002A32000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5112	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	IDMan.exe

Executes dropped EXE 1 IoCs

pid	Process
464	IDMan.exe

Loads dropped DLL 1 IoCs

pid	Process
3472	20240929f47313d903d4a4bcf067567fe0d43817ryuk.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\IDMan.exe /onboot"	IDMan.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
1424	cmd.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDMan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\IEExt.htm"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps"	IDMan.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "272"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	IDMan.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeRestorePrivilege	464	IDMan.exe
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeDebugPrivilege	2608	firefox.exe
Token: SeDebugPrivilege	2608	firefox.exe
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeShutdownPrivilege	3416	Explorer.EXE
Token: SeCreatePagefilePrivilege	3416	Explorer.EXE
Token: SeDebugPrivilege	2608	firefox.exe
Token: SeDebugPrivilege	2608	firefox.exe
Token: SeDebugPrivilege	2608	firefox.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
464	IDMan.exe
3416	Explorer.EXE
3416	Explorer.EXE

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
464	IDMan.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
464	IDMan.exe
464	IDMan.exe
464	IDMan.exe
2608	firefox.exe
464	IDMan.exe
464	IDMan.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 5112	1424	cmd.exe	87
PID 1424 wrote to memory of 5112	1424	cmd.exe	87
PID 5112 wrote to memory of 1160	5112	powershell.exe	89
PID 5112 wrote to memory of 1160	5112	powershell.exe	89
PID 1160 wrote to memory of 1512	1160	csc.exe	90
PID 1160 wrote to memory of 1512	1160	csc.exe	90
PID 5112 wrote to memory of 464	5112	powershell.exe	91
PID 5112 wrote to memory of 464	5112	powershell.exe	91
PID 5112 wrote to memory of 464	5112	powershell.exe	91
PID 5112 wrote to memory of 3416	5112	powershell.exe	56
PID 464 wrote to memory of 4244	464	IDMan.exe	92
PID 464 wrote to memory of 4244	464	IDMan.exe	92
PID 464 wrote to memory of 4244	464	IDMan.exe	92
PID 464 wrote to memory of 4520	464	IDMan.exe	97
PID 464 wrote to memory of 4520	464	IDMan.exe	97
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 4520 wrote to memory of 2608	4520	firefox.exe	98
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99
PID 2608 wrote to memory of 1640	2608	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3416
- C:\Users\Admin\AppData\Local\Temp\20240929f47313d903d4a4bcf067567fe0d43817ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\20240929f47313d903d4a4bcf067567fe0d43817ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:3472

C:\Windows\system32\cmd.exe
cmd.exe /c start "" /min powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\app.ps1"
1⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\app.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rc01leq4\rc01leq4.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFB6.tmp" "c:\Users\Admin\AppData\Local\Temp\rc01leq4\CSC37AA2216149C472897358C43E42CFD1.TMP"
      4⤵
      PID:1512
- - C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\IDMan.exe
    "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\IDMan.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\IDMShellExt64.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2608
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dcd5c3b-968b-4629-9eff-fef88575e22a} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" gpu
        6⤵
        
        PID:1640
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2380 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {044ae4ea-abda-4c8a-a161-19b889d86e5d} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" socket
        6⤵
        
        PID:3468
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2772 -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 3036 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9fc3cfe-4eb0-4634-a9c6-e193ee4263e9} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" tab
        6⤵
        
        PID:4296
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9020e266-a9b4-47d7-b9d1-133925c924f0} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" tab
        6⤵
        
        PID:1644
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1392 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4580 -prefMapHandle 4576 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {975681a9-c0e6-48d0-9f74-e39f071bc849} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" utility
        6⤵
        Checks processor information in registry
        
        PID:4932
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5116 -childID 3 -isForBrowser -prefsHandle 5224 -prefMapHandle 5228 -prefsLen 29197 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eda6eef3-deee-4d84-812f-e5a8ca46d848} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" tab
        6⤵
        
        PID:3076
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5520 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60908972-abcd-44d7-800e-5588d34a119f} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" tab
        6⤵
        
