hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
409s
max time network
411s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/09/2024, 02:32

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\cng.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\irda.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SDFRd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\spaceport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pci.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbohci.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BasicRender.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\MTConfig.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ntfs.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\i8042prt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nsiproxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\kbdhid.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ClipSp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\IndirectKmd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\UcmCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\umpass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vms3cap.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wacompen.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wof.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\NdisImPlatform.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\sdbus.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\usbrpm.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\iorate.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ufx01000.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\amdk8.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\flpydisk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hyperkbd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WUDFPf.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\usbhub.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\winnat.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\wudfpf.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\raspppoe.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SpbCx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\amdk8.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\volmgr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hidi2c.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pciide.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storufs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndisuio.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Ndu.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winnat.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\afd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fvevol.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidbatt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\NdisImPlatform.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\umbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mssecflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pciidex.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\SensorsCx.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\SensorsCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\USBHUB3.SYS	cmd.exe
File opened for modification	C:\Windows\System32\drivers\AppVStrm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\msgpiowin32.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\netvsc.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\synth3dvsc.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\Microsoft.Bluetooth.Profiles.HidOverGatt.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\filecrypt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mpsdrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\VerifierExt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vwifimp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pnpmem.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelppm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BthhfHid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\filetrace.sys	cmd.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	cmd.exe

Loads dropped DLL 34 IoCs

pid	Process
5924	firefox.exe
5864	firefox.exe
5864	firefox.exe
5864	firefox.exe
5940	firefox.exe
5940	firefox.exe
5940	firefox.exe
6128	firefox.exe
6128	firefox.exe
6128	firefox.exe
5136	firefox.exe
5136	firefox.exe
5136	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
2940	firefox.exe
2940	firefox.exe
2940	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5672	firefox.exe
5672	firefox.exe
5672	firefox.exe
5824	firefox.exe
5824	firefox.exe
5824	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_Antivirus Pro 2017(2).zip\\[email protected]"	[email protected]

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\O:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
71	raw.githubusercontent.com
91	raw.githubusercontent.com
68	raw.githubusercontent.com
69	raw.githubusercontent.com
70	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\PR8FD3~1.INF\prnms009.Inf	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\WinSetupUI.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\miracastreceiver.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\EmbeddedAppLauncher.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\lpeula.rtf	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\playtomenu.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\WINDOW~1\v1.0\Modules\NETADA~1\MSFT_NetAdapterRdma.cdxml	cmd.exe
File opened for modification	C:\Windows\System32\mgmtapi.dll	cmd.exe
File opened for modification	C:\Windows\System32\@edptoastimage.png	cmd.exe
File opened for modification	C:\Windows\System32\certca.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\iexpress.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\occache.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\localspl.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\tree.com	cmd.exe
File opened for modification	C:\Windows\System32\wbem\MDMSettingsProv.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\pnidui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\WIASA0~1.INF\amd64\SA3400.icc	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\it-IT\netrtwlane.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\iscsilog.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\msidcrl40.dll	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\en-US\netpacer.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\mtstocom.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\mintdh.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\hotplug.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\wbem\wmipdfs.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\Apphlpdm.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\radardt.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\TSSessionUX.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\rascustom.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\msaudite.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\wincredui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\SensorService.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\credprovslegacy.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\evr.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\WIAKY0~2.INF\kywdw810.dll	cmd.exe
File opened for modification	C:\Windows\System32\dsc\ja-JP\DscCoreR.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\WINDOW~1\v1.0\powershell_ise.exe.config	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\PRNCAC~3.INF\Amd64\CNBJOPAI.DLL	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\bootux.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\ShareHost.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\migwiz\SFPATWT.inf	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\L2SecHC.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\WINDOW~1\v1.0\Modules\PSDESI~1\DSCRES~1\MSFT_R~2\uk-UA\MSFT_RoleResource.schema.mfl	cmd.exe
File opened for modification	C:\Windows\System32\wbem\en-US\MsNetImPlatform.mfl	cmd.exe
File opened for modification	C:\Windows\System32\AuthBroker.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\lsm.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\netevent.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\WebcamUi.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\mmcshext.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\PRNCAC~3.INF\Amd64\CNBJ3480.DPB	cmd.exe
File opened for modification	C:\Windows\System32\en-US\PackageInspector.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\actionqueue.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\EhStorAuthn.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\migwiz\DLMANI~1\UPnPDeviceHost-Server-DL.man	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\KEYBOA~1.INF\keyboard.inf	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\NETATH~2.INF\eeprom_ar6320_3p0_SS_700.bin	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\dxpserver.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\de-DE\wnetvsc.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\ja-JP\mdmbtmdm.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\mprmsg.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\TtlsCfg.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\icmui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\werui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\IME\IMETC\IMTCTRLN.DLL	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4212266618"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107014fb1712db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31134231"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b50ffb1712db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31134231"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002985e2b4d1cbcf4382153420dc7e0732000000000200000000001066000000010000200000006bbae445adc9dbc884e6ad4f22349d123c4d26e78365efd7df41079cd62cde97000000000e8000000002000020000000b73d2428dc25b5601cc015d189ca14a933eb88cd7078dc85d54f59ec84170011200000008bf113a6286972d8e6ca650214b3e5adbe3c3e3b4f58b95114a761d0265be1cf40000000d0ab2db855d573903ff7f77309fc40bc57c3d1682e1fbbe0c7b12be5159da6ae99b0b40ea76cb571febf7ade0d7603e3bb4f3f8bc27e43d7c22e243903721c06	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4212266618"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002985e2b4d1cbcf4382153420dc7e073200000000020000000000106600000001000020000000e4ef0d8e15321e8d137e52bc13c4d1e4edd98a3e5f105f78effc16745e053b68000000000e800000000200002000000031ea205db6ba225fa3b6959a370ddcc79eae660af52f8324e30741805bfbfe1820000000dc596e7531b6e5c08c47be6470565dd9d005cbdcb1d03c1b7a8152438bc0749c40000000bd9a011a47f95fa59480289325f61b79989d4c46b48c54e6f6914b186dec67d36c78c45f5d92554b01d9db14fc324316ed0d0493edf54c8704b35d347ffb39fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2683B463-7E0B-11EF-ABE2-FA3BFB8A7566} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	firefox.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Apple System Security.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ProgramOverflow.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Antivirus Pro 2017.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Antivirus Pro 2017(1).zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Antivirus Pro 2017(2).zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2024	[email protected]

