f98d9022a796c324c8258577fc0bbee43c02a746be10e791eae1e42da1fc989b

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cortex.Command.Installer.exe
Size

107.0MB
MD5

ffbfd537f581450c0fbef4274eed5ad1
SHA1

1379b1b30b9dad1ad9f499d32f6487cf06e82b73
SHA256

f98d9022a796c324c8258577fc0bbee43c02a746be10e791eae1e42da1fc989b
SHA512

582bda95dad7b0246ebc23a2744dcfd368fb4f7040d44feb44d6cf742dd5e49ebbe7b1d381b465158493e0f285ed8b5fa4496d0647a64b1ee8e447da8555212e
SSDEEP

3145728:G+1bLx+WzEcHFE7tYT7pVnYXdqySLE9Hut9hY4aEoBd:GefVzEclgtO7p6NHWoO9FOd

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Executes dropped EXE 5 IoCs

pid	Process
2336	Cortex.Command.Installer.tmp
2936	VC_redist.x64.exe
2100	VC_redist.x64.exe
2016	VC_redist.x64.exe
4928	Cortex Command.exe

Loads dropped DLL 8 IoCs

pid	Process
2100	VC_redist.x64.exe
5028	VC_redist.x64.exe
4928	Cortex Command.exe
4928	Cortex Command.exe
4928	Cortex Command.exe
4928	Cortex Command.exe
4928	Cortex Command.exe
4928	Cortex Command.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d92971ab-f030-43c8-8545-c66c818d0e05} = "\"C:\\ProgramData\\Package Cache\\{d92971ab-f030-43c8-8545-c66c818d0e05}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e587bd2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e587bd2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e587be5.msi	msiexec.exe
File created	C:\Windows\Installer\e587bfa.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e587be4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e587be5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI82BA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E34.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7FAC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8451.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Cortex Command.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Cortex Command.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Cortex Command.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Cortex Command.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\06093EA0902F50D4BA7C458B9FFC3AE2\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\Version = "237141186"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	firefox.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.34.31938"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\06093EA0902F50D4BA7C458B9FFC3AE2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\Dependents	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.34.31938"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\PackageCode = "37C10DC7E1CFDF3449836C2066BBD732"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\3EA73AD7EA8D1B94B9CD32ACA09BFF22	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\06093EA0902F50D4BA7C458B9FFC3AE2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\Version = "14.34.31938.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\06093EA0902F50D4BA7C458B9FFC3AE2\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d92971ab-f030-43c8-8545-c66c818d0e05}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\Dependents\{d92971ab-f030-43c8-8545-c66c818d0e05}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\Version = "237141186"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d92971ab-f030-43c8-8545-c66c818d0e05}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\ = "{d92971ab-f030-43c8-8545-c66c818d0e05}"	VC_redist.x64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	Cortex.Command.Installer.tmp
2336	Cortex.Command.Installer.tmp
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2624	msiexec.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe
2016	VC_redist.x64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3772	firefox.exe
Token: SeDebugPrivilege	3772	firefox.exe
Token: SeBackupPrivilege	3120	vssvc.exe
Token: SeRestorePrivilege	3120	vssvc.exe
Token: SeAuditPrivilege	3120	vssvc.exe
Token: SeShutdownPrivilege	2016	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2016	VC_redist.x64.exe
Token: SeSecurityPrivilege	2624	msiexec.exe
Token: SeCreateTokenPrivilege	2016	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2016	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2016	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2016	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2016	VC_redist.x64.exe
Token: SeTcbPrivilege	2016	VC_redist.x64.exe
Token: SeSecurityPrivilege	2016	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2016	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2016	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2016	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2016	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2016	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2016	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2016	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2016	VC_redist.x64.exe
Token: SeBackupPrivilege	2016	VC_redist.x64.exe
Token: SeRestorePrivilege	2016	VC_redist.x64.exe
Token: SeShutdownPrivilege	2016	VC_redist.x64.exe
Token: SeDebugPrivilege	2016	VC_redist.x64.exe
Token: SeAuditPrivilege	2016	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2016	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2016	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2016	VC_redist.x64.exe
Token: SeUndockPrivilege	2016	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2016	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2016	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2016	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2016	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2016	VC_redist.x64.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
2336	Cortex.Command.Installer.tmp
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
2100	VC_redist.x64.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe
3772	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3772	firefox.exe
4928	Cortex Command.exe
5188	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2336	1128	Cortex.Command.Installer.exe	84
PID 1128 wrote to memory of 2336	1128	Cortex.Command.Installer.exe	84
PID 1128 wrote to memory of 2336	1128	Cortex.Command.Installer.exe	84
PID 2336 wrote to memory of 2936	2336	Cortex.Command.Installer.tmp	86
PID 2336 wrote to memory of 2936	2336	Cortex.Command.Installer.tmp	86
PID 2336 wrote to memory of 2936	2336	Cortex.Command.Installer.tmp	86
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 4696 wrote to memory of 3772	4696	firefox.exe	89
PID 2936 wrote to memory of 2100	2936	VC_redist.x64.exe	90
PID 2936 wrote to memory of 2100	2936	VC_redist.x64.exe	90
PID 2936 wrote to memory of 2100	2936	VC_redist.x64.exe	90
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92
PID 3772 wrote to memory of 3376	3772	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Cortex.Command.Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Cortex.Command.Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\is-1Q1G4.tmp\Cortex.Command.Installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1Q1G4.tmp\Cortex.Command.Installer.tmp" /SL5="$701DE,111100972,778752,C:\Users\Admin\AppData\Local\Temp\Cortex.Command.Installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\is-KSK6B.tmp\VC_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-KSK6B.tmp\VC_redist.x64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\Temp\{374C12CA-E2BE-48BC-93F9-31D71B28DCAD}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{374C12CA-E2BE-48BC-93F9-31D71B28DCAD}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-KSK6B.tmp\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2100
    - - C:\Windows\Temp\{4C61E987-8A75-4E33-9C04-6918C1E00574}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{4C61E987-8A75-4E33-9C04-6918C1E00574}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7E140E1C-1E89-48B7-B97A-C1F66E219C54} {5D8DC160-F27D-430A-8F62-5B223844958A} 2100
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d92971ab-f030-43c8-8545-c66c818d0e05} -burn.filehandle.self=1344 -burn.embedded BurnPipe.{D8B064E1-212B-4DBB-9544-BBEBEA472451} {8E1924D6-9C89-46B5-B50E-093CCC8730C5} 2016
        6⤵
        
        PID:1100
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d92971ab-f030-43c8-8545-c66c818d0e05} -burn.filehandle.self=1344 -burn.embedded BurnPipe.{D8B064E1-212B-4DBB-9544-BBEBEA472451} {8E1924D6-9C89-46B5-B50E-093CCC8730C5} 2016
        7⤵
        Loads dropped DLL
        
        PID:5028
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{68D6F758-6981-42B7-AB74-D95D6AF0E360} {38BBA0D8-4832-49A5-BE8B-F5C23F33285A} 5028
        8⤵
        Modifies registry class
        
        PID:2404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1896 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f3ca5b3-b578-46f5-9f68-bd596640f32e} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" gpu
    3⤵
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 25793 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0dd7193b-e62c-4635-add8-9c08ebdef75a} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" socket
    3⤵
    PID:3900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3420 -childID 1 -isForBrowser -prefsHandle 3444 -prefMapHandle 2652 -prefsLen 25934 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70bdabf7-5b53-4073-be8b-27a2f53349ab} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab
    3⤵
    PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3980 -childID 2 -isForBrowser -prefsHandle 3992 -prefMapHandle 3988 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf65c50f-c868-4e75-a42d-7a6c2e76cc62} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab
    3⤵
    PID:2712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4844 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4820 -prefMapHandle 4836 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb81d959-d6ed-4800-a865-902ff326d48f} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" utility
    3⤵
    - Checks processor information in registry
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5376 -prefMapHandle 5372 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29758e38-ec87-4344-9fa1-6bf67d250310} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab
    3⤵
    PID:916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6881fcb1-5632-4579-8538-58281e8ce325} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab
    3⤵
    PID:2536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5708 -childID 5 -isForBrowser -prefsHandle 5788 -prefMapHandle 5784 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57790f2e-2407-4277-9978-eafe579a71dd} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab
    3⤵
    PID:3040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6076 -childID 6 -isForBrowser -prefsHandle 6028 -prefMapHandle 6068 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86f6d25f-9671-4832-9848-268ee8c43eaa} 3772 "\\.\pipe\gecko-crash-server-pipe.3772" tab
    3⤵
    PID:2488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Games\Cortex Command Community Project\Cortex Command.exe
"C:\Games\Cortex Command Community Project\Cortex Command.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5188

