539c6c6affd63fe25f28af14dd946f01cc9181748a047602db33aa971df9ddde

Analysis

max time kernel
474s
max time network
476s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
19-03-2023 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WindowTabs.msi
Size

1.7MB
MD5

9b1cdae7f77f7654d673825d8b9e7a4b
SHA1

0d367c2cbe369551f58ea07edef9499e06acfb1c
SHA256

539c6c6affd63fe25f28af14dd946f01cc9181748a047602db33aa971df9ddde
SHA512

b2e633f9951a148b80190e3810aa37271dbee3c413c62ef8cebf2a10479ee849aa830e4726b8f7722a27d5f8d344a50f84d536751090aa92efed7601d047d4a6
SSDEEP

24576:0nr3Nn7BjlpOu3sB0p2DD7+Jm8R0IjiG82gQrgUoAdUVSGQch:0nr3Nn7Bxwu8BjKFRzjvIwg0dGQ2

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

1 4132 msiexec.exe
3 4132 msiexec.exe
Executes dropped EXE 2 IoCs

Processes:

WindowTabs.exeWindowTabs.exe

pid process

4116 WindowTabs.exe
3036 WindowTabs.exe
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exe

pid process

4332 MsiExec.exe
4332 MsiExec.exe
4932 MsiExec.exe
4932 MsiExec.exe
5004 MsiExec.exe

flow	pid	process
1	4132	msiexec.exe
3	4132	msiexec.exe

pid	process
4116	WindowTabs.exe
3036	WindowTabs.exe

pid	process
4332	MsiExec.exe
4332	MsiExec.exe
4932	MsiExec.exe
4932	MsiExec.exe
5004	MsiExec.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in Program Files directory 6 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\WindowTabs\WindowTabs.exe	msiexec.exe
File created	C:\Program Files (x86)\WindowTabs\Bemo.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\WindowTabs\Banner.bmp	msiexec.exe
File opened for modification	C:\Program Files (x86)\WindowTabs\Bemo.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\WindowTabs\WindowTabs.exe	msiexec.exe
File created	C:\Program Files (x86)\WindowTabs\Banner.bmp	msiexec.exe

Drops file in Windows directory 16 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e57803c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF21E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0A6.tmp	msiexec.exe
File created	C:\Windows\Installer\e57803c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84E1.tmp	msiexec.exe
File created	C:\Windows\Installer\{9E38E271-4D2F-49DC-BB29-C24D6F7E472C}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9E38E271-4D2F-49DC-BB29-C24D6F7E472C}	msiexec.exe
File created	C:\Windows\Installer\{9E38E271-4D2F-49DC-BB29-C24D6F7E472C}\_91D2D3C1F742563D912F51.exe	msiexec.exe
File created	C:\Windows\Installer\e57803e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI835A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{9E38E271-4D2F-49DC-BB29-C24D6F7E472C}\_853F67D554F05449430E7E.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{9E38E271-4D2F-49DC-BB29-C24D6F7E472C}\_91D2D3C1F742563D912F51.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies data under HKEY_USERS 7 IoCs

Processes:

msiexec.exesvchost.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 34 IoCs

Processes:

msiexec.exefirefox.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|WindowTabs\|WindowTabs.exe\WindowTabs,Version="0.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 530067004e0071005a00760025006c0067003f00730046003f007e004000300032006100370032003e0058006300560054006f00780068005a0059004f005a002a004400340032004f0047006d002500720000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\172E83E9F2D4CD94BB922CD4F6E774C2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\Version = "43"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\432D3676AFCB2714180957D6EEC92F1B\172E83E9F2D4CD94BB922CD4F6E774C2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList\PackageName = "WindowTabs.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|WindowTabs\|WindowTabs.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\172E83E9F2D4CD94BB922CD4F6E774C2	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|WindowTabs\|WindowTabs.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\PackageCode = "7F3BE63114D5639498AB403539F78629"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\ProductIcon = "C:\\Windows\\Installer\\{9E38E271-4D2F-49DC-BB29-C24D6F7E472C}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\172E83E9F2D4CD94BB922CD4F6E774C2\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\ProductName = "WindowTabs"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\432D3676AFCB2714180957D6EEC92F1B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\432D3676AFCB2714180957D6EEC92F1B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\172E83E9F2D4CD94BB922CD4F6E774C2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msiexec.exe