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	508	firefox.exe
Token: SeDebugPrivilege	5836	taskmgr.exe
Token: SeSystemProfilePrivilege	5836	taskmgr.exe
Token: SeCreateGlobalPrivilege	5836	taskmgr.exe
Token: SeDebugPrivilege	508	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
2112	iexplore.exe
2024	[email protected]
2024	[email protected]
2024	[email protected]
2024	[email protected]
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
2024	[email protected]
2024	[email protected]
2024	[email protected]
508	firefox.exe
508	firefox.exe
2024	[email protected]
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
508	firefox.exe
508	firefox.exe
508	firefox.exe
2024	[email protected]
2024	[email protected]
2024	[email protected]
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
2024	[email protected]
2024	[email protected]
2024	[email protected]
508	firefox.exe
508	firefox.exe
2024	[email protected]
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe
5836	taskmgr.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
2112	iexplore.exe
2112	iexplore.exe
4068	IEXPLORE.EXE
4068	IEXPLORE.EXE
4068	IEXPLORE.EXE
4068	IEXPLORE.EXE
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
508	firefox.exe
2024	[email protected]
2024	[email protected]
4400	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 4880 wrote to memory of 508	4880	firefox.exe	73
PID 508 wrote to memory of 704	508	firefox.exe	74
PID 508 wrote to memory of 704	508	firefox.exe	74
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 2308	508	firefox.exe	75
PID 508 wrote to memory of 3536	508	firefox.exe	76
PID 508 wrote to memory of 3536	508	firefox.exe	76
PID 508 wrote to memory of 3536	508	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Endermanch/MalwareDatabase"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Endermanch/MalwareDatabase
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.0.1967935447\1938702831" -parentBuildID 20221007134813 -prefsHandle 1708 -prefMapHandle 1696 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d250c77-db36-4f18-af13-8bf8cbb82262} 508 "\\.\pipe\gecko-crash-server-pipe.508" 1788 13c7e0b8758 gpu
    3⤵
    PID:704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.1.739271365\383123404" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9765c566-117f-40ca-bfa8-fe49f3a87d06} 508 "\\.\pipe\gecko-crash-server-pipe.508" 2164 13c7e00d558 socket
    3⤵
    PID:2308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.2.1681412538\1970344859" -childID 1 -isForBrowser -prefsHandle 2956 -prefMapHandle 2836 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08a9869a-4991-441e-a991-28e83da4aded} 508 "\\.\pipe\gecko-crash-server-pipe.508" 2968 13c027d0e58 tab
    3⤵
    PID:3536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.3.1552786543\2081352089" -childID 2 -isForBrowser -prefsHandle 1008 -prefMapHandle 996 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4429a4c-1a9a-4375-8cf1-851a0a834433} 508 "\\.\pipe\gecko-crash-server-pipe.508" 3616 13c036da258 tab
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.4.2111433337\990450509" -childID 3 -isForBrowser -prefsHandle 4832 -prefMapHandle 4824 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8520d17b-dab9-48e7-a04e-9b3342747c20} 508 "\\.\pipe\gecko-crash-server-pipe.508" 4852 13c05df4c58 tab
    3⤵
    PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.5.57050034\1806630815" -childID 4 -isForBrowser -prefsHandle 4980 -prefMapHandle 4984 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3931a8b-d824-4a33-a0af-6dc8f10a002c} 508 "\\.\pipe\gecko-crash-server-pipe.508" 4860 13c05eaf858 tab
    3⤵
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.6.1305806076\1252303385" -childID 5 -isForBrowser -prefsHandle 5184 -prefMapHandle 4972 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3db827f7-fa2f-40f4-bc02-5dfffe4d3e5d} 508 "\\.\pipe\gecko-crash-server-pipe.508" 5172 13c05eafe58 tab
    3⤵
    PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.7.963444948\1447659540" -childID 6 -isForBrowser -prefsHandle 1560 -prefMapHandle 2640 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f02e8665-2657-4c09-ac78-ccde2f7a0f03} 508 "\\.\pipe\gecko-crash-server-pipe.508" 1640 13c05eb1058 tab
    3⤵
    PID:2068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.8.335348300\1885397468" -childID 7 -isForBrowser -prefsHandle 6128 -prefMapHandle 6132 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdcae50d-79d2-41d9-848f-b6bcc3810d6e} 508 "\\.\pipe\gecko-crash-server-pipe.508" 1032 13c074e9b58 tab
    3⤵
    PID:1900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.9.798401101\1345424792" -childID 8 -isForBrowser -prefsHandle 4484 -prefMapHandle 2656 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68191805-2a69-459c-92b4-4c49af11c70a} 508 "\\.\pipe\gecko-crash-server-pipe.508" 6592 13c08c33258 tab
    3⤵
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.10.121015614\429451634" -childID 9 -isForBrowser -prefsHandle 6476 -prefMapHandle 5268 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bfdc9f4-792d-454d-8247-59d86cbe57a8} 508 "\\.\pipe\gecko-crash-server-pipe.508" 6536 13c09283f58 tab
    3⤵
    - Loads dropped DLL
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.11.1931450808\921170731" -childID 10 -isForBrowser -prefsHandle 11032 -prefMapHandle 11056 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fb8a7b3-6354-4380-9221-e10ff5b31294} 508 "\\.\pipe\gecko-crash-server-pipe.508" 11024 13c0a085b58 tab
    3⤵
    - Loads dropped DLL
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.12.1319241092\68276092" -parentBuildID 20221007134813 -prefsHandle 11024 -prefMapHandle 10900 -prefsLen 26826 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b7c313b-c869-4780-8913-a5bc924263b2} 508 "\\.\pipe\gecko-crash-server-pipe.508" 10812 13c0a088e58 rdd
    3⤵
    - Loads dropped DLL
    PID:5940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.13.47851107\1918962605" -childID 11 -isForBrowser -prefsHandle 6784 -prefMapHandle 6604 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72423b02-c86f-411d-b3be-9b161462b457} 508 "\\.\pipe\gecko-crash-server-pipe.508" 10560 13c060b3658 tab
    3⤵
    - Loads dropped DLL
    PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.14.2141953088\568657838" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5252 -prefMapHandle 6384 -prefsLen 26826 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f33b564-4f2d-4ff1-bce9-8c1c7f03081e} 508 "\\.\pipe\gecko-crash-server-pipe.508" 6524 13c097e4a58 utility
    3⤵
    - Loads dropped DLL
    PID:5136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.15.1566672000\1651765850" -childID 12 -isForBrowser -prefsHandle 6628 -prefMapHandle 6732 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0e5b242-61ec-4475-9187-dedf6d84bec0} 508 "\\.\pipe\gecko-crash-server-pipe.508" 6804 13c09284558 tab
    3⤵
    - Loads dropped DLL
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.16.685528362\209865206" -childID 13 -isForBrowser -prefsHandle 5932 -prefMapHandle 5944 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7853f59-58d2-4324-ae98-3e6bf90d7981} 508 "\\.\pipe\gecko-crash-server-pipe.508" 5916 13c0a1d8558 tab
    3⤵
    - Loads dropped DLL
    PID:6032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.17.672556422\556611102" -childID 14 -isForBrowser -prefsHandle 5996 -prefMapHandle 6804 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef0ffd0b-9f3b-4b4f-b1e1-20d1f6d0a038} 508 "\\.\pipe\gecko-crash-server-pipe.508" 5460 13c0c211858 tab
    3⤵
    - Loads dropped DLL
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.18.1198603930\2071012701" -childID 15 -isForBrowser -prefsHandle 10492 -prefMapHandle 5944 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {071985c0-ac90-4d33-a20c-9606e791c31d} 508 "\\.\pipe\gecko-crash-server-pipe.508" 10528 13c0c519e58 tab
    3⤵
    - Loads dropped DLL
    PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.19.1620820218\1421925008" -childID 16 -isForBrowser -prefsHandle 10336 -prefMapHandle 10332 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80d855c1-9a81-4b6e-ab27-d7e0b35fc3e0} 508 "\\.\pipe\gecko-crash-server-pipe.508" 10344 13c0c51b058 tab
    3⤵
    - Loads dropped DLL
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.20.359747497\1300826700" -childID 17 -isForBrowser -prefsHandle 10008 -prefMapHandle 9996 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0b5d791-9271-402f-ad9c-a0975c454336} 508 "\\.\pipe\gecko-crash-server-pipe.508" 10000 13c0cc3fe58 tab
    3⤵
    - Loads dropped DLL
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="508.21.197079692\1740179368" -childID 18 -isForBrowser -prefsHandle 10256 -prefMapHandle 10304 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2da0e24d-be0c-4a42-b567-deb2a3d80405} 508 "\\.\pipe\gecko-crash-server-pipe.508" 9972 13c0cc40158 tab
    3⤵
    - Loads dropped DLL
    PID:5856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2080