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x44c
1⤵
PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:5272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e587bd7.rbs

Filesize
19KB

MD5
935c823340cd57296c436d0d4db7539f

SHA1
b1f771c476c05a986a609c35d370505402b8e633

SHA256
0e4d20ab6a68004804a3a6d0e98683a474c1b23bdd171f708beeda4c5f5bf897

SHA512
b006f9903637d1264a3a49ab6d6bd02c6a195f5b2ebce664289555d5692c228df8820b86da30d9424a4a7daac0df5c5776f65b93bcb0bc7f288166869d29481c

Download Submit
C:\Config.Msi\e587be3.rbs

Filesize
19KB

MD5
d0f79dc635e364d5af6428d2be9ff848

SHA1
90242283d182b56f99db3fcf360c855ec636fc6e

SHA256
d3db7df38ae1a7456392ca9994d42422f3dc2a833e7243cceca80ba7ae78056d

SHA512
6ccbc3587982ab0c34f599a36a78224669cea26c873568f06d3265086c636655ec95e1e78f8e9a808fa5e821998d3fe63b0146325ae4b9639cb47fc3b63061fd

Download Submit
C:\Config.Msi\e587bea.rbs

Filesize
21KB

MD5
c4784367ee87191b7edb133299ac237f

SHA1
c0a891034cbb770c094fa59e508c4deed1000ef2

SHA256
f369018d9bb05b70edb4d8f869f4b4f02c82de7f82d62cac7f6762271806c161

SHA512
d33e784951039fa4870a3fe953c3bd2215af8759319d9d87996c72d9b93e25339a76dac5db8a2d6e306a41e5e71905a4721da0ec496835e83d9918a0fd5a86b3

Download Submit
C:\Config.Msi\e587bf9.rbs

Filesize
21KB

MD5
41a188a95dd490d04a7844b19aec2e87

SHA1
3577838fc4378a9c702d2165ce421fc347cb4bc6

SHA256
c9e1f8c1d36d337f5f056997134ea25a094b9e0c30241f8b9ad7c6238a0e3746

SHA512
9145bd5f253705d58f8c7a13cab2fa1ed9794ab1faeb39eb620c12edaf484818740e7177076317cf3f7d1a07f0050b379a6ff97e8feb0f117cdd5c8017b51ded

Download Submit
C:\Games\Cortex Command Community Project\Cortex Command.exe

Filesize
6.8MB

MD5
d9601ff70af0bd1b4005709f5e609826

SHA1
459fc9bfa4d9cc1778f103e166796b1d69a453e9

SHA256
e6dfb4832c5d0393eed94a01508485745fb3bbc069dda0aae69ac1b9cf3f2e5d

SHA512
4caec0d0fe6bee928bfa9e20647fbc8eaf299d65ac6b81368fe1e3c196b72a93f783431fa0eaf98e9522a61262739a3c0c489f0448a3b85a4aa40b217be4ed92

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Effects\Glows\BlueTiny.png

Filesize
236B

MD5
20b00790e6e1dfe32e334813e04f4221

SHA1
6975da9c84d9869a06fe700e4f1bdd971c134b2f

SHA256
4ab8b78191477f7216ee5eb735a9027ba770abbd4054d28bca6eaf9e61c11110

SHA512
6baf9bcbb0b1482406a46e8afd748436242cc8a0c43fb80c48528025dc3dde1107f31f8efdf4ffbf9daf4434ff9f532ca117ce117b3b14b59560ccdd48f5d79e

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Effects\Glows\RedTiny.png

Filesize
164B

MD5
9aae5fe52717b2b0b405d43f18501b40

SHA1
1a873c5d2356bff8436013ea318226ef94e1b375

SHA256
98e8ecc9defbd24cd43a429dae88a0f5f0a68e586f34ac979327bf318d8f7e09

SHA512
162037d58244c24940326154d56eb399244f7834021d622238eaea8e7b31ec4def24a63494cc7b9c1534c1bde46e98386a6bfe7d7191cc1d5bc3671baa07a0c3

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Effects\Glows\YellowTiny.png

Filesize
167B

MD5
142642a569510ceb94d77a2248e8b461

SHA1
6595393451856c59080e4fe18b59a784e4b89265

SHA256
53b3b70caac2cfdd83a1c7514f3ae3fb713354c1f31a0fb81cb89aea063f413d

SHA512
820b2909af230849054d2428b429ef70027cd6aa8866547bdca041a047cb5a9d902a226dd71aefad9b284307e236b0374f996d577d7e0ad178d1512c7c5ac934

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\GUIs\Indicators\is-0K6EB.tmp

Filesize
870B

MD5
07371015ede56bcef934d2ca9605ac0c

SHA1
5fac2bcf3fc03cd1d48bc657cee9e663683caadd

SHA256
b55c896326c5cbaa833198d0d2066883ea761f8c975292255c31ff9362039a5a

SHA512
dfa9ab6a3d794bc73a18dc1cf61dc29b6d8a5bb99d89ae3278729158b0748728039085ba98ac66e9ac9e74e34fad49012a5112702c81c95fa3477b3ac2fe9129

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\GUIs\Indicators\is-NDU96.tmp

Filesize
870B

MD5
a2b35e85f1bed7931edce965dc66030c

SHA1
d80d6dbbfa62b739a74ce2cebd8a4f3685491a49

SHA256
3636568ff7971e6c50615b87d1e815714331618a552511a308bff650fdc8b29e

SHA512
da4a6d69bf9f0f85eae0d54fefae44dd0db5c5e21ad07df3b4252e26651d235c5f7bee1e45c18f2a45ae05e91b7a78dae7108eb5f16ae1c38db7e357aad87c34

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\GUIs\PreviewSkyGradient.png

Filesize
1KB

MD5
68a2fef43741a4a3a9aed3cab465d997

SHA1
935d392beea563c367d6ba24ae6e4daf825f3e1d

SHA256
7451c5f9089abd782635e8840e530d746400aed311885790143b4382a748c8ea

SHA512
c48dbfdec359ed4780f50defed8b4f8c5251a31bcb386f08dbc141b96d40dbb950b9df752c35f11bc1b607a707c69de9604d00e18b7a477cf623e3137faa71f7

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Scenes\Objects\Bunkers\BunkerBits\is-9R4HD.tmp

Filesize
871B

MD5
c724f3c6114e2a54bec7022a094a6311

SHA1
9a95cda6e9ace4772d3aa1a128c0b0ea144a0a6c

SHA256
b93606b56c1c44afae8f84e5540d4021e2416e2d03491d192d343bceda8d1ea5

SHA512
3ef2d337fce8cbd8b1b201883e37873a46227a242903c42df57d2900dfd4b95bb1ad0c47a2a9f22334589dd71d394fa88a0d00ed82fa57899881f282cc87910d

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\ActorSwitch.flac

Filesize
40KB

MD5
66f2cb584ceb915e84ca57b803de994b

SHA1
d7f095937342acc5d57b2fc7f246897dd012245e

SHA256
007ce5d77f9bbc805b7beac3fa245c817232f579d6e141a10d17a5bfe90cb102

SHA512
daa75733adf61225a62ad13bb6217db32e4f199e705edc6f1682c8ad54359689fe5d118da5084380611c118dd5a6d0ec0ded639efd21108f4602d98c71932a54