pid	process
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4132	msiexec.exe
Token: SeSecurityPrivilege	2328	msiexec.exe
Token: SeCreateTokenPrivilege	4132	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4132	msiexec.exe
Token: SeLockMemoryPrivilege	4132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4132	msiexec.exe
Token: SeMachineAccountPrivilege	4132	msiexec.exe
Token: SeTcbPrivilege	4132	msiexec.exe
Token: SeSecurityPrivilege	4132	msiexec.exe
Token: SeTakeOwnershipPrivilege	4132	msiexec.exe
Token: SeLoadDriverPrivilege	4132	msiexec.exe
Token: SeSystemProfilePrivilege	4132	msiexec.exe
Token: SeSystemtimePrivilege	4132	msiexec.exe
Token: SeProfSingleProcessPrivilege	4132	msiexec.exe
Token: SeIncBasePriorityPrivilege	4132	msiexec.exe
Token: SeCreatePagefilePrivilege	4132	msiexec.exe
Token: SeCreatePermanentPrivilege	4132	msiexec.exe
Token: SeBackupPrivilege	4132	msiexec.exe
Token: SeRestorePrivilege	4132	msiexec.exe
Token: SeShutdownPrivilege	4132	msiexec.exe
Token: SeDebugPrivilege	4132	msiexec.exe
Token: SeAuditPrivilege	4132	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4132	msiexec.exe
Token: SeChangeNotifyPrivilege	4132	msiexec.exe
Token: SeRemoteShutdownPrivilege	4132	msiexec.exe
Token: SeUndockPrivilege	4132	msiexec.exe
Token: SeSyncAgentPrivilege	4132	msiexec.exe
Token: SeEnableDelegationPrivilege	4132	msiexec.exe
Token: SeManageVolumePrivilege	4132	msiexec.exe
Token: SeImpersonatePrivilege	4132	msiexec.exe
Token: SeCreateGlobalPrivilege	4132	msiexec.exe
Token: SeCreateTokenPrivilege	4132	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4132	msiexec.exe
Token: SeLockMemoryPrivilege	4132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4132	msiexec.exe
Token: SeMachineAccountPrivilege	4132	msiexec.exe
Token: SeTcbPrivilege	4132	msiexec.exe
Token: SeSecurityPrivilege	4132	msiexec.exe
Token: SeTakeOwnershipPrivilege	4132	msiexec.exe
Token: SeLoadDriverPrivilege	4132	msiexec.exe
Token: SeSystemProfilePrivilege	4132	msiexec.exe
Token: SeSystemtimePrivilege	4132	msiexec.exe
Token: SeProfSingleProcessPrivilege	4132	msiexec.exe
Token: SeIncBasePriorityPrivilege	4132	msiexec.exe
Token: SeCreatePagefilePrivilege	4132	msiexec.exe
Token: SeCreatePermanentPrivilege	4132	msiexec.exe
Token: SeBackupPrivilege	4132	msiexec.exe
Token: SeRestorePrivilege	4132	msiexec.exe
Token: SeShutdownPrivilege	4132	msiexec.exe
Token: SeDebugPrivilege	4132	msiexec.exe
Token: SeAuditPrivilege	4132	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4132	msiexec.exe
Token: SeChangeNotifyPrivilege	4132	msiexec.exe
Token: SeRemoteShutdownPrivilege	4132	msiexec.exe
Token: SeUndockPrivilege	4132	msiexec.exe
Token: SeSyncAgentPrivilege	4132	msiexec.exe
Token: SeEnableDelegationPrivilege	4132	msiexec.exe
Token: SeManageVolumePrivilege	4132	msiexec.exe
Token: SeImpersonatePrivilege	4132	msiexec.exe
Token: SeCreateGlobalPrivilege	4132	msiexec.exe
Token: SeCreateTokenPrivilege	4132	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4132	msiexec.exe
Token: SeLockMemoryPrivilege	4132	msiexec.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msiexec.exeWindowTabs.exefirefox.exemsiexec.exemsiexec.exe

pid	process
4132	msiexec.exe
4132	msiexec.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
1588	firefox.exe
1588	firefox.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
4116	WindowTabs.exe
2852	msiexec.exe
2328	msiexec.exe
2852	msiexec.exe

Suspicious use of SendNotifyMessage 7 IoCs

Processes:

