dridex | d997a546378df1ac4b47a2836b5cb6dfcfbaf10c4298165928237112f2d6cb27

Analysis

max time kernel
900s
max time network
837s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
30/12/2024, 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc.txt
Size

26B
MD5

77ec9122c07d50702533f30c31bf1216
SHA1

865d4c2651033ae7dde69c77012a6e3875fe88fa
SHA256

d997a546378df1ac4b47a2836b5cb6dfcfbaf10c4298165928237112f2d6cb27
SHA512

8c434e5fb0b0427e50154804b01c6e53ebdad2a5fecd551c84bcecb8147c52cfa18bb9a6f2890ffa3df5a7f28d9a1273cd3c9662a6e8d6c7d42cde503c00a715

Score

10^/10

dridex 40400 botnet defense_evasion discovery persistence

Malware Config

Extracted

Family

dridex

Botnet

40400

132.255.244.130:443

111.67.77.202:3389

198.50.236.57:443

45.122.223.13:8443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex family
dridex
Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
5540	dridex.exe
4812	dridex.exe
1044	dridex.exe
1900	dridex.exe
5640	dridex.exe
1972	dridex.exe
2416	dridex.exe
3132	dridex.exe
5684	dridex.exe

Loads dropped DLL 9 IoCs

pid	Process
1808	x32dbg.exe
1808	x32dbg.exe
3068	x32dbg.exe
3068	x32dbg.exe
3068	x32dbg.exe
3068	x32dbg.exe
3068	x32dbg.exe
3068	x32dbg.exe
3068	x32dbg.exe

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114
PID 1808 set thread context of 5540	1808	x32dbg.exe	114

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\dridex.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x32dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x32dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dridex.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ProcessHacker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads"	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0\NodeSlot = "7"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ProcessHacker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "9"	ProcessHacker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	ProcessHacker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x64\\x64dbg.exe"	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0\MRUListEx = ffffffff	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0 = 4a003100000000009e59ae65300078333200380009000400efbe9e59a1659e59ae652e000000ab6204000000280000000000000000000000000000002a542c01780033003200000012000000	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ProcessHacker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\snapshot_2024-12-21_17-05\\release\\x32\\x32dbg.exe"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\MRUListEx = 00000000ffffffff	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ProcessHacker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\ = "x64dbg_db"	x96dbg.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Process Hacker 2 (2).zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\dridex.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
996	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1808	x32dbg.exe
3068	x32dbg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1808	x32dbg.exe
3068	x32dbg.exe
3700	ProcessHacker.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	firefox.exe
Token: SeDebugPrivilege	3596	firefox.exe
Token: SeDebugPrivilege	3596	firefox.exe
Token: SeDebugPrivilege	3596	firefox.exe
Token: SeDebugPrivilege	1808	x32dbg.exe
Token: SeDebugPrivilege	1808	x32dbg.exe
Token: SeDebugPrivilege	1808	x32dbg.exe
Token: SeDebugPrivilege	5644	firefox.exe
Token: SeDebugPrivilege	5644	firefox.exe
Token: SeDebugPrivilege	3068	x32dbg.exe
Token: SeDebugPrivilege	3068	x32dbg.exe
Token: SeDebugPrivilege	3068	x32dbg.exe
Token: SeDebugPrivilege	3068	x32dbg.exe
Token: SeDebugPrivilege	3068	x32dbg.exe
Token: SeDebugPrivilege	3068	x32dbg.exe
Token: SeDebugPrivilege	3068	x32dbg.exe
Token: SeDebugPrivilege	3068	x32dbg.exe
Token: SeDebugPrivilege	3700	ProcessHacker.exe
Token: SeIncBasePriorityPrivilege	3700	ProcessHacker.exe
Token: 33	3700	ProcessHacker.exe
Token: SeLoadDriverPrivilege	3700	ProcessHacker.exe
Token: SeProfSingleProcessPrivilege	3700	ProcessHacker.exe
Token: SeRestorePrivilege	3700	ProcessHacker.exe
Token: SeShutdownPrivilege	3700	ProcessHacker.exe
Token: SeTakeOwnershipPrivilege	3700	ProcessHacker.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe
3700	ProcessHacker.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
1808	x32dbg.exe
1808	x32dbg.exe
1808	x32dbg.exe
5644	firefox.exe
3068	x32dbg.exe
3068	x32dbg.exe
3068	x32dbg.exe
3068	x32dbg.exe
3700	ProcessHacker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 1100 wrote to memory of 3596	1100	firefox.exe	87
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 3044	3596	firefox.exe	88
PID 3596 wrote to memory of 2096	3596	firefox.exe	89
PID 3596 wrote to memory of 2096	3596	firefox.exe	89
PID 3596 wrote to memory of 2096	3596	firefox.exe	89
PID 3596 wrote to memory of 2096	3596	firefox.exe	89
PID 3596 wrote to memory of 2096	3596	firefox.exe	89
PID 3596 wrote to memory of 2096	3596	firefox.exe	89
PID 3596 wrote to memory of 2096	3596	firefox.exe	89
PID 3596 wrote to memory of 2096	3596	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\abc.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:996