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\BackButtonPress.flac

Filesize
6KB

MD5
a37fb2bfc8c3a224b68db73084a76cfd

SHA1
a5424e7305ee7c3c07dcb6083b3797c05ab223d3

SHA256
97b64221796e5582b8b1f5f4a22b299c192590d31abe4e2c81e61652bafebb13

SHA512
ff9ca91884194eeea5767fb8bcad71d91cce2f240d47e6d5e383b266d9c48949209ca4a7ae07c2b2ccb27fdd001b22007ad06e5ff0297f1f4ea095190c4c333a

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\BrainSwitch.flac

Filesize
43KB

MD5
8090d72d1c9e7d7182ba7c07d182b817

SHA1
84789cbda19937b83279a47cc9e73a9af800cb93

SHA256
0390230b7c8c3abda717348c30b35c570454325e14abaac5e0e5e63f4d4e31e2

SHA512
4430bbf8be994884e76ac60d31631861ad4f3effa17fbd55db18fa45e93986f788bdec84c360817269580cc23ce8193758aa4723272ec7fde04e728b41792ca9

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\ButtonPress.flac

Filesize
6KB

MD5
0718f21a72ae15fce2c8dd01d2612763

SHA1
2061c5cee08a8dd867d71dcef47a27bece2909ea

SHA256
370fe4b1d9a2535148caf4d003f57dd3fcc9fb894732af3e5c9f472ddf10e26b

SHA512
b056e2a48e13c3823334f4b0b6f6d84dc8f9d546699e1159f59d4c91b986915f85124139eba6b65dc42d2cfedd1c0d99d6bb22488c3ece78db6ed0eb65a1276a

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\CameraTravel1.flac

Filesize
52KB

MD5
a87a3853e77c74ef757cfcdc478b9216

SHA1
2112872f56dc9cb2d9fa8db6b8a8da88c7904b69

SHA256
483dca9eb035ceea2ab96016a3d2a8b45254e0cfb339c97dc614beb39308e54d

SHA512
7c74ee0e4a321fff68872984e8b5f1f58de9848d51974562b97e2fe43c554ff811d3a0579197685589f9a3f1bcec4cc7e04a6b523e0d1750e68b1496db5e197a

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\CameraTravel2.flac

Filesize
65KB

MD5
c441dc9eff2c027ce5ed1d4b3cd53a6f

SHA1
eb00c10bc53f30d602c71b3db0bc862272e9d127

SHA256
e0727186537a6efee35b1cb03aa4a9bd523ce727272f968b19cf197bb5cd2eff

SHA512
7106bfbf239e1521ffaa292ce53eb7f7146cfdfaf9fc260bdd6c14827dd008904620e8e6f2e00af0ef9c82c1690c5c187a840165023199aa1ac43ff56bb6502e

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\CameraTravel3.flac

Filesize
78KB

MD5
d87f75841bf65cc7310abe0acd206a84

SHA1
271f00e322cc313629914bca630c9295684f0d03

SHA256
dd04a9f0ad835469c9bc63729f1d0f9d1cd6bf1ac0fcad81c48c7bf911b5da41

SHA512
d5ed4df33c82565ccded57db9c4de4b5ca99891bd1931b8c5506a67a06015167af333d4525c7848d74cd9da2ac08f2b0a9c5144bbb0ca06abec64ce64339e329

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\FocusChange.flac

Filesize
1KB

MD5
6e96c427a169a2710587ee93cb47c450

SHA1
5a01797ac6d804532cb4c9f8592150da0ded8f9b

SHA256
00128819d72287cc9b110b2811b051427ce82eb2c59b36464de7208473f11493

SHA512
61d39b56682975354032de5eaab5084c9add20ac04f02fc9dc389ed448d263b0bc71e2870f325a378782a00341936c178ea741a477be38674b4d3da3d4836d2c

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\FundsChanged1.flac

Filesize
7KB

MD5
a9814952bc5f0cc8f1eacd748247ac46

SHA1
b367d12e3e2113f7b2ae16aa1f0222c3b3986c07

SHA256
dcdab4bd975eed0b4c755442c22c522349a2fa6684720a84ed9001458e2a2eb0

SHA512
3650d006fdcfb4179aee7631024db11caf6b416ed03a9f1ba3c38a3eca600ec82adf85379b12076293e10ec36d9995c91e286ed35c33c545850fb07047ba9403

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\FundsChanged2.flac

Filesize
6KB

MD5
674e856a6e2b4850483763eb22df4b3a

SHA1
f25d84bfca5b0270e7eed1b65d1d250453208ca0

SHA256
bbd5e70b73fb6b9fca14f51ee999fc4ae110aa1f1dcae8184602ecdc0dc6b33a

SHA512
bb1afbcfa66aa83523cf3fba6cfc8128cdfdc31410fd477876d365ec6453f48d0ac0f14d6ec7c5d7e76eff270d789b6821e67002055b5d3def094dac3218f675

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\FundsChanged3.flac

Filesize
8KB

MD5
1e8d66793f574a0d508cc19b303cd5c0

SHA1
15339ef1e28d1ddff1d4bc1874e7325f5b95e2be

SHA256
7ac1e2f7bd043958c8b4f054ddac351fc747738d23aba15efcb71abb8a2a05c9

SHA512
83d59a83b43b03d670a9be91a2d9c9884feedd642729e410df97833974be314583e328456f78ed013dcb17e100a08d6d693eaf711d2a8c4bce5f146d3b9cb8f1

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\FundsChanged4.flac

Filesize
7KB

MD5
b902e27ac17809586990008c7dcab9c9

SHA1
ec19454430bdde0417db825fd3d8d9967a344c82

SHA256
97d1b1e7ed6a216b5dde02d456b41c874d9b7640139b3d81c694efe8567507b9

SHA512
0b5d8fc01a76f6de38d6219dbfe4d17751d9acb4c53c684a6df2c43e69e40073c861f45ef1527717bc73e7707f4fce5a4ac4d462aa86d9e7ed994b20aaad21e5

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\FundsChanged5.flac

Filesize
6KB

MD5
bd2ec90805676527154b41cb19a5d822

SHA1
9f6d7fe603dd7aa1ef0bb4c00a8caa982f81485f

SHA256
e97b594cfdbacf154eb69ad5d2e5f681a3d1eb493f271a67be59c2ee83d558b0

SHA512
9ac41448eada7cc0e11b7f9d37a6c3d951e66968dcccbbff5ae110d6412a60afdeb99b80627037a378722427fdac6c3d773d051b0b81fb784049d88ce51edb0c

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\FundsChanged6.flac

Filesize
5KB

MD5
10127b733c8b2c303b72b8f839d71bfc

SHA1
90da7e811ac26d765dffdf6261f8e34631370639

SHA256
091fd958913781e00c74ff9b878ec2ba95a45979104b815d0a37af94347429fd

SHA512
a4a5696fc8ad3696778331c2aef58e5bc22b6870f4e3106f9e0a544a1a6d8f79a6090a1053a85b1e676241ae9e16b3204974346a97ca5c7aa2ce28cd3160d3f6

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\ItemChange.flac

Filesize
2KB

MD5
9ec4ef950551bce475575455b9a94237

SHA1
7643d6792c4b45e10d6cc91aa740887fa20d2665

SHA256
b951a955665c87ff20bcdb1afd214f0fa16f34e9ee32637867b593f12deca762

SHA512
6d47101beb05011990c81de9ac5e3c831ad4f7d7586d26e9e74ffc303d2473b535a5b999144cb0e42f4e01e6c20c7f0af08e234b1865db67f2a496fb898bc4e9