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Apple System Security.zip\Apple\5f205bc2379ac_v.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:82945 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4068

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus Pro 2017(2).zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus Pro 2017(2).zip\[email protected]"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1508

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\8dd1201db05e4c8584620d770a060e02 /t 4068 /p 2024
1⤵
PID:4380

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Drops file in System32 directory
- Modifies termsrv.dll
PID:2088

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5836

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a9c855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\17458

Filesize
13KB

MD5
b80a582c05848e51ee3347661510d002

SHA1
4b97fcea679deb3106883ce021feba941236b4af

SHA256
60e1b24ec0923be0ca3b752caf83850ae93f18c9f435479aabb5d515254366e2

SHA512
09eaed2747e8352e101c5b09f804a541024f8012d85f89ab43db1e80df5d0b6408b8edeabbb8a49ab2b5d8add2dd0a6705fda04f2e68020474cc603cbea88186

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\22380

Filesize
15KB

MD5
e2697eda6ce4af10eb78f271a56ae49c

SHA1
3cbe70afa0895e47ae8d2c510c42ce563be0e9ff

SHA256
b6532ec24378fda53c9f53cc3d8504943dc30e4d1871bdf5344c74b2e1e5e2c8

SHA512
ef808655d56489cc232bf17a8a87fc14f2c3db1ed6764f49febd0ded46e0101da11fabf9b004706172a981713955e56fa310d76533e809f404029191dd0a8165

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\24027

Filesize
13KB

MD5
26f132b5c2713cf2dfefd72a8f4b9c3d

SHA1
e817822512bda0be506a11b5e12c854450344d95

SHA256
3f8c02fc7cd5a4b5c15854d79144b790f1bf5880d0e1c586d8da74a901af5d04

SHA512
c27abf925a27d8409b68fd788ffe588e0b3ed654a297f47620f57aabeb04944fcf6f64d92a4673d2a9df023ce27f1f7cd3ec6ea0381c1601f11631d630bd1376