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1974f22c-8aa2-43db-8084-2b339b27da4b} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" gpu
    3⤵
    PID:3044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2388 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd4d95b2-7f71-48a7-bd54-56b4e6f364c9} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" socket
    3⤵
    - Checks processor information in registry
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3052 -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 3140 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77c7a864-7623-45be-a63d-bc493e622811} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
    3⤵
    PID:4996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3684 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 992 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d959206c-c9cc-44b0-b487-745f2d01e87d} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
    3⤵
    PID:2272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4200 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4160 -prefMapHandle 4304 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e456da6f-a558-4de5-9b45-55e1748c9c75} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" utility
    3⤵
    - Checks processor information in registry
    PID:1536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 3 -isForBrowser -prefsHandle 5380 -prefMapHandle 5376 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f4f21ae-ea96-4e09-897a-d3a145d2627a} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 4 -isForBrowser -prefsHandle 5536 -prefMapHandle 5524 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {095e24bb-dd51-42db-8a32-0b7b5da1428d} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 5 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5125b40e-52ed-4d4a-ab21-dd03448b078e} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
    3⤵
    PID:1412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6264 -childID 6 -isForBrowser -prefsHandle 6256 -prefMapHandle 6252 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9de335e-8ea4-4f8b-bcc9-33ed2675752c} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6412 -childID 7 -isForBrowser -prefsHandle 6444 -prefMapHandle 6428 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fd2b414-8f89-4e50-8f95-bc3a81ccff7f} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" tab
    3⤵
    PID:1908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4896

C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe
"C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6040
- C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe
  "C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe" ::install
  2⤵
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6100

C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe
"C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5268
- C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\x32dbg.exe
  "C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\x32dbg.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1808
- - C:\Users\Admin\Downloads\dridex.exe
    "C:\Users\Admin\Downloads\dridex.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5540
- - C:\Users\Admin\Downloads\dridex.exe
    "C:\Users\Admin\Downloads\dridex.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5628
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1928 -parentBuildID 20240401114208 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 28351 -prefMapSize 244981 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d688d7ff-5311-47ee-b451-1f958f471ee1} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" gpu
    3⤵
    PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20240401114208 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 28351 -prefMapSize 244981 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa9e8cfc-6f4a-4096-92b0-1d4f3e3f6863} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" socket
    3⤵
    - Checks processor information in registry
    PID:2948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3248 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 2792 -prefsLen 28850 -prefMapSize 244981 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad45ac41-dc09-4962-91be-c54eb3fe8dac} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" tab
    3⤵
    PID:1556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3656 -childID 2 -isForBrowser -prefsHandle 2464 -prefMapHandle 2868 -prefsLen 34083 -prefMapSize 244981 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa5c7bc0-7d79-4ce2-9340-93bc20682177} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" tab
    3⤵
    PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4824 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4816 -prefMapHandle 4812 -prefsLen 34137 -prefMapSize 244981 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98311a38-261c-48a4-bd7d-767781fef187} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" utility
    3⤵
    - Checks processor information in registry
    PID:5404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5244 -childID 3 -isForBrowser -prefsHandle 5248 -prefMapHandle 5252 -prefsLen 27664 -prefMapSize 244981 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af26c0e1-45bc-4d46-8060-a0e5af6c0483} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" tab
    3⤵
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 4 -isForBrowser -prefsHandle 5396 -prefMapHandle 5404 -prefsLen 27664 -prefMapSize 244981 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd5ea287-cfbb-4a2a-9043-d3d9236e6a10} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" tab
    3⤵
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 27664 -prefMapSize 244981 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fd1faa0-a9f1-4035-9c9d-99af56d7f53c} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" tab
    3⤵
    PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5964 -childID 6 -isForBrowser -prefsHandle 5956 -prefMapHandle 5948 -prefsLen 27664 -prefMapSize 244981 -jsInitHandle 1352 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6ab488f-2226-4732-8103-18df4cb14296} 5644 "\\.\pipe\gecko-crash-server-pipe.5644" tab
    3⤵
    PID:5640

C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\x32dbg.exe
"C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\x32dbg.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3068
- C:\Users\Admin\Downloads\dridex.exe
  "C:\Users\Admin\Downloads\dridex.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1044
- C:\Users\Admin\Downloads\dridex.exe
  "C:\Users\Admin\Downloads\dridex.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1900
- C:\Users\Admin\Downloads\dridex.exe
  "C:\Users\Admin\Downloads\dridex.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5640
- C:\Users\Admin\Downloads\dridex.exe
  "C:\Users\Admin\Downloads\dridex.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1972
- C:\Users\Admin\Downloads\dridex.exe
  "C:\Users\Admin\Downloads\dridex.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Users\Admin\Downloads\dridex.exe
  "C:\Users\Admin\Downloads\dridex.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3132
- C:\Users\Admin\Downloads\dridex.exe
  "C:\Users\Admin\Downloads\dridex.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5684

C:\Users\Admin\Downloads\Process Hacker 2 (2)\Process Hacker 2\ProcessHacker.exe
"C:\Users\Admin\Downloads\Process Hacker 2 (2)\Process Hacker 2\ProcessHacker.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
4114080f84dca7e7901a621f62fddf19

SHA1
72974652e7ef47af7430867f0bbe4d77f2468653

SHA256
69d97bc5765090c3fc5e4b7361a70de30a9940239ff73f7be5a18d2bacf6cd13

SHA512
a00ef7b71ae08c67ab5a66833437c4524f5bddf0b8ded4467da9fed1022fb61657e3205cd70541af6dfc9cd934be5dfc17889016dd1976cc3388c2d89fb6ce7e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
6bc31601ec33e5c46af11e9187100989

SHA1
521db57bd8fb985f5b7994ee2db07830aafba5da

SHA256
b05667d4589b96faff9a8e64f7d4425b744d465d292be4a3f2545d260bab5f4f

SHA512
5628b8687d11a9b4f60f50edfc961ed9512870718b8f643a218b115b3fa74e8e9faa296789b2a90298e64ff5c4b196f4aab3d8bff5d5f05fe28a73f16ed74c36