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\MenuEnter.flac

Filesize
26KB

MD5
4c8bc7b21ea607a6d8b1caeec916a650

SHA1
5a9216c5213f1a05d8b9c277e258d6eb5507405c

SHA256
fe73fbee58367ba4a65cff64b954715d53f24c2162a90c7adcca93af2e4434f7

SHA512
83b6b6df2e2762bd15fdf0f33b813b0e5835e472a190ce4826bd9fec3ebf270483e7224d8e56ec6b693a7e2904cd845b10138f8a4cbb0f428a17e8ed38749272

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\MenuExit1.flac

Filesize
28KB

MD5
9062b89b9ac1fb6aeb5dd52cb0fd63e8

SHA1
6657bf49a701367c734529b7f1261bec0b13ad2b

SHA256
06aa257f0a7d598c6df5f713e06007fed69657abcf0343fe7fd6fe9f4d7982f1

SHA512
844a002684f352be6982eb8797588c304a4e4a2202e74794915deb2f9877c25b074b965fbb1dec4cb2051a770a32742571b251ca1c70cb1ae6dfda0fe42d12ff

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\MenuExit2.flac

Filesize
31KB

MD5
60660905d5b9c0104e8d7df965ba162c

SHA1
a2a9afe7b928235ae26d46620f7a0a046f32b9d1

SHA256
ae0c4c99a77345a29f52db72132fb158d161383676224113fc32b2a6b5ec6dd3

SHA512
1dd9ac73cb532833cc03586c979c8c7b0df8c20167215928a18a807cf192ad9dfdb64a27471bb08c99b08f2a155283f9ba082f58c58a04fae931f2a10593f363

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\MetaStart.flac

Filesize
98KB

MD5
43183d4550c79bd94309b1d04ad75cfa

SHA1
f515535b24a7837ff55df96f626d0ed377ed9611

SHA256
d44fdc612a4629e8e8e84d127cb1094cac0c983d2d061059c62da3a36382b62e

SHA512
736cc5fdef1ba57946e6cc257e4082ad0479ac88d34c632f6b137436953b3c2e2a28433e06205878c2e6432f0e3f7cdfbaa691feb56dc4826939c9fc41c1c080

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\PieMenuEnter.flac

Filesize
17KB

MD5
f91930264bad9356a12ec1c33a7bda02

SHA1
2af512a1d273344ca499de10b59b12b7c29433e2

SHA256
82fef4c5b98e5645df00539d2d3b305ae1475a85393c520a2efa6c670217fea3

SHA512
3b910c34c3c09dc2c9f9a15fb168aa2911c4b20a72f99ff5c1f04e425634d347135e41cfd1870fc51208e3400fab03d7ab2e7bbb4ef019ab0c3d40c13c3128dd

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\PieMenuExit.flac

Filesize
13KB

MD5
1864a21ca180b429186bada51714452c

SHA1
287aa2403c4b306f21fe78d70bb0d9bbc1f43949

SHA256
77b6cea6206ede6fc74da738178b741d2717c1ac750f9a5b2e374e3f0a05eb76

SHA512
e0d7e8e2d94e54e0c93cf7d91209c082759817af339bdfd837f2ae753c97f48bbbe5c487cdb4ba0a9e610124123eb2a065a16f2925d7d316e0e9aa1b014491bf

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\PlacementBlip.flac

Filesize
2KB

MD5
5563cfbc39dab4f11503a84f33f144cb

SHA1
3abd64d924a7d098be5dc99eb6f61478ec75e30b

SHA256
db7ce45a662321b3b4450848b034e9951b708fd322b65e57e4da845b91353415

SHA512
709b4a385bf23156f543ffabb4e9c8e9e1c232a940f208dad141363618ae731d6949de896d253f26793e8abd5fee0dbc71dbe1b173d8cd8471768c3df0884570

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\PlacementThud1.flac

Filesize
6KB

MD5
f211d0d280b9ad0875beb092e3a2f006

SHA1
e1b4c9bfe1335ff8fd866b476c05ec8fd3c4dc6f

SHA256
5eb9b0892d85d7cea6de99c124b328a62fda81f7fd393bf07ee10d8a96872acf

SHA512
80398eb4e6a2b909d779a8a104cb6e36f71cec68a0e0a3f22eef55a92497221f4b08bd197ecc8cd22effb66b7dc111b0f2c8c82167653dc9f7d32873887b17b4

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\PlacementThud2.flac

Filesize
7KB

MD5
1a723ff7815df33023c6283a674cdc9d

SHA1
16e064c6d483dbcb890796541432128711d8396c

SHA256
07b41e0a0bd6dcd91bb5dbc1c035eb457a163ca581eb0551ae806dfef9de2d39

SHA512
8e96501b9f9f34b73772e3aaaf16e2f5939c44a2cbf8d99a8c511a674cee101a7aba8f0e4fa69b9ce4178b533c00ed6b4141517fe97756a4f1ee36c38d03033f

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\SelectionChange.flac

Filesize
2KB

MD5
87fe8344cb040f7508812e7113cb1b89

SHA1
6ea5bd18501a60c873b335e6e0f456899214603b

SHA256
c5d847a6bec72314977aa2b2ea3360a2e06d58992a1cc7c13673ae3a04314d4b

SHA512
8102f14c452b84723cf99841a70d6b0e08801e6330b258e0f80ca6726f93c9e40d742e0a09853b941d8fdbcc1cbfbbcb339f3ead0025dd30527dbbe7124caca1

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\SlicePicked.flac

Filesize
9KB

MD5
aac91ab47c122ca9ca357b17159e0531

SHA1
29a24c1d092291d9c28c139849f560485d51aec3

SHA256
1d2344702fdf15b75b94eb1e98eab4902bd051361df1302d02d6d945e639b726

SHA512
66f4d30d3c2f37cb20ef7735983679859e54461c021d3c2ace2b9e31a488a4e72f374104006644f4603d79d993ca9dd881d23c490607c04e818a4a80ae4f0459

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\Test.flac

Filesize
2KB

MD5
1e427155052e8fc87ec8b57b756794a2

SHA1
78f3e6737dd53c5b27bd1f82e9c8be7d9d2e9eb7

SHA256
aaf78cb942ce726c0814cf0c35a2d6972d2f8e877accee2e43f42731828e8ba1

SHA512
2ca5fab04f898c99197a645e57d847104f08b92b28f9fba65643511518d32bfff774a273b6068417d2138fcc9999c0a6a437e61453fdf31ea6c97a71a3ae193a

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\GUIs\UserError.flac

Filesize
4KB

MD5
be265a90657425765cc6a45ee3085b9a

SHA1
1e7576b98d5f0ad791076d94dd0f2332c9637f9a

SHA256
4d5648fb28d2dde8d663fe6872c85ba20dd8205e39a7066188fe5c05149a06f1

SHA512
3d2503ae1a12fa4bee930e485539c2b976b33c0930ae37e98cf052137826720c9661497144ea6d902773ae251c63ab161cd63058e1a41dca8bde544108fd28c5

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\Penetration\Craft\Generic\is-19H1E.tmp

Filesize
41KB

MD5
f8df33be8d71a780936b2314e27f6b1d

SHA1
373b086fc6a29acbe62dd86ddb51277771c584bf

SHA256
fd5234bee65c7eba2272e1c1b60a5ae16a6e2fc0fe868a78b90bfed21223c576

SHA512
0a3fc057fa6cbb00f6ad8c08ee63eeeadba15164b8d8e1f7a55272f9ec55f684f9a613ab1f207fe14e8e4bf49b7db6f2cc82aea2d122cca21ebe5b0f2af35bf5

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\Penetration\Craft\Generic\is-4380A.tmp

Filesize
41KB

MD5
61e9728833dbab77fafff62b16eeb8ec

SHA1
5d499aaccba10ba35b3065b415bdf7798ecbfb63

SHA256
8d6ec7d9d4ed7d731a1a6956695b7e5b563c1ee49ec783dfa18fd155878becea

SHA512
3d06067f0e730f637a37d7dcb638e9d5013cb764f9aedc37c314ff6b8f84e0e693af0496294d6173e57ffc1b0a5ea2d9d7df26b30d1d9df53e814fe4f680eb34