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\31007

Filesize
13KB

MD5
3c49de10421d36502c13b7fbb33d7672

SHA1
531c73cb9e779024d7d314503ee6f882651ffe48

SHA256
141834f6ce0c4c5c8f0b6df66dc7455767d7740f80fdef67fc078251ac9b95bf

SHA512
12bff839e3b4e5a9ff97bc36d8dcbb480d351f76c1fce32da7113b1d1d8da446657c8e158e4fb3d5a1bf6b52221ebd612658dc01735749682d11bae1c5ae75ba

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\3219

Filesize
21KB

MD5
b1c295e42a37b3be5c426eb2b92a5a4d

SHA1
877922d655cfa1652ce92c18b01552e58700b63f

SHA256
642a70c58465f479bc79b9faee434593ca88faa4adf253c4373621bce74d855d

SHA512
228d56f54494feffcae17f76ca9a8b8e6463f62b9cf529d0a2076e08aa1eb08a4d591a60985c02b0017adc069b002cda7c4f3061f89dfa563967451e111036f1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\6899

Filesize
5KB

MD5
b6f33c5a36cce73ecec0aa80590e62e3

SHA1
cb0a02ba293ab92e1bcc9a98ff3480dba5bc10b6

SHA256
4332cf755ab85bc8f4f02e35d18bd176b26a01308f5862509367892198e41647

SHA512
c5ad0f44f2a507e791b9ffe4c5c61bdfdc1319e55ce9614bfbbde4461e87e946436c652184a482390870dc4fe97ad59300c09912a6d1457804e36592df57a10c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\02404D04BC6E1ECC8A9AF6236BFF794EBDE4A23E

Filesize
128KB

MD5
67ea473a0d30754e7428d795122afec3

SHA1
04204c84d6954eacff5fe6a3b788d69817775b28

SHA256
445bc04645710b5fc29fa6a1d503e99239719402f7d77b68fa541b18d9239d69

SHA512
fe9170642b773c31d270e513e97a1ee5bc7a4e982e61d3a1641e4805a964c48f0c8110854bf7dacdcd4b8056d54107629d8d370a61a9e5e60d3184f693283a4b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1799007856A9D53EE1FDCD01A316215CC4F68AAF

Filesize
221KB

MD5
80205f2f95596b1d1160945ef7e3d2a8

SHA1
c6dd7c3dd4e7b316fda19eae34c84bf1eda1e32c

SHA256
42874d936e869e922e0fab285b95ad57fc62b786da8c86f29eddf97e07ed84af

SHA512
0571f917bb693f8df9a08f6fecfffe217908231876e300718609a83cd5597be05b6baca12a89d52207eefe7981e37da1a7417f7e0dcce873c5ffb2c33f1083ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0

Filesize
328KB

MD5
01699408e4b2ae4784e251422812f879

SHA1
4b5b693cd43efe166e4c461ead042d7fc09b6943

SHA256
e9179f22b55c44982b81420878a02edf4420b631cd9fb6cca7876a39c2e008a9

SHA512
ee88a7bda028631534ababf8d6258efed065f255f527545c75f59e5085dfe2f6fcfb5c01dab91e12a06883b0b6f3df2a03791224d83af34aa41e6c1f73e72abc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\3EB2498DDC1551A8D43364BFEF54CBDC382A5925

Filesize
19KB

MD5
a5a0aa6d2df3c1fbebb642b2bb60a4af

SHA1
a7133cc4fd805b5b1e1d3efbb247aa102388c3e9

SHA256
e9f18383da331a73be100f23b57e4b281d8c47130b769c2a863cd91b39e0e5c9

SHA512
93e2e2001aff05d733d2c0ed325a2fc29127dfd57ad9f89af1a9fd67003f81c1d3363ffbb0bae95bcecfebed5c24e424b0741de90de3fb69a1c6b1ec093c744e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\4412D919A32B54AB53754B2E68861EB10099D124

Filesize
49KB

MD5
09b6412e3e2c4621e63423a6ffd583a8

SHA1
ffe8c7f56ed9a665fb38ac4f8b093c7ad8b9e11e

SHA256
da686396f46b47cb40d5bed4f91ea5212552a883c41d7285a973876ff035a6d5

SHA512
a9e91f19c17065d40fbf404e6612718955dbcf9a02a29fde289f2d9819c8c4f4148c6423c796ecbba1454d230c5d15658aa805e4bba7569335288d71444b630b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\645AEB44FBEE3EC2FE9DB6CA5209F74C6FC79689

Filesize
54KB

MD5
c4d21e7732674871ec4dbe47c2cc246a

SHA1
84296490d1eb6f0dd0af23c8562ed1a1036b149b

SHA256
9bf955265582de1a1cda1f63dcc5a48cf4e5790e93c991f0be7081ad6b66152a

SHA512
0a1df0d5c30adc735f6bf12a0dc5d1e77dd91e7ad555b17276bb43b271fa1d04f477bd757f539128381042343eefa6bdc6940bb0309a7178c0632d89b5e418a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\AB2F92DC7C69C9091382D53EEE8D05C7CD3CF9CE

Filesize
129KB

MD5
d246ea68238891c6a8168723837c5a5e

SHA1
13ad9ec773e19dc7a28566e3326713adb71bcd4f

SHA256
c52734e925c9356eba9467d71bc402a9caecc1ebd7b882f178f6809f36c1a77b

SHA512
b920ee39c06c969d99ca56fe8166ee050473a9b3137328602e5e0ed7ff8974fec94aab8692c2ea4003dae1cf60c17c6a88a8b5bd5f7fbfbcb2e6667458e376e8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\ACFA93DB292B0B53E2F9B6C329F2D1CECF83BDBE