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
14KB

MD5
9a0ba00cf0ceb168590735ac0059609d

SHA1
09a2cc18b431126fde7ea0233fb66b8c576ca748

SHA256
f1189d82bc1ffee363dd79f4b2b9d0acb6fba5a46aabca2b7fdf8385461eafd4

SHA512
b72638e029ce936f4f63f94fe08269394ee0842ecbc43ee3aa5fc22e79a21098cb086a3c15db0379ea3492a83341f8a38f7f1959deaa71999eaeab1735406f91

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Filesize
13KB

MD5
4bea951f6a9ecb0f7193ffeb0d1460b0

SHA1
a178cd5bbf994709448ff4aa069ad1e12afc727e

SHA256
c67ee55232e7b4eb19ac382a50b7780eb0fb7ef319b9058ad0d23cb545144efe

SHA512
5ed4d0bae62fea7eb1e4e9a7a02f13f933970117b07e00b70ccdffc631065df48506a288c8a8a685deab3df665047a6ebad0ab304512681c11a5203748d5b9c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\startupCache\scriptCache-child.bin

Filesize
469KB

MD5
15405b40b11396456243a08ab4c1f30d

SHA1
eda1aaf4281a3f6ac05af57ae91e37f6faf3048f

SHA256
2aa3c813af62320d33d79d971fe48ef775ff66a716658e428b043e2425e721b1

SHA512
e7aadce7de8ac6ca2243cfba8ab242ee6b7e7590445c4d8bee16d39cbfc2b74f0095230ba2bf70db70eede4a3cf1be98372bf79c3bb0db2826608a5da4520618

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\startupCache\scriptCache.bin

Filesize
8.9MB

MD5
295a2d04112a6309da74c19adcb77b3f

SHA1
96650ac15f8954c76bd0fbfca4e19760724de8ae

SHA256
9344466b0eec2c1e8b2cec14906035e0ac900464f21780c80e2d42dcbf46dc46

SHA512
cb9b01ef8302ea5ab0234134eaa0a4834c68d6bf6ddac9f4c7784d032e7c9a7a9b8465f854a734a55e9eeffdf5a2ae34ccf6a12356ed596a8db6ebd75a8717dc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
b7fc7dd825a2d03e6bf65c081ac475f5

SHA1
ff5998dd480b0d94a2d4c6d78e020b6350e3288d

SHA256
5de9d2c3bf59827790a07de7eff041056e0cd1f098c7dff9414aae197970bdd4

SHA512
569693f3a42973f589263d3728936647b71764aa08fa0fba4ed605dbe63beaff80b039ad607895b5b84a340709ae0a6e5cbdf906cdb76f65fee5cae3031dd580

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
6dc44f93250aa475bf897114be736326

SHA1
4f61407a284785af4caaa9d5b103f3bdaa403ecd

SHA256
60ad6936735de84311d6221678d8dd4ad14a296e302b6c98390b1d468f01f5f0

SHA512
a979d498553459eab87e1a4e62226acc349471b64053896fdd36ade37ae32ade944229bf4f363e62a52e9c691584158bdd9219a98405d66a56e1950146f7e6b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\AlternateServices.bin

Filesize
8KB

MD5
bdfda3dda131adea9f5ac79cdd8bd71c

SHA1
a46d773c6c3593ea27499c545158055e4065491b

SHA256
da3d01db0ff216c962bf90ba8fb45715db22f0941ee449e98b8a13223ecd2533

SHA512
e16ae02fbf67a13448be1d081a31cde051a318c5009f122d943d2be37e594a0fd16a0407403d7cdd978966110b0160f9d8bc23ff27d13966a922d6e02eb701eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\AlternateServices.bin

Filesize
8KB

MD5
1715bb3cdcc5c948e7b8a6a5a47ab4c7

SHA1
902a5d24200842a9120cfd00bde1635ee7a22a29

SHA256
aa16e61e0ff8e588ebf7af3dfdbce8d16f3224450fdde5faa309038433800686

SHA512
bc1d253e39f14326d515c4cecd2697660581ec69a4119adfbdfc1ef211526a8c0e41585b24d21011a6c3b31cebce16adf8b2d6cf7d162d201d76b52f3bddf461

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\AlternateServices.bin

Filesize
11KB

MD5
f8ab9ef332e8f7bf5aa8eb4d4037ca48

SHA1
fddcde7287e678604b760a0b79dd7a12f3a2f155

SHA256
a6b5fbf3eb7f85ae97d514e65d3b2ffe7d6e4e43d39e2ea68c9514cd561c2946

SHA512
823e4f3e4dc06d22f0b57679ba1eda5a1e2e004f5270b881c3044c6cc4d5b8430c39a96f06f92be5b32351ed4fca7286d8ee4f5bf7a751b4bf2e59d607e09430

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\SiteSecurityServiceState.bin

Filesize
1KB

MD5
f60c36be7c5ede7315dc15ae990cd3d2

SHA1
bd6914665e59398fee8c5bf7035bb95c37a0d696

SHA256
cd56697b7dcafb19309f97a7819dc26f0117bbb1ff27f3009ed990bacf850d1b

SHA512
5b1e0733a221fc154dd7bc6dabf3dec0a9ecf15fea6c4107ae476a96e01dc583cffb2dfcaa7f18440d57816e363ec53d255ff3d156864e6da8fcf4d0d1470349

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cert9.db

Filesize
224KB

MD5
a13dd0a797995261f6022ff6a1a7b777

SHA1
81657dbbb38655b6948cca04bde9386a7b952c31

SHA256
6cb459fa47a4e0ef30db24a1ac58bf6d01dbd49ce2998619ed660df5d5ea4e89

SHA512
f3b42f4472fc484d7221cc2402d1b9a3965e6c2a29f47ff9279e5e8602a2aca3a9d3aa228f90930b3ac97c49e60b833c5b15b5442a3685df541eaaf5acb3da2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\content-prefs.sqlite