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\Sounds\Penetration\Craft\Generic\is-QERV4.tmp

Filesize
50KB

MD5
8a031d58a85094a3452deb3ee51a0dbe

SHA1
9a80a0449a473588a7873432430cce94436bc2a9

SHA256
d7a9defa38ba0576ab40c694cf23da1ec7875bca9de8b13b94bce4fc3becf119

SHA512
a55d9139cf2f3038fa07f05ab9fb3f2601729f224915c3c378281e522e8577f035ecacd55a261a84426ad869575ee1078958dd5c4518bc87fb459c6149aa7431

Download Submit
C:\Games\Cortex Command Community Project\Data\Base.rte\palette.bmp

Filesize
1KB

MD5
8f6bf67b933bcbad7dec7b1d77a7363f

SHA1
e9bb59c7dad9b0ca745b43b58c66ef170d6e9c77

SHA256
d23ed4fade8500ad35572bf0ecdcdd5e111f5a208331c2716ceacd60251133f6

SHA512
245ce44ec169b4e09a32a84ea5233618a96c176cd2eec9cd80e0b5243d5df36cc820a4360a60caa95f2a68548fb0348cac7bdc84b211065e704123ac1909d226

Download Submit
C:\Games\Cortex Command Community Project\Data\Browncoats.rte\Devices\Weapons\Firestorm\Sounds\is-582T8.tmp

Filesize
35KB

MD5
c1d120db72e7d22b3a655180ab9c2b6c

SHA1
75b7f09882b8911af0cbece529d2966c348e3ede

SHA256
dc4ed884a4f524e6d902c1859e1a2fb2c5bf8515101a2be18fc295ff052c04a8

SHA512
bb8c9513904253c4478a5ef65e9c9779d508cf0d9b336aceea61f794936182c193a5356622f401a378febd94195e3db9165971eef170b76b683629cc90b01eb6

Download Submit
C:\Games\Cortex Command Community Project\Data\Browncoats.rte\Devices\Weapons\Firestorm\Sounds\is-JBM27.tmp

Filesize
19KB

MD5
e4cf4122ac84694a40ae6e6cad538c5e

SHA1
f183c1d3458b912493f2b86229667e3193fd0386

SHA256
6041be75f7c229065d14c629f1f35db91f2fbd5b0c4c18edc806ae85b4e1a650

SHA512
ac5cd914d58b2f95b378eb62ff5881d97c248acfd6471e04b3a74d59797f82c7c2d963642f80979d75c22197563d742f3cf2a39cf42ab9a38343bc198f5fd24c

Download Submit
C:\Games\Cortex Command Community Project\Data\Browncoats.rte\Devices\Weapons\Flash\Sounds\is-Q3RQ8.tmp

Filesize
110KB

MD5
09e290738fc583de5fe6f93b50d814f0

SHA1
d42216d84b9b9f7ef9455ebe904c4197d6276d6d

SHA256
a208c3d408424cd697ee1b7ccb3bb57bff6a08b30969079b7399006890f05cb6

SHA512
fddf03f727d6675c08a3a07afce59ff6ab689918a57431ca121f0efbfe9039030762d1aced8c020cb35f281389a6ab27ec37a9180b736c9c9727d69f01cd768e

Download Submit
C:\Games\Cortex Command Community Project\Data\Browncoats.rte\Devices\Weapons\Flash\Sounds\is-S4I34.tmp

Filesize
103KB

MD5
5f3f737b88eb444e3de1664fda58f215

SHA1
20e979e988afae9fc4d6f1982faa0533abbad648

SHA256
ba7c25a4a883c5744b8a927af9dbf6bba32c3c1576efc2704175f9383ba58286

SHA512
5e462b2d9dc347ed55406b1d0623ff1a0898df790dc0bebd901cfedb284be3ee791c0de0c9c08447fd6ac129008b5022b034df1ef6e90c67590599331aa7b696

Download Submit
C:\Games\Cortex Command Community Project\Data\Coalition.rte\Devices\Weapons\AutoCannon\Sounds\is-V1AFE.tmp

Filesize
46KB

MD5
27a691ee653694bebb3c6f1257eaa758

SHA1
47f63c9fcd994e4b93646b8a77cc3c7c1597881c

SHA256
94130300868d78d7cf4e81f32013e4a2cd79259605ab466b613b3abb32c29075

SHA512
0f196455e38f33af8933206cb74f8cbeffa13229ca9c9621ec204519c05cdb19e719f366d1b915c5b9b873cf44a0e5db5351dccb89ee83b4750aa24b0a6208c8

Download Submit
C:\Games\Cortex Command Community Project\Data\Coalition.rte\Devices\Weapons\GrenadeLauncher\Sounds\is-C3LF0.tmp

Filesize
768KB

MD5
80ddf59bf1bc9469bea459b0500ff4e9

SHA1
060478dc37961fe148e0d41c77ea54c8f8e0a284

SHA256
ed6940fd48d6d6d8d64ed38a0ed778fc8813a77a7156d98b7f7e1714b589f88d

SHA512
9fa243e6334016b67d1537b673e69cf36ab3d345638b248d1753bebc3f8bfeb9f28f678f33aa0772a2805bc00eda791f01a2c9491bc9cc97927cadf9baa355c0

Download Submit
C:\Games\Cortex Command Community Project\Data\Coalition.rte\Devices\Weapons\Shotgun\Sounds\is-B1MUG.tmp

Filesize
24KB

MD5
301dcea778364e62a231fd54f4b13d96

SHA1
b147f447cbc2b09b7dd1bc7c21332e2100f3221e

SHA256
a28deec7c70650b66d71b241a01432d1015fd90cc65dc543ad497d6671fb6ad6

SHA512
73c4a99f9730afdddc84b5b028ae53536a34025fb0046868b8f38f1d4784484fb5744420caeb3cc5cd515d18b44f26bd11322a429870e9f4d25bcbc59da72a6c

Download Submit
C:\Games\Cortex Command Community Project\Data\Coalition.rte\Devices\Weapons\UberCannon\Sounds\is-G0OIU.tmp

Filesize
46KB

MD5
474264fddd0e2de77908f3cb24389274

SHA1
f3a4ec361997a2fc19c3d33cbf368145448742aa

SHA256
711e7aae03b39cb2becc965841598f88b7f5d9a9da6255aa584902fe7bbb70d7

SHA512
72528e0c362595cdadf55ddf29a906bab5b316a37529efa383313ff947b4e53f759dd1ddd5eefee6a5e475fe0de7073b93a651dc06d6688004f2de598cc6747e

Download Submit
C:\Games\Cortex Command Community Project\Data\Dummy.rte\Devices\Tools\TurboDigger\Sounds\is-S4DTF.tmp

Filesize
39KB

MD5
53f4ec88e84da714746d51a67de0ccd5

SHA1
9bb7d51b8f73082bb406589844b8318d66fb9161

SHA256
635b86a90b9c3e92e081d726dd3c35d38c78062380fad800f03adf60ff43fa17

SHA512
602349898c2be66a4ce0f53b26e7732c8190a479bd7ce6439a13c72f6208b403ba8e2e9e59d68a9d473bc68282cac0ae4b6d194ded5af1f78d3f6010d4d1fc14

Download Submit
C:\Games\Cortex Command Community Project\Data\Dummy.rte\Devices\Weapons\Lancer\Sounds\is-E64CA.tmp

Filesize
32KB

MD5
c2408e9e7a67230da4c1a905797d6a35

SHA1
2884ac45462f9a1d629c9274b63dde041de04377

SHA256
90ee7efaeb56649cc5364f478a1367f576cb7143a080f4fab9ee0e5f1c5b6458

SHA512
aedb8a3d7cdfa1560186567d1f4cd18533159ddc576f9a24b590d771909fb1a07be31ac311b9c5d3746f9541b0af1e8a835e796be742ebd748d7ce71e0e8f714