WindowTabs.exefirefox.exe

pid process

4116 WindowTabs.exe
4116 WindowTabs.exe
1588 firefox.exe
1588 firefox.exe
1588 firefox.exe
1588 firefox.exe
1588 firefox.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WindowTabs.exefirefox.exeWindowTabs.exe

pid process

4116 WindowTabs.exe
1588 firefox.exe
3036 WindowTabs.exe

pid	process
4116	WindowTabs.exe
4116	WindowTabs.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe

pid	process
4116	WindowTabs.exe
1588	firefox.exe
3036	WindowTabs.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exemsiexec.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2328 wrote to memory of 4332	2328	msiexec.exe	MsiExec.exe
PID 2328 wrote to memory of 4332	2328	msiexec.exe	MsiExec.exe
PID 2328 wrote to memory of 4332	2328	msiexec.exe	MsiExec.exe
PID 2328 wrote to memory of 4372	2328	msiexec.exe	srtasks.exe
PID 2328 wrote to memory of 4372	2328	msiexec.exe	srtasks.exe
PID 2328 wrote to memory of 4932	2328	msiexec.exe	MsiExec.exe
PID 2328 wrote to memory of 4932	2328	msiexec.exe	MsiExec.exe
PID 2328 wrote to memory of 4932	2328	msiexec.exe	MsiExec.exe
PID 4132 wrote to memory of 4116	4132	msiexec.exe	WindowTabs.exe
PID 4132 wrote to memory of 4116	4132	msiexec.exe	WindowTabs.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1220 wrote to memory of 1588	1220	firefox.exe	firefox.exe
PID 1588 wrote to memory of 368	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 368	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe
PID 1588 wrote to memory of 3484	1588	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WindowTabs.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4132

C:\Program Files (x86)\WindowTabs\WindowTabs.exe
"C:\Program Files (x86)\WindowTabs\WindowTabs.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4116

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1BC52FD448479BB9F7BC7CB2FB534D41 C
2⤵
- Loads dropped DLL
PID:4332

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:4372

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C967ABAA074CD3D7704CD9425F2F82A2
2⤵
- Loads dropped DLL
PID:4932

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 97D5739909CFFD24852854E390B11EBC
2⤵
- Loads dropped DLL
PID:5004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.0.2030556819\1055250775" -parentBuildID 20221007134813 -prefsHandle 1668 -prefMapHandle 1644 -prefsLen 20810 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8e48bc6-40e1-448b-9d79-b053457dc4e1} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1748 27cb362c858 gpu
3⤵
PID:368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.1.383821594\1377485966" -parentBuildID 20221007134813 -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 20891 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c24f0fd6-e6e8-4242-a9b4-1b0128eb59e4} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 2104 27cb250f858 socket
3⤵
PID:3484

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.2.553466612\862111271" -childID 1 -isForBrowser -prefsHandle 3420 -prefMapHandle 3416 -prefsLen 20974 -prefMapSize 232645 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {030b5524-aa1b-4f29-8d4d-06272bbf9a61} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 3432 27cb63eb458 tab
3⤵
PID:3900

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.3.252842162\1719592747" -childID 2 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33c9ea25-530d-42d1-b3dc-dfc24e6a18a8} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 2948 27ca6e60158 tab
3⤵
PID:3980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.4.1853358866\844109385" -childID 3 -isForBrowser -prefsHandle 3892 -prefMapHandle 3888 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5c7862e-d33c-4111-a186-7f722e20173a} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 3900 27cb74fdf58 tab
3⤵
PID:3600

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.6.1566151460\1021984378" -childID 5 -isForBrowser -prefsHandle 4992 -prefMapHandle 4996 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1126e40f-87a9-4ee2-8da6-18382d5b47f1} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 5068 27cb89e6858 tab
3⤵
PID:4964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.7.271794827\718369509" -childID 6 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {515436b9-27a4-4cac-b642-d9c7e4bda7db} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 5088 27cb89e6b58 tab
3⤵
PID:2196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.5.965035287\1960788537" -childID 4 -isForBrowser -prefsHandle 4852 -prefMapHandle 4836 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe8c5720-c411-4256-a4ec-5bd504abf2bd} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 4864 27ca6e2e758 tab
3⤵
PID:4436

C:\Program Files (x86)\WindowTabs\WindowTabs.exe
"C:\Program Files (x86)\WindowTabs\WindowTabs.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3036

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {9E38E271-4D2F-49DC-BB29-C24D6F7E472C}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57803d.rbs
Filesize
8KB