Filesize
108KB

MD5
c11b0b76f03c9dec3d1115d8df3c4e1f

SHA1
8598fa61c69ca4a9d29b7331b7f9921e6586c5c3

SHA256
fbd070ac0d0e6492f663b938aa1d4e0140b4a1a252d5993e668bd488e4002a01

SHA512
41445bb237c1351050aff06a777f22d678b84a62fc24b146d0ba12bd722dc653883e3e198153df7a1bc08d4dbe4fdf4bdb98ed6c763f907cfa946214aa6334d1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\C12464B8648A176648E1475661E88CA8FF101482

Filesize
131KB

MD5
986f7df402039711632479a08d070bba

SHA1
14b2629e6dd2568f1eefbd46e2980cd6ba8f992f

SHA256
2462f6ac8d0a5971dfd8afa9372670d7370eb22d1e88498c61b689a396ba0e4b

SHA512
be9e5bddbe330429c90dcf448bd2b2c5ed462e33ffd625889612950cf4f487110516c1f65a2381a3ad961e1048360b7a433d1592aa4d2ebaf4b51ab7b06ce481

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D16479E925AF122292501EFEF9D2A14A47D3245A

Filesize
77KB

MD5
94159c16ce6b2107a4f9f782f4a100c9

SHA1
d780ceb0406905b183f86f7a18785cc1754b8840

SHA256
ee0c1923978bd6a8d3244d8160c5767751d1c06ee8181c1627f57987f1a40670

SHA512
eac474d4ad386d475f27f67413eddf07428b47db29fc4d7c25731c929ecc723258fe00a1a1ca6301b9d1ee3f9e2f4e978721cd66718556473c3dced1c9694785

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\DBB1D200AAA5C0E8FECF3BF2C49AAADAD31FFE96

Filesize
1016KB

MD5
3f2aa62627d8ab02f23e2d2827cfb974

SHA1
f74a6e47426e4f9f83d4beef4607f707396ce4f2

SHA256
cba277f7eb8801de25d09559f48a93095483b42ebb324b1302d2e7729a4f950f

SHA512
52a241d688cbb782f98344aadbebfab5170bd12820a10648f3353324885858dc5cf13b722146db7439e4e1d375eb11e7e14b91eaf0d22ad18863cf9f81f7353c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\E6C22A3DFCD18E3C6145370266896FF76AE3F7EC

Filesize
15KB

MD5
9a803b038202c7d9753993cfaa188767

SHA1
445ebf5879a916c534fcfd0d774ff9c1e13f7cf8

SHA256
22fb4c7a7dc2cf6b55997a4cd0737719357ad9ce44a22d45f207e2417c6cf924

SHA512
1c98cbffebcb32bd7366d6a6e7496f178b5e103dce75dd661db0178cd7a1c551a17f5463bbb7fcc5996e5919082cf9eabec13208007b7c580af0627f744015c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\F1DD23AEBAACEC3C0BCE9D576D6904F3233FD8CE

Filesize
53KB

MD5
5a9f589d0b2052a05a3b760edef63dd6

SHA1
136de9ca5badaa492786fdc472d1bf2e69ea7526

SHA256
931206b196b409baa9c96b6a7d722de17e9a1469a6d8c6e06b324178edf5a24a

SHA512
4e77529e8920d6f42d15085d5ba40ff429e3fe22d14213c51ba4ab59067d37df62d1174a46d95edcaefc1a153fb3935bad5dac16f59a4535a076a7bd4202afb3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\jumpListCache\LS_dDQvbW5vfMezt_5zg7A==.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
9041ae84782829517c606f963f209a6d

SHA1
a54a473ddf8f3c054a9ca3f06b76be8fed1e3068

SHA256
deea275f83b71d168f514c24e6a29f8db4c5e8823befb7b51bbdf0f4505273ce

SHA512
baae1959f46d0141ab2ab0b8f4aebcf13bfb1d21c6fdf027587db84b9ee15a9ac96d66e93062da93a3bc87eadf503df2281fe4a33f48bde84f4eba6f18c2d885

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
e1073d041e19e9ec94e52df9d19f270a

SHA1
f65da81f1c51c66fc02c4e5eb7d87d42ae589a40

SHA256
7c57c00c32997b84c73b5d0d96dfd924589be72ab95599f77be50a0114a6f969

SHA512
29d78e9274a184c2fb1673f7252fe4df5fd1e73e1ebbb5340f682e38a37e344f067729ea9ba209f2a1f7b178f526855e4ac2017a4f8d59dbc577a94b18a0a791

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
c9f4d5a86a72c51b4112c95422940fac

SHA1
06907227af7e481dfe0c3b74a075b10dc8603951

SHA256
b37cc8389052714746d7cb34db52f541585ab56e013920c5e06e9a1c05d89a5e

SHA512
c7f36a2bf6884debf5e361248071ef23be8094ab3e9a6f60982fdf62dc8a8fd9cf7bb3f1647b477a09c63fde93f54a51204234003d646cbb8930d6cffa28087b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\7ae0d71e-1587-4f45-aa77-95130864c8af

Filesize
734B

MD5
15d2aeadd045cb7b5d7ad31d85955788

SHA1
00627b9c3589cf934c76f6ac947dc36c14910d7f

SHA256
39d1c4eed7ae065eb736020540d8ec55e71c0c8c4e73210976f7401f007a75a3

SHA512
d3ac2ba7eda950a59118770af251e59ebc05ac5d3291dcfa665afa6df40084cbdf20037bc06832d321dbbc901bece6f8cc1ecee522add7be9cfd66f191144755

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
733b710e885ccc056f65403ee52a202e

SHA1
226e0bf4e920a466eef6af52fbe54839f90db3bf

SHA256
4128d49a0d22c592602d53e0039c7c3eadcdc781e3aa6743ae7dd5a5f752698a

SHA512
b3470ce6ab8255a7a843a66f71f342fff28bcb08cc440fa9896912bff374b9922a58480af9796099ab24edca777a6c357f00718efe607c7df6539f7fa053c1c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
dad1153cf6f08936d1b7833a92703369