Download Submit
C:\Games\Cortex Command Community Project\Data\Dummy.rte\Devices\Weapons\NailerMachinegun\Sounds\is-K60NQ.tmp

Filesize
27KB

MD5
b3b1ff4107f131f3eca99e2fb0c0ff7b

SHA1
9e7665888b5cb5dfd542343aaa10575acc0aa462

SHA256
0109e72146d1b178506068a7cd908e76a4fc237d4cd608f481512aed74b415b5

SHA512
4455c5bf08734477af2dd031858e57ccbb0e2555cfc34f979991576640efc64bf453ae5c8155305d7ab815a8332d39d25ab0983bf8af6a9a137dc6014566b155

Download Submit
C:\Games\Cortex Command Community Project\Data\Imperatus.rte\Craft\is-ECJ7P.tmp

Filesize
94B

MD5
e4133fe8932f2bd00407fbec9aae1cba

SHA1
cb6e480eb4a9a45b5a9013f430abf4fc37008a7c

SHA256
79e56af3a8f1719c6c3b344fcec7243344aecd6c5a20ddcd06fb14b948ac6f0e

SHA512
c890819daf981556f638acce5c174645244f9ba18ef6196045abf354a1594c3c044301e53be1d0161ef0e5c5f9b7bceb44fe26bb9792980fb711f94c5ee53ab4

Download Submit
C:\Games\Cortex Command Community Project\Data\Missions.rte\Objects\Computers\is-TUBFB.tmp

Filesize
90B

MD5
c9ab1948916d0ca612289a46ff0fbf63

SHA1
41e6a55dafae23b9fe548939edb0c55d67c0891b

SHA256
e74861d08b47fac1d08ea5eb222b15519fb1017a44c4b284dcef98655d39e168

SHA512
4f5815c6e0c042bcac96a24755f16235b9573d98fb7aa8b125bf3a09ff98c22f62897218d3127197f814043cc8a21c9adaf680ba12c02876b17501e1041015d9

Download Submit
C:\Games\Cortex Command Community Project\Data\Missions.rte\Objects\Fauxdan\is-DB00A.tmp

Filesize
1KB

MD5
76d84c05a72c4c3e54c653109238d30c

SHA1
e9244bd986773a3123951545b8f71aa203adc35e

SHA256
29034caa63c30142c90d0c112563b4cb54b8e4f875afc628f679d3a527b4d543

SHA512
b2a265a4a6974a0633dfa72c31fdfc3cd858f179347597c8d728c8da91b48bac271449b14df6359c81f2dd022d457b3348efa4d377418f47e022dcf136642370

Download Submit
C:\Games\Cortex Command Community Project\Data\Missions.rte\Objects\Fauxdan\is-MFTDF.tmp

Filesize
1KB

MD5
4423ed111d205b6da8c9311b75f151bf

SHA1
296cf7b96453593264b99cb95ccfd6cff0a7dd68

SHA256
d059530c6fa52720058d9f8cdd3a018057be953c179d7395c4413b7f2ba3e9bb

SHA512
8bb087b3ed97e6a746e9d112c6d13643c7f02208fee2710e1673e7b6c3babfff10da72a8f59e9e73d46586de6306448a6302a724d2c28b4ad91ed914d53bb61f

Download Submit
C:\Games\Cortex Command Community Project\Data\MuIlaak.rte\Devices\is-BN84E.tmp

Filesize
96B

MD5
1ccc16b5ad53144139161edd0d88fca8

SHA1
d3159ed19a4e1e6315424a085b85218363761eaf

SHA256
ac07ddcd5c0c4d0237bb033be1b3354de8023c93bd624ea10c2d6aa18ca4bedb

SHA512
60d7ab3c69db929a55dd6857d7cccc16f6066c844a5dd66e7934106992b99501197c2d16cb610341c1c650c4e485f86cdf45e0fb9363bdc06593bce32654b5a2

Download Submit
C:\Games\Cortex Command Community Project\Data\Ronin.rte\Devices\Special\Scrambler\Sounds\is-HU185.tmp

Filesize
1KB

MD5
2fc6155bd514e1815f2486df0add379a

SHA1
1a6da658b1b17ee68cbe18a84fd2bc26dc6cec28

SHA256
d946cc79bbbc7d989058d68549d72723fc3e51ada1f2a007c8efdce3fee267f0

SHA512
f7dde6c6f8735a3f65f2389db9ef60d4ca6c3cf5e2c621a65f2743cdaf653b7cf03392371f88e375915df8c0c8e4ad786fb0f0b236039b55c98d78d929a5cff5

Download Submit
C:\Games\Cortex Command Community Project\Data\Ronin.rte\Devices\Weapons\357Magnum\Sounds\is-QQ6IS.tmp

Filesize
58KB

MD5
93858bf26d208f2d938bd9eab07bb4ea

SHA1
0f9220de06241294a95c5baaec1fdca1b3e00aea

SHA256
bf679b7ac78066525f2a605b76db4dd3235dc1e4a5a16905c19f34b89802fb5a

SHA512
7bb8ccbdcd4f6e3a46314cad508193759d30988814a2d3943526af466c56c24fce0ca0c25c50ec09f63ff6b7ea102f0d59bb9a7b6a41a0c5dea6553f10b3a0c4

Download Submit
C:\Games\Cortex Command Community Project\Data\Ronin.rte\Devices\Weapons\M79\Sounds\is-KP78E.tmp

Filesize
49KB

MD5
635e8bf0e417b03ac75ac776614a2a02

SHA1
edaf3883d65ea8a75113801a2fb008478e57af70

SHA256
1ee3ec4e72fe43bc6753f5339698fe0eb4c9cbc9aa78edbee99e0b528c718f8d

SHA512
6bd7611803404ea298a9f23f889f0f31a2ca2327f97a2e8d9aae0b9800aade3176f3baad5455d89ca47399b6822ab0d5dbbcc10c59b31cb8c4a735fc2f030b45

Download Submit
C:\Games\Cortex Command Community Project\Data\Ronin.rte\Devices\Weapons\RocketPropelledChainsaw\Sounds\is-NR797.tmp

Filesize
391KB

MD5
2ab03a33ba2249511bdea7addc2299cb

SHA1
2c4bbf40bac50d86004e49ee6fee207534ca41ff

SHA256
6e0896eadc4ef9c8031688774a69193c45d57d31f22840b593082581181c73e6

SHA512
9b736a7c55917a704cb0222c0500649d79cfb359093f3dbcc677699980cace70d21a361349c9a26b1a5ff90c6597d20212d929557ca6b5c9b8110390afed8d80

Download Submit
C:\Games\Cortex Command Community Project\Data\Ronin.rte\Devices\Weapons\SPAS12\Sounds\is-NUIBR.tmp

Filesize
20KB

MD5
080bc05b1f1362148b8308916a941885

SHA1
1785c2c9060c42fa80719f758b85d01224e4bb68

SHA256
217ba916f32421a7daf6bf2741d789c7e8039089e2dc1845bb4a714a38c434d9

SHA512
a98d24b5f38a3b29b2c2edc42a8363ac594ecc5ec783de10e5233bb91086a7077c00cfe7601f7fd80d95861618c0dc940d44495398d9de73af44193ffdda4168

Download Submit
C:\Games\Cortex Command Community Project\Data\Techion.rte\Devices\Weapons\GigaPulsar\Sounds\is-193OR.tmp

Filesize
47KB

MD5
001afd9b71af910a117a9278853f7d28

SHA1
8e36d2d54cea561fbee6833eb073a8a8ceb2d873

SHA256
f7ad2db44b6f3d2e3fd68b4cb8f00f5f3dd8d75d735d70b1c09c2f0123d407e5

SHA512
53ed5c1303362b80945c2b7ef40771d43f61cc8fd889bb6e206d27881e2367141ff72ef0ab45a3ffb35a0b11e56ba03f9a5ffc74a6b9e77fe8e05c1bf1716762