Filesize
256KB

MD5
b41ed219e2c8dac47f2701562d092621

SHA1
90d507eae3ec943a121dbe5a080412e40470b54f

SHA256
cfed019635a1e14f74ae78f2c03fb96b40ac3da37b67489bd98c144afc200f1f

SHA512
5c6027ec701055efb3b6c055727af5ed261e8f1d5ba954e64e8a34e5c791679b1e4a6ef49896ab8089ec151fd758ba41efc7333611af42b851606a0544a9b947

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.bin

Filesize
52KB

MD5
1115e76cfe7d09aeede7282f2f402bf2

SHA1
c18f30d2f48e2af15f6fd69234e5b4f01dc01a32

SHA256
6d38a5394c32d6dcb0e084b8223f9dd78c5fafd5babd82c83da36bbe68ef1dd7

SHA512
9d58ca067a2154458f679cdf5c1117f6cacb48126d0f37c104731cb68eafdc62c96b2126c3014c454bda558a8d2b7eb63abe87a8925fb752a5924f4b4f414388

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
1df445f7d5321f4211120296840c16bf

SHA1
c51b31d996f5dc5dc59504abbff68ee19b8ef48f

SHA256
cea0591bc23d0ff8539e64565f2bd3f0597535ae914fc82b25eb82e980c4885a

SHA512
6a38d2054f87c7f6b7853a6ab58e32d97e5144e2ebc95bb5f7b6b3d5ee1ce667a97990c8a9960bbf10f443517b77352d8e5283190cb629cd56c129df3d42fba6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ed5f436224eb73555f79c78ce27cafbc

SHA1
8f0cbcbe79b54ae2496706155e3bd6cafcb3da2a

SHA256
fcb195ede3996fbe56ad16d6ed20e7c159ca0fb0cb7188318e517a6398d955a0

SHA512
9862d54313beb4e70b0668cd19a20ea9819ff37906b401ed7400c8e56125bfc09cd40b49b3c4b456b8a2a25dc3c4f302cf79d08308d9c4b5cd99693b0cdf4111

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
3df6a2b8e1d121d388631e3660ae15f2

SHA1
8db66e22132207ed6a05cb857863feb4b12b8ede

SHA256
281dc356bd83dbf9ae258c3ccf655ded52e15635fff2d4b8c7378c66049e3880

SHA512
de8f5ba24cdbd6f19daab152e2e9de32b6733cb078e9478450f749a41b979f9ed50e63a7dfced1651e46e6ba0bdad237219a988dc178bcc6f3a3f0840955ae06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
51KB

MD5
3aef8bd2421eba13122366d69a6d1e9e

SHA1
ae20b34dd3272ef5ec36c63b02005ee6e7105bdf

SHA256
1d782c2c7bf2ea163519244c4c80e7dd1efeeb432cc63bf49b68de4a3a2c04e0

SHA512
b360d7aa3c7454630801e71eb08135e2df43aabf73b56288b95c4b0fb42777a127ca5b48963993ba0d8391d89823da698dc890dcdad8924e8e4c9c688a3feb62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
51KB

MD5
24ad405bf3529a66ac5a760678f862fd

SHA1
6f9f3aed0b76944002ceb746cfbc1581ec13abdb

SHA256
ce2e64cf4b475ffbd48dba7551eeeed0c0e035046c5f9ad15417b007f7480b14

SHA512
09d80255a6f0f741e075c9dd630c01c546dfcdfe92d97a40f44a29d4b24d1bad67a505f152d510bd3b1aba8ff7592cf50b62205d9b4e287e522a297832266a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
25KB

MD5
a97558d6737f85837e0df1497960692d

SHA1
0a3cc4a97696fbd8ba61fa20af1d3e90b0203a30

SHA256
d82780c2e2c04c017f3d4c7252ad239721a014d293aa995d73e15768aabc9012

SHA512
ab7471756ef1fe920765a9435e2160150979fece4fc01f37a28f19ef1f5054c53a5cb2438d771ad84677e9204af261babaea304fa65062ee780bc3af411fd861

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
8ea4ce2d9e9eaa0a4be87ec073e1c418

SHA1
13025bcba4afd10f66dee32194a84362f8038e11

SHA256
e3703d87b9c2456e3674ccfbe136b78cf070141afb4b1af71540526a071a424d

SHA512
305476309ad489244d9522b0a43ea1999281ce438728d11e7fddee46db9bb5e7216c10609fcae22b42e91b4eff823e7778b0721f19a66f2a53b8f0ae5437d697

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\events\events

Filesize
483B

MD5
c3c35307593ddb4ccf5de082416f7cdd

SHA1
e0eb9bcfe089c4c133871766f7bc2b72b62a6a7b

SHA256
aedd2338ebb02ce1bac0a311b6b473e552eadc0229a4152e17a0cddbfea53be3

SHA512
22e76109e1df600272e84d7486ced24c25b60d6447f5f717a2ae80204361abe2d9f32c1226bcd85940aad8cd8b9eb74b65567d464b5cc7d5188419bd5a8b87cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\events\pageload

Filesize
618B

MD5
961aaa42ede7d411b64893beb6e669a9

SHA1
6f33465ef61e7b70ec6d02fcf4eea557ce9bb7b0

SHA256
bd37eb54de0861889fd66fe54b4bcf49f46ec98d954d922304b274998e90aad0

SHA512
58c8963afb9bee3259b6eaca9e2c1d0fa615a27fa14686a74579180667575e48909448a28e3acfd81e209532340a80710085eccc617fb161da2751c36a288a2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\0f413167-5549-43be-a368-a8f3dbf76369