MD5
d9fd6e0bd074f96cb406964e90faf068

SHA1
b6b31ef54247862934b3f6f5511e7e1a8f8887ff

SHA256
7400551e99d49d9fb39e0ea159d3c28b60e63df18d40a72d311da9cbf92bb35d

SHA512
05e8f33777dc443c8d70016e98fa66cd027efb01d67aae397c1aa638ec77df90c7044d6f42a7e3fb8ef3483ecd35a94578ebfa2c25f99c0216ef75478c874a3c

Download Submit
C:\Config.Msi\e578040.rbs
Filesize
9KB

MD5
9621e77972aa202a62d3a5d88200674b

SHA1
d7e6e2d09c1c6af8e0da764ef17eca09140207e1

SHA256
87d22a60852273697151742a318346975064aa06399c44d9c1246e683d7564a9

SHA512
d438a1020a19fe5ad437e2fbbf75c26622843074caf532de021a95eb74243422c12672df1a634d799a0b24288b2f3229b38c2212218b1e8ba332d235384a2f2b

Download Submit
C:\Config.Msi\e578042.rbf
Filesize
35KB

MD5
b546fbe02390bddaaec16c99bb1a4c01

SHA1
83a97dece27de64b3c927648fc6f78cbcff51f30

SHA256
50aa73e95d5d661a2486cde5402dead2db4670d397043a1623c3c93a7df4fdf2

SHA512
89b161586e6dd8a84c19a12c9d730aa74d42eda6270476eb820f42ea3c025a7eb057a5ddeba37542cbab1983fc2d7811c143eb3281d8b1137a863cdb058e4b63

Download Submit
C:\Config.Msi\e578043.rbf
Filesize
163KB

MD5
bc99defea0c9141db5a421ed6c636689

SHA1
c2f3105f301c4f8f246c3f5b99edca75cb6d72c4

SHA256
c6de6dc9d2506929ee6739865fb1f95eb434ffbb09370a4f57b507f4ab7af9ec

SHA512
f4c43830ec714202c7e2e8761fe8b53066519a2bea41316aada0b87ac582ffbf38984edbd6a33ea033205c6d49cbbd5d17d7972627c15a7d6a220f938ca5f71d

Download Submit
C:\Program Files (x86)\WindowTabs\WindowTabs.exe
Filesize
2.9MB

MD5
61128bcdd15e694b5735b2c9cda6896b

SHA1
9b0c9b0d0c7c913ca89ec0efe6a9dfd6301af4de

SHA256
26dfe90d839cf02f2ca35a2a7f951af83d9f32e5ad2612cfc564193c0103387f

SHA512
9041f4b1f9bd792577e8aeb5aec92ad27c8b1f6600501548d7243ad7e6836d11130ca2fefe1fc14325388fd59f9360118a9fdf3e37bf4088f4e9fe3735e6bfc0

Download Submit
C:\Program Files (x86)\WindowTabs\WindowTabs.exe
Filesize
2.9MB

MD5
61128bcdd15e694b5735b2c9cda6896b

SHA1
9b0c9b0d0c7c913ca89ec0efe6a9dfd6301af4de

SHA256
26dfe90d839cf02f2ca35a2a7f951af83d9f32e5ad2612cfc564193c0103387f

SHA512
9041f4b1f9bd792577e8aeb5aec92ad27c8b1f6600501548d7243ad7e6836d11130ca2fefe1fc14325388fd59f9360118a9fdf3e37bf4088f4e9fe3735e6bfc0

Download Submit
C:\Program Files (x86)\WindowTabs\WindowTabs.exe
Filesize
2.9MB

MD5
61128bcdd15e694b5735b2c9cda6896b

SHA1
9b0c9b0d0c7c913ca89ec0efe6a9dfd6301af4de

SHA256
26dfe90d839cf02f2ca35a2a7f951af83d9f32e5ad2612cfc564193c0103387f

SHA512
9041f4b1f9bd792577e8aeb5aec92ad27c8b1f6600501548d7243ad7e6836d11130ca2fefe1fc14325388fd59f9360118a9fdf3e37bf4088f4e9fe3735e6bfc0

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WindowTabs.lnk
Filesize
2KB

MD5
cf058d7b470cf6e1f711c91166eac261

SHA1
a4d769781cc335459a1f2077cc55ed361a71e37b

SHA256
0b56d1eb02ce144f203f0474858b1decd0c41af99e096b6671251402510d77ff

SHA512
aeae87337ff8d4f628ad5ba0c8e038183ebb55e607d48240c69953dbba60059671a8e9c523af5cc8718eddef0fe59f6a0e87bb7fe4b16753e57755ea9ad51ffc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\activity-stream.discovery_stream.json.tmp
Filesize
148KB

MD5
a22f4dc38fb69ba47b8ce65b3797833f

SHA1
f94f4bb8b328a6cefbe329bbb0badb76ee0cbd38

SHA256
d0f012114424770c94f2961bbf3ad25a0ce2a6ce4818bced444bc76863ee496f

SHA512
6358f4b2413c69bdf45cd8b29e5de58e46c460d7858323d566f215db6cc020a8355f725a9507c7233713c9fda9b0e6c946c9f952df8c1c9869577e924e9c67d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI64F8.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI676A.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
5KB

MD5
4b170f40afb07567ac0482dc35f9e778

SHA1
fd3201f4457fbb372b03541721a1812bc1d86708

SHA256
595162421e5940318702191af3fbd51684cbe91e066a9e33c73aa539595ff0a4

SHA512
0fa4a1a7459b1b548665eed80b4bb133be062e86c5361758eaaf710bb8744bc74097ff66010bc2fe309433af9c9e6149fb782ef87238e83631e63287098abb5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs.js
Filesize
6KB

MD5
cdb5a91b7898f75f98e448e80b41dba6

SHA1
c749651f98e32a2320d2e52fd467fd6217660535

SHA256
ed56bd19352777293cf7195af0fe1412d52e25af6a9a8e2bb04e3e32056556dc

SHA512
b99bca03a398f7e068691852106fe03a90489d1e8230720749c25703e59874765ef706e9e27c9215251372efee84d9c9d0eb636a54e45035d5d2095304fee97b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
9768be4efaa203b46300d60d688db452

SHA1
a290f4db93028897ab8afd9636fe4399f62fd78b

SHA256
1804f6521c229dafeef958ca3cab5e3caf77236d78771608a1d145cebcb3dbb1

SHA512
472358a3374e0c8944135618db276ef8f5e9ff2a1066b644b7f81a1fb8583b72e30a80dec6133f7f56f9c2fac1d29d098fbfc266f2281b2a1002f84324f22c3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
ac7982b8fb71986471d48716d3deed8c

SHA1
89d2ee12d050e4b4ab0a6f8a8c36be0be0ae6ecb

SHA256
79d1bbd10897a718ba800b3e56cbd900ce38e1c52a373106951227fac723f27a

SHA512
4ce5c2321f2908c8a932838f9cf25a03311769ca25633be43ddfb19538d3198beb24b60c8f16f3e6ed90b44e2017ea218926fc49cbfedf15874217905f0112b1

Download Submit
C:\Users\Admin\AppData\Roaming\WindowTabs\WindowTabsSettings.txt
Filesize
437B

MD5
dcdee44d33b813bc5d26072de97059eb

SHA1
8e4f316724ae4e3854b2b32f203f2728b3268b53

SHA256
d0ebb13304d0b7610381adc75e5d9ddab8a9d5e1caf844bda98d4d43bc59ddda

SHA512
09bbb80c6a03d7927c74ee563d038ef1406f5725b8051c4c75afa30bc78e22fedc62278c2185fdcbc70ee6daa219c72d6a6b67146b5ae9e95341f372f2ce4b8f

Download Submit
C:\Users\Admin\AppData\Roaming\WindowTabs\WindowTabsSettings.txt
Filesize
474B

MD5
9d884e3ac681918ae2c5673d3fe9effc

SHA1
6eceb97249f75cfc8b7bf699aa25f7f53f4cc64d

SHA256
79f0818f211a1654e864eab1e55269bfec96c3c78593563aa25118d1cd17860a

SHA512
0b97abd425863d5b6dc9b55e5eb4f896a84cb11156b7cee6b44657db03ac6d8eb98a1fb50a3f1ad3c1a65002a00830dafd2e8e89c85ca5112a079e475ffd49ba

Download Submit
C:\Windows\Installer\MSI80D8.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
C:\Windows\Installer\MSI80D8.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
C:\Windows\Installer\MSI835A.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
C:\Windows\Installer\MSIF0A6.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
C:\Windows\Installer\e57803c.msi
Filesize
1.7MB

MD5
9b1cdae7f77f7654d673825d8b9e7a4b

SHA1
0d367c2cbe369551f58ea07edef9499e06acfb1c

SHA256
539c6c6affd63fe25f28af14dd946f01cc9181748a047602db33aa971df9ddde

SHA512
b2e633f9951a148b80190e3810aa37271dbee3c413c62ef8cebf2a10479ee849aa830e4726b8f7722a27d5f8d344a50f84d536751090aa92efed7601d047d4a6

Download Submit
C:\Windows\Installer\e57803e.msi
Filesize
1.7MB

MD5
9b1cdae7f77f7654d673825d8b9e7a4b

SHA1
0d367c2cbe369551f58ea07edef9499e06acfb1c

SHA256
539c6c6affd63fe25f28af14dd946f01cc9181748a047602db33aa971df9ddde

SHA512
b2e633f9951a148b80190e3810aa37271dbee3c413c62ef8cebf2a10479ee849aa830e4726b8f7722a27d5f8d344a50f84d536751090aa92efed7601d047d4a6

Download Submit
C:\Windows\Installer\{9E38E271-4D2F-49DC-BB29-C24D6F7E472C}\_853F67D554F05449430E7E.exe
Filesize
163KB

MD5
1924e7088b86dcff560bd287833cb7e4

SHA1
5e0c10c86b10c7dc540c52be43c9e3cbbaf7cd82

SHA256
1c9ca78cc6ba3e5f771ed4114a41074bae9a0d3cd9b38ef5d89a9b92e5314bfa

SHA512
e2a4245783043b6ec907254477e684f69fceb1177ffd415c5a00aea471021ec426b05a1b1311593b141267d7135e03561b702cb4e2f1aaf85d1d7eb6d34272fd

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
25.0MB

MD5
16b4827ff677a62f6daeb6eb8d6e4a18

SHA1
c89c7c7b39b7e5b6a65451bb7c9d42726feeff24

SHA256
68ab088046db6fa4f0fe5a104f36155eff3a4dd7910ec65f6bb363b7eacea854

SHA512
5e8414f50ef7932644c73e97739de6fce55e3339dd38bf4c4dace75f71549d31b91effb0654d2c41b679d85f1973b6e2c58bdf411057a2f11df07944b420735b

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\Volume{ce598122-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{aac5ce6d-f6b9-4e6b-ab17-2516510c0c90}_OnDiskSnapshotProp
Filesize
5KB

MD5
169398150ae3986d522dfd5fbba45e2f

SHA1
b152edb52733c149354f855992743f1911316c66

SHA256
27b4cbf6c9424220c527db3ea8e7cec094588f219f9b71013b57cd7a88e66e5d

SHA512
016060b2250f443200d0884f73b9fd49696c0ca9ff6e2b05899fec0f5c415085778965f60fef1772536e9891a0073c6c320d8cdf6562b9c27cb84a511ebe6c47

Download Submit
\Users\Admin\AppData\Local\Temp\MSI64F8.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
\Users\Admin\AppData\Local\Temp\MSI676A.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
\Windows\Installer\MSI80D8.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
\Windows\Installer\MSI835A.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
\Windows\Installer\MSIF0A6.tmp
Filesize
231KB

MD5
0a2626fc9e4e0ca18386c029e9efffd9

SHA1
ac5576497afac2456f485cdb14bf52d895769651

SHA256
97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3

SHA512
40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da

Download Submit
memory/3036-906-0x00000000031B0000-0x00000000031C0000-memory.dmp

Filesize
64KB

Download
memory/3036-917-0x00000000031B0000-0x00000000031C0000-memory.dmp

Filesize
64KB

Download
memory/4116-255-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-876-0x0000000000F20000-0x0000000000F6E000-memory.dmp

Filesize
312KB

Download
memory/4116-353-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-256-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-967-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-242-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-1057-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-1082-0x000000001FE30000-0x000000001FE66000-memory.dmp

Filesize
216KB

Download
memory/4116-218-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-2207-0x0000000001220000-0x000000000122A000-memory.dmp

Filesize
40KB

Download
memory/4116-207-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-200-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-201-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-199-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-197-0x0000000000E00000-0x0000000000E08000-memory.dmp

Filesize
32KB

Download
memory/4116-196-0x000000001BE80000-0x000000001C34E000-memory.dmp

Filesize
4.8MB

Download
memory/4116-195-0x000000001B910000-0x000000001B9AC000-memory.dmp

Filesize
624KB

Download
memory/4116-194-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4116-193-0x0000000000490000-0x000000000077C000-memory.dmp

Filesize
2.9MB

Download