Download Submit
C:\Games\Cortex Command Community Project\Data\Techion.rte\Devices\Weapons\GigaPulsar\Sounds\is-E8KRL.tmp

Filesize
25KB

MD5
c4a00c1a9ced84aa731d59ea696d839e

SHA1
280a157e62ede93bb1ca09036ab97c7c16e64e63

SHA256
e635241d8713478faf96cc20791601c43aa877883eee7259e505e8278f48b211

SHA512
8bfd7bb926962cd8cf8b59a6e4ecef1f074d7febe46b8647e2b609cb1b2e675a801ceb11fe0b089c83da73655ef439ea3c2d80af6cd9a45ce05500bf5de920f1

Download Submit
C:\Games\Cortex Command Community Project\Data\Techion.rte\Devices\Weapons\Nucleo\Sounds\is-1HBGG.tmp

Filesize
65KB

MD5
eb3e4ba1af97d9f63e26d880119d3baf

SHA1
78be818624fc156767407d6aecb3df82b29cd35e

SHA256
8204bd2e7b7890e32573a73a98c92f06a72ea009b046d0c10abe15c6b70af5ab

SHA512
348579b4f1615a5717992238c235588aa61727674f6a91df6d16bec488369fafafd9a22694565611d1fc1fbfc0aacd6eb707e2abc5f62a10c4f444540bcf0dca

Download Submit
C:\Games\Cortex Command Community Project\SDL2.dll

Filesize
1.5MB

MD5
01af76814f9366b35ea1640465b69053

SHA1
c301c117e20268ef7aa2d700fae847bf98510896

SHA256
3c34c1d3dc0731a806f328ee9cab1e5f1e8e0a0c3b3f2df2290ad0e18a60c934

SHA512
a46f80dd40e3c4372b71faefeb0633a29b1b74f4332d5479d350161e64d339bea57cc872ef93dd5782276e16a71a32de30ef6ba9371353a49b743ca62615b47b

Download Submit
C:\Games\Cortex Command Community Project\fmod.dll

Filesize
1.8MB

MD5
e5124a5c8a51a80362e1191471be5f5c

SHA1
e4729477b086ae01e63038e2e6d3e0f605d51ff6

SHA256
6f2a20c0c81f70e047724b5f9b60e62ad92e762a988868abc4ec482daad594f5

SHA512
07546025baca27c7f3568ed9d6d9f32fdcb31b0f67a3a8b41f9f0494d8f591d6980d15222b480472b07c42ad74b312503d520f54e3f36cbd6d6287b48ba19644

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
e05cd373e2745ed2b9eee5cdcbe44e11

SHA1
91c4baa7d65516b92cc915e350887f96c9e1aec4

SHA256
9f86b52a65ab94d7444a0eb2c3a4ef2d918679a61e2f22975ec336822a721da2

SHA512
af497c6b7f35de1665491b0dc9443497d483283e3b961b36d680c8feaa916c060d634c7a83a89d4609cd717ccb72fa5054539f5dca51b405c392ec2af18bac32

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240709185750_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
7c0aae748db84d4424b00544cc6e1e89

SHA1
014c69c49b0672f56fe697bbeb8c1ebdb2ddc08a

SHA256
779d90ba56eb6feef05923b2cc84d2969402059a849e3312fd830c261b85644a

SHA512
fb9704b9f87e07d7d68a9fa26666b9c3130ac9c7c7e57fd06154dd9f512ad27188f593e99df031adf49e3ea7fc0f26182c535ce660db6bb0f9f29ebd478edf0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240709185750_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
0da973fcfaf2b6ab07ec4355a65c0c59

SHA1
8ff47f9f49132ba46e36515c48b4e56b2bc130b8

SHA256
f74471d4d306c2dec3f07d618156694cf455cefc4113edb01b07c9a166b51e55

SHA512
4c2d1a6a2de0df7c5a9b87ccd5d7c62a25afd696d6d164a1263beed07005949fc371e44b6563194e44cbfd1511aee330de3755f86b24f40f7b13a2747f58332b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1Q1G4.tmp\Cortex.Command.Installer.tmp

Filesize
3.0MB

MD5
912f6ca6f6944835331b43c4b6acab1e

SHA1
518dee1399e0eb6359493545bddd61a5a3885152

SHA256
433a0337ded5f5f457c79b2c8fd82c3e0abf5665ec27db53eb8f82db1a0597a4

SHA512
13ad6b4b55be833f40c25ce09b846302ee03f4b53da549e7f91ef17fff43dd7dec5b202c0da69a6672ae594790f9acf56f16563f4eb8b285a814fa6d26f01977

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KSK6B.tmp\VC_redist.x64.exe

Filesize
24.3MB

MD5
119dde89a20674349a51893114eae5ed

SHA1
4de9f6681f0f213b132def3af88a3c68483f5f32

SHA256
26c2c72fba6438f5e29af8ebc4826a1e424581b3c446f8c735361f1db7beff72

SHA512
9be541f26b5d43cee1766239d8880ab7d30d18fea2f17e28d63a498b30b7dd0918f389805398cb56b0df0df17c8633cb73f9e46672c93b21be04b85bda7a2648

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin

Filesize
8KB

MD5
719a159590fb0a3d185061185787ab18

SHA1
9d2f98bb688b0c2bcf30e6efd7403841c483ab51

SHA256
13d8f083570c8099f1687f1df434af72e7f85af7d9498cc5b499964d5d64f5b9

SHA512
b5f7503fa9aba28af39f87c6c771735075576ea22a5bef8557252ce80e10a25efd073dfbffe8fb784a761e0396f479dd5809f7ce628ad728f4994343de42cacf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
714344ddfa9582f5c6a8525236ca8cf4

SHA1
cbb193c294b3807bdbb8c13edac8630be094358e

SHA256
db40f9e098be8af6bbd3dc8d117c296643f042649212f7d1b392137f98d52b6b

SHA512
f0ff068e75fc2f46803cfb2f656cca35d2cf179292b32f129747d08a6608dae6685feddf04588e0597e66402adc478810c2de4c8c2890769f88e7d0849b630c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp

Filesize
33KB

MD5
78bfb38ed351ac5555b5a71cb7859107

SHA1
3ef3a426c36d805452b26cff33dbe924ec5ed000

SHA256
94737eace019fd58a70eb74ea1ebd06f2df49f234c965f16c59b8f854c996cb5

SHA512
c9de4fee8a4d13ca38c6f81a4d060be88c7a488e06fdfc1c82da64370fa7783beaf3e682e0c46d75f336ada316997312fd2e504008db2ea314d273ccfcadf243

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
cbe2d7ecdb0b449b62fe25beb28399c0

SHA1
7c1884426c886c55c5491fd3dd5a498dc71f5137

SHA256
d7d05f689b1efd9e96dc2dbf1ba43f6a5d58b1a70a3ebed4642245e62f15d575

SHA512
7b4d80a63d34f68ef55533dcbc6113b056c0e1538975898778afe84bf5635a4a9f79117c9243d3052b3711373f5a22b24aecd66b782b29f2f695f7abd6d2395f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\022569db-362b-417f-9820-bc945a2113b1

Filesize
659B

MD5
7a0ffd264a412223c2b27010ad17583f

SHA1
3af6e45dcca9c06ae014a85ecbb7a831710e1684

SHA256
21bfb8512a0292abc6c73b83bfcd7d8fae5857e460f3b3f57f0578c9d60e63c2

SHA512
db2a7a5495eb50bb20ec94fafe1c65f0d362ccd9670ec93d6e491253ee7218f9b60ec89dfb5bb1a3890f6c9ecd6ea607152ff036083ae1e8a9dacc20be8a4655

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\c242107e-8605-4aa4-97ed-4a9f1d865d4e