Filesize
26KB

MD5
df06bf4f9695f5a818d1a69bf5b8af9e

SHA1
3ac4345e9a4d673a1e11958693f708faf2a7f2ea

SHA256
c91cb593b4b79b80299d830392391fdf24b07d1c013d032f6c8d3c6ccd2cad3c

SHA512
b50ef672da10c6d91bb3be6a7eb55968e839d9b25163aa166c3800a23f441b1cfe546c095263ed949ce2056daa8d57826b23e2959638173498479ff7d2781f9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\167d5964-3d9b-4295-943e-68dff99e6e15

Filesize
1008B

MD5
0aeba7dc6e1de6a305b2f98caff76723

SHA1
0175d72333e208434a895600a6b370ae9431e9a7

SHA256
3c05fd93562445ab75c1e1dd1c47632ad6da8244fd261bc64fd98fae884eed86

SHA512
19c11bd7d3e09da0cb8a1aa87c2a891c5c6cbcca7f16b5a65dcdd44bae9312bfa0de6df11b81465653298a75afc4a3be153575f80c5dd32ebffd6af70fea6ea4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\45b68a0d-3071-40d4-b61d-df1fe5e7b307

Filesize
671B

MD5
f1609a45123b687c3c11f5595d2d5fcf

SHA1
d4537bbd99d0cf6e2011b83caffaf5cc4c11d239

SHA256
4580eee1da5e1034c8a5ed4c1104b48b7192ef2cd4cf97c685745a168b49abe8

SHA512
451e77ac47e379c89a7006809f8427911b34553c016aeb8899e8b01e7c137e399fe2957774bc0fdd4959866ab4293fad9c34155b9fea524c446f16d80c04151c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\632d51ad-5280-478a-9ff1-dd3f8748a0e5

Filesize
797B

MD5
f1cb9b79188710409d4ec338d066c6ce

SHA1
ac9fb375c610de9d2a4b11ee2350ce2beb4f7e4d

SHA256
6eae2793e9c4fb12a827e4583008099fe52dde70714c2cff5e6e2b112872a15f

SHA512
2b9181a62a964f7a1e5404086d6edac8cf4c4efbf390b16fbd00a8600c9657785f07da1abb7c917f22579afad9de246ddb28ec2baa30e39ebc3b0d99f71e35b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\92c40d58-926d-410a-bb2f-f3855477e7ae

Filesize
982B

MD5
3a9ebd17241ff2ff0570f2cafd6ebe6f

SHA1
dbc17d41c4e8b31643a82225d02cb23b4b68a821

SHA256
87e247f281f9bbd2857c7df95334afe836243a1d706ac2ca8bce636af2155aec

SHA512
6db5d94d22f7d2912778567314a50afa310b8addfcd6f98ca9fc01f7b4c7cb2bb69670e9ce47f9db657f7a995d5baf1558fe9b71c2ec008072995b2de07c2625

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\f97d3aed-ce91-4372-a37c-cca9ed1145a4

Filesize
734B

MD5
e0efca7f62b3c384163a466e89515d2e

SHA1
15ea180e137d8372999090c65f08a574c73a4fa9

SHA256
7be2f1ee23a411e15441d75b56449403087f0749f8127e48d48e1db1ea576418

SHA512
16a7fc66a9507eed78b4d7a040645f0ea4a9c488f957f33e57aaf22a3d411c009dabb4b567db88a920f48fe3437df821a9247271334f5a58f79b529a6dac6c88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\fec0608a-6ca4-4f87-9631-a801bf647fe0

Filesize
1KB

MD5
36b9576f3dbdad4af9ff06b41e9211a7

SHA1
58ea51872c6ca3a394d1e9eaa61943746016a737

SHA256
784bfa7d942ee0893b61b2e56267b7153ebbf56ca7fe223c05abd14444cc1cf5

SHA512
2d3d21d35c34e9eaaa179ce30b960dd8b39e2399ac449f3fc78ed2961f562c5c9e8ee801958a371c470b9fa48cdfefbcc2086263d53b0911780a9f6beef9abc2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\extensions.json

Filesize
37KB

MD5
58c091672dc4c9b8e2338f9fb2528b9e

SHA1
2373c23977d28e3283ab54035998ae5db8f76d3a

SHA256
9882de8bdd599f67f827d793f1675a547efee29330f6d6894e421ae91d81b1f4

SHA512
74085927cccdffdc5715562ed705e8dfd1799005db182e5fb1dcacfd7ef3e6abdb5d40771bd078b86b4428128b367a175d67c62a545ca94de1644e24653d3a19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\favicons.sqlite

Filesize
5.0MB

MD5
3abb8caa701138d6cd6aec30c484bc8f

SHA1
19f17a4642590f26e0b5dd509c3b14c82b5c5c10

SHA256
a753d97759823c16fa0670408ba5f2ee59e5f2cec4f5b9badbec0d625b33b178

SHA512
c662f1abd600a10e56502d59805af655f7c3c53744c89a2b354bf260ffe92842198c4e3a9cde3f3d9b101abcda5cf7c01174aaea39507d55f534079865943c80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\permissions.sqlite

Filesize
96KB

MD5
89a1e870a4b1795024fcaca93f27b187

SHA1
63520bf80a2a302e0c53ed76f85f062ceed992b4

SHA256
26187aa28139ea51a43e692387639e733e7a60d5c59f913a99449b6ce020b803

SHA512
00a7185331eb11c8cdeceea9e1d9331bf44533423b76365e23c99c85d55a79616dab05bdd0bcc8165d1c9cf26668b32ef6cfdf3edfbde6d37ad938654ded6204

