hxxps://whatismybrowser[.]com/

Analysis

max time kernel
854s
max time network
824s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://whatismybrowser.com/

Score

7^/10

defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4020	setup.exe
2144	setup.exe
916	setup.exe
2448	setup.exe
3812	setup.exe
628	setup.exe
1760	setup.exe
2528	setup.exe

Loads dropped DLL 28 IoCs

pid	Process
3540	chrome_installer.exe
4020	setup.exe
3216	chrome_installer.exe
916	setup.exe
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
3812	setup.exe
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1444	Process not Found
1760	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

System Binary Proxy Execution: Rundll32 1 TTPs 1 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
1676	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\RESTART_STICKY_NOTES = "C:\\Windows\\system32\\StikyNot.exe"	StikyNot.exe

Drops desktop.ini file(s) 14 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	mstsc.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	mstsc.exe
File opened (read-only)	\??\X:	mstsc.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\I:	mstsc.exe
File opened (read-only)	\??\Q:	mstsc.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\K:	mstsc.exe
File opened (read-only)	\??\N:	mstsc.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\H:	mstsc.exe
File opened (read-only)	\??\O:	mstsc.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\F:	mstsc.exe
File opened (read-only)	\??\G:	mstsc.exe
File opened (read-only)	\??\Y:	mstsc.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\D:	mstsc.exe
File opened (read-only)	\??\W:	mstsc.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\P:	mstsc.exe
File opened (read-only)	\??\R:	mstsc.exe
File opened (read-only)	\??\Z:	mstsc.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\E:	mstsc.exe
File opened (read-only)	\??\M:	mstsc.exe
File opened (read-only)	\??\S:	mstsc.exe
File opened (read-only)	\??\J:	mstsc.exe
File opened (read-only)	\??\U:	mstsc.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	mstsc.exe
File opened (read-only)	\??\A:	unregmp2.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emf	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm	WinMail.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\~ideos.tmp	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Explorer.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\edb.chk	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0F84BAB8\04_Music_played_in_the_last_month.wpl	unregmp2.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\~ocuments.tmp	regsvr32.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms~RFf84cdbb.TMP	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools	regsvr32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3VDFCEMQ2G1FN2LRZY4F.temp	Explorer.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif	WinMail.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Burn\Burn	Explorer.EXE
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms	regsvr32.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Videos	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Windows\System32\zcgahj.exe	cmd.exe
File created	C:\Windows\SysWOW64\config\systemprofile\Contacts\SYSTEM.contact	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\oeold.xml	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD	unregmp2.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\~usic.tmp	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db	Explorer.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low	ie4uinit.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg	WinMail.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Videos	regsvr32.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\~ictures.tmp	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow	regsvr32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\Documents.mydocs	regsvr32.exe
File created	C:\Windows\System32\%LOCALAPPDATA%\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml	ie4uinit.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs	WinMail.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Searches	regsvr32.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites\Links\Web Slice Gallery.url	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb	unregmp2.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms~RFf84cec4.TMP	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\Contacts\desktop.ini	WinMail.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\edb.log	WinMail.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML	unregmp2.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms~RFf84c237.TMP	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Contacts\SYSTEM.contact	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg	WinMail.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb	unregmp2.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat	RunDll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned	regsvr32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\tmp.edb	WinMail.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	WinMail.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\Stationery\To_Do_List.emf	WinMail.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\~ocuments.tmp	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Links	regsvr32.exe
File created	C:\Windows\System32\config\systemprofile\Links\Desktop.lnk	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\Contacts\SYSTEM.contact	WinMail.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\RE99D5~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\REVIEW~2.GIF	sethc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\EMAIL_~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\REVIEW~3.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\TURNON~2.GIF	sethc.exe
File created	C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\CHROME.PACKED.7Z	chrome_installer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CRYPTO~1.DLL	sethc.exe
File created	C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\SETUP.EX_	chrome_installer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DEFAUL~1.PDF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\RECDE7~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\SERVER~3.GIF	sethc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPU~1.INI	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\FORMS_~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\FORMS_~3.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf	sethc.exe
File opened for modification	C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT	ie4uinit.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\END_RE~1.GIF	sethc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Uninstall Information\mshtml.Install\mshtml.Install.INI	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LOGSES~1.DLL	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMPRO~1.CER	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\TURNOF~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\REVIEW~4.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\RE1558~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ADD_RE~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_250F0.tmp\SETUP.EX_	chrome_installer.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\classes.jsa	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\FORM_R~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\REVIEW~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSIG~1.PDF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ADOBEL~1.DLL	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ADOBEU~1.DLL	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CRYPTO~1.SIG	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\STANDA~1.PDF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\SUBMIS~1.GIF	sethc.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	ie4uinit.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SH~1.DLL	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\LICENS~1.HTM	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MYRIAD~1.OTF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\FORMS_~2.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LOGTRA~1.DLL	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif	sethc.exe
File created	C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_250F0.tmp\CHROME.PACKED.7Z	chrome_installer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\STOP_C~1.GIF	sethc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif	sethc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PRESEN~1.MUI	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIAUTO~3.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe	cmd.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_53EF~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PRESEN~2.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PRESEN~4.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_A468~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PEC8F5~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\ShellUI.MST	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENT~2	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_7457~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\UL_MSV~2.98C	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\WINDOW~2.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_A206~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_68A2~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PENIMC~3.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\SYSTEM~3.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDXFIL~1.ICO	cmd.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	ie4uinit.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_EA13~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PENIMC~4.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UI9BD8~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\MICROS~2.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PRESEN~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PR5A6B~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIA3D3~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_5CEF~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\SYSTEM~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe	cmd.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFIL~1.ICO	cmd.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SECSTO~1.ICO	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\INKDIV~1.8F0	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PRESEN~3	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\SYSTEM~3	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\SYFE7E~1	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\ShellUI.MST	cmd.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\XDPFIL~1.ICO	cmd.exe
File opened for modification	C:\Windows\Installer\292d.msp	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENT~2	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PRBFC1~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\SY59D2~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_BA02~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\SY2C2F~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\FDFFIL~1.ICO	cmd.exe
File opened for modification	C:\Windows\Installer\360c.msp	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENT~4	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PE3AC5~1.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\SYSTEM~2	cmd.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENT~3	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_C9E2~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\UL_MSV~1.98C	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIAUTO~4.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_038A~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\MICROS~3.DLL	cmd.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_REA~1.EXE	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_3C0D~1	cmd.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_E61E~1	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\ssText3d.scr"	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinMail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1528	SnippingTool.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 35 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe

Modifies Control Panel 8 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Appearance\Schemes	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Appearance\CustomColors = ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00ffffff00	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Appearance\Schemes	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\ssText3d.scr"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmz	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.midi	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wax	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wm	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wax	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wm	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmd	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmx	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmd	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmz	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.midi	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmx	unregmp2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules	regsvr32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup\0.map\94a8d2e6c683bcaf = ",33,HKCU,Software\\Microsoft\\Internet Explorer\\Main,UseClearType,"	ie4uinit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Mail	WinMail.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	Explorer.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCacheSMP = 010000000000000002	Explorer.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup\0\a0290d1b18554834 = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000	ie4uinit.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\EventLabels\FeedDiscovered	ie4uinit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\HME\	unregmp2.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1F3427C8-5C10-4210-AA03-2EE45287D668} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e4c357889de4da01	chrmstp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\Appearance\New Schemes\2\Sizes\0\Contrast = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CacheLimit = "256000"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Keyboard\Native Media Players\WMP\ExePath = "C:\\Program Files\\Windows Media Player\\wmplayer.exe"	unregmp2.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FavccvatGbby.rkr = 00000000000000000000000000000000000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bfffffffff84838e489de4da0100000000	Explorer.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Appearance	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\MLSChangeIndexList = "23"	unregmp2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\	ie4uinit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup\0.map\c00c44a7beb89d93 = ",33,HKCU,AppEvents\\EventLabels\\CCSelect,DispFileName,"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesRemovedChanges = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\Appearance\New Schemes\3\Sizes\0\Color #6 = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\RTSP\ProxyPort = "554"	unregmp2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\OobeFldr.dll,-33057 = "Learn about Windows features and start using them."	Explorer.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYFRFFVBA = 000000004d0000006b000000d22720000e00000015000000a06806004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e00470065007400740069006e0067005300740061007200740065006400000000000100000000000000f478e6fdfe0700009000000000000000e4d6ad020000000001000000000000005231e6fdfe070000020000000000000030d7ad020000000074ddad020000000000000000000000000000000000000000e803000000000000000000000000000050d8ad0200000000e80300000000000054d8ad0200000000000000000000000098badbfefe0700000000000000000000e0a1dbfefe070000000000000000000010d7ad020000000020f6770100000000000000000000000000000000000000000000000000000000000000000000000080781f000000000002c6ba7a00000000887a1f000000000020f6770100000000000000000000000080d9ad0200000000e0ebad0200000000b2c5ba7a0000000080781f00000000001054a67700000000887a1f000000000020811f00000000000000000000000000987766fefe070000000000000000000004d9ad020000000074ddad02000000001054a677000000000000000000000000700000000000000000001f000000000008000000000000006000000000000000e8021f00000000008e599a7700000000000000000000000060000000000000000f00c600e9500000707c1f0000000000220024000e00000015000000a06806004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e00470065007400740069006e0067005300740061007200740065006400000000000100000000000000f478e6fdfe0700009000000000000000e4d6ad020000000001000000000000005231e6fdfe070000020000000000000030d7ad020000000074ddad020000000000000000000000000000000000000000e803000000000000000000000000000050d8ad0200000000e80300000000000054d8ad0200000000000000000000000098badbfefe0700000000000000000000e0a1dbfefe070000000000000000000010d7ad020000000020f6770100000000000000000000000000000000000000000000000000000000000000000000000080781f000000000002c6ba7a00000000887a1f000000000020f6770100000000000000000000000080d9ad0200000000e0ebad0200000000b2c5ba7a0000000080781f00000000001054a67700000000887a1f000000000020811f00000000000000000000000000987766fefe070000000000000000000004d9ad020000000074ddad02000000001054a677000000000000000000000000700000000000000000001f000000000008000000000000006000000000000000e8021f00000000008e599a7700000000000000000000000060000000000000000f00c600e9500000707c1f0000000000220024000e00000015000000a06806004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e00470065007400740069006e0067005300740061007200740065006400000000000100000000000000f478e6fdfe0700009000000000000000e4d6ad020000000001000000000000005231e6fdfe070000020000000000000030d7ad020000000074ddad020000000000000000000000000000000000000000e803000000000000000000000000000050d8ad0200000000e80300000000000054d8ad0200000000000000000000000098badbfefe0700000000000000000000e0a1dbfefe070000000000000000000010d7ad020000000020f6770100000000000000000000000000000000000000000000000000000000000000000000000080781f000000000002c6ba7a00000000887a1f000000000020f6770100000000000000000000000080d9ad0200000000e0ebad0200000000b2c5ba7a0000000080781f00000000001054a67700000000887a1f000000000020811f00000000000000000000000000987766fefe070000000000000000000004d9ad020000000074ddad02000000001054a677000000000000000000000000700000000000000000001f000000000008000000000000006000000000000000e8021f00000000008e599a7700000000000000000000000060000000000000000f00c600e9500000707c1f000000000022002400	Explorer.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Colors\ButtonText = "0 0 0"	regsvr32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\msconfig.exe,-126 = "System Configuration"	Explorer.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\International\Scripts\4\IEPropFontName = "Times New Roman"	ie4uinit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Keyboard	unregmp2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\DropShadow	regsvr32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1C00 = "0"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Colors\GradientActiveTitle = "185 209 234"	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Appearance\New Schemes\2\Sizes\0\Font #3 = f5ffffff000000000000000000000000bc02000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000014000b00000000ff120050000000c0fe12000c100001	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Player\Tasks\NowPlaying\InitFlags = "1"	unregmp2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup\0.map\c0485f76ce0c8d63 = ",33,HKCU,SOFTWARE\\Microsoft\\Internet Explorer\\Main,DisableScriptDebuggerIE,"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup\0.map\bada9b0c46ef6d92 = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\EscDomains\\microsoft.com\\*.update,http,"	ie4uinit.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\EventLabels\ShowBand	ie4uinit.exe
Key created	\REGISTRY\USER\.DEFAULT\CONTROL PANEL\\COLORS	regsvr32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\Images\ID-1 = "4XAFA8BUg/E0gouOpBhoYjAArADMdmBAvMkOcBAAAAAAAAAAAAAAAAAAAAAAAAgUAEDAAAAAAIQW0rCEAcVauR2b3NHA8AACAQAAv7r76UoGCkF9qoCAAAgiCAAAAAQAAAAAAAAAAAAAAAAAAAAAXBQaA4GAkBwbAcHAzBAAAYBAGBQMAAAAAAg76QBLQAwVlJGA0AACAQAAv7r76goGurDFsoCAAAAjOAAAAAQAAAAAAAAAAAAAAAAAAAAAXBQZAIGAAAgEAgFAxAAAAAAAM6ThDBBAXFETMBVQ+FDAAAEAIAABA8uvurDFswoPFOkKAAAAN6AAAAAABAAAAAAAAAAAAAAAAAAAAcFAhBAbAwGAwBQYAAHAlBgcAAAAYAQ2EEDAAAAAAwoPFOEEAcVauR2b3NHA8AACAQAAv7r76QBLM6jkDpCAAAwkOAAAAAQAAAAAAAAAAAAAAAAAAAAAXBQaA4GAkBwbAcHAzBAAAYBAHSAAAABAv7bAAAAA1RAAAEHBAAQMTB1UFUdzVzpLbAxkXiAArwS+uGCAAAAEAAAAAsEAlBQeAoDAQBQSAQEAAAwEAAAAkBAAAk3AAAAFAAAAAMEAvBgbAQGApBAdAkGAvBgbAAAACBAAA4BAAAAcAIHAvBAcAQDAyAQOAQDA5AgNAcDAyAQOAUDAAAAAA8yAAAwEN+WEeARpPRI1/LYe4kRNAAAAAEAAAAwCAAAAJyV8SdhWhj0uNb0o4zJfCDAAAAA4a9cQadvBI17hZdc2k4YukBAAAsAAAAwHAYAAAAgKA4CAqBAcAcGAAAAAAEAAAAAAAAQicFvUXoV4ItbzGNK+cynwAAAAAAuWPHkW3bAS9eYWHnNJOmLZAAAALAAAA8BAHAAAAoCAuAgaAAHAlBwZAAAAAAQAAAAAAAAAJyV8SdhWhj0uNb0o4zJfCDAAAAA4a9cQadvBI17hZdc2k4YukBAAAsAAAAwHAYAAAAgKA4CAiBQbAAHAAAAAAEAAAAAAAAQicFvUXoV4ItbzGNK+cynwAAAAAAuWPHkW3bAS9eYWHnNJOmLZAAAALAAAA8BAGAAAAoCAuAAZAkGAiBAAAAAABAAAAAAAAkIXxL1FaFOS72sRjiPn8JMAAAAAgr1zBp19GgUvHm1xZTij5SGAAAwCAAAAfAgBAAAAqAgLAAHAuBwZAAAAAAQAAAAAAAAAJyV8SdhWhj0uNb0o4zJfCDAAAAA4a9cQadvBI17hZdc2k4YukBAAAsAAAAwHAYAAAAgKA4CAnBQaAYGAAAAAAEAAAAAAAAQicFvUXoV4ItbzGNK+cynwAAAAAAuWPHkW3bAS9eYWHnNJOmLZAAAALAAAA8BAHAAAAoCAuAgaAYGApBgZAAAAAAQAAAAAAAAAJyV8SdhWhj0uNb0o4zJfCDAAAAA4a9cQadvBI17hZdc2k4YukBAAAsAAAAwHAYAAAAgKA4CAqBAcAUGAAAAAAEAAAAAAAAQicFvUXoV4ItbzGNK+cynwAAAAAAuWPHkW3bAS9eYWHnNJOmLZAAAALAAAA8BAGAAAAoCAuAAdAkGAmBAAAAAABAAAAAAAAkIXxL1FaFOS72sRjiPn8JMAAAAAgr1zBp19GgUvHm1xZTij5SGAAAwCAAAAfAwBAAAAqAgLAQHApBgZAYGAAAAAAEAAAAAAAAQicFvUXoV4ItbzGNK+cynwAAAAAAuWPHkW3bAS9eYWHnNJOmLZAAAALAAAA8BAGAAAAoCAuAwdAQGAwBAAAAAABAAAAAAAAAQdAAAAUAAAAAwSAUGA5BgOAYEANBAVAkEAEBAAAgAAAAgTAAAA7BANAEDADBgRAUDABBQRAADAtAgRAcDA1AQQA0CA0AAOAADA2AQLAIEAEBAOAcDAtAQNAkDADBwNAQEA5AgMAQDA4AQRAIEA5AQfAAAAAAwKAAAAKAAAAAgTAEGAtBQZAAAAIAAAAABAAAwVAkGAuBAZA8GA3BwcAAAAbAAAAoAAAAAAUBQeAAHAlBAAAMBAAAAAAAAAAAAAAAAAAAgFAAAA"	regsvr32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "145"	regsvr32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005 = "Desktop Gadget Gallery"	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\Appearance\New Schemes\0\Sizes\0\Color #2 = "16711680"	Explorer.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{a951de81-3ad3-11ef-af8e-ee5017308107}\	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\AcceptedPrivacyStatement = "0"	unregmp2.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000c448cd809de4da01	Explorer.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\RTSP	unregmp2.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\.Default	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\Shell Icon Size = "32"	regsvr32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Services\	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591 = "Windows Easy Transfer Reports"	Explorer.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Appearance\New Schemes\Current Settings SaveAll\Sizes	Explorer.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Mail\WinMail = "1"	WinMail.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\MediaLibraryCreateNewDatabase = "1"	unregmp2.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\TooltipAnimation\DefaultApplied = "1"	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE UserData NT\RegBackup	ie4uinit.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Document Windows\y = 00000000	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Colors\Background = "0 0 0"	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Mail\LastRun = 843c9d849de4da01	WinMail.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\International\Scripts\30\IEPropFontName = "Microsoft Yi Baiti"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Setup\CreatedLinks\AppName = "%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe"	unregmp2.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\FaxLineRings\.default	Explorer.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\OpenWithProgIds	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\PreferExecuteOnMismatch = "1"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\OpenWithProgIds\WMP11.AssocFile.AVI = "0"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m3u\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/3gpp2\Extension = ".3g2"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpeg	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4v\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wms	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mms\shell\open\command	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v\OpenWithProgIds\WMP11.AssocFile.MPEG = "0"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wm	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\DefaultIcon\ = "shell32.dll,40"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\PreferExecuteOnMismatch = "1"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpeg\CLSID = "{cd3afa76-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.asx\MP2.Last = "Custom"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADTS\MP2.Last = "Custom"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.snd	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.wms	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mp3\Extension = ".mp3"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf-plugin\CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl\Extension = ".wpl"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.MOD\MP2.Last = "Custom"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpe\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\PreferExecuteOnMismatch = "1"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.midi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wpl\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-wav	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\OpenWithProgIds\WMP11.AssocFile.3GP = "0"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\OpenWithProgIds\WMP11.AssocFile.WMV = "0"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mod\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-msvideo	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wma\OpenWithProgIds\WMP11.AssocFile.WMA = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpeg\Extension = ".mp3"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.au\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mp4\CLSID = "{cd3afa7c-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmd\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.wmv	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-mpeg2a\CLSID = "{cd3afa89-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.wm	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aifc\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ts\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.avi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\shell\play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mp3	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.aac	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/basic	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/avi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wax\OpenWithProgIds	unregmp2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2980	chrome.exe
2980	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2164	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	firefox.exe
Token: SeDebugPrivilege	988	firefox.exe
Token: 33	3600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3600	AUDIODG.EXE
Token: 33	3600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3600	AUDIODG.EXE
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: SeShutdownPrivilege	2980	chrome.exe
Token: 33	3540	chrome_installer.exe
Token: SeIncBasePriorityPrivilege	3540	chrome_installer.exe
Token: 33	3216	chrome_installer.exe
Token: SeIncBasePriorityPrivilege	3216	chrome_installer.exe
Token: SeShutdownPrivilege	3476	LogonUI.exe
Token: SeShutdownPrivilege	3476	LogonUI.exe
Token: SeManageVolumePrivilege	2204	WinMail.exe
Token: SeRestorePrivilege	3828	ie4uinit.exe
Token: SeRestorePrivilege	3828	ie4uinit.exe
Token: SeRestorePrivilege	3828	ie4uinit.exe
Token: SeRestorePrivilege	3828	ie4uinit.exe
Token: SeRestorePrivilege	3828	ie4uinit.exe
Token: SeRestorePrivilege	3828	ie4uinit.exe
Token: SeRestorePrivilege	3828	ie4uinit.exe
Token: SeRestorePrivilege	1676	rundll32.exe
Token: SeRestorePrivilege	1676	rundll32.exe
Token: SeRestorePrivilege	1676	rundll32.exe
Token: SeRestorePrivilege	1676	rundll32.exe
Token: SeRestorePrivilege	1676	rundll32.exe
Token: SeRestorePrivilege	1676	rundll32.exe
Token: SeRestorePrivilege	1676	rundll32.exe
Token: SeManageVolumePrivilege	3796	WinMail.exe
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE
Token: SeShutdownPrivilege	2164	Explorer.EXE