SHA1
cf520655f5127fa4eeeae3e52f1e1a98e28b5968

SHA256
ff68c7fbcfee25171143df4f5c77bf24a3d4de225a7c08c4b32db647f0e741f7

SHA512
67b0e36bf2c16b43d6d57dd8eab043fdb365ecb1c6ead3c4c96b0b848178404c68de2a53bee67485109fc9e6d7092e60854f0b75e7eca9c3758121207084e164

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
7a84303c3135e155f08983d59d94dee8

SHA1
fea8e469378063df5255682cd17cd21a90d52782

SHA256
672d45f7830353f25188e546b6166f3a51ed6e476f8d210ba649c170f7fa8965

SHA512
3c0f85bed135a1c63b105c0626a8e958d09d76ff948d511f544e8ca2f2ff4599bf05c045c2f3afc3e1cb1b6afded50325cd5085995d2c16b5916524cf12bd036

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
044dc7b6e751eb46b777b1eeb4ba03bd

SHA1
9f5c3e9ccbdade5912bc9900b998b27866a19338

SHA256
74aab701640214e6a31cb6f0f997166b16d99e922dad819428a3f217322337c1

SHA512
c759561e9159b045796474ffe02dcb4b1171e31771a04302aa22c098e8536ec01bd7f4587ce88e19966d4b54c2e54b94d39cff0d2b75918488e90243a696de9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
1078dad352efee3239ae3d3c96ebc4dd

SHA1
45851f118a9046abc74a0ac6456c85fa5d50ea4b

SHA256
cc50a347ac18a3a68feff48f5aa8f553729588a96debf454b854f6f67983c505

SHA512
4ca03e47f3387906623e8ebb597afb0c776c90c4744ff37451128587119b205572a23f4ca7b6604fe7e1139d7bd968fea460cd4885e56703772eb010c521fc3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\serviceworker.txt

Filesize
162B

MD5
4b19d01aed7ad839f53b729000aec3d0

SHA1
80530ee72543e76b5eb1c712dd135f5274488d00

SHA256
1436d51e00db114de089cdea585af36c72f61f4018adb31376a59348381579c9

SHA512
92aa75e6e98d237d2516ca278f547655d1c31c78e527b8428005a6b8890e862e6457d75ec9c4ba20377cb548c1cfe854eb4accf1a42806d938dad89421fb7b34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c944308da5c66915cfe4eabc80306966

SHA1
f2b94e72bc068353233ac3dca50007226489f8b8

SHA256
402b59d95bf1a8f9445f36b5862c8340816a03ef05a3a7097df76e75439e3927

SHA512
95f0b40a849c6ba667e06dcdbc1cc8ffd0f07f5cb34042d063a18f81f4032e3e5d3292766315427ae80903485644f00f601adeca94c1a350027c7dea9242df0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
36045be2677a3e686de9ae8666ada7fd

SHA1
a0076402956ea562a4f85f146800f96b019ba9fe

SHA256
a4828dab721086666178b5e6a4507cdba1e0677834921bdde0b42bfe40ac68a0

SHA512
a596108777b6fe1f53e17ca4b8afe7a33d2eb0f428fbb013954a8ba710c86bd1ed264c8e85beb843bb47ecc204415b3cd551c3f075c89b30c4072f5e5c13bb4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
86a75eac6235cb412b1b9bf8e1676b4c

SHA1
f50172250737746aea68139d7a91149cbdde4c0d

SHA256
d6ba80ebc960d26de0a61249715e4b1c0c6deb6618b57149af9648ac490f185f

SHA512
b6e3892d237d4e7d8ddfee6b3fcb7ae959d91160a426b643cd48927ff7c0137e52d1b1abbbf16f49739a6c963042c95cc56ad418612568a29dfde43e676e19ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c947b2e47341e0be35ba1e84b38e97a1

SHA1
5f47363eb63618364a3c27a024fa533501cb5e8d

SHA256
ab06509b83e649b16b1295e2106b45e946f368d300f6549f9d5946f00e50c87c

SHA512
78dc7eecf9ba9e9be0fe5c04c2a1424d21424a5ccae59113ad61eeea8ca6195bc2fd5f9c3655f2d8ec67e2a9b5f39c3cb23f97cc6fc59fd2f58c50f364d2659e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
bb27af64209362a12f523a8d5990e10c

SHA1
3761b1e53162a5eab997b46305df2774e4a21a2e

SHA256
4b64c9f8ff726658fd97ff4171d843a6a4a2e2c2d3b0c68a5c3eb396f4165f6f

SHA512
9dd434b470c1752e69e1660eae3c529f5cf8b41ca9ded8e672241c6422242eec532a51c3d23d57deabd6dafc18d3d9b3f3c03312451d383b58d149db7e94dc0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
a9812f521f62599458eea7b0041ec273

SHA1
96a9246c4ce4286e1dcd2ef0c5d722e56a2fc3d9

SHA256
b3af6264dd0a4ee485e22a5bd0cb1b632908941736df66633874e470d2fc6468

SHA512
12bfa34ebfbb58827a19caa5ec6b539a54b3c6544e14b9e289bab526c138653a48debb2e8c5704b3532568f79ff3066358f3bc54b536ae715218ba5f83492238

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
24KB

MD5
dd4b1ed26e0767546831758730a4ac89

SHA1
665c668d0f804e929fc6796d2975b5353f048cc9

SHA256
0886373016aafa0092f505c8c0e49e2e511ea9c77616802497b9de653b369011

SHA512
0d5c7b41285c31db1d394f902ef1f20bdcb354c7ed48fb8e8ba9620434f039ed2125532b93249af5f7ae7bb2b08208dd3eb7551143a24eaa760b7f127dc58815

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d9fde882f00fd617682fbfa8d5cbe7fd