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\places.sqlite

Filesize
5.0MB

MD5
28f14dcff52d138bcffe68e76a4b3b87

SHA1
5b342954375ec91b9d93b7a12dcbc991ffba85ef

SHA256
a5a589ff63626fff4a016829f16409df2daab3b09d08ca4d7baeffcecff2202b

SHA512
497a429f46c7b6a77e2396f4f8592aededbea79c8b69138965aea920288d428f609510875920d4801dd2ce9358eb10ee74040bd30c849d39072fb991ad0fbeab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\places.sqlite

Filesize
5.0MB

MD5
bf4a2494ce27a7d132d143c0162d1a6f

SHA1
f3a98591223705e7b75cf934015995a7249e04ce

SHA256
cc5f57d04349226a660445d844f28c96e6724cdff2ed19ea8bbe8a1ef6ae3092

SHA512
9ac1d056c43088aac3db0142a885264a9fc75bee2530ce70b858e72f7e2209536ec7eed27a0bd572c6b02c15219ecdf5d57ed97ba47d9d7acdb974a38a5ef5b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs-1.js

Filesize
10KB

MD5
6021b73c3ee41c03dac545832a0b731e

SHA1
f492c1f158650f31ae5a52ea2f2ac87b5cd6dc24

SHA256
026bbf551cf4e31be4896c5ae285ce57e77f9f937ba4e90604b3cc9af970cc8d

SHA512
354cab5acf9eb185a8cd09c989c457e96253d0d740072793563c7f483800b92d11952d74b60b55f2247160ebfdfd853ede5390652188b4ab41e8b5f382eff252

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs-1.js

Filesize
11KB

MD5
53d5b88566416e5e6459914d7c772bda

SHA1
9e1feaeb3aeb151883af2431e822d637644ba150

SHA256
b9983a28ccf94dc60229108b9657e1b86daa1e6e3da9576423784de2c7da7821

SHA512
530885aa42f4c95874be52e1f0389ca76021e8dfe41b7de62a45f72e846f7444873c85622ab37d7ed42587200ce9c43f0a91f439cac0361ecf79b49009c9bbe7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs-1.js

Filesize
10KB

MD5
c90104f2eb36bc12291c8da0234b29e1

SHA1
fde8d986947e74f7c69a9d21abe1bc42ca7ba671

SHA256
2e69a9c172a956d98b70720b5b93e554eb10bfee638de84559da645ce4258660

SHA512
a184c8fa6f2124314d4a5a18ad7c994ac7299ed0aea17dcc57bf77a4c6cddad68bb00f6fc40f003f7f8ea970f2672ed65251ff2dd1183ad28c43fefa97ea8f84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
10KB

MD5
2cd4a31bb29db9b67384d244d372f2f3

SHA1
251874ead540bdc5e8293ec743228e87cbf91682

SHA256
0f39fc59dbc931a27162ad8299bec1b48b52e08e0f88370de8f1d65b98333f42

SHA512
dd29e7798d8d17c31a32abbd75ca5ffae7081f109ce529effaf6d7a598da22fc98f856cd7ffbf57bab8a36547f3f8c859c4dd853da8aa846a60c8db2bda7537d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
10KB

MD5
8a64939fa135055f675a85af63e7da9f

SHA1
d968b92568a54e9915cbbbe20de9eaeea13fe467

SHA256
c4ccc147466f21688d6048d1d6f717103b369ca409fc55d0ab9d498ff3568c5b

SHA512
d50fe12d4c129cbf86943f736305e1b455ae45fba3ecddcbdee0b83ce70108944cb8f7823b57d5125e7d0edab1eb64ba02d225c0fc90fd275e4dc7b9871ac454

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
11KB

MD5
88e0772e29e5857a87dac44004dc2a6b

SHA1
2e6a3a008b503a6c431082b360e451b5690113a2

SHA256
b43c51cd61669e183c67f8cda8f8a392c9864e922b73b90f7507c63a2fab2600

SHA512
9a474e40879afa3f3de61623b20d614c4edc3f2c79f0d81df15c4ae46c7d391f247dd76f55c7b8fbb05a83efaac97b779954084519bdedba4f7c93a7d53ba9a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\protections.sqlite

Filesize
64KB

MD5
76786a4c0dd19d88d6d3ed95a293bf2f

SHA1
b0d6d676127a7694fc6e71ee57fcc2ffaa621ff7

SHA256
1a2564c1ba20b8038d35c2319258d94dc15d97914dcf753b31c48b79940dfd31

SHA512
8cd3298e2ebba763d3c80ac4b17e44af7eb63b46304967d0c6316d314baf8611c05f7b9979c2c5c329ac167aea0246e8c9f057ffbb272481c13fd5e4b4bcb2d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionCheckpoints.json

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionCheckpoints.json

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
398305a2c9a3f0e49f534be1b8af8445

SHA1
fc56bdc414a5625c24c745ee263069a6f1ac7638

SHA256
1f8894b2306a7fe10efb103b9e6fcd716b9deb757b4ace2d3e9efef75813f173

SHA512
c30a3f34dc60cafa32d78bc79d2be0a586fa963451b4f9b855335c3fdd78d28d6c623037d4f7f98f793ed3ded4b658efe5e4eaebbe0318a534af88913c1e264b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore.jsonlz4