        PID:1788
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5240 -childID 5 -isForBrowser -prefsHandle 5340 -prefMapHandle 5388 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91ccddeb-7b69-4bf0-9d90-344e3547b1e6} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" tab
        6⤵
        
        PID:4332
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5552 -childID 6 -isForBrowser -prefsHandle 5720 -prefMapHandle 5712 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {840aafd2-1f18-417a-9660-28eb03af4f65} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" tab
        6⤵
        
        PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\IDMan.exe

Filesize
5.7MB

MD5
57f08cad5c4a34e4fc5b42a7a0fe9ac1

SHA1
17d7ceee243a924ad324f266d8e37f441ed87658

SHA256
a75ba6948935a5005212f576be7dcb1d9814011c11f6a7c133a2c89673a7dd86

SHA512
7e506883c8e221c7c6847982efda2c4cff2fa142d7386be413f46c92fe8b48cb6a5949315b882d05c6bc239a197156c986372e8d34d232d9f8fa4486f65c763c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\app.manifest

Filesize
47KB

MD5
6fec4faacf51e3f656421e6cf5217299

SHA1
b4963d03ae835f9b064491dce20108f9450e7507

SHA256
582524e8046a86b6729bd9c3032f0da3d2b99c9eb537cce4b827b1a55d65a638

SHA512
2b2951dfb9c856cfcee73f5dab6218118b98e98cfa7bc47f5d241215024863da5b0d08ebab43475ca97fd13ca2d3ddf5ecdb5a16bdb117fb5bb0a506b6a7fe26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\app.ps1

Filesize
5KB

MD5
37ad876274cee87e5cd06f73a11f7b25

SHA1
089f488d67c4cfb0926e800447ec2f4dc5ed19d3

SHA256
bd7e27789b783b8c606b796899a64653264b93d0044276b769d01d580ff7cc81

SHA512
28a34edce21f9f24fea114843373f474e74508cf036f8bc6ee3b10c7e6db1f90ed832d5bfa847be061b2b521ba8b52155854b8f947ac2d5f29ad74489f04d6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wAPI.dll

Filesize
6.3MB

MD5
83f543239172049edf135de8383a1a10

SHA1
b35559b0fa24afeee4295b6a5b5522b21c52101d

SHA256
4071b396f1152389806a3127f84b4f6a8b4cbfadc6d7f11f77a93424e9306dee

SHA512
2dededb6307c646844430f7c1f2354c0ad26351321b64dbc1b573592d8e5d4833318711447e6ca3e11912fbff3eac507dd6732ceb1f692a4cd92570f40d19a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBFB6.tmp

Filesize
1KB

MD5
ef6e4909a98d653c2979f4b8bf8fad67

SHA1
f927a974a4c6e7f20155387ba9e0a629140fea59

SHA256
4047392b2da49a37c6a3ae0a64aea3ac6154c3fae8b6136018c7b6d367fd42ca

SHA512
d9b2f19ae4c084ea893783b422075075427a8afa27b57252539f76e5e1c9f7be32e115a5c754b307debd55c8dcb1e58de2ab4dc698f8d7102a7838d464adf47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sulopxns.tsz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rc01leq4\rc01leq4.dll

Filesize
4KB

MD5
70bab861b500a417a01a45d3529d5cf0

SHA1
e322a25c631732a57c6f20f3b233af1a339c7728

SHA256
224aff48b1f70f0987019df5c6f996b16e794776a1ac7df3a68007ee7e3fa3df

SHA512
83e24ddf5a0e27143afb3a9faa6c7646344d412f3f38ae2b701b72e2ad73e465630e25670e52d90c521d016aaff4f8fa9c27a1b50be7f93f348dd8f83145edb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

Filesize
7KB

MD5
d565dd24392dd18ea7b6c7989451aa2c

SHA1
cb68127fa9aba28a48fb921893234aac6f3997df

SHA256
1481f213f53656af828310e30451e738949a844700bf948811aaadd1812d5011

SHA512
50c708f5c53962b3bafaf8292f7a619c34c6fc97609c63b048a600a1b021c9f19370c9f228aa7a01c757ac0815c18fd73cea9e10844b8e6e6093fa6e27da1215