SHA1
eca1726a53619590b450406c37698ba70ac14c82

SHA256
1c4297f462b87bfb5c112e3f03fc4e0c0df4a8068cbd43701c70ebb709284dc1

SHA512
f055142eb9172dd72033fbcdaeb4309ec71c01bab118ad8db9933185030d71dd7348119e59bb2e9455ba33c93b4ecea4e5f8291f1ed7aac5b2636263555990f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
25KB

MD5
4ad876a30bc30462acc5c08a2f83ba24

SHA1
7d80f217025d4f3dcc3f05042bbfee5328bdeb5c

SHA256
260f19d601eeadc2323cabc6da4b124678387b3f960c4f51a971481141d4a612

SHA512
5eb2f7f8098f04cd38b3c4c172b4e456facb2e466528d0a6532e8c25decaf920785682694f61d98d7ef3b7d8c1d2e60e7d2583faa24ae8b665aeb8bb2c406754

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
2f8b76e769d81e08d5f14ea557956b4f

SHA1
38b29f62c6264bbe3456f7bb1fa389a4e4788e36

SHA256
e9b8b81080b71550cdd01f80b6d381e322a8f4ceae1f8ab54a114545fe3a642b

SHA512
32e85e78a85a8a7f47885fff6bb75760471796cf8e4ad00887f0f4a8f16bbd62f9fd5dbba05179947921bcbde401c876a224501a81279872a50abc880df71483

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
2d1862f8bdc2f7651804ead1bbbdcc61

SHA1
96a608d4fe40d73a12096d9c2813689dc8de7a33

SHA256
9e4d01f9a4fe78392d3a3a8bd6c601a883647fb2e6203cbd856df26d6bc4bf4d

SHA512
39fd2b248d38b4cffcedeaa2a3d34f86d0a74231d228a3611e2146a94a4cfbed9824f35e48d9cb15b70300d6dd3b45e8d23ea8d6024858dfb0151d059e450b52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
98e1df99342e864c51a09e4184496195

SHA1
51a10f70d8007e9df16b72a58bac4320cae324df

SHA256
65192a7965c1c7073636bdb90b64cec1a465f3f135d8c1e23a6258afa6bdd3a0

SHA512
5ef3f127ca4185b2428829538231e1cf683fa75a88daa1d8d37c0737ce847809191bc1b7c7bb4e4eb96828df125a7d7b1215519bcb7c79d92ff53773bd42da69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
2118fafcae8898fb1efeaee27e92dd15

SHA1
af46dfa39e734f36c26ea38b76bf170d475a098d

SHA256
151cb1319eb1e5e69dd82c3bd9d11514e75e9ee017ebbaed4e52880d6ecc68bb

SHA512
5ec464a6ee6cec33e27ffe45bf4dbdd02e56a07522a284a6729ab9c4072986ad8b6c99bfd03937d75e821c5805664fb4a055c36f8220d0413e609117bf83ea10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
21123b439a4a33debf034a1e9aa40a7d

SHA1
729ed3ee6ce574689c20b96800fa84b2d70c9079

SHA256
9df6fb955e58070d6e7c640967ffbea19bf5d6c0c5fa1a984d2d20e4a106bcf9

SHA512
5ce92503665b7e571eb6c4ca93d5e67f7312c8001886f96f403cf0ce70898317fcf9145c8359b7662c5908b957ac14e313a938547270e3a14209af4408525460

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
e243c4ad0bf184621bd4f55be2ce52b8

SHA1
6490c75b8f2c5bf558240882698e0ff178acef86

SHA256
1a732b7f051afec0989bd38bcc4b2d636d4e259a345ef805270e205e010b7a37

SHA512
d0780c38f3a0ed8078c9de0732fed643ce0752b6eb23784dfb7206b751581689c1aeb484cd60bd19902ad35cd20a91b52c4ea17bcab22fe81dd95683cb493364

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
25KB

MD5
c8e2f1c9e5580a8ce2aa2bf6744ea7fc

SHA1
647bf1574651d4c1f27f912f50ae2f3dd2aa3161

SHA256
1d05611d58466c9bf9b6a59d23640cd4e8d2024d704b7e92a7f756fbc888c8d9

SHA512
23fc699701b10dd35b3f8e61935b394ee476a9fd6ce4f1bb934e2f97aec3bc8b965d1b42bced8558faf52b177c436da15eb9e1083e231977e7d79d5467ace4e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
25KB

MD5
a25f744d0bc09ba96b295da1d70f15c4

SHA1
09f3af4ea9c5ee13dd25c44bd429fab4ccf6a58e

SHA256
fd1cc5a4d333649909b05058fab61a3ba376735f084b924a14fc0ff837ccc02d

SHA512
67f3676e594a0d1140e0536f98884c0d09744f4d54751e8eec20778c89041783f630de65908cf8353363a7a64be23299dda0292d448901e60967f1563b9581fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
d44c75527030ec63bfde2607071cb00c

SHA1
89d83ba11c0f99d7859eb4056d026df7bfbedac1

SHA256
4e79460beecbcadbce4f707483004021667263d9074b472623f0ab0d58f45de3

SHA512
a6f4e0aca00b4cc5fe7ebfa8ca9e3a729e33d88208e740ecec50614a4012b5bbadbea38aebea021b0e442498659cf7bff10f2793dc0ff5fdbef24c85f585c92b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

Filesize
26KB

MD5
2c84bcb2459c34f950c39a2ed61716d1

SHA1
7559b7344e391df5ebfd94036038b901b20eb056

SHA256
c34d9e6aeae8441fcb8715954354ca8ba54b1a3d4eed30acec573a1f1eb0fabf

SHA512
acf60ff5d26cc6d6f34d00d1ffb1d5b165e4d91d984a329553141ad21bc8bed601527b53c52bc15fa8cd2d38af8fbb787e7e8ae20ec529d36188f9e23b0e83e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.linux.org\cache\morgue\67\{76ff6864-94f4-4c7a-9443-03ec4be24843}.final