Filesize
2KB

MD5
a50bcd90270dc34a7eab9a73c125653b

SHA1
652cb18b5b5298268165c19b6d1e5ab69eeb4ed2

SHA256
a51c34f4c75c4dcdfce6a3f54d0d1de529bf970871b3f184376ac2cf3cd90be1

SHA512
125c412c0614fde5fcf50971abaa4430fbc417064e534fc97303de285f2c13fdaa6fb93c3c3bce3179483910e5e135cee3ef7f8e6fa2a446bd2bf54a36e17dba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\storage.sqlite

Filesize
4KB

MD5
0027dd207996184106fbd6eb1f498264

SHA1
91c47dec4371fc8b69d67f9375943914e7b3072f

SHA256
35d3a02ea55282b852ffd6aaf3273d479b4d823e67d33c1677d113528b8072fc

SHA512
6ca04335414348597d93053a4920d4324c9691de71063982ede340ad65a786a20099241fcc6f145d0b840b80864d2551515e2753afbda2a8bee3a1b09f267ee8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\storage\default\https+++gofile.io\.metadata-v2

Filesize
47B

MD5
09330b0ef75fb8a6dc50124fc6966593

SHA1
918d1d14e5a54452bf296baa8a4ccc84547fac4e

SHA256
77c41455f8b20f946336f85858eedb762678b8154fe28ca465a2df8a5442505e

SHA512
aabf4b3af3f9da91a25e8c3c77678c52dd5f3b8e13c9c23aa9b559fb3dd5eb8fa8a390849cfc189e6cb4acb1bbc79b2a7e21712a3121938ffc9c5b12eee97d32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\storage\default\https+++gofile.io\ls\usage

Filesize
12B

MD5
cfa9b13e80d6681a21201335c9acd6cd

SHA1
3ca0910e0dd90436028e1e09a83c3e1a080e481d

SHA256
2bda041ccc5227e202204ceb7106b78735f2aa4fa240256e61ef25c0e6f78b4b

SHA512
5f867c8d198e970141dc2984d1b40051de7cf98ffdfa2feee4781dfd736f2295e70952c46b4393db030fe019aa8c1c0a101450c423d82e2ba7fd82e75814ab87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
a4499c8b8530deafb2516c1e111b91f1

SHA1
bd89904c42c5460edaa8f1410dc7f057d571d6ac

SHA256
cd29fec94131a29e187e4fff2b50345bbb57859cb49b6d21f0312a426aa7c56b

SHA512
5f1ed1d8c51e6f3991a255c0ef2489a3933ee594eef35e113ce11b884fffcc1f56dfb46fd411d68e0c68e2873f8f3c903ac64874690424d737acad11bda52369

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
624KB

MD5
c66f8608b78ca3683cb1e080ef4a0e4d

SHA1
24e1872d2eaafb72208831c379c364bd173ef8d1

SHA256
5424c90af2e07228d9df1760b440de3877c9b96b37c3528e132f9b2735f565bc

SHA512
2283fd381b93203ce96172889a28652160c5be733a269c2dc57e288b93b4252d324d7035448c7cb735a20de36a9e33a9f2eff043b51f66ffef247afd83cc8443

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\xulstore.json

Filesize
217B

MD5
3c7edbdeecdb47fba617e3d03c36b0d3

SHA1
53628ce8c5170810fabafab8e001bfd971d47825

SHA256
c3db6f2519b071b7441022f9ed508b0da5ba40295be0ee449a27bd6146595d04

SHA512
bbf56ea374114173f7de198cd71ac6e75276b0f30926c6690db512f45ac2e54d099d990c285578f702696494d2884d8550e5dddadeee01077933034ac3817842

Download Submit
C:\Users\Admin\Downloads\Process Hacker 2 (2).DaEktafd.zip.part

Filesize
2.9MB

MD5
a517b00e4f2eeb55de2344cf147e001e

SHA1
60614d007c87f2e713a4cd09f07fc0b7d0144ca6

SHA256
437c6e64a3cbd2eda3c080424ea7fa4d9eb199f586f25a389b14d974fb017ca6

SHA512
a491d8c1e457b934dd6b6944abf339b9a328ecd5c6ce22293ca50dbb5e2fe52e3aad265351afc9cb60bf584f5fa554513cbe9fafbd3ca396247d862128d651bf

Download Submit
C:\Users\Admin\Downloads\dridex._XamRZSx.exe.part

Filesize
208KB

MD5
6a8401448a5bd2b540850f811b20a66d

SHA1
9f01d4442c495c7128649b98201187bc0c58dedd

SHA256
178ba564b39bd07577e974a9b677dfd86ffa1f1d0299dfd958eb883c5ef6c3e1

SHA512
87680152e6ed8a294c824cddb559797c0ff9f7106e8e9d16fc8f0195c338566b9cdd76a8bf79ae23450625466bdf54af30a1c91939f93b204604d7deb7e00dd8

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05.fPEZ5QQD.zip.part

Filesize
33.4MB

MD5
1989bf07b6673fe5c83a79dd74cd60ce

SHA1
536d81f1be18e000e17978949176094a32336300

SHA256
22a483e2ec9cc11d875f3d99e64b691e7b2ac71f13623584f5272c54cb2a73a2

SHA512
fc292ab669eb95aebe5665e997b2890b99c1d7d0b3daa844fdd83989bab18ad645443e82a6e8738a4f1851eaa84ef489aca1a7f453359fae1397b6c9849bb960

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\db\dridex.exe.dd32

Filesize
414B

MD5
85b2afb360d920c717910cb70b1eef5d

SHA1
6b99f66ec6b2e23ea998cb8dcd6753ee31c7a4d6

SHA256
81322dbb62404eedba8656238c6184140067376ba9b209739f173060444d492d

SHA512
ef0ca86e92ce29a35aeab2e362d687b5d53f43ec26a70047e58ed0a06c5b3ac2575b7670aa8eab2be821fd47087a09e2fcf28cb9c7df974d6f7b83511ed5c803