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

Filesize
12KB

MD5
a45611cfe4591843364aa8626c7f3eb7

SHA1
94e9ff7168190f41d6e417d60f7b52ee016b247b

SHA256
bab63514e1b07e612d9bd8d2488ba8e38e8fad2e28536804cf59bd6bf042aab6

SHA512
db0318fdf78c89e71510960e04fa65fed45c715f54d2f2144e10d34d7adf9a467034c7460d3322b781e2921e8b65cc536347207ff210b50325f2094f75c16371

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
727d1e526cff3b68511c02ef19aefa32

SHA1
7c968bac7f34d183ec42152ed364217ef5ba73cc

SHA256
008d694fd6ac9ecee48134b9ca433518161d6c92b58405d09b88650eed66ab63

SHA512
db7ba1eaf3c53fbf9db546ea6505b96a84affe7e6ba40e961eaae5af433c8704dc9c5f24cb0f1fb8e5d616a29e37de7b6ac514faf00b78c7425166892d9935f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

Filesize
30KB

MD5
1a24c93bd1d7bebf78e28f098836d840

SHA1
b5c80d40ca797a160b17d3e6ed601b5ccbf135e7

SHA256
f62c205e62c1c84ccb4bcbb63e7f40f7074c9f0e381bebfaaa30ed5e30079cb3

SHA512
92bf04b68b1a6598d171e5feb78de7906ad5ace3ebcaa3adf96984b89274ab2d4629682d5551eb554881ec566bfb79fc726cf09fb8dfecb843c708d8632dd5d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\9196b94a-21bd-474b-baaa-65c9c3510e64

Filesize
27KB

MD5
0f68ad0bf390e9f50110d27ea44c637b

SHA1
2b7b19538f20bd104af9dc6a3ee6c06a9c5cd584

SHA256
c0fa4d256d27450695e3db7b2f4cc8f82d30a7b0cdc47131701ddbfcab6a8e66

SHA512
1414b29d975f155fe6e5cfb20bf6eea0a2abe4fa97ee8f5b07182dada4e24ccc9c0bbb4443469bf3f5dace33a717361f9f584b97b54d7ad8bd7a92e5c741400a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\c8755944-d407-4945-b64c-97b1b19f81e6

Filesize
671B

MD5
4f7f541efe95f24383982d757cbb4269

SHA1
01cda5e7b0eac9935adcfd601085a854a71353af

SHA256
62e9a41fdcb7ac9ddf85af43c8674559df01b28097c3367ecdffd0d59a8c2d93

SHA512
fda6c504a812336ab358c242226ecb59d8565ed3016d5fcba753f0d29c3fb7a839b20d59107359095c2e277435def06274aaf02dbc8314bffd625b68c87176cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\dae13a55-487e-4aad-aa36-d5e194b1b04e

Filesize
982B

MD5
ea79008f865773e9dff57c70a449e410

SHA1
422d385a3e52c1afb43ccef206cfc7cf827fb8e7

SHA256
a0184334c461210517cf95dfdf061a7178ebc65686c233192b754e61c0e6a530

SHA512
6f813560049825d0be10ccd135b2b048eb65cc6cbf72400fa773fd9d4e3012d5a77eff9026741dc41e036340b78b37001f56d5dfecf657060e746909026d3eaa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

Filesize
1KB

MD5
36e5ee071a6f2f03c5d3889de80b0f0d

SHA1
cf6e8ddb87660ef1ef84ae36f97548a2351ac604

SHA256
6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

SHA512
99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

Filesize
12KB

MD5
ff462924f33548cff733fba2875332bd

SHA1
88571a993c40102b47fc9c4045164284be386f1d

SHA256
d4569beeddfbe40b41861babe00c663d09e134abed8bfbfcc4010ee1f2bd429a

SHA512
2ea62c8b53c3b9246f018ecb2579fe17ce3db90b141555cddabff32edfdc155e9510b2d96e43f018f2320335162c5f9c8f8cd8406d78153c2e37ef38e81aa284