Filesize
982B

MD5
6601fd4770de68f7356a3e1d9543612d

SHA1
75dbb77742d70cba8ecc4854908970021f11d16b

SHA256
03dae4bed12b0f622575f29abe17ecb8813aa0ac1b7382db0b0a832baafc40c4

SHA512
3228d1df68e7ecd81d14cc9cc1612966862fd352802e1115bf67575a1f3e28345773b4e409e66171ad7792b0a62d23e0b587dcc2eae2669dd99e88c7dcf9e60c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs-1.js

Filesize
9KB

MD5
83532226d676d93805ba842bd21e0af3

SHA1
7963975b01e096b89a5de9f2ada0a4856d63b1d8

SHA256
0dddf12c86841dcbbd8e264732c3a038a76cb2aaffb2213e98221878d0847ed7

SHA512
6fe8249a9e4d4477e3cc85446b27bd88d7874f3a91669382f9e3749491683260bca1499616208bdeb4d4d7b90326e97a52e415099e90c05c8a77fa004b937e55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs-1.js

Filesize
8KB

MD5
160b19f140611c5554865d9ce0bd488d

SHA1
074a295a19555ea6b390730fa3ce8ca2a5b8111a

SHA256
7b3e4891ece16d711d59f592265dba60c63295d6656b1ac065d66690f0103842

SHA512
d6f677461ab059d6be427f4319e9696ff4fc2fd6a4525055f442009ab3d683646a2c72f270af339e75679724e775f804eb8cb693909178619fb3ace719c46547

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs.js

Filesize
8KB

MD5
08bc410631dd093703d20776b421e9cb

SHA1
882ba9efc8248f77a165e11b2cdd41aefe381169

SHA256
e3b147d48c91dadc54642088825f1eef52ad52c83c874eff0fa2c0691f8e4be4

SHA512
0a68aeed9ebce7d5c1eb8ab1a31843e7ba3c68a7a298d482db6005b7c079f08ad10db4f4be82f99780190b67a753f41ca7480d79b8b168663e7452aa117109ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
1ca91bc9ff841588b3d2846c22b3383b

SHA1
f533c7f6dbb4bd3a6c31a782cf2dc043e23ef1a5

SHA256
c5cb2103a4f65d54e072b357ebe458644a15a473604cc592dc45acfd83c55ea3

SHA512
7a7f30d0cd0a074dfd48ae47bfde965592082b0fa2072eb70a76b3366341b31162469b22980fc19c98112a683ea62bde5ccb2c0ce7a3331db4ef5adebda10760

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
4a23be0d6accf3b76da95a83e545bdcb

SHA1
61936d5e73b05f16e96afeb46ed47931c541cce6

SHA256
b0b8978c51dea37cc02b784dbe319f494cd8e75e0bc96dd40b25856512b93800

SHA512
8a8ff193085b1e5e91a420855e115d1bd714061ee35ab3ae2f9c7d4afe013c48a7fe2e9641365fd6690dbd6b9b714096ea309e7da83ee69092ac3220cdadfe5b

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\System32\msvcp140.dll

Filesize
566KB

MD5
a62a22c33ed01a2cf362d3890ffa70e1

SHA1
ea3f55d92cdcb788876d689d394ec3225b1d222c

SHA256
003da4807acdc912e67edba49be574daa5238bb7acff871d8666d16f8072ff89

SHA512
7da909a6c5dc26631fec8a382d5cb677d3aabf5b5c4e98b545c120685f879adcef8cc98e7bf74d37f7fc24b0f18999780d70aa28061f50adf6b28f19ce06930a

Download Submit
C:\Windows\System32\msvcp140_atomic_wait.dll

Filesize
48KB

MD5
b7f657c969f7b087ea2563c02111a3b3

SHA1
a23917a890e7f0e1cd4410a9b3b6368367bcc6a5

SHA256
0fcf613254644c2ea451a693d7737741b8041f11decb8feffd3b34e00220620a

SHA512
f3ea77edc972719804990aeaac71613412e3b840b35786e84eda99ab72aa791255fa276abf9200c4b21b70473b08e655844acd64d20d78f19122a064b99f1e2f

Download Submit
C:\Windows\System32\vcruntime140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Windows\System32\vcruntime140_1.dll

Filesize
48KB

MD5
7e668ab8a78bd0118b94978d154c85bc

SHA1
dbac42a02a8d50639805174afd21d45f3c56e3a0

SHA256
e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f

SHA512
72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032

Download Submit
C:\Windows\Temp\{374C12CA-E2BE-48BC-93F9-31D71B28DCAD}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
7cf46d8dfb686998aaaf81e27b995e8c

SHA1
c5638a049787ce441c9720c92d3cd02aa3b02429

SHA256
120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4

SHA512
66cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe

Download Submit
C:\Windows\Temp\{4C61E987-8A75-4E33-9C04-6918C1E00574}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{4C61E987-8A75-4E33-9C04-6918C1E00574}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{4C61E987-8A75-4E33-9C04-6918C1E00574}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
21742d42a69cd5caf3a8a2755fb0d472

SHA1
2f081e6a2e3f3f6bbf40e8645e2e85678f52a769

SHA256
51d43233a4a4726e4bf0cb65214dc54cf7b703a980f7b0a276f37bfd2bd7761b

SHA512
53b801763a891a7ac40fd198d91d700050272c9445b84445edfbbe797a4f4d28efbc793297ca45f43cb53db2d0710bf9cf45eba664d70cc414ef73545b834fae

Download Submit
C:\Windows\Temp\{4C61E987-8A75-4E33-9C04-6918C1E00574}\cab5046A8AB272BF37297BB7928664C9503

Filesize
925KB

MD5
49d2d776f9d88979fff9041b021ebce6

SHA1
0e505bff7ccb0913a5e2e1c49b5b4cd86102541d

SHA256
5333dd41789fcb64b9da329e14b34544031b8cc4fc2b5f863a01d425064a7954

SHA512
555a9f091bc6cdbe4bc6f9ed40bb3f92129b1bf6db9108c65ea4d8cf837fdd7d47749b33ae9b8a4ae606247485f29968ae52d5c49a086e2522444b02f440c913

Download Submit
C:\Windows\Temp\{4C61E987-8A75-4E33-9C04-6918C1E00574}\vcRuntimeAdditional_x64

Filesize
180KB

MD5
5454587e1613092539742efe1183dd67

SHA1
3a26f9456051d342758732f66e5ed751d8afda70

SHA256
cfcdba2bff2f9933db7af33ed47c6a43f484fd8c8b844c246506fc3a5329b6f4

SHA512
c73b6cb8dfce6a52f82ea289f43cdaf198dfc0bfbc406afbd8edc74e5724e0b492850c56d9540e723b60ac0a43be3b4f5c5e6d471c4bc7e4191c04498e57de22

Download Submit
C:\Windows\Temp\{4C61E987-8A75-4E33-9C04-6918C1E00574}\vcRuntimeMinimum_x64

Filesize
180KB

MD5
a16b7d2616657a5ca44c480a82dcdd74

SHA1
1da94c7ea9d2042e6d71e5b2cdbf2256b3956c2b

SHA256
293eba293c34aa7257abb89d7e6aa3dce218b28f565a664a3c531a64e46be379

SHA512
f8244892766553238c56618be1e96515e58cae2b8c3db60505034f4e44b8e3faf766d79839eb0ce0e57128e8a6af71163260a851016b9446ac997b6945e6fc7f

Download Submit
memory/1100-12212-0x0000000000320000-0x0000000000397000-memory.dmp

Filesize
476KB

Download
memory/1128-725-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1128-12270-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1128-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1128-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2336-11607-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2336-730-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2336-11996-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2336-6-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2336-12264-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2336-8855-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2336-7894-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2336-12255-0x0000000000400000-0x0000000000707000-memory.dmp

Filesize
3.0MB

Download
memory/2404-12174-0x0000000000320000-0x0000000000397000-memory.dmp

Filesize
476KB

Download
memory/5028-12211-0x0000000000320000-0x0000000000397000-memory.dmp

Filesize
476KB

Download