c7bc4bfcfae542a7582b8466755b12cf3d9775e2273d2cee59838f17f40d96af

Analysis

max time kernel
138s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INUI.exe
Size

11.6MB
MD5

37dca4f345627490b15cd2dc2a350def
SHA1

4869bab2501f23a3100c2ba92505d4c8efe195f2
SHA256

c7bc4bfcfae542a7582b8466755b12cf3d9775e2273d2cee59838f17f40d96af
SHA512

93a244ae04a676a09f80055644359bfa04ae7cde2fec0ba9fdbecdfeb3192c18385ada5df17dbff01bcf5ee1477f6276e1f95eeaf1e6830c3741cccd80d3197c
SSDEEP

196608:QE1NuTUUGfEth7K8ZiZ89qZR5dsvNc/VXbRKRH7KBynSgrZTmaLzjzKqftsd0zsq:QMsXhvZAdv5dMWdKRbKBsrdaaPnftHz1

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1844	inui-installer-win_x64.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INUI.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.win32webviewhost_cw5n1h2txyewy\Children\123	Win32WebViewHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.win32webviewhost_cw5n1h2txyewy\CIStatus	Win32WebViewHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646\Children\S-1-15-2-1310292 = "microsoft.win32webviewhost_cw5n1h2txyewy/123"	Win32WebViewHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.win32webviewhost_cw5n1h2txyewy\CIStatus\CIStatusTimestamp = 6f95ba1912ecda01	Win32WebViewHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.win32webviewhost_cw5n1h2txyewy\CIStatus\EnablementState = "1"	Win32WebViewHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.win32webviewhost_cw5n1h2txyewy\ChildCapabilities\123 = 53002d0031002d00310035002d0033002d003100000053002d0031002d00310035002d0033002d003900000053002d0031002d00310035002d0033002d0033003200310035003400330030003800380034002d0031003300330039003800310036003200390032002d00380039003200350037003600310036002d003100310034003500380033003100300031003900000053002d0031002d00310035002d0033002d003700380037003400340038003200350034002d0031003200300037003900370032003800350038002d0033003500350038003600330033003600320032002d003100300035003900380038003600390036003400000053002d0031002d00310035002d0033002d0033003800340035003200370033003400360033002d0031003300330031003400320037003700300032002d0031003100380036003500350031003100390035002d003100310034003800310030003900390037003700000053002d0031002d00310035002d0033002d0031003000320034002d003900350035003600380031003200390037002d0033003400370030003500350039003000360037002d003800370033003100340039003500310030002d003300310032003800360036003100380031002d003500300035003100340039003000370034002d0032003900360035003900390030003200340035002d0033003600340031003200320034003300360034002d00340038003000360037003600350034003500000053002d0031002d00310035002d0033002d0031003000320034002d003900380033003900320032003200350038002d0032003100350039003900310037003600320035002d0032003700350031003300360032003200340030002d0033003200380034003300360039003400310030002d0032003400390037003000320033003900340033002d003900340033003400310031003100370031002d0033003500300033003200380032003900320039002d00330037003400310034003300340034003600310000000000	Win32WebViewHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646\Children\S-1-15-2-1310292	Win32WebViewHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.win32webviewhost_cw5n1h2txyewy\RACProvisionStatus-123 = "1"	Win32WebViewHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.win32webviewhost_cw5n1h2txyewy\CIStatus\isEXEIATPatched = 00	Win32WebViewHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.win32webviewhost_cw5n1h2txyewy\ChildCapabilities	Win32WebViewHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646\Children\S-1-15-2-1310292 = "123"	Win32WebViewHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1310292540-1029022339-4008023048-2190398717-53961996-4257829345-603366646\Children\S-1-15-2-1310292 = "microsoft.win32webviewhost_cw5n1h2txyewy"	Win32WebViewHost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	firefox.exe
Token: SeDebugPrivilege	1132	firefox.exe
Token: SeManageVolumePrivilege	5992	svchost.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2460	Win32WebViewHost.exe
1132	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1844	2548	INUI.exe	89
PID 2548 wrote to memory of 1844	2548	INUI.exe	89
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 224 wrote to memory of 1132	224	firefox.exe	114
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 4228	1132	firefox.exe	115
PID 1132 wrote to memory of 1740	1132	firefox.exe	116
PID 1132 wrote to memory of 1740	1132	firefox.exe	116
PID 1132 wrote to memory of 1740	1132	firefox.exe	116
PID 1132 wrote to memory of 1740	1132	firefox.exe	116
PID 1132 wrote to memory of 1740	1132	firefox.exe	116
PID 1132 wrote to memory of 1740	1132	firefox.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\INUI.exe
"C:\Users\Admin\AppData\Local\Temp\INUI.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\7zS4F9B0387\inui-installer-win_x64.exe
  .\inui-installer-win_x64.exe
  2⤵
  - Executes dropped EXE
  PID:1844

C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe
"C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe" -ServerName:DPI.PerMonitorAware.AppX5wghjgh68rykr39c831b2mesh6pk39yz.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2460