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\db\dridex.exe.dd32

Filesize
1KB

MD5
3fae9a6e0c89d11fce48d0f48100dd61

SHA1
aae2503cecd9b98211d1239a9a53f2800f10ccf1

SHA256
dfaa52aaa72318f82835fe83ae0b942eb3d57601609220d602549a0b59d0c2fb

SHA512
38fdce751196316b6e14f4374fa79df56c6252994a74bf58bec38bb9c82ca273c6f09cd3309aa15798b200b5ec7fb61fb4fc0c962eb9acaeaa850133789754b3

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\db\dridex.exe.dd32

Filesize
1KB

MD5
6316d51903d84c205bcce3e76943cacb

SHA1
b604d0f9e8536d4e72fefe0f74499cbab730ba44

SHA256
e480c45e6c0871ba7b28d37df7194024ebd947a00edfa52a20155a066bc1a86d

SHA512
3ff9ba442e691097c6573a22e94f1ff4a4a1ae1475efeee58511731ea74ebcb7de4b22c3e21e0c8ee1e82dea60dc0bdec3715bf3edb53b2b137c80504143de4e

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\temp_E58FF6A.lz4

Filesize
297B

MD5
7562301a08444d5896cf86ff63f9b3de

SHA1
d50ef2888524b84c64a9784c945dc60e71236aee

SHA256
a34c0b47143f0d3a7c99cfa1a0bcb4daebb4243b8aba44457c08ab897c316706

SHA512
50364aa95ceac1626686dde57aa88124f15802766e0df08cc1633cbbb39d6b9d65137714be3d2924925ceb69782148a77099476e64454e1744f14a2c738ac418

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\temp_E5E725F.lz4

Filesize
410B

MD5
c6f6213f2bd4b3e0245d0a4fa9ce1fed

SHA1
190a6b2968411dc4fbaf2bd13f535d67421c8a12

SHA256
4aee415b2162330c75112b73080441823ef166ea6f2405734f5c3a0985fcac24

SHA512
39ee7911e65433defc0ee228f38709894a5d8aab830d218b2f536e31e04e680b0c9bffab1e5fece8b86ac993fb708538547b9091c8c0084c34bc1971290231d1

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\temp_E5E725F.lz4

Filesize
2KB

MD5
4a2206d1501704f49529eacf136ae0bf

SHA1
7f5834c6c2a0a8f05d3b9a2541bbdc31ef5b4a2e

SHA256
f5e22771ffbb1bcfc361f7ba9df974a8f7a0d232081f33e9aca621e845c27bde

SHA512
e0fde907929d02bec20f7c67cf6aaeff5628134b6249740de89dc541d939bb58e5d4e8be5ed3a728fec430fbf86fc51a863653e35f1618464c2069e9b0f3ce03

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\temp_E5EDE29.lz4

Filesize
334B

MD5
7f9b29ba2f25d62bb7748c8c17f5d6b2

SHA1
cf41187bfd5d98a9276d6caf26302117504a7263

SHA256
036eb0ae9a2735b5740f4745dfbf2bb36c92f17c40ed5d53ff35f3adf7c4680d

SHA512
e1a224991e028cfafeb83966979078a1c0f9baffae9f4851ae88d676db0f1499e39df2e11592488205f39f759af5e540ca930dbd6137d3b31e2d7ac0b9530e9d

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\temp_E6027EF.lz4

Filesize
324B

MD5
7a668baa80e15c62e6bb20a7fba5aae5

SHA1
16f0600835a76cad70caed659e202b6d256dcb69

SHA256
66047ecbf15b5e0ef78af26a6218b73ff3c2389026ea8f153dc5f9a588993d6c

SHA512
0b46d1a1b7fce2f0d251b9f1b270fd1a827f091598293e3e1f34c74894a967c48795559d0f4cb74a7a3d7bf0411b0c12604063bf2fbdc8990ef41b8937198414

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x32\x32dbg.ini

Filesize
52KB

MD5
0ed12e6cd65be22eec3d7a6579afd927

SHA1
19b0e8b5792e6715f25d8e5da20142330b78e944

SHA256
36101dd6171e0ad426f2b939d489a19158c21749fd14dc8f45436282c2bcb174

SHA512
93db9edd491cba0b33a4d67f139b79696bef7df66570d260d53663a0807ea4082c333baff7c708765c55b746a555ee1c36c2d2074d0598a9563b2ec36841700a

Download Submit
C:\Users\Admin\Downloads\snapshot_2024-12-21_17-05\release\x96dbg.ini

Filesize
122B

MD5
45c1e010baaeb6b086b93c73cbfa1433

SHA1
6570b66b77103aac30dc7cccfacde1e42413890a

SHA256
672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc

SHA512
6b00d4050ad80dc575b056e40b3fdae831e57d1b035fc7500c1523c70c7f03f344e8b53b070ec3c8482fcb7c300d401260502ba4c04076ee23db66c236d3ad50

Download Submit
memory/1044-1100-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1044-1106-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1044-1112-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1044-1118-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1044-1127-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1044-1129-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1044-1135-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1044-1099-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1808-1076-0x0000000074130000-0x0000000074142000-memory.dmp

Filesize
72KB

Download
memory/1808-600-0x0000000074130000-0x0000000074142000-memory.dmp

Filesize
72KB

Download
memory/3068-1090-0x0000000074090000-0x00000000740A2000-memory.dmp

Filesize
72KB

Download
memory/5540-603-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/5540-606-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download