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
988	firefox.exe
988	firefox.exe
988	firefox.exe
988	firefox.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2980	chrome.exe
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
988	firefox.exe
988	firefox.exe
988	firefox.exe
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE
2164	Explorer.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3688	mspaint.exe
3688	mspaint.exe
3688	mspaint.exe
3688	mspaint.exe
3248	WISPTIS.EXE
1528	SnippingTool.exe
1196	wordpad.exe
1196	wordpad.exe
1196	wordpad.exe
1196	wordpad.exe
1196	wordpad.exe
2204	WinMail.exe
3796	WinMail.exe
2164	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 2504 wrote to memory of 988	2504	firefox.exe	29
PID 988 wrote to memory of 2404	988	firefox.exe	30
PID 988 wrote to memory of 2404	988	firefox.exe	30
PID 988 wrote to memory of 2404	988	firefox.exe	30
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 2864	988	firefox.exe	31
PID 988 wrote to memory of 1008	988	firefox.exe	32
PID 988 wrote to memory of 1008	988	firefox.exe	32
PID 988 wrote to memory of 1008	988	firefox.exe	32
PID 988 wrote to memory of 1008	988	firefox.exe	32
PID 988 wrote to memory of 1008	988	firefox.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://whatismybrowser.com/"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://whatismybrowser.com/
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.0.1814219838\509376916" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b1d1c50-921b-44fd-9625-19d685a2de72} 988 "\\.\pipe\gecko-crash-server-pipe.988" 1316 f3f4e58 gpu
    3⤵
    PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.1.1280846168\1582372075" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cf5c348-886f-4b0f-97d2-6ffc740d2d7f} 988 "\\.\pipe\gecko-crash-server-pipe.988" 1512 f30a258 socket
    3⤵
    - Checks processor information in registry
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.2.1270571031\1408495869" -childID 1 -isForBrowser -prefsHandle 2080 -prefMapHandle 2096 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c18d060d-e07a-4b3d-ab20-50c6f0013d4b} 988 "\\.\pipe\gecko-crash-server-pipe.988" 2072 19fba658 tab
    3⤵
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.3.1646936743\1693047524" -childID 2 -isForBrowser -prefsHandle 2888 -prefMapHandle 2884 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17dda5b7-6873-4758-9ce9-00b91d6be5f0} 988 "\\.\pipe\gecko-crash-server-pipe.988" 2900 d62258 tab
    3⤵
    PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.4.1933390198\1100016403" -childID 3 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48f8465f-8668-467d-829a-66bdeee9542d} 988 "\\.\pipe\gecko-crash-server-pipe.988" 3668 1dafb258 tab
    3⤵
    PID:2288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.5.1269943585\1707975254" -childID 4 -isForBrowser -prefsHandle 3832 -prefMapHandle 3836 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07cc02cf-4273-4797-998d-8ea86504ae3b} 988 "\\.\pipe\gecko-crash-server-pipe.988" 3816 20ec4d58 tab
    3⤵
    PID:992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.6.822778579\1439100178" -childID 5 -isForBrowser -prefsHandle 3860 -prefMapHandle 3920 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14b92831-b6b4-4a74-a089-b8ab4471d0db} 988 "\\.\pipe\gecko-crash-server-pipe.988" 3900 20fa4558 tab
    3⤵
    PID:468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.7.654847467\1547938557" -childID 6 -isForBrowser -prefsHandle 4356 -prefMapHandle 4352 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b960522-63d9-4bb3-a695-7d8db2a74bdb} 988 "\\.\pipe\gecko-crash-server-pipe.988" 4368 22b93158 tab
    3⤵
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.8.808398526\144931798" -childID 7 -isForBrowser -prefsHandle 4500 -prefMapHandle 4504 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6641379-ac65-4a98-9c5a-6ce73311973f} 988 "\\.\pipe\gecko-crash-server-pipe.988" 4488 22560a58 tab
    3⤵
    PID:1708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.9.1216393914\768465947" -childID 8 -isForBrowser -prefsHandle 4608 -prefMapHandle 4612 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9375367-8de2-4fa5-bfe5-0d5df2e4f645} 988 "\\.\pipe\gecko-crash-server-pipe.988" 4596 22561058 tab
    3⤵
    PID:756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.10.1231174329\645165015" -childID 9 -isForBrowser -prefsHandle 3784 -prefMapHandle 3796 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4b3746e-c941-4909-b8d9-168dd5b72843} 988 "\\.\pipe\gecko-crash-server-pipe.988" 3764 22a23e58 tab
    3⤵
    PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.11.726725898\1828649460" -childID 10 -isForBrowser -prefsHandle 4568 -prefMapHandle 4476 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c12d749-7c57-47a5-806d-49f6e45e3ee7} 988 "\\.\pipe\gecko-crash-server-pipe.988" 4392 21052358 tab
    3⤵
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.12.925204627\1171616031" -childID 11 -isForBrowser -prefsHandle 4536 -prefMapHandle 4524 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {782a3ecf-c46b-4490-b270-c8efebc7d781} 988 "\\.\pipe\gecko-crash-server-pipe.988" 4552 22560d58 tab
    3⤵
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.13.478935637\1577751115" -childID 12 -isForBrowser -prefsHandle 4524 -prefMapHandle 4176 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4de7d792-2a23-458a-a302-4b5a507af9c5} 988 "\\.\pipe\gecko-crash-server-pipe.988" 1848 1c0f0d58 tab
    3⤵
    PID:3120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.14.732878436\879527026" -childID 13 -isForBrowser -prefsHandle 3960 -prefMapHandle 3972 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {233209a3-dc24-4c8d-a238-e37e735cc81b} 988 "\\.\pipe\gecko-crash-server-pipe.988" 3956 1cd66358 tab
    3⤵
    PID:3124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="988.15.231663606\223297721" -childID 14 -isForBrowser -prefsHandle 3400 -prefMapHandle 3076 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91aa1654-9584-4aac-b6ae-5f81017406d4} 988 "\\.\pipe\gecko-crash-server-pipe.988" 3388 1d13be58 tab
    3⤵
    PID:2684

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1220
- C:\Windows\System32\sfc.exe
  sfc
  2⤵
  PID:1744

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3688

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1816

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3884

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x160
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:1612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6219758,0x7fef6219768,0x7fef6219778
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2124 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2136 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2476 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2588 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1156 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:2
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1404 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:1
  2⤵
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3820 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:8
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4364 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
  2⤵
  PID:2924
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140377688,0x140377698,0x1403776a8
    3⤵
    PID:2964
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
    3⤵
    PID:3532
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140377688,0x140377698,0x1403776a8
      4⤵
      PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3352 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3100 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3012 --field-trial-handle=1252,i,14849028251323106320,13695470763300823374,131072 /prefetch:8
  2⤵
  PID:1364

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2252

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
- Drops file in Program Files directory
PID:4088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Program Files directory
PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6219758,0x7fef6219768,0x7fef6219778
  2⤵
  PID:932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Program Files directory
PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6219758,0x7fef6219768,0x7fef6219778
  2⤵
  PID:3272

C:\Windows\system32\mstsc.exe
"C:\Windows\system32\mstsc.exe"
1⤵
- Enumerates connected drives
PID:3792

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 332 -s 324
  2⤵
  PID:1656

C:\Windows\ehome\ehshell.exe
"C:\Windows\ehome\ehshell.exe"
1⤵
PID:2804
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 556
  2⤵
  PID:3900

C:\Windows\system32\StikyNot.exe
"C:\Windows\system32\StikyNot.exe"
1⤵
- Adds Run key to start application
PID:2212

C:\Windows\system32\SnippingTool.exe
"C:\Windows\system32\SnippingTool.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:1528
- C:\Windows\SYSTEM32\WISPTIS.EXE
  "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3248

C:\Program Files\Windows NT\Accessories\wordpad.exe
"C:\Program Files\Windows NT\Accessories\wordpad.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:860

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL desk.cpl,Advanced,@Advanced
1⤵
- Modifies Control Panel
PID:2336

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL desk.cpl,ScreenSaver,@ScreenSaver
1⤵
- Event Triggered Execution: Screensaver
- Modifies Control Panel
PID:1324
- C:\Windows\system32\ssText3d.scr
  C:\Windows\system32\ssText3d.scr /p 393450
  2⤵
  PID:3212
- C:\Windows\system32\ssText3d.scr
  C:\Windows\system32\ssText3d.scr /c:196664
  2⤵
  PID:3876
- C:\Windows\system32\ssText3d.scr
  C:\Windows\system32\ssText3d.scr /p 393450
  2⤵
  PID:1740
- C:\Windows\system32\ssText3d.scr
  C:\Windows\system32\ssText3d.scr /p 393450
  2⤵
  PID:2344

C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\chrome_installer.exe
"C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\chrome_installer.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3540
- C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe
  "C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\CHROME.PACKED.7Z"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4020
- - C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13f857688,0x13f857698,0x13f8576a8
    3⤵
    - Executes dropped EXE
    PID:2144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    PID:3896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6219758,0x7fef6219768,0x7fef6219778
      4⤵
      PID:3892

C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\chrome_installer.exe
"C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\chrome_installer.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3216
- C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_250F0.tmp\setup.exe
  "C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_250F0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_250F0.tmp\CHROME.PACKED.7Z"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:916
- - C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_250F0.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_250F0.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13ffe7688,0x13ffe7698,0x13ffe76a8
    3⤵
    - Executes dropped EXE
    PID:2448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Program Files directory
    PID:3596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6219758,0x7fef6219768,0x7fef6219778
      4⤵
      PID:2624

C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe
"C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3812
- C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe
  "C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13f857688,0x13f857698,0x13f8576a8
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  PID:448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6219758,0x7fef6219768,0x7fef6219778
    3⤵
    PID:2580

C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe
"C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760
- C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe
  "C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13f857688,0x13f857698,0x13f8576a8
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Drops file in Program Files directory
  PID:3644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6219758,0x7fef6219768,0x7fef6219778
    3⤵
    PID:3240

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1528

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2424
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "143985620-21318569131235682051-1147071053-782900151693683493-1953842613-1163495262"
  2⤵
  PID:2560

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2472
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\system32\sethc.exe
  sethc.exe 211
  2⤵
  PID:1220
- - C:\Windows\system32\userinit.exe
    userinit
    3⤵
    PID:584
  - - C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Windows\System32\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
        5⤵
        Drops desktop.ini file(s)
        Modifies data under HKEY_USERS
        
        PID:3448
    - - C:\Program Files (x86)\Windows Mail\WinMail.exe
        
        "C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE
        5⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3752
      - C:\Program Files\Windows Mail\WinMail.exe
        
        "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2204
    - - C:\Windows\System32\unregmp2.exe
        
        "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
        5⤵
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops file in System32 directory
        Modifies Internet Explorer settings
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:3740
    - - C:\Windows\System32\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
        5⤵
        Drops desktop.ini file(s)
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3392
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
    - - C:\Windows\System32\ie4uinit.exe
        
        "C:\Windows\System32\ie4uinit.exe" -UserConfig
        5⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828
      - C:\Windows\System32\ie4uinit.exe
        
        C:\Windows\System32\ie4uinit.exe -ClearIconCache
        6⤵
        
        PID:3068
      - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36
        6⤵
        System Binary Proxy Execution: Rundll32
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
      - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m
        6⤵
        Modifies data under HKEY_USERS
        
        PID:2432
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        7⤵
        
        PID:2652
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        7⤵
        Drops file in System32 directory
        
        PID:332
    - - C:\Windows\System32\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
        5⤵
        Modifies data under HKEY_USERS
        
        PID:1060
    - - C:\Program Files\Windows Mail\WinMail.exe
        
        "C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE
        5⤵
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3796
    - - C:\Windows\System32\unregmp2.exe
        
        "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
        5⤵
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops file in System32 directory
        Modifies Internet Explorer settings
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:1532
    - - C:\Windows\System32\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
        5⤵
        Drops desktop.ini file(s)
        Drops file in System32 directory
        
        PID:3704
    - - C:\Windows\System32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install
        5⤵
        
        PID:2160
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
        5⤵
        
        PID:3528
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13fb97688,0x13fb97698,0x13fb976a8
        6⤵
        
        PID:976
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
        6⤵
        Modifies data under HKEY_USERS
        
        PID:1684
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13fb97688,0x13fb97698,0x13fb976a8
        7⤵
        
        PID:3544
    - - C:\Windows\SysWOW64\runonce.exe
        
        C:\Windows\SysWOW64\runonce.exe /Run6432
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
      - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2328
    - - C:\Windows\system32\wuapp.exe
        
        "C:\Windows\system32\wuapp.exe" startmenu
        5⤵
        
        PID:3488
    - - C:\Windows\system32\mspaint.exe
        
        "C:\Windows\system32\mspaint.exe"
        5⤵
        
        PID:1068
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:1656

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:2960

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:1512

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Screensaver

T1546.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Screensaver

T1546.002

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_250F0.tmp\SETUP.EX_

Filesize
1.5MB

MD5
3f1c927a16ac6a149fda42546775b26c

SHA1
004326d11019a0aca62b463598aa20c6a74484c4

SHA256
5c99458ed3ba4cfa42a9e1c48e2ae5f71e0d060a7c63e4fd88445e9680c29362

SHA512
7330b87ab5f465421e8d32080e80fe80165467e99beb3e4651aa4b4905d572cbd119b9745326e29ce170c8d6193a684a1e3e30623b2101d56c5f579262807563

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\ae2c11a9-ab74-4886-93a3-dce6f33f1926.tmp

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Program Files\Google\Chrome\Application\debug.log

Filesize
372B

MD5
cdc062b0533e88c45de2e420163f9dc5

SHA1
b15af3d7c41e24d3b295dd511f5474f8afef3bc6

SHA256
fe60953975418808bffc83bcb47d82a72dd01bfe4985af5f70159bfc63e43056

SHA512
e5220a48ec062f48105bb3dd5130e919bc11e93d12987e13a699906c343be129badf44c4ff241fb57d454ba749d7bf769e0d190a985be0ab1cb73395724ae384