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

Filesize
10KB

MD5
89a0573a5bd73682fef6256e0106e522

SHA1
cc466ba9a20ebdc550b7368e263ccedd15838048

SHA256
1dcf275202befd658b564e76394cd7e0d3e0f03195690f1a10cff3822bb9eac4

SHA512
4349f07e694688ef381fea66c8d43f67a81885b7731563ed12278555478f938af74b68f6f454d8cc0189be43c947e20cdb91111271d0f862844c16827d60db69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

Filesize
11KB

MD5
7b9a2a5b66397496f595528855485316

SHA1
e3bb117c7fbdeed2661bf8b8b7b581c9228da8fb

SHA256
be8e3765ade257396e6cf63b2b1da08a5bbf2aed6bc80c802c5c1f26a75b510d

SHA512
e7ef7d57e4b6dabdfd1fd02777c9a1fe1510cc561278ba9fb7cf85712d3e125c4a8c4089ddf206913600647f381b7b4fb577469498f651c4dc8097ba7668f406

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rc01leq4\CSC37AA2216149C472897358C43E42CFD1.TMP

Filesize
652B

MD5
22093e978da0737ab3b4dbdf3093f419

SHA1
4d3606a4dd85388f2beeea52ccb0e046a7631e18

SHA256
3457bf0b4f5fb7fd58dab3887e534390bda6f1858bf6e32b514d68d88c2a2928

SHA512
9b6ee3269250cf4a21cabb90e36c43ca1b04532ac93969e10de2b6080aab8af34be9492ad0dbcaf501adce6c8e7efdfcc51094d04edf057f7af61338dfd49301

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rc01leq4\rc01leq4.0.cs

Filesize
1KB

MD5
3fa19360e09832c3d711d4fe71911eae

SHA1
55a86c45af0f33419db93c39aaae09a06f610c78

SHA256
92a6b697b5bc2e42c280074823e06c1f39efc36fd985feff938b4f071756d28b

SHA512
880abc257e440799cbc718b39d776127e2a683cb5ffe4ebe426240aa52d7fbf6a4982b66b536388a88b00ed810088dc80b47e94297d24db89c1e2a92c982ec84

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rc01leq4\rc01leq4.cmdline

Filesize
369B

MD5
df082d5e9608237029d9fd3bac9bb93c

SHA1
dff2d3c0d5181b0d2cd3650b663c4a081878e318

SHA256
a7ae1b06d14b62583202e75d9d3957f63cdb8a318467bd053e8fa63f0d924623

SHA512
7d08ac1b53385dd6000381b40436bca08816ef0d3ae8a9cf0297b3a821de76e83e759ad3eb417dc2669dd90f82e3eed4089153ca6633dd4945ebc3604df47683

Download Submit
memory/3416-44-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/3416-41-0x00000000008D0000-0x00000000008DC000-memory.dmp

Filesize
48KB

Download
memory/5112-45-0x00007FFD20130000-0x00007FFD20BF1000-memory.dmp

Filesize
10.8MB

Download
memory/5112-40-0x00007FFD20130000-0x00007FFD20BF1000-memory.dmp

Filesize
10.8MB

Download
memory/5112-35-0x00000184887D0000-0x00000184887D8000-memory.dmp

Filesize
32KB

Download
memory/5112-21-0x0000018488E10000-0x0000018488E32000-memory.dmp

Filesize
136KB

Download
memory/5112-11-0x00007FFD20130000-0x00007FFD20BF1000-memory.dmp

Filesize
10.8MB

Download
memory/5112-10-0x00007FFD20130000-0x00007FFD20BF1000-memory.dmp

Filesize
10.8MB

Download
memory/5112-9-0x00007FFD20133000-0x00007FFD20135000-memory.dmp

Filesize
8KB

Download