Filesize
2KB

MD5
81c542f8823ebd1002b023a3abf06fdc

SHA1
c9014514e5f46ab23daf73f11b02141715d056cc

SHA256
9a8a674170fbf6af1939cb9f75b6432b45e196fe48ca171a76ee1217515fff17

SHA512
9bb97eccf14dae0cbaadf46a6a6e7171b316982be029f8c5c8f9b6e5986c9930ea04dc66424b50f2c05dd3842ac880d8efcc1723a8eb7776e395929f92d8cf65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.reddit.com\cache\morgue\62\{2286dd75-44b6-47a7-850b-1e79b4af3d3e}.final

Filesize
2KB

MD5
d106e9d73e807ce0916ac3fa51d1461b

SHA1
a1138b90f539ebe70efe33fa35f96f237fc2c059

SHA256
1ddaf57a54e90c2f53b0f3479651a124f56d1ea3ade097cd0bfa0157de62f942

SHA512
28a0a450cb47d9dbdc743a5ff5e472ace7ffcdac7644d155378e9a848563b58061110f7fd1e2006c4baf1229efc138f6f3ddda847f1191557765529a8e3517ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
60a25a7a289768f29370a29a7373c0f8

SHA1
ff5d68a7568d13a2cf095e267c2da19ab182b8c8

SHA256
ccf8e4d0cedac9f6f08414a066c5d876f313606cef626cde740f2a97ef05aed9

SHA512
8908f73604830e67ec831aad08bf0215904d23506e82502f2546a468f119d6ddff383fbbef5b98898408bdaa6ea62a226531f5107aedf6207bb0cd66e0cccb08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
1fdc13de64cfdb8ba3fcd71aad9d33d3

SHA1
b7649cfd66d751435fa56a4b4b20daace452c692

SHA256
fa890605b23aecfebe4300d159f10096cfaba982a942c8ce829617b3de36a783

SHA512
3c9dc261a1f0a96d4433d60de03423d58f0bd63dbf5db48962372658103f16991f6da06c1670deea1e51efd2a15aae699d1d287ee377e0a457299a7dd9f691a7

Download Submit
C:\Users\Admin\Downloads\Antivirus Pro 2017.EED_UURR.zip.part

Filesize
794KB

MD5
ab1187f7c6ac5a5d9c45020c8b7492fe

SHA1
0d765ed785ac662ac13fb9428840911fb0cb3c8f

SHA256
8203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a

SHA512
bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2

Download Submit
C:\Users\Admin\Downloads\Apple System Security.QcOZ7orj.zip.part

Filesize
28KB

MD5
4355e7e16a7a2878fbad631493ca6839

SHA1
412ced449b16e152e2bde301a293acbd54429ce3

SHA256
91b37fcdcff54f668bb2fcbc22c87493e56b04b8daa67c4f866c914d7f0a4d25

SHA512
021525b2d9ea1e429473698c5f9d0a277c966382a8b9022a0ee3c1d9de4add53e2b739f1abd6104baf84121035afc61e700a245801ffd4c537c7c8950937a5f0

Download Submit
C:\Users\Admin\Downloads\mz7uNJbE.zip.part

Filesize
560KB

MD5
44481efd4f9a861444aa0aa05421a52e

SHA1
22e9b061f8fc3147dd0ec8a088a38272b0d30bcf

SHA256
7b8632db07cb8693963402624e6ad884187b23f81ec7968fba2631909d5919b2

SHA512
819cf783345751f6fb000142b59ebac5b72c8878adfaec1c9472bf242d7a469cdf21a2d89c6e292599606f19782c1951752f763bd89efed35e1b0f2d2fd52827

Download Submit
\Windows\System32\msvcp140.dll

Filesize
554KB

MD5
c7a693fcffcb6c245282d1132e38ac5b

SHA1
8965f69c938eecb2226ad7329a9df5109d93cb8c

SHA256
a8102891d06b5f21c35c67e4ab26eb84f54405b67e67eaf75dadc62cef08b55a

SHA512
321456ae04eb392734a0aba27e965500467d58dc1277fc550b6573916607ba53c686db05219ce326fb3f9289cc4430b85990362f630e4a7829345067986ca6d2

Download Submit
\Windows\System32\vcruntime140.dll

Filesize
94KB

MD5
6e34fc4a713c3fbd88e47ac188d2540d

SHA1
1877a17da406d147566168c56aac1eb576782b37

SHA256
d8faf8ebf360ed0b3b1a43877a04863f7e044b3d19b641d88737e0829d683b36

SHA512
848a1d9602210d7da0f6e4d7817af08dc02baac7eccf1cfaadaf3a24b55e1316e77c40672a6a1195797e525f448817e534ae200e99cdf548ee64a7996fbcec4f

Download Submit
\Windows\System32\vcruntime140_1.dll

Filesize
36KB

MD5
d76532f224b6648179b77525326e8754

SHA1
cb0a90adf84b9c19e750b166789452693f031053

SHA256
0d8217dbb0d52a3f8cd233b089131ca19aa6e0fc0c0fb10081f3c50761f5d15e

SHA512
721b4f0f55fbeefa394d3471c66d32e2f0f452f9977987450b1662b8e2e9a88d1b9c014b5f2a4b378d99f6fe4de6b5810f8b00157ae25b0de2a3bf3e211ea2fc

Download Submit
memory/2024-815-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-609-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-628-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-626-0x000000000043C000-0x000000000043E000-memory.dmp

Filesize
8KB

Download
memory/2024-614-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-613-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-612-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-610-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-629-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-627-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-608-0x000000000043C000-0x000000000043E000-memory.dmp

Filesize
8KB

Download
memory/2024-630-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-818-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-694-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-631-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-782-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-771-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-722-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-666-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2024-711-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads