87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9

Analysis

max time kernel
642s
max time network
1587s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
22-03-2024 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

50016010fb0d8db2bc4cd258ceb43be5
SHA1

44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA256

32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
SHA512

ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
SSDEEP

48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	\??\c:\Windows\System32\drivers\asyncmac.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\vhdmp.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\MTConfig.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\usbehci.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\hidbth.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\processr.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\sercx2.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\irda.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\UcmTcpciCx.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\BtaMPM.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\cldflt.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\dfsc.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\spaceport.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\fltMgr.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\rdpdr.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\cdrom.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\mshidkmdf.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\mspqm.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\dumpfve.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\vmbus.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\SpbCx.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\buttonconverter.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\UmBus.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\vdrvroot.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\wdf01000.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\NetAdapterCx.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\Microsoft.Bluetooth.Legacy.LEEnumerator.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\exfat.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\tdx.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\UevAgentDriver.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\WUDFRd.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\UcmCx.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\dumpsd.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\nsiproxy.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\scsiport.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\tsusbhub.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\vdrvroot.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\beep.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\rdbss.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\sdbus.sys	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\usbrpm.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\rspndr.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\i8042prt.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\mssmbios.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\NdisVirtualBus.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\wacompen.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\ksecpkg.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\acpipagr.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\ws2ifsl.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\mausbip.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\NdisImPlatform.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\tm.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\disk.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\mup.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\winhv.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\partmgr.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\srv2.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\mausbhost.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\npsvctrig.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\luafv.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\en-US\tpm.sys.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\intelide.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\drivers\mrxsmb10.sys	cmd.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

Processes:

cmd.exe

description	ioc	process
File opened for modification	\??\c:\Windows\System32\wintrust.dll	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\wintrust.dll	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 32 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	\??\c:\Windows\WinSxS\AM664C~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM3085~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM9F84~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMC6FC~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM6020~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMA2CB~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM2B68~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X86617~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM59AD~2.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM6528~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM4D7C~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM0935~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM9DBE~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM3D76~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM11AF~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM1C0B~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMDE56~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMD7B5~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM0E5E~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM4F04~2.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM7077~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM0743~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM4CF3~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM0683~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMA4BE~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMD94D~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM4552~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM63CB~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM690B~1.0_N\desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMDDAD~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM4B40~1.0_N\Desktop.ini	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM7BFB~1.0_N\desktop.ini	cmd.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

cmd.exe

description	ioc	process
File opened for modification	\??\c:\Windows\BITLOC~1\autorun.inf	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X83420~1.0_N\autorun.inf	cmd.exe

Drops file in System32 directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	\??\c:\Windows\System32\en-US\bridgeres.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\es-ES\usbceip.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\ja-jp\iernonce.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\it-IT\comres.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\mciseq.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\it-IT\route.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\WINDOW~1\v1.0\Modules\NETWOR~2\MSFT_NetTeredoConfiguration.format.ps1xml	cmd.exe
File opened for modification	\??\c:\Windows\System32\de-DE\IdListen.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\de-DE\rascustom.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\FILERE~1\NETJME~1.INF\NETJME.sys	cmd.exe
File opened for modification	\??\c:\Windows\System32\fr-FR\dusmsvc.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\it-IT\FrameServer.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\dvdplay.exe	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\iepeers.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\iasrad.dll	cmd.exe
File opened for modification	\??\c:\Windows\System32\de-DE\hwrreg.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\en-US\TSGenericUSBDriver.inf_loc	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\fr-FR\prnfxcl2.inf_loc	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\certutil.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\de-DE\msrahc.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\fr-FR\nettun.inf_loc	cmd.exe
File opened for modification	\??\c:\Windows\System32\ja-jp\pautoenr.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\netlogon.dll	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\sndvolsso.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\de-DE\inetppui.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\es-ES\mausbhost.inf_loc	cmd.exe
File opened for modification	\??\c:\Windows\System32\fr-FR\setupugc.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\es-ES\EhStorAPI.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\es-ES\sessenv.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\migwiz\DLMANI~1\Microsoft-Windows-IIS-Metabase-DL.man	cmd.exe
File opened for modification	\??\c:\Windows\System32\ResetEngine.dll	cmd.exe
File opened for modification	\??\c:\Windows\System32\SPEECH~1\common\en-US\Tokens_SR_en-US-N.xml	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\DolbyDecMFT.dll	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\en-US\vsmraid.inf_loc	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\es-ES\UsbccidDriver.inf_loc	cmd.exe
File opened for modification	\??\c:\Windows\System32\es-ES\poqexec.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\wbem\wsp_sr_uninstall.mof	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\it-IT\D3DSCache.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\ja-JP\wvmic_timesync.inf_loc	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\sdiagnhost.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\rasmontr.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\hidserv.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\de-DE\gpupdate.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\it-IT\DeviceProperties.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\it-IT\WWAHost.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\it-IT\dskquoui.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\AdmTmpl.dll	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\CallHistoryClient.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Display.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\POSyncServices.dll	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\it-IT\sxs.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\dmenterprisediagnostics.dll	cmd.exe
File opened for modification	\??\c:\Windows\System32\DOWNLE~1\api-ms-win-core-file-l1-1-0.dll	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\FILERE~1\NETVWW~1.INF\netvwwanmp.inf	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\WINDOW~1\v1.0\Modules\NETEVE~1\MSFT_NetEventSession.cdxml	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\FILERE~1\NULHPO~1.INF\nulhpopr.inf	cmd.exe
File opened for modification	\??\c:\Windows\System32\fr-FR\WinSATAPI.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\System32\sfc.exe	cmd.exe
File opened for modification	\??\c:\Windows\System32\nlahc.dll	cmd.exe
File opened for modification	\??\c:\Windows\System32\appvetwclientres.dll	cmd.exe
File opened for modification	\??\c:\Windows\System32\DDACLSys.dll	cmd.exe
File opened for modification	\??\c:\Windows\System32\DRIVER~1\en-US\mssmbios.inf_loc	cmd.exe
File opened for modification	\??\c:\Windows\SysWOW64\IME\IMEJP\applets\IMJPCLST.XML	cmd.exe
File opened for modification	\??\c:\Windows\System32\en-US\hwrreg.exe.mui	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol
T1021.001

Processes:

cmd.exe

description ioc process

File opened for modification \??\c:\Windows\System32\termsrv.dll cmd.exe

description	ioc	process
File opened for modification	\??\c:\Windows\System32\termsrv.dll	cmd.exe

Drops file in Program Files directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MICROS~4.0_X\Assets\AppTiles\LiveTile\2px.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~1\HxCalendarSmallTile.scale-100.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~1\LinkedInboxWideTile.scale-125.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI06B9~1.SCA\AppxSignature.p7x	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MICROS~1.0_X\Assets\DarkBlue.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\Themes\Beach\beach_11s.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI20CB~1.0_X\images\11891_32x32x32.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI20CB~1.0_X\images\CONTRA~2\OneNoteWideTile.scale-100.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIE984~1.0_X\Assets\AppTiles\CONTRA~2\MapsAppList.targetsize-72.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI5B43~1.0_X\MICROS~1.MET\RESOUR~1.PRI	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~1\HxA-GoogleCloudCache-Dark.scale-140.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~1\HxA-Yahoo-Light.scale-150.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~2\HxCalendarAppList.targetsize-24.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\GenericMailLargeTile.scale-100.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\models\de-DE.mail.config	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIE984~1.0_X\Assets\Images\PRINTA~1\Logo.png	cmd.exe
File opened for modification	\??\c:\PROGRA~2\WI8A19~1\ja-JP\PhotoAcq.dll.mui	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI79E2~1.0_X\Assets\GetStartedAppList.targetsize-96_contrast-white.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\GameEnd\ads_win10_previewBuild_3840_300x250.jpg	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI7930~1.0_X\Assets\CalculatorAppList.targetsize-60_altform-fullcolor.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI6356~1.SCA\Assets\InsiderHubSmallTile.scale-125_contrast-black.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WINDOW~1\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI476B~1.0_X\VFS\PROGRA~1\MICROS~1\OFFICE16\EXPSRV.DLL	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\MAINPA~1\klondike_bp_920.jpg	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Designs\Flags\small\nz_16x11.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI4B57~1.SCA\Assets\CalculatorSplashScreen.contrast-black_scale-100.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~1\HxCalendarAppList.targetsize-40.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\models\Email.model	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIE984~1.0_X\Assets\SECOND~1\DIRECT~1\Home\RTL\CONTRA~2\LargeTile.scale-200.png	cmd.exe
File opened for modification	\??\c:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\fr\UIAutomationClientsideProviders.resources.dll	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIE745~1.0_X\Assets\AppPackageSmallTile.scale-200.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Designs\EMOTIC~1\large\heidy.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Designs\Flags\small\cw_16x11.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~1\HxAccountsStoreLogo.scale-100.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~2\HxA-GoogleCloudCache-Light.scale-140.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI0ADF~1.SCA\Assets\InsiderHubAppList.scale-100.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI7B67~1.0_X\Assets\GamesXboxHubStoreLogo.scale-100.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI54FB~1\de-DE\wmpnssci.dll.mui	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\DAILYC~1\Popup\FUE3_Image.jpg	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\Themes\Aquarium\mask\13h.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI21E8~1.0_X\SURFAC~1\FlatPaperDetail.dds	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Designs\EMOTIC~1\large\movie.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI54FB~1\NETWOR~1\MediaReceiverRegistrar.xml	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI21E8~1.0_X\SURFAC~1\paper_hotpress300lb_512x512.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI22BC~1.0_X\Inbox.winmd	cmd.exe
File opened for modification	\??\c:\PROGRA~1\COMMON~1\MICROS~1\ink\FSDEFI~1\osknav.xml	cmd.exe
File opened for modification	\??\c:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\ja\System.ServiceModel.Resources.dll	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MID8A2~1.SCA\AppxBlockMap.xml	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\Awards\common\Well-Played_Unearned_small.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI20CB~1.0_X\images\CONTRA~2\OneNoteNotebookLargeTile.scale-150.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIF50A~1.SCA\Assets\WideLogo.scale-125.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WIF4A9~1\es-ES\MsSense.exe.mui	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI54FB~1\de-DE\wmpnetwk.exe.mui	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\THEMEP~1\Effects\Bubbles.jpg	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\Themes\Autumn\autumn_1c.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIAB25~1.0_X\Microsoft.Input.Ink.Analysis.dll	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI20CB~1.0_X\images\Office.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~2\HxA-Yahoo-Dark.scale-200.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MI691C~1.0_X\Assets\video_offline_demo_page2.jpg	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WID5B1~1\Modules\Pester\34AE2D~1.0\FUNCTI~1\In.Tests.ps1	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WINDOW~1\mpuxhostproxy.dll	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI54FB~1\NETWOR~1\wmpnss_color48.bmp	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MICROS~4.0_X\Assets\AppTiles\CONTRA~2\Weather_TileWide.scale-200.png	cmd.exe
File opened for modification	\??\c:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Avatars.dll	cmd.exe

Drops file in Windows directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	\??\c:\Windows\INFUSE~1\Packages\MI41D1~1.0_X\Assets\AlarmsLargeTile.contrast-white_scale-200.png	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM1F16~1.0_N\RA7FF8~1.PNG	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AM3076~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\INFUSE~1\APPLIC~1\MI34BC~1.0_N\AppxSignature.p7x	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AM9505~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AMCE46~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\WO79CE~1.0_F\Geolocation.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\SERVIC~1\Packages\Containers-Server-onecore-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM95C2~1.0_N\LXPJLMW.dll	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AMEF02~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MSD7DA~1.0_I\MICROS~1.DLL	cmd.exe
File opened for modification	\??\c:\Windows\HOLOSH~1\SplashScreen.png	cmd.exe
File opened for modification	\??\c:\Windows\INFUSE~1\Packages\MIEA86~1.0_X\Assets\Themes\Aquarium\mask\1s.png	cmd.exe
File opened for modification	\??\c:\Windows\INFUSE~1\Packages\MIB685~1.0_X\images\CONTRA~1\ExchangeMediumTile.scale-100.png	cmd.exe
File opened for modification	\??\c:\Windows\INSTAL~1\$PATCH~1\Managed\68AB67~1\157~1.200\READOU~1.API	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM221E~1.0_I\L2NACP~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AMA8B4~4.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMDEFF~1.0_I\LANMAN~1.ADM	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AM7E4F~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X86BAF~1.170\GlobalMonospace.CompositeFont	cmd.exe
File opened for modification	\??\c:\Windows\INFUSE~1\FRAMEW~1\MIEC84~1.0_X\APPXME~1\CodeIntegrity.cat	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM1F2C~1.0_E\SHUTDO~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\Backup\AMF997~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\WO03F6~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\WO55AF~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X8015E~1.0_D\IEADVP~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\INFUSE~1\Packages\MI41D1~1.0_X\AppxSignature.p7x	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\X86673~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X8ABFE~1.0_E\NETIDD~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\Boot\EFI\nb-NO\bootmgr.efi.mui	cmd.exe
File opened for modification	\??\c:\Windows\SERVIC~1\Packages\MI114B~1.CAT	cmd.exe
File opened for modification	\??\c:\Windows\SERVIC~1\Packages\Microsoft-Windows-TFTP-Client-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM34E6~2.0_J\EDGEHT~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\WO8CD2~1.0_N\cmmon32.exe	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\WO4497~1.0_N\NETSWI~1.PSD	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\WO20FF~1.0_F\ui0detect.exe.mui	cmd.exe
File opened for modification	\??\c:\Windows\MICROS~1.NET\FRAMEW~1\sbs_mscorsec.dll	cmd.exe
File opened for modification	\??\c:\Windows\POLICY~1\RemovableStorage.admx	cmd.exe
File opened for modification	\??\c:\Windows\SERVIC~1\Packages\HYCEEC~1.CAT	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM5AD9~1.0_I\HGSCLI~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM7064~1.0_E\WCMSVC~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\WO0430~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X8E614~1.0_E\SMIMSG~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\INF\netb57va.inf	cmd.exe
File opened for modification	\??\c:\Windows\INFUSE~1\Packages\MICROS~2.0_X\SkypeApp\Designs\Flags\large\bw_60x42.png	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AM5652~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMDC50~1.0_J\WINLAN~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMDAD0~1.0_N\LXclV1.GPD	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AM4AE9~2.MAN	cmd.exe
File opened for modification	\??\c:\Windows\INFUSE~1\Packages\MI7642~1.SCA\AppxSignature.p7x	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\MS7B85~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X883E8~1.0_J\RDPEND~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\MICROS~1.NET\FRAMEW~2\V40~1.303\fr\System.Web.Abstractions.resources.dll	cmd.exe
File opened for modification	\??\c:\Windows\SYSTEM~1\MICROS~3.SEC\pris\resources.ja-JP.pri	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM3DEA~1.0_N\MIEA49~1.PNG	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X85980~1.0_N\AuthExt.dll	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\X894FD~1.0_D\HWRCOM~1.MUI	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AM9E2F~1.0_J\STORAG~2.MFL	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\AMD205~1.0_D\hform.xsl	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AM11B3~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\WO1B75~1.0_J\ntshrui.dll.mui	cmd.exe
File opened for modification	\??\c:\Windows\INFUSE~1\Packages\MI2235~1.SCA\AppxBlockMap.xml	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\MANIFE~2\AM9F61~1.MAN	cmd.exe
File opened for modification	\??\c:\Windows\WinSxS\WO5154~1.0_E\ftpsvc.mfl	cmd.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

812 5100 WerFault.exe rundll32.exe

pid	pid_target	process	target process
812	5100	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchUI.exeSearchUI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

SearchUI.exeSearchUI.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies registry class 64 IoCs

Processes:

SearchUI.exeSearchUI.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "English Phone Converter"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "{06405088-BC01-4E08-B392-5303E75090C8}"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "0"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Elsa Cortana Mobile - Italian (Italy)"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%SystemDrive%\\Data\\SharedData\\Speech_OneCore\\Engines\\TTS\\en-GB"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "804"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "40A;C0A"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "407"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Nathalie Mobile - French (France)"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Matilda Mobile"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "0"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "{14E74C62-DC97-43B0-8F2F-581496A65D60}"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%SystemDrive%\\Data\\SharedData\\Speech_OneCore\\Engines\\TTS\\en-CA"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\TTS\\zh-CN\\MSTTSLoczhCN.dat"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "C0C"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\MrtCache	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-MX\\MSTTSLocesMX.dat"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "40C"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Voices\\Tokens\\MSTTS_V110_EnUS_ZiraM"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "{2984A9DB-5689-43AD-877D-14999A15DD46}"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Sayaka Mobile - Japanese (Japan)"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-AU\\M3081Matilda"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "SR en-US Lts Lexicon"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\MSTTSLocdeDE.dat"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "{37A9D401-0BF5-4366-9530-C75C6DC23EC9}"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Anywhere;Trailing"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Koyal Mobile"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "0"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-IN\\MSTTSLocEnIN.dat"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Female"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Sarah Mobile - English (United Kingdom)"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Ana Mobile - Portuguese (Brazil)"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "{C6FABB24-E332-46FB-BC91-FF331B2D51F0}"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "1"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "6e-1"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Mila Mobile"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "French Phone Converter"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "11.1.2014.1222"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "true"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "CC"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%SystemDrive%\\Data\\SharedData\\Speech_OneCore\\Engines\\TTS\\it-IT"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

firefox.exeSearchUI.exeSearchUI.exe

description	pid	process
Token: SeDebugPrivilege	1776	firefox.exe
Token: SeDebugPrivilege	1776	firefox.exe
Token: SeDebugPrivilege	2084	SearchUI.exe
Token: SeDebugPrivilege	2084	SearchUI.exe
Token: SeDebugPrivilege	2084	SearchUI.exe
Token: SeDebugPrivilege	3452	SearchUI.exe
Token: SeDebugPrivilege	3452	SearchUI.exe
Token: SeDebugPrivilege	3452	SearchUI.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

1776 firefox.exe
1776 firefox.exe
1776 firefox.exe
1776 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1776 firefox.exe
1776 firefox.exe
1776 firefox.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

firefox.exeSearchUI.exeSearchUI.exe

pid process

1776 firefox.exe
2084 SearchUI.exe
3452 SearchUI.exe

pid	process
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe

pid	process
1776	firefox.exe
1776	firefox.exe
1776	firefox.exe

pid	process
1776	firefox.exe
2084	SearchUI.exe
3452	SearchUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2496 wrote to memory of 5100	2496	rundll32.exe	rundll32.exe
PID 2496 wrote to memory of 5100	2496	rundll32.exe	rundll32.exe
PID 2496 wrote to memory of 5100	2496	rundll32.exe	rundll32.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 4392 wrote to memory of 1776	4392	firefox.exe	firefox.exe
PID 1776 wrote to memory of 2716	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 2716	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe
PID 1776 wrote to memory of 4196	1776	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
2⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 616
3⤵
- Program crash
PID:812

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.0.1207162778\1547893423" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1684 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee464c95-2c9c-4d0c-9a46-013a61544b2a} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 1812 22e464bb758 gpu
3⤵
PID:2716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.1.1347299819\1624221651" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecb15be5-be17-41c0-8cee-23bad65c366e} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 2168 22e3b472b58 socket
3⤵
- Checks processor information in registry
PID:4196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.2.1343518155\632680824" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39b365f7-1670-42c5-84c4-15839bcecda9} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 2808 22e4a697258 tab
3⤵
PID:4716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.3.1431892504\458384984" -childID 2 -isForBrowser -prefsHandle 3512 -prefMapHandle 3144 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d146d8d8-c3bb-4d9e-99e7-a67847ecf13a} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 3552 22e3b468758 tab
3⤵
PID:4592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.4.939008401\928900300" -childID 3 -isForBrowser -prefsHandle 4180 -prefMapHandle 4176 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b26b769-0a78-43d5-a374-56fe1f591c5b} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 4188 22e4c455858 tab
3⤵
PID:2084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.5.227202455\1131592258" -childID 4 -isForBrowser -prefsHandle 4868 -prefMapHandle 4864 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a367b03b-11f7-4fa4-a2c5-25c0379fca74} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 4876 22e4c90fc58 tab
3⤵
PID:2832

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.6.293657351\139587361" -childID 5 -isForBrowser -prefsHandle 5008 -prefMapHandle 5012 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b188b427-db39-4e7d-a465-7ec052a48bce} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 5000 22e4c9dbe58 tab
3⤵
PID:4172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.7.1501292895\1250898129" -childID 6 -isForBrowser -prefsHandle 5208 -prefMapHandle 5212 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a426eadf-c8a9-444b-ba09-d3543b3cf417} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 5200 22e4c9da058 tab
3⤵
PID:3628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1776.8.223174061\1982116939" -childID 7 -isForBrowser -prefsHandle 1620 -prefMapHandle 5604 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8f220ff-8706-445b-ad9c-eacf973ad5b9} 1776 "\\.\pipe\gecko-crash-server-pipe.1776" 4688 22e4e3fb558 tab
3⤵
PID:1736

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5848

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5932

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#125 S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
1⤵
PID:4504

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\180PT8ZM\microsoft.windows[1].xml

Filesize
97B

MD5
7ca6f407b1125139f6596947962c3e01

SHA1
f01b5fa66932d4a7271b6025455b75958c771641

SHA256
ffa458ba10d741ed678d73ada07427dc85ca633e516cdbc6a18b37e67e670c53

SHA512
22e09fa2b495084352515e741879e2b3ba9aa8441a9bf142db0de4e7870a3c9a6dfe5ba344c4c8feb6675bf9c82660f509ac390d88ff32fe14d3629a66375d5c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BU08OZ7E\microsoft.windows[1].xml

Filesize
97B

MD5
3f7b7620864f67d9f80ac896394d0732

SHA1
801e573480fe91717403d7db9ac4577b95c6de39

SHA256
cf3338c341dfff3d4900e0080cfe084568272659216d5e33620d8555c33d9ec7

SHA512
aed0e182243fd37ac4e6a68f478958fd48127544efe67ac4e1eb17032ee06489b6bf64adb7cfacd17f0ef2c00f0331245bc0450cab8ad18598b005656c2955fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{dcde6480-803c-4508-adb7-801538fb8d65}\appsconversions.txt

Filesize
30KB

MD5
f21f68ab0fd9bf5b4255eddde72be816

SHA1
abea6564790813e12784c8fabd43eddbec334bf2

SHA256
9034fbd5f370a37a2e43cae5d482b84d3ed9b6c62c6ddbc4bee25b0526ad25ee

SHA512
3b75d817d4f5361a05148fd7e62f5c54b97e685d8db046d73bf4889cca3fb5080da0d8e52b4d0d34b31e927bcb9f2a073411c4597a1f9528c419aadbb2663472

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133555644951162437.txt

Filesize
106KB

MD5
6f3f02e724a230060746b55f7226eb23

SHA1
9aae9a3381aae20cd22f8cfa3e065339b483ae5a

SHA256
426cd35bbfd86b95a680a5951ab3816de8eba2ed76790da8b127db48b42e6496

SHA512
01c2a8e3858ec25e6cccde6899c813fc2490acc885a280bc567454c1999a6e6cff94907409217ff84fc9684b791ad7e09ada75f69814edc2f427024009fab6ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wsv9rfx0.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
aa52019b9765d4bbabf8225e7ac69141

SHA1
318c1969a79e7ca0a0c2ce268a3ae5810520dceb

SHA256
7f541ca6dbd3cbc10928e7e9654a1776fc2ebee687f750fbe63f2afd2e874350

SHA512
50d6ec1e13afade01cea9ef71d83a1e78bfc4544173e4e66fe4463f2ffdc5b35f0841f4efcc6e8043c51a3fb7c7c71c2f50763fe70511fa0b39639bdc252e3e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wsv9rfx0.default-release\datareporting\glean\pending_pings\25cb02d4-9b92-4bb0-9fd3-b575688ca357

Filesize
746B

MD5
947c8bef9cc07dff15f43ccebcc48d37

SHA1
c4e7968f863a0df54f95cf323251f63664ca00ae

SHA256
4a3865e220f40e49ca95b6b636656e5bd09fc8c52e8ce1bc044099adbef50005

SHA512
5113392e12b77c8c97e5f67404d3c94b8cd525ebcafbbd13a8f8f82c58ee1b973a472b37ed38e445f893d2a439e56e758308a013800cc2bd5b6eb9ae509f1ac9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wsv9rfx0.default-release\datareporting\glean\pending_pings\6dcf7d62-c7ed-4b47-bc47-7f8c96fe108d

Filesize
12KB

MD5
268dcca7b9d4ca9992996383c9fbe275

SHA1
3075fe073b845b1ce7ca1e48cd8f996648da581a

SHA256
81581c1e1f604f1327fa28d533fe3dfeb6847bf2a347a66aadad3896efb686e1

SHA512
498df212fe3b636c83a408efcf0448cfe62ba01074886fc54b2039181351e032ea0ff73d54e65b31789f2791661d628bc91eb59dcfe7fd6d8ac432de80d2fe77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wsv9rfx0.default-release\prefs-1.js

Filesize
6KB

MD5
1faf54cffdc67315d7d2cb7ef8b74bfd

SHA1
d6c0361e50257f57c230a1719939237e23b77c3a

SHA256
8aed772c233ca9214ba6c510eb89fee162e4a237d42d633150c82ec092e3b32b

SHA512
dcf3d5846410ca5bfd3e8aaf901855ee7de99418cea71aa56c1305c425058a44399a3ad3678f50b7f4def7ebd154fa446a20d49675d312b97a0fba6c128f592e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wsv9rfx0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
6d3d5530ea2af0582b66e030da441961

SHA1
859dad06f7f2053d8881c97089dbd53d638093c1

SHA256
fe2b4d48264ecaaf8439c8d9931f904d969f864085fbe17cd036ab709c52187a

SHA512
2cc27b9e142bcd3b6e6236f152505a842be0f378dd942e3df59fd6e689f09a2bcdb25e14a9ac48a438396d4121e44779e8f031a98a057d4feb361df7c978e43f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wsv9rfx0.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
383f27c5e6c54bb51181ee46c0370a9e

SHA1
f8c40477389249421ed2830cefbb623b42e77a14

SHA256
1fb1741979e4183c9de2359a819532646de000e0d125c3460ad1e13b3b257c16

SHA512
4ca5dfda0ffdfa1a57551747fd8776cf16afbcd9f8186234b275f35502e801e0cd0cc67e0505c13e9968f62e6aae7691b500031e0cf6b8b51dbd71926dd199fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wsv9rfx0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
79a2e724738b0f4e7f1c76bd227ec901

SHA1
3a4cb5b907fa1d2ce7ac57b9d9b4407e3a8376de

SHA256
9011635f03e5ec54fca594bceb6b6a838b76c7ea3597a4fde0a9bea67663abea

SHA512
71245d6b5c91a98977c1a895d8a1e2947637bad4c7b79dbfdf6a496142334cee3a5ee787c4ab9befac0591b02eefb9f67f0912d6826288374e08e8ab53d93199

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\STARTU~2\urlCache.bin

Filesize
2KB

MD5
3c69dced6715bcd63e14d74f38965eed

SHA1
a162d1a33454e1b90d382499616e1b9211a0653c

SHA256
01f90ccbbfcaa7ae22e8a09a18aa16ec4e833934e53d2f4e361816f66f6ada14

SHA512
5e1a4bd3221c2287bc05322e54b80fab5b32ea2b1267ac2c781bdf67099993f31d009c743d50066eb480daa373eec88f5649362f50e9b9065aa1b7e5736e5ad0

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\037778~1

Filesize
9KB

MD5
1486392d7f57119904900b0c0bd15139

SHA1
aec8eaae67b115a89ca6b02a19e05f3e525b8c18

SHA256
0f3b1c326c4e8c77afdd1079a7d0002832c5352ac629a8e2f2f5a0f4f9b5c4ef

SHA512
3af9629f52bb3c6bae884ba1f5eb1950268d1d13fd0206cd4010db9657f17e2481798644a45eea1058128cac00d5a853fa62ecd3b456f519f2aab42b17b9669a

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\254256~1

Filesize
9KB

MD5
8a35b1f55d097e5fa406c862ce27566a

SHA1
3d07a91e1bef30f0317ec4457320a9fda229c860

SHA256
67ddf456730771273c6b583ad0a9632f9a7dafe75ae558dc96fbdbb090e19b59

SHA512
f469faf57e279395d8ece3acf7107f9da9c845cbc7b2120e1c2497b4fa7cd2470a38b276bf7a115fc4cafd1fe8119ddf9f490ea14fff53f45d42cc832c6079b3

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\4832D1~1

Filesize
13KB

MD5
feff2a338bbaadabf7d30ef322080da7

SHA1
790f9d30608411091413cab966514221e8dd8794

SHA256
56479ebd6de3da7fb3e7840e4901456da4ff0a51d7dc872e287a1291b6d0355e

SHA512
3cec09b8767b4d1020312bb7b8c9e2cb88e04dcd052ca94737a5ebf3b83056d3c8d621bc58925b77c63b9f830ba8f8d2f644f78c436df22e301f0dd0b3b7ac9f

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\5C1149~1

Filesize
33KB

MD5
929063329bd096f9340239dfd7d329a3

SHA1
4d6bbfcda2c26874a3e9ab24ac6eb61417ab3fb4

SHA256
7dc008ade7d925be322d4243ae1799736ee2cbb9eb4c9ba6ca344cb69db9fe4c

SHA512
e8846621c7b3b498f9464c42ca4692df558d28439c6e01e958a9769b307b11c8784af72ffd032e0333fabc535e8479e669a3e99ceff89435f587d9989892d609

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\6C0465~1

Filesize
22KB

MD5
89dd33655af977bedaee6a92b0d0ce87

SHA1
af6c976bdfd740fcb4b857fafa34c57209d2964a

SHA256
339c0cce277173b11bc845883a713b0b531f219f10ac681e965e9920ec1696c6

SHA512
b75df86037576abd4c41cf2e9c894f8c940391b388845e3e92732038c3bc40ce6877dee74343959f47cd3c4088beb4b13cab974000b2d19b41c5679b3c93fbdb

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\6D8934~1

Filesize
9KB

MD5
5334792b96e87836cc46773f690e373f

SHA1
4333c6e8c5fba6fd6b325bba067b2bf1c91e536b

SHA256
ff42b93a77107be4ac4b5bb06143bdd0ffe3546a968bf57abf02e228d31b205e

SHA512
d15b6fdad6e18587fb0ae12bd8c2bde45fa88d6b35e06218f1b234ac4ca311bc8e5defad1cdf4e21df2e8be4ced3a61acc75324b7842bc2b7ab2679a2d25f5da

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\8540EC~1

Filesize
16KB

MD5
f4c170816ddff32ca79396e0c9941fe0

SHA1
a6ceaf25d436f4ac370621f4a8f04b17fb850413

SHA256
9cce9658e24910fc58c32fc465ca1a19edeace8cc5105a45d5699c1221797953

SHA512
672ef1c5b851c8861ad7163aba27bf3f759635163067f98a242965cf55119881c168422f8074797b0a3caab6284b703ea878ed7a3793f7237e1e8242f6f92cf7

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\8BAD8B~1

Filesize
205KB

MD5
3a7ad10f2b5efb73ec69a8c8fe09a34e

SHA1
62371b37d46a0dad9ea5ccfddfac9bbeb4fa4ccc

SHA256
66852837e782a5dc30b80e16b8ae8fc0b8ed29c7f438f5ab513228f24ef631ac

SHA512
d0e254c0a0a9773f87f75eb99d50471b056af403111f3664c5ac328fb1f3800f5851450e1cee3eb3b97ae75def832fa96712351ffe3107d16108190d5dca5985

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\9FC8C8~1

Filesize
24KB

MD5
9357d475ef2091c72aa231dd5d2eed83

SHA1
6ad20deb3f5d254fed5912ed7f89ed3dae347471

SHA256
7de90807684e10d94f991d1b69768e8f30610745de408ce0c744c99e6b2307dd

SHA512
4716100761bab461c9c736af77ac6db20dafe7eadcec0d6a2b356e66f284209a6552fef5fd99d37354fbaf8f45f3e8e22358032496bb66e9ed860eecdf20daa1

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\A72798~1

Filesize
13KB

MD5
7cf558855ed8428f74accb5ad6113401

SHA1
c5864bc15fab2dbfce18d2b2e50fbbbc7396c6f9

SHA256
ff7e5e9541aef443b908b9f2f5e66102dcc94ebc21424f4b6101ec7f36c505a9

SHA512
19efb062bac994d3d1d82d1eb3922c029a8dd3d9040a0e3d7ff3519593507d7dc95592ab7c81648f6eebb7b9dd8280dbce914c90c87ab1c602daf81d89240c86

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\B42066~1

Filesize
15KB

MD5
06965ea412b49604914a49a032bc4900

SHA1
e15ed08dff5f570e5bdd045f31acc9c7789330b0

SHA256
ae49df9650663edb678643948e65d5ddc0a4e467858ce9c776bd2f2dcc8a4dcf

SHA512
22cff75850335dfd47f42afa0e8f165e516a77e5bb080c2fc989ae60f16227f471269bedfd18775e850e70210083629e7dceac99a9ae2cae6a37fe8e7e2cbcb4

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\C7A175~1

Filesize
10KB

MD5
72bb7fb77a6a72083ec5b7022266bc52

SHA1
9a907080339b53c79660da5edd46445b8839cd7c

SHA256
57092b213dfe58ee4a132f011c71aa555a9d7a8ad751279c7aef905f62e89d3c

SHA512
33674e3d3a499a9e29945eb414da3cd557f5afced11a318178aa0845c02545f5c16a0484b1f4562d6aeda16e1a909bb8266096a8da184077d9e900277ed6d1de

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\CE30F9~1

Filesize
15KB

MD5
ad4a6dc5c82950db0ebf5f5f0d95a9bb

SHA1
3342ab160eac97bd7d37a0f1920cc2914a11b83a

SHA256
6a0deb58fefce0a2a6ef20c1dbdbb15274c69aa29fdd5316b0a34c4c10296f5f

SHA512
080889ff5ed5e500f72dc8ffd9ab1e8bc812518155f34e0084baaf5c9fe0b8684bad46fdce47e293a624cb39af0cc432dce1401d32f587fa997b3707015ebe87

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\E238EA~1

Filesize
205KB

MD5
69d902d9ff36f0f257bd5bf354fb653d

SHA1
96f3ec99f7685de667e18441b28e5afbca6fdc6b

SHA256
7abd1106691054488309093b528ef529a9fb050c3066d74a8d3eba3935adf215

SHA512
5a995b05e8a94137b2d32842a8192ee52d034f4c8016471684500fc8807d43e42616844f68c01a5c8ed41d9ccabd297c32720a932f178d1e100d6cf6780615af

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\F18D85~1

Filesize
298B

MD5
864b5ebffafbc17f00ffc8e1af48e749

SHA1
2a05a52a3e754b5052c4e98224f5b1e9c91b36d5

SHA256
79690c289a1ee6b4b9c0ddf73bfb339162fcbb8b76d27c8d6d2d8f1ee13802d8

SHA512
9e674893660082f78148d0b73cc0233d657f07bd86d0a28245a7781376737fefd536be237c2965adb97bc66d41b6a3850e11c7be6fa3b9994d22747ac24101dc

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\F210D4~1

Filesize
11KB

MD5
85f9b2c5edc17ab5e5a1979da23e736c

SHA1
9a438b2e519966233ee69e1bf076e8959d8a00d7

SHA256
08e736e02b4e4ae22f1a58be8b2069842f3a819992c07b11c4cc1e03686ce5d6

SHA512
b3fb5becf89ea834fbc7f6bb3bb3d35d38b6d6fb0e0ad73627b908b94d392cfc05ee4b1a6638e12c4b4772dc00e6c125fa1ec42f0c74c9f8acc58264c5167c52

Download Submit
\??\c:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cache2\entries\FD3C8B~1

Filesize
11KB

MD5
81dcaa14c0c986ce51dd11643490cec5

SHA1
ad23a7fb43bbd242aac28191491cc1911392cfaf

SHA256
bc9e228541ca0f49c22fdaa5fcb3aad627151a322186ab49d8f4410c5b8ea31a

SHA512
cd1f08661d860525b70b0eb906ec38ba8d050be7b3b4ea8860133547aaea6807395a069d5635f27aa75c54977a80285c01c15b01dd993b94b6e9db9839fc5846

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\ALTERN~1.TXT

Filesize
603B

MD5
63eb4e4416e07e757137a54d01666f05

SHA1
9a1f6778b0c47cfd22f91729118f32eac0e486d7

SHA256
eb561cfff196afb67ca78d2dbeb4463e15f02caa897f7428a48eec765f3f12db

SHA512
8bb537b0e977754ee4771b2387bfddf3badb2ffbfbe6e2d369b777427f953784b82eb6cf63516097a21be192005de329609da2ccfdf6bc5618ec17f0c8caef5b

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\COOKIE~1.SQL

Filesize
512KB

MD5
7eb160ce7632db0942ff0c1b122c3f75

SHA1
fdcf690cf197d7cbf59cb2beb7d557a68a7a7467

SHA256
e5eabce633e49a870070a8b2def7cf231127b09dfd9a207d7790e40e23ded726

SHA512
6be96bebf960de0e436b6e537f14b2bee555570da8d6ece7d93eab7ea73ea827fcd2aee7a5231a6c3275dd5ac84859fce291b827c2a20e5785173e55cc60121a

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\DATARE~1\glean\db\DATASA~1.BIN

Filesize
5KB

MD5
fe73f8eba3a35e8be60af60c15c53b10

SHA1
f0328df91f85743952c3510aed0adcbf84233eea

SHA256
5b0ede64a009cd8c635b40925e2ca6b8000631777ad3e4ecd6c50217d6c85715

SHA512
395c59040104bfc44baaa96362408a1e1017dae1670adc582b9f2be3de45a879c1809ef472478892549c11f50d671e6ef9c5ce895b989d04b175e66af7995e3d

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\DATARE~1\glean\events\events

Filesize
162B

MD5
c9181114d1655639b3e99129ed0eb588

SHA1
87c572e3d073c22910b298a9cc2bd8883dc5a9be

SHA256
3ac05f227e45e7684b923d52d72b82fccfb50674c28196e56ed375b6ef342aa4

SHA512
b463b2aad933797b9e81965de9eb00acfbe548def265760ff27c4bd8ba19fd0e38882df9f272ed574c31c1f24a015a16e94fb7a1a1cdfe5881781867ca6db4f5

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\FAVICO~1.SQL

Filesize
5.0MB

MD5
e321d1d68b0469e9db24d9f85781cdd9

SHA1
196e41938c87e15aa807f4f361794ea99eabccc9

SHA256
04e163e69afb18acd81b9e16e0797c9e456d2e82da7788cc7eaf85295e50cb99

SHA512
3f096b669910ca1ec847472346234029bf6d18b88eddfc4309b90b884af9dd8019a393c4d48829ebbf5945f6c5ecb565a8e9d4a1fc733c573b0b1da9200e1d4c

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\FORMHI~1.SQL

Filesize
256KB

MD5
86a25084b352e1e09c0713b7ab9fadcc

SHA1
35c65038bb9c9a505c9a5d3c03501e185b4d5638

SHA256
7d2f08c447fe7280a380f054e4b437abbf6027b1d854b0ffee957332467e21ce

SHA512
cf3b96bc37bf29b7cffcac5f216157d645fc69138be86c7b7819a71157b73cfd0065c28be8d6776f560ad4a3b28f9afd47f987d463f5349442ae78f2ebf8acb3

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\PERMIS~1.SQL

Filesize
96KB

MD5
5344f6602d296ef187e83e852c6a1538

SHA1
7b1b808542aaa2b39872523cebe0dc342c6cbd51

SHA256
c0e30d9426ac9af313d685e205a0dddb9f0ae6176989444b767fd89dc96c9d57

SHA512
e141c98379153ef0e4bdbbeca7088ae083ca79512b7a020b840a3ceb39aba49d3cc3f60f7d508562149da8e55cd9548382003c1a8b7728eb542ce281e05ea549

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\PLACES~1.SQL

Filesize
5.0MB

MD5
9bae1b8bdab46f92d62783e7c4e84d30

SHA1
c2ef4138cb48123baa7cc23a5ce369b8b217a25a

SHA256
2c354f26776f9b900f8bc0cb40f0d91fcdcc4b9b843ba9678478cd13366a3fc4

SHA512
daa2a5d0256fe7b18fac1610a725eaa790836e3f355aa6d4b238b61823c7772c42a05ff7325b292a744e4e0870958dc474d67ca6be8a2825e335082d79bf831e

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\PROTEC~1.SQL

Filesize
64KB

MD5
deeced8825e857ead7ba3784966be7be

SHA1
e72a09807d97d0aeb8baedd537f2489306e25490

SHA256
b9f022442a1506e592bf51284091a8a7fe17580b165d07e70c06fd6827343a54

SHA512
01d303232d6481af322137b44fef6c2a584f0643c48bab2836f9fe3193207015da7f7514fe338500ae4469651e3d9618293858ae507e722198a249257677099e

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\SESSIO~1.JSO

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\SITESE~1.TXT

Filesize
407B

MD5
b4c8a2135322276812eedaab8b053ea4

SHA1
f1877c46cdcdbd0b6590cb6adf3506a243a53b87

SHA256
4cd4a600e1829b9855774d65ab2387e9c965b3665bdeeb6b181d9209210aa209

SHA512
4462db5ded3d32561fee2ecd0473e183e8593484fd5ecf86211aad454a0a750ecdff0f9b3f7e49c86552229a9e0ff2f03ed69f39271b3d178347cd855a0cdc08

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\STORAG~1.SQL

Filesize
4KB

MD5
89f843b3c7354732d0d7b2bf57c536f5

SHA1
a6368e95cf93617624e0aa8568cf9eca2215d70f

SHA256
6f3009d59402727ba3d312b4e6919a2766be77e923b56454b8cbe58df095d8bb

SHA512
12322e51506a04d8edfebfee6e9c0adeed735bdbcf79b7a400adedf0032519c3836a679935c2231d96e49e4c854f65ad1d90d8897698483579a7d968d4507156

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\TARGET~1.JSO

Filesize
3KB

MD5
3dd500dd882a36ddf16ce76a9d3da4bd

SHA1
dd993c99094178a653fcbc7d5ea7a8f0ec1edae5

SHA256
bd0d7f17477954f785d37c072946e64b8266081eb732071f97651eb8f7d9ad19

SHA512
6c7632255d3234905784e2fb5e496820dfd614039da3bf89b2ee3e70b6e57f60f9ce92b9bab915e3da2ff9615501bb8dce46044c853d9521ab448fcf3b7b8c05

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\XULSTO~1.JSO

Filesize
120B

MD5
05e1ddb4298be4c948c3ae839859c3e9

SHA1
ea9195602eeed8d06644026809e07b3ad29335e5

SHA256
1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be

SHA512
3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\cert9.db

Filesize
224KB

MD5
9389db5233d8d0ff46e957b1917d3427

SHA1
b8d54dfbaddb53665fe160c4863162d5a56d7cb5

SHA256
11a919a94a71a11c5d404384c529935183ab3c400393f2153c906ed92a507d04

SHA512
c63d75133ec8c9a6381b13c7f8173cb1726bab3c07d1ce3368a1a3dceaa2ab958087768915ec9322d1c399283aa37242c8d754ecbdfbd711d1d7cd1a8f9e3dff

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\prefs.js

Filesize
6KB

MD5
0a7370fc1c01da0af6e02b788cbafb0f

SHA1
a39f1bfccd278066a53b294828458b695c54bd9d

SHA256
89d4d29202dda2ba55455a704f41351e1de7ee7d90012b709c77d9e223a6b9b5

SHA512
9f1592d5369d3cbb73761051ec45e01bb0a44a378a66e390e850311cb5f802712381e6d04203724f173c24a0423d2a681198bafb81a035bc42eb087fa71449a7

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\storage\PERMAN~1\chrome\idb\165711~1.SQL

Filesize
48KB

MD5
498a8185257fdd0709ef6c760d706e38

SHA1
4dd6a6581f98fd6f8fe0bcc596f98b0c8783b0ff

SHA256
8585d1ad535af109d01693c1e310cd6519a36ed6301d3b068b4803efeab4a09d

SHA512
65b845164f1d431099224fe0ce4f3b5c0ee8f4351591efa4f189ab8706222fa187bef4111df66cabbfbb6e03ad9a87027063d8baf803a71c24e94ef4acf8966d

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\storage\PERMAN~1\chrome\idb\387011~1.SQL

Filesize
192KB

MD5
545e7888deee12625d8b49e2c59bac4d

SHA1
7ace28f4a65b7aa97f4266510e6847305c3e7ec3

SHA256
6b20e840a08d8ec25e66ebdc1814c7782678eefe9f5695d833c3a82b21d93514

SHA512
a4067fde0b30dffbe7fd17787938909eedb4c6b1a05b01767598cc892cfb42873583bbcce9055c5c6b63888a6650bb30362eb08b81365c9c271528991c36cd53

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\storage\default\HTTPS_~1.COM\METADA~1

Filesize
62B

MD5
9f2c135b190de246d962a145a75f1d2a

SHA1
b18c317d1f9ebde51844fbed5c367f7a9ba0682f

SHA256
7c343664825f5086c491becc25723e615a7e391aa69cd677c5f2a437571ee067

SHA512
3e0ddacfaf90df08e17b9e3787dea240f4c42c642681cebce4a3e501679580fdb3ce44daac32f70f41fcd0db3e235de3b944e75d8f3ad891f2f1402de445d256

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\storage\default\HTTPS_~1.COM\ls\DATA~1.SQL

Filesize
6KB

MD5
5e47b5ac3c19c5c7cf3a1953679cfe58

SHA1
1fd913a79265f4e2aa18e13ae5e698637a840ce1

SHA256
9c184831f5137b63cf782da55a3a5a1870e6f645f415b773460c9876ca300e42

SHA512
290b9d1dc9e3f0a9d58321be4a634d1c7f1840b1afc7c1f433befa05aed03ef47f90199a820695e917ffa57ab5955889c5a9cb87b74fbd691fc19e7003f15369

Download Submit
\??\c:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\WSV9RF~1.DEF\storage\default\HTTPS_~1.COM\ls\usage

Filesize
12B

MD5
cd4a95a318587ce800fff845aa75b8ac

SHA1
613272b60c3a91a9b5fd7b2931bd295a95de30f6

SHA256
bb7fc74d8df01e39a792fbf2da0ac59f40379afdfb83485a235890a50d218c14

SHA512
6a08063d1381425f57ade714614d316fe0eb054e170c1771b36bfdbfc326a173ae61863b7769935b456d0f5a81425ef9f2c706915ed621bd867d5eb783a0e7af

Download Submit
memory/2084-275-0x0000029657300000-0x0000029657320000-memory.dmp

Filesize
128KB

Download
memory/2084-268-0x0000029657180000-0x00000296571A0000-memory.dmp

Filesize
128KB

Download
memory/3452-347-0x00000188821A0000-0x00000188821C0000-memory.dmp

Filesize
128KB

Download