C:\Windows\System32\wwahost.exe
"C:\Windows\System32\wwahost.exe" -ServerName:Windows.Internal.WebView.OopWebViewServer
1⤵
PID:1512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {268b0983-988e-4890-ad2a-0f40f01327e6} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" gpu
    3⤵
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d54d66fc-f12f-403c-be36-207cd72fea93} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" socket
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2832 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3180 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b8b13ba-898b-49f5-aadf-7f8051bd347f} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
    3⤵
    PID:636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3192 -childID 2 -isForBrowser -prefsHandle 3720 -prefMapHandle 3664 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1ea27f4-6c83-4f66-9581-580fb0937f7f} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
    3⤵
    PID:384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4824 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4848 -prefMapHandle 4844 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78596e55-5362-48ab-88ca-a4930e9da72a} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" utility
    3⤵
    - Checks processor information in registry
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5092 -childID 3 -isForBrowser -prefsHandle 5116 -prefMapHandle 4964 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed1ca69a-3f04-42df-af31-154239800a74} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
    3⤵
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 4 -isForBrowser -prefsHandle 5352 -prefMapHandle 5356 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {549e641b-aa5b-40e2-bba0-03547a8016bb} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
    3⤵
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 5 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e5c75ff-e7ab-48b4-9797-6cc4d5940dd0} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5968 -childID 6 -isForBrowser -prefsHandle 5980 -prefMapHandle 5976 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15d38217-c463-49b6-8a44-b22bb435a0a5} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab
    3⤵
    PID:5908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6228 -parentBuildID 20240401114208 -prefsHandle 5864 -prefMapHandle 5880 -prefsLen 30532 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f667415a-66f4-44d6-9f9f-611b2aeedabc} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" rdd
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6264 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 5108 -prefMapHandle 5872 -prefsLen 30532 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fb0edb8-aa5e-4673-9e2d-ac5cca36b3d7} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" utility
    3⤵
    - Checks processor information in registry
    PID:1360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
2ee1ac75874d60746ae4768076b21dd2

SHA1
0bc751c10619709149d8e511ae58792160bca9c5

SHA256
0263cde180d97badeaab838bb18a06483cfdd7d7f133ddef681237450c037abf

SHA512
36bcd0c744111ef777bef8685797029a7e293b6483f08f12126ac4a964609de7fa658e117eb2387f833d5ea82709a8f16e64e2798f135cfc8f1ff8d92dae1706

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\activity-stream.discovery_stream.json

Filesize
45KB

MD5
e1ccecbbf60195143c7456773b7c320a

SHA1
2ce008813f5ce87fc30f83042c281755041263fb

SHA256
155e1b3a9ce69f40b303dab10fd3d0c10869576639b24aa6e163c6343d26db02

SHA512
52a212c7e3d3a4b0a7834bf3670c513029727e6d1300a77bf71863503f9346e8bc25c89db7360fd15d7362206e4d5189200a981f68bfd32cbf5d3985868338e2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\doomed\13107

Filesize
31KB

MD5
e3f2475b2d979d9579867db253a27bc7

SHA1
52f7063eeffcf2666016667566be7314f8ca08a5

SHA256
a610aef2fdeb0202ced4e7a552149e7ff2c21ccd19ab8182bf2d879da9590fc7

SHA512
0cbb48ffdcdb81b7a9d4307a0c3ac582b390f1240bb12b98c1d6e2d39bb4eb31c6820bac891914e4dc5b335856c36effab6a46bda667e1826245ea84b50b4a94

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\doomed\14914

Filesize
30KB

MD5
fce13f35cc631e6d7aadc53836f70c94

SHA1
b262c2115d2b5f67ef80cc01e755668f81dc53c6

SHA256
57ce52a5b091d650b036a378276b50ec45164b931e22c20d9663256588d194c4

SHA512
168f2062d972372f31dc4d794caa312f9949a5dab38bdcedf9a9f9cc2237457f5968065d7991794bb1f3e8f43805e7a1b06eac3cec4c9cbfcf615f4e2e8a679d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\1423F2CED225F66A74EE1701C82AC2F60BA1CA7C

Filesize
27KB

MD5
1d4a6c484a299d4188d211c29de82dbb

SHA1
ddcd2dc5afc975565a3c259879482b5f5d85adb4

SHA256
e7bb76393754bac45f630732dbcca184010400819196cbd83f508f0a17a0eb53

SHA512
c9decaa4e81bbdbc5fb75c15cdf22b5c8e804204f1c42a15b8bba6a91ef6e57ccc690fd5217a01b2b5c3e4a1a0eae7dd081b5d13063126aacdd793c8e171bf3b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\52753D71094501E96A26B156541B6CA5B72C23F2

Filesize
38KB

MD5
448650e4fa538f23cbf89591f8681852

SHA1
ad77cdc88f8a1ebdefdf57b5a80d2da11faf2e96

SHA256
979d5378120b197c75542012bfc8f8eb2ab3942a2a69e449a6ecd37d5979a5dd

SHA512
d28ecd8130aeefa4ae6e96e368e00b330a8df9ff509826d9bfbd7f45e6a63c075e0c3553c407487c5eae1a6f2beab8a2a512f99695ddb47ffab2c9f0ee4d4c19