Download Submit
C:\Program Files\Google\Chrome\Application\debug.log

Filesize
558B

MD5
204584cd5a3da3c35b1332b6a4b4289b

SHA1
4c31daff52a6f0a2878921caad0d47b7ff9f34ac

SHA256
ff2d248bfe406bb50f90dc694f2af5c9080bf40af338d9cbbdbd72cf2830d189

SHA512
51d10705485bc5dec5a829c3b103b9671a1ba451bb4f43c232f6885c21b69e6bcbd269247d72dd657a99660bd80dcb788d37aea1fbfdca2fc9ca883a204b8520

Download Submit
C:\Program Files\Google\Chrome\Application\debug.log

Filesize
744B

MD5
28c592c42728862916bb18e78a404078

SHA1
fd5c9bfe8c481ded02692c339fac038baa5a0fbc

SHA256
9f9ca9dd212d48eb3af2aa354f975f4dacab3e1fb38f22c2674f3fa8f2864c1b

SHA512
2c6be756e65a382e2eee810b55182c7ec5cc44e1a033afb1ae650e622b50de14525101d5735322015422e3b7ec0990e10d31aa95927d0bd8584a71439b24820c

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini

Filesize
964B

MD5
46a4eca2a791d84afecfd9f129a567df

SHA1
004f2926d9377cc23c5b68ce26907435b8539643

SHA256
06b6d34db7e9ebecc07e0b53fedb2a9bc2d4563b1d2037b7630fbc002942baf7

SHA512
dbeecf882210add0dd4ac57f75ccdf6a9604c3308e92f70747313f89a7f9c590f4e1cdd507e53ee37e0a1b7e437320dc6ec1299d406ef34ddd67dfd900fddd98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\662cb8d2-0c8a-4ccc-96c7-5424afb8e094.tmp

Filesize
159KB

MD5
ef40e469bb46d64967ab90bfacc5eeab

SHA1
75b510a442f6166d0146effabfd9c3f9c98b7ff3

SHA256
0f6f2e92ff5216632d51218cad3dbd29ddb7a38c0607ddfbc627571add49101e

SHA512
6219c544ddd5de47b6f8a01353005319a2cc6bdda5c6d04677a515fa6b90237af1bd10d3038887cf599646d2ec41152c7292ad0da060f51ca6d5c1a1c1e53a9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
8d60a9d64f0bfc068d4be41f916699ea

SHA1
f2a043066eb49db7d051711f8efad80600febabe

SHA256
88ec1b4b371a7fdd0c2827f6b7153ace6b37aa8061e9a4952e45ed2dd20f8a43

SHA512
cdc8524f632e0fbb7f0a0bc69bbf089fcc6dc682f75af8faa9274312c54fdb13feb43f4dcb357c79b6a70dae806287e124610c2ab14f84899dd5c4b8e7210ac2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\feed87b3-7427-495f-8282-d00d6ad9a742.tmp

Filesize
193KB

MD5
ef36a84ad2bc23f79d171c604b56de29

SHA1
38d6569cd30d096140e752db5d98d53cf304a8fc

SHA256
e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

SHA512
dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
dfc9e9ccc42722b8a47d401cd2fe3ed9

SHA1
885f6987ce264e4e3d1d793f51a13d6b6deefb23

SHA256
9dada48c7bf044d66fcf6ea3d0ade2bdf7b9424843345e14b2eb92c690638e4b

SHA512
31a50c341b31413d158235976da5a1bfb8e92cf1ccd533e753ddfaa41e30e4928b56325b663e73c4fda116377d8838c29b2ac508b46f9718164275259b2097e0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\13369

Filesize
8KB

MD5
2fcc10fe94f630aca4e8909552f2df7a

SHA1
322cd227e555f79454d5893db9074968e2b68c7e

SHA256
989340520419417e8f3f457c40821954ed747e4a6d6cd21ed559cb2cfb07da70

SHA512
abace5582755bda67edcaf0960ca994e9e816670a8e5dcc89fc58cf4cbde887ec56403b2273c5642df2fe0b1c41a7703828f11ffc93573b4118d4fb72d0414b6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\13460

Filesize
19KB

MD5
41acdd11cd5e64df69d68cc735b223d6

SHA1
983ab59293f1070bea991014d11505240a04d622

SHA256
2b42e679c616abcd4e6bb41bf12c57d1796347c7ed8ebc70b90c2f8433861bd6

SHA512
9beb2f38e464b9a5c161f55a1622aff121ec20b20c4fca4ad1d4b522777ab73c93819f30083c291e096716d9a35e0ebfa80aae0eba7c132092e3120c7556086a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\14468

Filesize
10KB

MD5
f971e280c71b22228464a33614c9aa30

SHA1
ff6d33a63200fc3b59c2178dfd5abc24df3fce2c

SHA256
a3ef20d077e90c45fa3a7cf1e4268f0d58c8419032c1b749114f39e530e1b1f6

SHA512
b283ff9308547d87dfa39c070a3986c30a56c11d1d053a29d54b9d54016b12c94138c0503da85673a4ccb661f837622d35577144c2226804001ede56c5204db1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\16352

Filesize
14KB

MD5
501306d5f2c04ce1ce864cb24d0b2403

SHA1
8f9d84466d6e92b5e6be3a774b5c75145453d2b3

SHA256
25c748533820d8f9a7f9af4094665b9e26a120fb3ba0e49b63faec7e7a988332

SHA512
a6affee1ff94aa2d271e4ef84a3be43ae2f07a00c428c3578902dafea54312860ce3f7f812a5e7a897d63b8d54b379e6e4ef15637ebef19eeda952673c5238d9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\16976

Filesize
9KB

MD5
f20e0ca62a8fca9b0bacbf3c33837f6d

SHA1
f79c6415a4299b9033bcafb4f63179048d441d11

SHA256
f5ee2ebb6f03f9f77cd9eecde0180971a2b9827833529e86537784acc0c65be2

SHA512
3fa147fed7d815a35881cb6f4d83c1966699fe2e8dad66bdfad2e7ecdeb006a01501a9c37214cd92c41381c4263cb18c33f77e3d38302fcf9368defd0a825e80

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\1800

Filesize
14KB

MD5
fde44ee62cfada62f2432aeb1d68c77d

SHA1
e57ab90bbb3dcc890be8b9bd920d7ffde070c631

SHA256
5c2b050d68e871c27cde64eeb2ed352a2350f637b49294fbb059faf8e84c928b

SHA512
5529f04a12712a86cd03916ea3af3bd0f78b30d9401ad65db5074b2b4cdb622abce59249cf2b83d3464dec3dc8a2bc92dc2e9e5c6cf5953c5c640b41a5c450d2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\20094

Filesize
9KB

MD5
8fb4098cc73b0973df2d3f54eee67430

SHA1
b719289762f6b5ff3cf619964cf99485d12fb60e

SHA256
5f52c3c71f85fd8adf8e439c71bf7c610fc53ba8e85c2a0c39f1972c4638f41f

SHA512
170995dde3529a80464dcc2dcb33a8bc2360f84f751b42a5f76bd834ccfcf3ee7372356199732d1934076f6fc669515eda6a851875832f9f49c454778f3404cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\20242

Filesize
10KB

MD5
a2c09b2f8506eaacc3c1bec90e644c07

SHA1
ea7b62d557141af8054bee180043413a89f2f32f

SHA256
2dd0479aee4c05e81289b5b5e04164e59021ed53659ab82f74547f66e0ec8c31

SHA512
158ab70fa1b79df8571f531988ad43f592f0efa90895a335f308881bec86a4b18e8d151ecae999099973e607f848ea28f6cbd15d3d62f05e4c5b7126fd7c128b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\22806

Filesize
10KB

MD5
aa0a2e36697770fcd1a02f3e0a05380c

SHA1
b20b23357979cce4151b98419b0460f64797819c

SHA256
6394f92d51ad7fb987b1f73c0aa351596b70d1b0f0188a55762de364d09e6326

SHA512
5f43a26cbf52159f66efa7034514090451b9039d7cf6509fe73ba70a42e286b3e501d7cb19b7fc400d5057131ada2703d4ec602ecfd96e43052f4cfad73256fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\29017

Filesize
9KB

MD5
45ddee87f5aed43bf5e73d2628b84056

SHA1
110d4b5303426d342a03ef35782730defc60e1f4

SHA256
1bd4c5e5df60366f8d1ed5fd2560db7e0f7090abab8a0445fb1fc1aee78f65cd

SHA512
92517404162602b56ae80551b25e053274210e91f684d434e62bf06bbc661cc9be89ddfc3e7cb2b8b84f12c2da5200640703b32416cae74264d812b7b0022713

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\29047

Filesize
21KB

MD5
c771daad052c388583774392127bd5eb

SHA1
43a6f20cbb07999b340326c6244e611c5593dfbb

SHA256
b29bf69809a33ceb18e97bff2733ec66814c4641e0edd7f8ccebd0482b7dc129

SHA512
8ba42183eee3b78846f88bb196577bd7fa5604390636b5438f9dc36df3e36ceecf3914ea10154a7bbc7d3a32cd62f399d2bd40e7857e2b2dcc632a20efda3828

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\29948

Filesize
8KB

MD5
75a3c4dbddee0b8b5f9566fdeb728b71

SHA1
e846bceb78e2548536b616434d88da18668cd2d9

SHA256
01982296081123322f4297095088cfe70c6bd2da65d1cba4cdd6f0ba98c85464

SHA512
c6ff845f4c4fdb557fd318da83aa2dcc0fac3c9f696505a6fddea79eb0f36ab06e656ebb9617fcaea0cb82b40e54290f30f927a092e656d246d907bb1f6ef5c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\29969

Filesize
8KB

MD5
d55d1b34103f3681c6ba1d979db1d3f7

SHA1
e02313e63166573e1903e85a3611d099cbdca62f

SHA256
55a835833b17df19b287d136c4759b4868bc2ab59fa82ad6a1b47e82184a46b5

SHA512
7573f4d2f4b4240a5c341422ff8db7d7942a42d5145adf975ad932fbc699387009e6c57d49e2b8494605b91c8d4ba6d0bee819a4653497d0c8c632065c2810b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\30146

Filesize
14KB

MD5
0270246c358c7ec520887359a6848f8a

SHA1
f39a38578af2442ecb283ea9de5f9d321747d3c9

SHA256
af79f2f9f0980408d331ee737233434c964ed562de24ff2fdf82b4d188c69066

SHA512
cd689a19c68439db3b7db1682e53c3c002c3b3d7e78435df679bc316a90d697705bf44deebf63f14d32eaedd7da265749bc1895675835d8c7a199cd48092f2b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\30537

Filesize
8KB

MD5
ce94cf220add1108d8f0db33700cf071

SHA1
5ffae23f1fb02b8d59df628b6a3b4fce0616dcc0

SHA256
937fb5893cce7b3afe70c31fdde63a13e63ece9970c1a7f50fa83c030aabc3a8

SHA512
54b2cb19850d1bec1278b899a7e52b773ca6a2d281420015a0a62eaf1e58231976a3a3cb3fa8d21471a69b9f9862f15adf9404c989e76e36a112e544cdb38180

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\3236

Filesize
8KB

MD5
560aa932371063d2df2d65bf3aa85489

SHA1
1fcd6c257097965cb0cd3655569e254069acf1b2

SHA256
1d1692c65b20bbe07024cac85034cc39c7d3ae4718a1276ccb5f3e86dbc670ab

SHA512
e5365e63eec14ac89260d3d27ad87f72681851d6f6fbfc7ccb20dd2a0fddb82d8d11d66ed1b12344ecac791dc1def90780fac074212ff6b582ed9006c86d03b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\8031

Filesize
21KB

MD5
9ebcd1381572c8142a74cf74625e292c

SHA1
5514fc4f86c04bc076ee59ad88e678dd6cc1b449

SHA256
eb271d25a410fdd94797d6fc9f1b655c200b51faa6cc134199bdba5f143a11f1

SHA512
b37436d73b1caf8a31431bb4067869bf2679aeb29655f3e42f24593b2e72d6e4fa64c5cb202c6fd1356626cd75dd93a4bde1c6c0a9a95f2fa5fd345d8b08fd14

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\9130

Filesize
14KB

MD5
cbe13dfc8c4d5aa5ef2ac5977320dbaf

SHA1
fe3bf30d236a178bac9a1645d03ad82260c20dd9

SHA256
0b7b8abe061bcc22d22ad3642f12a0ca782dc05aa556f9239cbb53b0ed4bed68

SHA512
ba77e202fbc5ba0fd587a726c869f8a65f48279946250546916c0708fccaba2473ccda31154b6ce106a79b82c29db6218268870e009542193ede08c8c7cf796e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\doomed\9805

Filesize
8KB

MD5
831a3dac0cfd14877584b6b23c9b056a

SHA1
add60e821f4e66adf9a4344c02827945816b5af3

SHA256
d221c6bfc7eeed81e3e53c3668a02da20f5e655ebe0092256d7317702aaf87af

SHA512
dffa3008eba75553710875525ca0f644df15b685e7c3f61dda3b3186755bcff32e4e4cac24c7c649685f3d67c7b5a3009d5ab20e483710af0d5244ff5abab37f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\2DA6B5AEA4C3411F4B446CB5BB170D5409ACA592

Filesize
16KB

MD5
942b40662abd7c7bfd76a266a3d330bc

SHA1
780c92f07524f5c580357817fdbb7000d19fa776

SHA256
0fa34dbc1d31e78b7eed8aa7ed3aff6ab651f3614932aacac6703d268cb36110

SHA512
b9e0dfb1f03b3f57cd2b41f2a363871b8573e3736606404e2b156d769711c1a57a323fe7146b601a17eeea02ad0fcde0ff7baa61558a01b79b5de6fd29ccb862

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\2FF8669E5FF51B5EA6889BB625D63DBAD36C0ABF

Filesize
769KB

MD5
c48714c1f7a2e9c21be76d5a0cbd73d7

SHA1
57f6a7994a6294b30fce3c8917d077edd192fcc8

SHA256
f54e0ceae6968d6f8f553136ae785fd2b62c29fe547625cd93f887f7b2cb04d0

SHA512
7b0803080aabb72bb15b73d60d7f723cc47eb2b8d4e0296015589135038d5e7a788d1f5b9746017b461a5f7f25959afe466a62681e8eccf93b66525f87292681

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\33C255A10998AF2ADC8A08BE9F72C4A97EDF6430

Filesize
13KB

MD5
42b80d42ee4d93f4c6c90aca2e903976

SHA1
973d476f67b83928799d42c49376be358b6ac445

SHA256
57cab4940b5b75011e9a688f0fe980a722be2006a387c1fa882d8cf9aef0bdfb

SHA512
ec83a83e90db91a12aacedc18420792fa31840fb4d9358b6f4e7cdf4dc59e4c5296d40825b0815224db515c08f40b00ded078e34f0b328856c08770400fdc288

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\4CD415EB3C9754AD7472B50D58AA56FD065939E1

Filesize
88KB

MD5
c9a92ccd6340b646745e5e41fb30f5d0

SHA1
31739bd3a12a7eeaec60e6cf8bf7b1a4e83b59ff

SHA256
71bfac74346bc87b5c422d1e5a7851d25d84f6957d4f2b29658dfe168139f9a1

SHA512
3f1f162210a390bc581dc56591e3b39357e17dbdbf70b2d0f94ea9e314092d51a88ea17a75240ea669a7dd36b5f16fc50524e8fdbc08a1143a2af1cae62cefd4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\4FEA857F59C3673B8BB8F6C58899A7ABC160489B

Filesize
17KB

MD5
5f465db83aaf860398ffdd58d9f15577

SHA1
a4f8325017b4e2996aeca3f44bffda1cb76e6904

SHA256
e4fb92c411640fe42ab04e38d424513c1fb4ca0777ae782eb6999a7c159c0367

SHA512
d5e452dfd115bf5f10037b7a2eb6d3cf743fe49ed2c81b9305e5f3ee80ccd02c2db19d0656790e08ed3e7636856ae25d4d7b8aa9fb49cba5b513ee869d518a64

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\577D19EB6ED4C4EB60FCF2EE46D1C9B3619FA701

Filesize
26KB

MD5
16c2cbd8b048faa3eafd38f8e6d28566

SHA1
13211d0c75bd1f9c66a05b15a4443bb260d10da5

SHA256
6885847912f2da6f03ba4852f6b2d71801958fbc5bec66daac01d55257db784c

SHA512
719b83b80e7c5d2815ee14c48bfa9ae52641b2ae986e0be9588510c8a15b5caa240c4763475a968bed4a09c0a5d496a2b9866d2258a3e564230fa028d8dd4541

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\58AC5C8ECD2B67D565F029BE9944D7148BE69A23

Filesize
62KB

MD5
d6e3ce6212af005cbcec58280f2f473d

SHA1
2a58cd7e20ee600a1c9a22e5b7f5b74c11cd7382

SHA256
20609f7137f6e52f748fc151eed8c2520000c34bec6095aae3b3acdfafd0f929

SHA512
5909ec42fc7d620233b69eae6acaeff37850472afb9ef9c21ae810472a2561c5e8cb1b29ff75b7602b760ecbbe3da9b425977cf4d14081d84461d7b45c3161bb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\5D5DD606FF7773FA604F05AA262322945835C645

Filesize
20KB

MD5
6931123c52bee278b00ee54ae99f0ead

SHA1
6907e9544cd8b24f602d0a623cfe32fe9426f81f

SHA256
c54a6c3031bf3472077c716fa942bd683119dc483b7e0181e8a608fa0b309935

SHA512
40221fe98816aa369c45f87dc62e6d91fcdb559d9756cb6a05819f1cde629e23a51803e71371f4e4f27112a09489d58ed45b2b901a5f2f00c69c082b3576057f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\68B84CB94C72B4E594A6DEB5F33E4812B93F3CCF

Filesize
8KB

MD5
2b50860f2676115b674a639d92e07024

SHA1
a284ff8ef635df341b59214d93979593e4a6ab0f

SHA256
ad247277934c599b1a4185dee592ca7a7981fbe6ff9640416a884a8fe5e4c300

SHA512
4600198fd6296ef2bb1e062c43c0622d3ed835640e43a88aac7ec6f12b305d150725277246e91a6ced2c12d08039bf4915cf32db3df92022ca6256627315c47b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\68BC2ADA259BF925235C7E6BF89FCA3B60EECD19

Filesize
60KB

MD5
78c0316f3239c601d78e710da5f0fb2d

SHA1
d427a319416d170e950e019cd0f1a68477f894de

SHA256
5ec65d7bb0d978a23b0fb4a4809c138ea326f5fbe92301ed819182741bac08b7

SHA512
7ad76fb0e2f893e4e61d1b89a47cff6c2ae432f469ceb0477918141d858c4c5858ebc1488ab8f5d742f92ce8ebc09b89da9de8b1172f4bbe30d79a7181ca2f36

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\6A0AC487910E78565D06F0D5EA8BF90A59404245

Filesize
80KB

MD5
63c39ad248ab40ae2ec0c74d84c2f19f

SHA1
4db1f894fd2490b1b096c76a301b8b40582b8189

SHA256
e66deeccb985ca5e361bcf4026901684a2061aa67cccaf062990da8014cde93f

SHA512
abe6adf3bf6a5ae6ab9c15a55f0d7e673bc6e638d281e830bf3e630967a43d1d469b0fa006fefde9c6571a7f007d0bb6e2fd53c9bb664b7ca9264bd38c5b57a5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\743230A227374A57D1C406BA4E75A7BAB39135CE

Filesize
36KB

MD5
e776ac3a4bd930d24b59edbe3e457429

SHA1
ea4e414cacfaa20a3f479bb02a63f9bee04fa03f

SHA256
bf1fb17290e17a9dcb309890865e24e0304a0cba0630858cbeec27cd9fbd99f9

SHA512
7a2b231ab408966b45039d24aab2afb63f314b91ed1a0f42fc725d7b97abad7ceb3f9342bb606a02d25e42e5259b5aaf718bee0c6d059114da55e22dd67a5057

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\B8FFA4BDF34B92097DEABBC764203895B6356D1C

Filesize
25KB

MD5
e8973d8667352f347a5f7d9ae8d0f430

SHA1
c47260215e1e7544b70ec4152c18460c12626ce8

SHA256
f31ede2f0de4a9a64aacd69d9930b4d87a49c62833dd81b879bbc9bd00a5cd69

SHA512
8a0572070788e7a47e3d3688b637d30e5094cff00d867291a6130e0db3d88a67b1ce59bd091bd8776e1c3f6a34ac17d1190ec4bc463286be2ff232cb7a655e88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\E05F68C2D6F25A133224A87F084F2508F0F7F3F8

Filesize
152KB

MD5
0925278ac6e8fc5133141b291ab43e44

SHA1
91acc743b4a618f490e1ba9f092515a398fcc7ef

SHA256
6cf06ff9369b30dbbe55f5447080c6373bb34be9215aee78f6e50f1a91047faf

SHA512
3daa90809d8ff4148320805dee38477c461fa2a87724354703c666474fe9e32bdc748ec866a4a3faaca2fe72dca5e74ff33f597c6859eb67513ea0b2b369c5c9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\EC83F3010B4B9E887991DF899B72037CBFC4D5A9

Filesize
132KB

MD5
7aa6a3992eef111288d50c6741534489

SHA1
10511e2d03abbec4da38327b04ae3a729bcf04c5

SHA256
0b08c41441aa8cad3a117a243f789b6ad8788ff020100298284191ee740891f2

SHA512
8f0a4beac3fe9c35c8bc82f1d8bc7d9b3c5af36cd5fe5c0fc40662c90618d7125666ad4f66390d68e25bd419a1e3a907ae06c6d02a860fd26dd9e9dba4837d05

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x07tfuqf.default-release\cache2\entries\F341E29C9740B6B3860265029470ED2178B588B2

Filesize
24KB

MD5
497ed128708e8e6c5c5e99457f93c7b3

SHA1
8967af8e4b56acd45b6bb1343feb16b9d542d882

SHA256
3576be865d93ae3af1f2a99de579434be4e1e31bd1296c776533123c56b98226

SHA512
85070ff45b0719c04666ffded43f8e5391ec3566b850852d37b3c8891314dadb1e3218ccae4bba62d87892ebf8fc18eaa415958d9ea6bbd2e4d093c1e329aa1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
1KB

MD5
ecb7f4e648ccd3ee858bec1dca948de3

SHA1
789aa48e3955ba09e2b80472cada4eeb5b178689

SHA256
6574b3a7c9aa07290290f089dc8c10ae3f9ed11c66efb2980453bdb8c6af85cf

SHA512
251635c7565a7cc2499131f2df4839b49ede39199c6090db9af8d74ebd34b6a0660738104930199d6cafacd98d6e40aeb55c7d699b17271d310edeef84865de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
2KB

MD5
1dcca9b7b60f838882bf9009723ca0c4

SHA1
10f234b3b7144dd4055da7bae708eea67ac698de

SHA256
0264d61a764df52c9e92dd09cd2e81912c52d5253022ea4f2fbbd53fd62dcad8

SHA512
21705f1c9f05e0c49c5cfe9f1dd00e3d97b87fdac26c854f9708588cdcda3fc9b4d10df41ca548f795e55a8d3cf09d5e329c33299e8024d472a546dc87b79778

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
3KB

MD5
ebc1104c6fc115fc1f300562a220ff44

SHA1
847d5cc5ce08d37106977498ce55177789728fe9

SHA256
07bc2b2a29304510d63df8ce7e7e731c31afd17d361344d73c286667f8ec2909

SHA512
5b1a47d6dcb041a9c85d0310364b9064cb97f5d6b96af96a55f3a8c690a5c1d0f1dc3f0fbd52a7512e51bab9fbfe085db3ef1ea69e44e606073da8700c46e2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2980_1256292237\34ee6e2c-9cd3-4f35-bc2c-465992ac9365.tmp

Filesize
88KB

MD5
2cc86b681f2cd1d9f095584fd3153a61

SHA1
2a0ac7262fb88908a453bc125c5c3fc72b8d490e

SHA256
d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c

SHA512
14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2980_1256292237\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
17KB

MD5
60bae81c1513a4cfb326d91498a59d3d

SHA1
72fb08ba1c139f2c9decb11a47ae8a2a9ff2ce35

SHA256
024ce372475a0b4ba7a40b9fec9c7387652c916eb86f7413649064988dc81676

SHA512
7eadd80aed23905c43971233f8c81b7c6917d95d5677d05b41e2e02c1ef72717a103fac1397d38697eee54860b49159312d484c58c6ec9649fa9e2afd46ce517

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
dd0d836dac2cab2f3e1ee7522e2dcb28

SHA1
c12bb45ce42da9798d19e67903b15ec40c1d8153

SHA256
620076c9ba68e52bdbdb726e82856aaedee62600bed8da68ee64b06ca83a0a7e

SHA512
90a162922b670f5c7b96d6501005d2fbb7514877acc1a1bedbfdff75f114de71354fa729896d859dff8ead586825b87f536ff39181aa70ec129d78589b582776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\pending_pings\04c275ac-d8cf-4c01-8847-f432e0eef3ca

Filesize
1KB

MD5
8e5359ffcc7225bb0dcbc7882907b73e

SHA1
f289a594b1fd7518a7c6da4255b077fcba19f7c1

SHA256
b551ac7dfdd825ba25bc351bb23f0d4360878a46d5093a97b2055ccbf398c6d2

SHA512
dcfc88e234259ec24ca02019c9d58520987657c2c3bc4bc9d39e22490400b43b22fcc5b007cd91a2ad490a97fca7a8d3ef9b70c33a107bbc55cceb8beb37ff3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\pending_pings\4a86106c-bcce-4c97-94fc-9f53958605df

Filesize
745B

MD5
febccde94f32e2850a43279f00c0a48d

SHA1
c38f71eabab429629df92839874fc8c7e15d07b0

SHA256
3477ae3594227bfadcb074b5bdd4e5a417fd5efbfb26fbdf676fbb8b670e6faa

SHA512
ce35357efe9ff5a47fef98dd0fc5dde1c8549db40f3acafa566c1d00cd2066e0ace6dc7990573607274f295476d21519c479aca328f3a8fa3d7c3b554e5ec52a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\pending_pings\a8b7f210-5ba1-4082-aac3-4606287451fa

Filesize
12KB

MD5
8d60bcaf48485cb5d9c1d15925c08c43

SHA1
848b346848763dbec02cfc6491f7a002818341eb

SHA256
eeccda67b7522b1c79575b18c2111846e0c783c4ff118515eac9afc490dfb752

SHA512
1b686a9580587c25aaf1600421c2135365aff43ea322aae112eec2fffb60d60c789bc8a097f42d05c5006da9c88af39ab1a9dc735c6b67fb619bb018acff1ac5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\datareporting\glean\pending_pings\dc61e534-7677-441e-b72f-c6643db8182c

Filesize
854B

MD5
6c9adce1bdf68a1ab3ed8f1f6bea314a

SHA1
e2ba218aa70e285f75da03bc2ca2e7879ceeb932

SHA256
2d02e7050982afdb844f91d4f34e4291b3bbd799b3da7daa04bfa4c132bc59bc

SHA512
49ad94ae6540c8e2a575b91f3d1fdeb253001cda15dc4268ed63dd91884cb72674ba961fbed3ac714348efbe3791a8f0a8b4095d9ef6e2bff45374f8491685fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\prefs-1.js

Filesize
7KB

MD5
c860a7d523e6a04c56efcfe7884e8692

SHA1
37399e327f68a812aa588d05f2beb0c0feee6ca7

SHA256
6d4f7d5499d9dbe5014f77f104b18b16bf667620678e5bec5e78795c16b1e8c8

SHA512
c32518560bd403fea0a7900e477d765edf3704f4d8968cf8a51bf5efd40ee3a2c6f6faaa90932437f796a8916372aab93c59d3a831121461f6d42bda2a320902

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\prefs-1.js

Filesize
7KB

MD5
b47ed3f56b6fc2cf6da49ac6d85da27a

SHA1
8314ce70322f81440260f50c3fa251c32d34f51c

SHA256
5e7608a4217a080bf839e3688d4a2ffa411206582c58306d98ddeb43f74c6bc5

SHA512
9c1e9f2b737031429d981c98160cac794ff2205c82e9b27e03dbeea032b04907484dcfc24d8f3853de3539f9c1d8616e5dc46956134fe4be1aea0b8d748af593

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\prefs-1.js

Filesize
6KB

MD5
a1b69ef998c95a6fa1faee1c5cbe701c

SHA1
5b03ea833b992083a160e97ec7f98d2f41392a03

SHA256
a9e454a53c9112004567bf8dfe09472d4aa373c1538babe21dcf52d5b14a439e

SHA512
4f12e5dd122ccde923132af1020bcce3c70f441fecd64201fdbf2bd3e1365b5d9e64ae81fd8c777bce0e27e3e84771f6c1856d68089c9b1a490ea9e7fca3c3f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\prefs-1.js

Filesize
6KB

MD5
73e31fa3c4540df5c505aeefdf9602da

SHA1
fa3e5df14416f1dc17d256309ab37fa58a9d3762

SHA256
f1b4573a5545ce5a1e64c86ec4c864a80af89f21b6ea96bdffc5ae9e4662c2a1

SHA512
245a08c7b02be3a0aa375797975816d8de51ff7998347c65432245e741359d84d7748c8288e9657c941cd83f8344fd97de8107fa1bae3f6260a23ef66d1f1ad6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
8547af5041fd037f94bfba82b4fc090e

SHA1
22587e77901a50fce9cd34d4c72de5d9f44e95de

SHA256
6d303a33fda3918629c292c6c16e97dfce997820dc270ed3e5091c2c22fe2454

SHA512
c3a39722200ec94a40e10e5560d8a0aea7bb937f4b2ce56dc85a67bf7530eef07a7d66aedd5691b6bc4326b77b8432aa445d7ae9572a5259cebb8b40b3ce95ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
351fbc3f71c317356920f998c715f36d

SHA1
9514a3642ab8508095e603ed750cd4d406218a3d

SHA256
869026074829623aded8870f58521344c3961b32d6d90410bd9379f2e0b30c41

SHA512
7320323065831c14fbb1c4f4339431ecb1108e656e2ba17f3d53ec768de7a82de78c7d9da016b2a315f8c25c00bb021752289a9f0fe786bf0d50d3416f85524d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
ae129232d46adc9a9136947c7bc2dc8b

SHA1
c878312dc406cbd5ec4d4c5eb7f7feb10bd60efd

SHA256
00c66b39b76053f3d223c929ee84167b4bbc8f61fc851725a843a61a15b268f9

SHA512
45f4b2bfe441f83521d4244fd4b5d3403d5384184a9a841846315c99167d8a3bb28487ca0b1c67dc1a80519d09f953c0dd1f1314491b35ac1b5a6f297ad6504e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
39340ec01be25ebbdc16e9a93453752b

SHA1
290173f04288a56e407e15982130b6fb1c4b7299

SHA256
841d5258a136a045b60a0d3729eb92e22d5eb2884a3b609a1fdd139e1eaff862

SHA512
be8425c7e8ea45eae4bfcb914b16aa94a60430b2565e9d7e9a58601f78dbe20888f3376c7ae79844f5a886e73900d72bf4ec6f85a224d7e9322191c94067705f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
936cca03b13d756df34fba409408805e

SHA1
8374ad22bf735a16e234ac32deb6b44d8106643a

SHA256
95163a5c05b701d380cb53df6b2d1299e4a2856c3fe3522dc9903367b8852461

SHA512
315ffa9b87c19aa893ac69a72646390e9e79e7ff2a02d897ccedb3b6fa63d1fac1601ac1d45a3ccb464598b59c4c3951ec0e0c145e6d6a0fc6303c457707ca32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
88c91ca635e310d11b0b04eb8fa92591

SHA1
e31c7f848fcc679a5efd8b3f9bf7393ba7b3e9cc

SHA256
8deba145333223a63959d35e1f8ad6c110d5039f3e531c01c3abadb6f8731638

SHA512
915185cc1bf407fa17fd45e97c2a161dd6f9c24f50fc8b5d8649daca340e3fd0d65b60307d5bf47ce1b0b702726351509f5a0012daea6e04705adbcfc34c5974

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
34b1b4d22acde3fc684f11ec116dc5e5

SHA1
7cd58396647de1d433c97573276a320cd8805910

SHA256
9095d78782f0a119e91a7c86bec8b3e7af4b2c9e8b3c5ff289d14b93f4e5bc34

SHA512
244fadfc1305328ee5fe6719b60bc32efb24ca00fdef6eb68e98c37294b48551bd4e4de7ea7ec1be515e2c361e38eee71d424e8d37c50a29e052ca3c813053f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\sessionstore.jsonlz4

Filesize
10KB

MD5
ca6145764aaf411e7cda028083f61a41

SHA1
c61862ebad9469ade34066f6d3cbba0281b439c5

SHA256
5a0b8cf2abbd582f34f78aac4b8fb4992a79ff02c465c9e04289a09169e1c0d9

SHA512
27bbdc3617e56bbbec6aa69cbcbb256fc5306db2a050319f683deabb604a4baf68fd9659075bc5857af49366c6d3dcb95586b74b04ec5674c7a219b1650acd31

Download Submit
C:\Windows\SysWOW64\config\systemprofile\Contacts\desktop.ini

Filesize
432B

MD5
eefa7f76ff11a5ec21bb777b798ac46c

SHA1
2e7a65ea8427d13a92ea159a5b8859ff99d2a836

SHA256
840b46ed74821b5b61ca9ddc51a91cfe9151d11a494c89f183fadc02a78ac8ae

SHA512
111301e33c0b33c154ffff274db5eb167de0ddb4e769cab9a2d9fcd2882e6192053149abbcb00d17ae5f7661bafecc1111aff2025c89d07b247633bbccb0e3ef

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
4KB

MD5
cccc22731330ec9c77c3053bba41c5e4

SHA1
01658e6be9637e55a9312a308ce72f74e33799b7

SHA256
e0dfa92838b5f55bbc8e39c97d34ee46e47a283d639cd5f8d7d2eb4e2c97fbe8

SHA512
5aab986c3458c3d1773391c691ab412c1ef5108373ea187a2d89bad0dca9194a8142f850f60a2462d5fd4351c3684655057f4007bdca2d97c08fe6e09177d325

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\edb.log

Filesize
2.0MB

MD5
47cb55e36e8573c520267c30766472b8

SHA1
36856f9c587dcf34e8f0b896c30aeef1e0215a68

SHA256
522668c3564c8953617bd50977f546548f25320109563db2cec50ba1f25bc00c

SHA512
4efac4ca2a1cfa24f8db92ba8e360029e5c768c07f7e6688dd49c59b4d790c79ae3fda80e921b1d540d9d8ac330742133e973adeb371b970975d1468969d52d7

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\edb.log

Filesize
2.0MB

MD5
fd848b86d1607af722bbef2bbad29a3e

SHA1
5e6cd3910a1568b9dbf91c08aa678e247887ced1

SHA256
4f01235182e5131c0b0f65e237a3b7fecf3b46d3948b86ded050a01d8d8b1e5d

SHA512
a225661d65fdf66c9296b7d25b9b0364df92233c5a511504893086a2b130c4e205623c87eafe95d79305bc0e335dc12c0d01a265263c744074f5fb61bb779a52

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini

Filesize
174B

MD5
e0fd7e6b4853592ac9ac73df9d83783f

SHA1
2834e77dfa1269ddad948b87d88887e84179594a

SHA256
feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

SHA512
289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk

Filesize
1KB

MD5
58cf4b02cc01d0b55acaa83ed734dc34

SHA1
a022079631cc67ca37735139ae6aa2bd21585d63

SHA256
c051dc9cf7a3e9f0a42083dc56a470769a8483cd1e32819e20629adeb8b0a8c4

SHA512
13039f84b89859efba8c385d8e723c4d2a5f7e3b651467a091ca1a380c6d6ecf185c2aec1432a066a92fd7ae7fef25e2ad232322b51ed6768e07794c0add1bac

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk

Filesize
1KB

MD5
b00e45b2c321e4676c35cba3ec5ed492

SHA1
7dcc003fb10192a2effda88e9f2fa9ece0c7ca49

SHA256
a36c48b26e1e03f5f356042ab19e79d464056062372dfc7205aec0450e494e1c

SHA512
17248c6d228ee1903ad315e2665cc4c63c01a4fe33fd047c49edafdfcb5d6d4de673039aeab9771acdbf7cf2d6286223c798eebd99219a1ff367eca8bdb85996

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini

Filesize
82B

MD5
1c61dc21f9b83172d65be1e94b79026f

SHA1
7324473ddda64b87c299bf6e3b9e9aff53f7fd74

SHA256
8e920d7893b682a049f6a5097f880d915dc2d7bf8bc87ae558cd7f14466d5d1b

SHA512
9660cde4d7606826c2fb6623460a2a286339970256e677c8abf8189fd1d58e0284c024bbf5c0bf539189dafa3e8d5269c1e0f7e3717891f2ae4771634731bbd8

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini

Filesize
147B

MD5
f905d54dbb3f9be52ec48963750452f6

SHA1
16c98d1292323a44d1719374ec165511dcb5d980

SHA256
62d266a207c9f75ddc78b62e22218df9bdf5c8362f33bae69fd4cc02ea1256ec

SHA512
cbc9abf8b31597c2e786c7da58896aae17fa53a3b3a2e5eb7612350387081b3d36e3e08f39cf6bcedd266bcbae0b0d4a5aba767b3274950c1fb2da7248693200

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Filesize
3KB

MD5
6265909eb9ec7a4fef3bfabdaf39aab4

SHA1
c1f096e91b8e0c7fe5efcbdcd3156c51a8b1e94d

SHA256
b3ed4e854ac4358a654b55fbd3a97e750b4df1b83d4455bf36292e90a9aa0f85

SHA512
15ce785825e8114a543b90fc3602f712d4aa3e7ecb82da5fe269b6151e61068567fb40eec17afeac348b41eb8ece9c12b042d291288788799102426bdf1ca2d5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Filesize
3KB

MD5
11ad925632c218d0ee4cc76b40517202

SHA1
66477e075445fd755a925af5a2c22aae5c9acf81

SHA256
0214b100a0038f11d169c319bb89edd9467fb35d993eb20ec6eb48074273da00

SHA512
a352a1ea06a55f7b173233784669e6c63ab44bfe49fabfde91b13f37f44c041cc8f761507688111877884c2a5d42129f3f8dc9ccba1dfc10a8ecfb9583376439

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Filesize
3KB

MD5
9c5af424d0acba49964290535f8a56c8

SHA1
315cf80ef8ee03dd0ea4cf601b44873d9daadc84

SHA256
0c22ebeef16805e2da7badc4b93652ed274ad1f4c3127448b9271f250eaa3f0e

SHA512
31f33da05d402cec858341446f6c908e4ec4a165075cc32b2ea300439b421c063532096c01610b8e2b03aa6d08f3fc298b137c1f8eec7b3f5cd6ed70f296d6cb

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Filesize
3KB

MD5
6bc60e41b3cb2b1fc395e9fda20ebacc

SHA1
e6fd785990106cea5cd679a83952519c6dfc4bc6

SHA256
d104e3680756684765949dd6ee1ba7f57289ca8a45a3a9409b9929b962c72ec8

SHA512
b6e9745d3acc766be4f5bd5e10f8508bcc7642af0bfb09eed79717cdd2bf23b12f8723317f13ae57cf18e5ada38557d6891a615537ed7d56bdb22744114b820a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Filesize
3KB

MD5
f2ce1a6237ee64d7a13f3aeb3c9f7f3d

SHA1
f01d40c5f44d40887d86f9d8a25dc74be6ea110d

SHA256
554b3831bbd22f4a023ec1beb328effa0384bc9af5f2675f4f566adb0862e4b7

SHA512
b1fd7ec83262017ac8644aa0698b7c820eee4ba905e96879402ebe4a3b1fff625f1467b2167b9509d6449c07d07b33a66eaac2c03e911771115b8e3a6840dfa9

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Filesize
3KB

MD5
06d18d7cf4f49186d1b487b488511be8

SHA1
1d96dd3f1ccb47241c02c46218f4379a050dbdd6

SHA256
52bb2a24ac1572d3a451eca91907b22f6ee24f22564489f535597cd50e32a610

SHA512
25fdfd82bc468d6b7dfdec3c2d0b562ed3c93213b6a1a77ae6adb38cbcdb6c371b65911308d177bebd58be160e754db848c9831c7f7475fc1d05b196db674d07

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Filesize
3KB

MD5
2e9a420de4e914dd3dd2cb70541ab90a

SHA1
30ae29a8233984813db2bd3bf36aee8945ce3446

SHA256
3c2eff9118b5b19fd52b7ff00411c9bac1b5c96cb405f0d3d0ec4bdb165c8258

SHA512
e2888101222f5c8ef6a9504ac0d6c8bc3ba4dc4895953e56a1533366ed1c675c94843d7a05957baeb8705e9d12d5b73fcf12490792ea6600c51e64c32a6d07e0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Filesize
3KB

MD5
b49310b69fd7d231c333ee4119023588

SHA1
b6fa80ef9fe8b0ad99420300bbceb277b4797096

SHA256
d3f159bf4e37041c3c9e5b9221276f0a8fd3ac434d5ff4cab44acb41f331cadb

SHA512
efa467fc7633d038d6baad60de2d75b0d464e05a5b89a2c29ffd08d7f176a9da52dd4d923cdd046d8dcd42e0a999ad6734fc46c25488f80d3af8922a8451039f

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini

Filesize
87B

MD5
764bcd12f24f7fa8fa5887f720a19179

SHA1
5c8348269c4161726f49fe257f0bf1d9179489dd

SHA256
d3cdda5c91a4998c77a697056ab5b3f23f44483de31714d3a069e4a67055c518

SHA512
581d7c9076f036482ea5b116fbc179e402f2264239c1f118af3fc9c2914eb23583b770f3d9e6f8d03c9017ee24a3d88873d547bb0d200017de72121c41dec160

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini

Filesize
151B

MD5
0ff56a4620c3221ff64ec61a3a0d3033

SHA1
3a45320be12b585dcdc5ab2af5ea1455b2c919a1

SHA256
0b0a65accca705494739d03b6c2ea769c78cd0eee996bc95b0c6ebc0941f4b1a

SHA512
962a340efeb6d18c85e5872997eebb83374e114be088689690ba438f0db8e2e4df6c24713a35cfaec518f58d5322cf9617638ea55ff279a9d161c4fdf9af74f6

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini

Filesize
213B

MD5
5547a64ee3681b1fca07111e73dcc51a

SHA1
0b16a54ccb7c0284df649594e006ca96e07ac296

SHA256
c6a3db953cc63f23aa5ff66de5fc6b483f6a1106cf1f77cbd73617b2c4340e0e

SHA512
21a6b9b2c578ea8d0bfb22c1b37b0dde47395ec958fa5c73eafeb8b865080db132e565c7e8ce2ab1d2e934f414e23b820f3ff3571a7d737453f3ace76d11cc25

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini

Filesize
274B

MD5
453249f95d75eb5e450eb91fa755e1c8

SHA1
3e200e187e8cd21d3d1976ea0f7356626254de18

SHA256
01bef150c18e377a57843965d55f18f0b5cb3fa867c5ab30f1e67eacd6ece48a

SHA512
6125ffc1ab457bc1ba957c78c2a89ca54060c1969c4a981acf71025a1d79760159816d5fc36e351429de3bb5820e755b9bc22386f3d6892bfdf3da67d86f157c

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini

Filesize
432B

MD5
f107d0270e21a2fe91099fdc15918d44

SHA1
dabc2f24f4a4e90053743166e5c4175dcf2b2d2d

SHA256
eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8

SHA512
b5d51c0d6abe99121d4f4f1d236def4260b7d5c26c501d7735eba4f58e2597db0e89b2b1df16545e49fc39649806e5305efb912328541bdd31c01ff3d2bda49c

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini

Filesize
174B

MD5
548b310fbc7a26d0b9da3a9f2d604a0c

SHA1
1e20c38b721dff06faa8aa69a69e616c228736c1

SHA256
be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac

SHA512
fa5bb7ba547a370160828fe720e6021e7e3a6f3a0ce783d81071292739cef6cac418c4bc57b377b987e69d5f633c2bd97a71b7957338472c67756a02434d89f1

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

Filesize
174B

MD5
7f1698bab066b764a314a589d338daae

SHA1
524abe4db03afef220a2cc96bf0428fd1b704342

SHA256
cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76

SHA512
4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini

Filesize
174B

MD5
17d5d0735deaa1fb4b41a7c406763c0a

SHA1
584e4be752bb0f1f01e1088000fdb80f88c6cae0

SHA256
768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed

SHA512
a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini

Filesize
338B

MD5
e4e50dfa455b2cbe356dffdf7aa1fcaf

SHA1
c58be9d954b5e2dd0e5efa23a0a3d95ab8119205

SHA256
9284bd835c20f5da3f76bc1d8c591f970a74e62a7925422858e5b9fbec08b927

SHA512
bef1fad5d4b97a65fec8c350fe663a443bc3f7406c12184c79068f9a635f13f9127f89c893e7a807f1258b45c84c1a4fc98f6bd6902f7b72b02b6ffbc7e37169

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

Filesize
627KB

MD5
da288dceaafd7c97f1b09c594eac7868

SHA1
b433a6157cc21fc3258495928cd0ef4b487f99d3

SHA256
6ea9f8468c76aa511a5b3cfc36fb212b86e7abd377f147042d2f25572bf206a2

SHA512
9af8cb65ed6a46d4b3d673cea40809719772a7aaf4a165598dc850cd65afb6b156af1948aab80487404bb502a34bc2cce15c502c6526df2427756e2338626062

Download Submit
C:\Windows\System32\config\systemprofile\Contacts\desktop.ini

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\System32\config\systemprofile\Contacts\desktop.ini

Filesize
412B

MD5
449f2e76e519890a212814d96ce67d64

SHA1
a316a38e1a8325bef6f68f18bc967b9aaa8b6ebd

SHA256
48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7

SHA512
c66521ed261dcbcc9062a81d4f19070216c6335d365bac96b64d3f6be73cd44cbfbd6f3441be606616d13017a8ab3c0e7a25d0caa211596e97a9f7f16681b738

Download Submit
C:\Windows\System32\config\systemprofile\Desktop\desktop.ini

Filesize
282B

MD5
9e36cc3537ee9ee1e3b10fa4e761045b

SHA1
7726f55012e1e26cc762c9982e7c6c54ca7bb303

SHA256
4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

SHA512
5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

Download Submit
C:\Windows\System32\config\systemprofile\Documents\desktop.ini

Filesize
402B

MD5
ecf88f261853fe08d58e2e903220da14

SHA1
f72807a9e081906654ae196605e681d5938a2e6c

SHA256
cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844

SHA512
82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b

Download Submit
C:\Windows\System32\config\systemprofile\Downloads\desktop.ini

Filesize
282B

MD5
3a37312509712d4e12d27240137ff377

SHA1
30ced927e23b584725cf16351394175a6d2a9577

SHA256
b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3

SHA512
dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05

Download Submit
C:\Windows\System32\config\systemprofile\Favorites\Links\Web Slice Gallery.url

Filesize
134B

MD5
873c8643cbbfb8ff63731bc25ac9b18c

SHA1
043cbc1b31b9988d8041c3d01f71ce3393911f69

SHA256
c4ad21379c11da7943c605eadb22f6fc6f54b49783466f8c1f3ad371eb167466

SHA512
356b13b22b7b1717ded0ae1272b07f1839184e839132f3ab891b5d84421e375d4fc45158c291b46a933254f463c52d92574ce6b15c1402dfb00ee5d0a74c9943

Download Submit
C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

Filesize
402B

MD5
881dfac93652edb0a8228029ba92d0f5

SHA1
5b317253a63fecb167bf07befa05c5ed09c4ccea

SHA256
a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464

SHA512
592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

Download Submit
C:\Windows\System32\config\systemprofile\Links\desktop.ini

Filesize
282B

MD5
98470d9bd7fba55a0c303065f9c4f9be

SHA1
5303b190e29ba48332f7c90a832ef08af5a1953d

SHA256
3830022d5d7ef2ae2ca0a2b6ad73f0d4716b49bf7eeeaa87b618988d531b7c72

SHA512
134e072c3600bbb3c724c2700da399a14ba5b907153969362b3dbff32c480d39e7f5ecceebc9122a5a27265410557a16eb6bf82c9b635b90ef1fa0ae9efb849c

Download Submit
C:\Windows\System32\config\systemprofile\Links\desktop.ini

Filesize
580B

MD5
de8858093993987d123060097a2bad66

SHA1
0a89e87ba46538cb73aff1a47e4dc0bcfb4760d5

SHA256
4c0d757717dec80eca8c6cbbfdda4706eb38fbbb7624933d5429dafc7bb9f0ec

SHA512
fa348ac4025b599f460cb831338ce010dde8fba87587a6d078d6d594a30fee87ed112e412078c10604553f326cc7bd7627ae93b0e3d8a60cfeda0720cad29f4c

Download Submit
C:\Windows\System32\config\systemprofile\Music\desktop.ini

Filesize
504B

MD5
06e8f7e6ddd666dbd323f7d9210f91ae

SHA1
883ae527ee83ed9346cd82c33dfc0eb97298dc14

SHA256
8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68

SHA512
f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98

Download Submit
C:\Windows\System32\config\systemprofile\Pictures\desktop.ini

Filesize
504B

MD5
29eae335b77f438e05594d86a6ca22ff

SHA1
d62ccc830c249de6b6532381b4c16a5f17f95d89

SHA256
88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4

SHA512
5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17

Download Submit
C:\Windows\System32\config\systemprofile\Saved Games\desktop.ini

Filesize
282B

MD5
b441cf59b5a64f74ac3bed45be9fadfc

SHA1
3da72a52e451a26ca9a35611fa8716044a7c0bbc

SHA256
e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311

SHA512
fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3

Download Submit
C:\Windows\System32\config\systemprofile\Searches\desktop.ini

Filesize
278B

MD5
8e11566270550c575d6d2c695c5a4b1f

SHA1
ae9645fad2107b5899f354c9144a4dfc33b66f9e

SHA256
1dc14736f6b0e9b68059324321acc14e156cd3a2890466a23bf7abf365d6c704

SHA512
a9fc4b17d75f85ae64315ba94570cb5317b5510c655d3d5c8fb44091ea37f31e431e99ed5308252897bdd93c34e771bf80f456c4873ef0aa58ca9bbb2e5ff7e0

Download Submit
C:\Windows\System32\config\systemprofile\Searches\desktop.ini

Filesize
524B

MD5
089d48a11bff0df720f1079f5dc58a83

SHA1
88f1c647378b5b22ebadb465dc80fcfd9e7b97c9

SHA256
a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17

SHA512
f0284a3cc46e9c23af22fec44ac7bbde0b72f5338260c402564242c3dd244f8f8ca71dd6ceabf6a2b539cacc85a204d9495f43c74f6876317ee8e808d4a60ed8

Download Submit
C:\Windows\System32\config\systemprofile\Videos\desktop.ini

Filesize
504B

MD5
50a956778107a4272aae83c86ece77cb

SHA1
10bce7ea45077c0baab055e0602eef787dba735e

SHA256
b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978

SHA512
d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a

Download Submit
C:\Windows\System32\sethc.exe

Filesize
272KB

MD5
3bcb70da9b5a2011e01e35ed29a3f3f3

SHA1
9daecb1ee5d7cbcf46ee154dd642fcd993723a9b

SHA256
dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5

SHA512
69d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
37ff609bb9286a088755e2997ec50f1c

SHA1
c916b8471234abdd1247893910e28300c1459f70

SHA256
80e21007075db06466ff23584a124dafacd19dd51e62e0b025bb3bb7e451dbaf

SHA512
5a38a300719a1465ac90d35d41f806ffcb2f02037077bd37e02b2e7cc2552e90dbaecd6d1084bc033b41400498a1e84563bfc9ff809fe5f98d8c2f3abaacf524

Download Submit
C:\Windows\Temp\RGIC65B.tmp

Filesize
24KB

MD5
3006752a2bcfeda0f75d551ea656b2ef

SHA1
b7198fc772be6d6261ed4e76aca3998e8f7a7bdb

SHA256
dfd64231860c732dced3dc78627a7844a08d5d3e4cd253fd81186bae33cc368a

SHA512
3fcfa7c8f46220852dc7efef5b29caba86825d0461a35559f26dbb2540c487b92059713f42fe1082a00a711d83216db012835673e1c54120ffa079e154950854

Download Submit
C:\Windows\Temp\RGIC68F.tmp

Filesize
3KB

MD5
a828b8c496779bdb61fce06ba0d57c39

SHA1
2c0c1f9bc98e29bf7df8117be2acaf9fd6640eda

SHA256
c952f470a428d5d61ed52fb05c0143258687081e1ad13cfe6ff58037b375364d

SHA512
effc846e66548bd914ad530e9074afbd104fea885237e9b0f0f566bd535996041ec49fb97f4c326d12d9c896390b0e76c019b3ace5ffeb29d71d1b48e83cbaea

Download Submit
C:\Windows\Temp\wwwC807.tmp

Filesize
206B

MD5
c2858b664c882dcce6042c40041f6108

SHA1
52eeaa0c7b9d17a8f56217f2ac912ba8fdc5041a

SHA256
b4a6fb97b5e3f87bcd9fae49a9174e3f5b230a37767d7a70bf33d151702eff91

SHA512
51522e67f426ba96495be5e7f8346e6bb32233a59810df2a3712ecd754a2b5d54d0049c8ea374bd4d20629500c3f68f40e4845f6bb236d6cca7d00da589b2260

Download Submit
C:\Windows\Temp\wwwC808.tmp

Filesize
226B

MD5
ad93eaac4ac4a095f8828f14790c1f8c

SHA1
f84f24c4ca9d04485a0005770e3ef1ca30eede55

SHA256
729111c923821a7ad0bb23d1a1dea03edbf503cd8b732e2d7eb36cf88eaa0cac

SHA512
f561b98836233849c016227a3366fcf8449db662f21aecd4bd45eb988f6316212685ce7ce6e0461fb2604f664ed03a7847a237800d3cdca8ba23a41a49f68769

Download Submit
C:\Windows\inf\setupapi.app.log

Filesize
2KB

MD5
54f09131ab39c61cf2d692eebc5833f7

SHA1
fc9a9968afecc11768edb53e79d55b0306a89e00

SHA256
490c14fb4e0ed133653a4f89c3d7a6df023c8a378f72f05728001d5c073ade38

SHA512
83c470c0abebf6b8d5501c872f6f6bfba8c69d841e9c00b925ef09e27eee78bc3fc42b2bf947e23d285f99731b7d1c89ec6628233b4155b5200c9c35d8b1a231

Download Submit
C:\Windows\inf\setupapi.app.log

Filesize
3KB

MD5
b932a3a28860dc1cf0fcb5d9db575015

SHA1
0667639f8e732470ded815a5876dd85437635f42

SHA256
a4108b4e27afc866b73d2ac71f12fe799a18513ad95ceca5d3dc457cfc9167fc

SHA512
95d273cb53a7fd249e4db1c7dbb608c0f85f2a5f26a2a3020079a1402688b87aad5851105f57adc6b476b7b675f0619b7f8d239d7fdf02c8b589a7984095ff61

Download Submit
F:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\CR_19E28.tmp\setup.exe

Filesize
4.3MB

MD5
2161730a7ae00a1fb8c5020a43be949f

SHA1
8db6b820472cdfa266c874e0d3a9395412995aa1

SHA256
07e7896b2304e3b9966294a02d2ed32f41994ee7bd0a284e4160743edaeb9e15

SHA512
aa3659b6184f4273b7fcf1f7d2cd0a5a9129b8856d15e4ca8904b709e85cd432538ce0510ca9777760a1a9d5391671232a79908860e7d665260a54910f6fea5a

Download Submit
memory/1068-3993-0x000007FEF5D00000-0x000007FEF5D4C000-memory.dmp

Filesize
304KB

Download
memory/1068-4006-0x00000000046F0000-0x0000000004700000-memory.dmp

Filesize
64KB

Download
memory/1740-2504-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/1740-2505-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/2204-2680-0x00000000010D0000-0x00000000010D2000-memory.dmp

Filesize
8KB

Download
memory/2204-2753-0x00000000021C0000-0x00000000021C2000-memory.dmp

Filesize
8KB

Download
memory/2204-2656-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

Filesize
64KB

Download
memory/2204-2662-0x0000000000F80000-0x0000000000F90000-memory.dmp

Filesize
64KB

Download
memory/2204-2677-0x00000000010D0000-0x00000000010D2000-memory.dmp

Filesize
8KB

Download
memory/2204-2675-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/2204-2763-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/2204-2761-0x0000000001070000-0x0000000001072000-memory.dmp

Filesize
8KB

Download
memory/2204-2688-0x0000000001280000-0x0000000001282000-memory.dmp

Filesize
8KB

Download
memory/2204-2690-0x0000000001270000-0x0000000001272000-memory.dmp

Filesize
8KB

Download
memory/2204-2757-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/2204-2754-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2204-2698-0x0000000001270000-0x0000000001272000-memory.dmp

Filesize
8KB

Download
memory/2344-2506-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/2804-2448-0x000000001C260000-0x000000001C4DC000-memory.dmp

Filesize
2.5MB

Download
memory/2804-2446-0x000000001AD40000-0x000000001B19E000-memory.dmp

Filesize
4.4MB

Download
memory/2804-2447-0x000000001B770000-0x000000001BD78000-memory.dmp

Filesize
6.0MB

Download
memory/3212-2500-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/3212-2501-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/3688-1406-0x000007FEF4C60000-0x000007FEF4CAC000-memory.dmp

Filesize
304KB

Download
memory/3688-1405-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/3688-1400-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/3688-1399-0x000007FEF4C60000-0x000007FEF4CAC000-memory.dmp

Filesize
304KB

Download
memory/3796-3434-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/3796-3422-0x0000000001240000-0x0000000001242000-memory.dmp

Filesize
8KB

Download
memory/3796-3425-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/3796-3432-0x0000000001050000-0x0000000001052000-memory.dmp

Filesize
8KB

Download
memory/3876-2502-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/3876-2503-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download