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\66B0DFC4BA30D4960A68EF02E27F09F1D0E4264D

Filesize
28KB

MD5
b93861eb13514acf28b90d22873990bc

SHA1
abbe75dbf64bc79f66a3edc8a5382ac5267bac69

SHA256
655de9af78488e5cca4f9e2e5f44301805552967746465ccd9c253ba7b425dd7

SHA512
dc7f643d7ff9376ec80ee6d14061c7eaeeac375e9a5a3ebedf324cc3e6ce5e28ff9655348c398bc7b0b8d20be103f6a80a575098f80a6988e5513a6c1a845ca8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\7119860AA194C757DF15E4BFEBB59542928EBC26

Filesize
34KB

MD5
9df1169d2414aaa61c40d3efaa8fdb4d

SHA1
6ffe215109cec986df9a2ac3bfc9616a9c67d173

SHA256
10ff9c3c66e6b33fa7a1a0e010c4467a7d5cb7e5721ea3e48b8febb91372b358

SHA512
eca41747010af4b8ff6ff0a59d4f252bd4dda122d24191af9e02ff507a92e8b7e1da828af75faea33354972779a9d90887ceebce7c8a87c362b3c9a8b9f11eed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\92DDBADB59D5D489C9FAF5D5575257DD0C04553D

Filesize
38KB

MD5
ca5d0f801dbf4cef5d871f6020f9369e

SHA1
1ac0560ce952c50e6a25f4954bb9f8698a6922df

SHA256
26e1798defa77f5d966ebd1d6dc920740f904eebdc0ace47826206771822d285

SHA512
db479f5573b08c0d3d8b122a088efc57664b49c8500b2b34d8a89902716a447aaab09c4bf80da28eff7ff22ecc29b98557c31e0d8b2d76e368fae64d7741704a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4F9B0387\inui-installer-win_x64.exe

Filesize
2.5MB

MD5
883b5f05278bceee824418ade0269d1d

SHA1
ea823689033d942adcec783a2595fc5e2e7492d1

SHA256
8c445487c4a63b056a2be77ff6b8c6fb75c46aac61a5a6d8dabce5525d4c0e7e

SHA512
ff7645e530821f3fbe2bfa11fa8dca6840d84e1fef21be098771d6ddc381d4cca9349704101b7702e03c1292a57acdf23e6805cca142c3d0dfe3952efd282f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4F9B0387\resources.neu

Filesize
14.5MB

MD5
730d2482cb8498c545815c47207ef1fd

SHA1
dfcf965f707495877c8c7f88f9500a2a590825fa

SHA256
29b22c12deb8eea4d537bcbaddc8a6e3d2603a1cd9075b341cb4c26902664966

SHA512
cd4add0b8f109cf1b3cf1c0c3a2358465d075af5089670627c3b6ec051ce7cce9744c59ec81551f84a602a549bb7b566746c65adc67e32395f62ed853e732758

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

Filesize
8KB

MD5
8ebd2fc198d8050bb2fae71d9a6c2f7b

SHA1
3666a3641bd46b4ba08489bdf9e2c0f3e841b0c4

SHA256
65f6b2687e1e9fd56ec7134fa3a52f5137f319aabc17d799a684aca354a3ffe4

SHA512
17a3e76eb1ab82d31620d9d64108e2a15434d53ccdb13121326ec472c02e801e2951ef78e65af9fb143354ee2fe41dfedf048f6e4013e79efa81a860bb61553c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

Filesize
13KB

MD5
cd156ceb91d92e32c14d576a87dcb0ee

SHA1
429e45b188dad66c37e4c613c589cb13b9ce27ef

SHA256
c80a96e07a9e9f8a8811b7a6253204909e55e38b6875ba882d4442c3f0a5a34f

SHA512
b21f263a1b2d025a0556d9b892d76e17d6e6ac54b538cd52632f8f199c5055131ad6d2696dfe764738629545513f3b242b8af29763afdea404bc12978bd19c48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
6bdec5142ef7465193af1a7f478960ec

SHA1
380795cb0f1aca028be38a430a59821190f9299f

SHA256
3322230dbca315e6710aad7000bc96ac7758c49989f16655d90e8677942c5c8b

SHA512
dfbae4920c04ca44ae52428d14465c98dbedab7278969e8981619be6e820fed6a473a4d20c6b2c7c78c11b4fe5c4789976e6b6c41585fd18efd34be0a5831ca3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
dea7ab42e116f3f4ce1c4e59ae6189f5

SHA1
5bc31b8bd22713f56b466dac5d420b29e0a276d3

SHA256
4a6bf407f31944e5b3d1f6da58791301d189d93579cd117c617ab9dff3705946

SHA512
725eff1508eb6ca437d295a27c10185e18e01a6ffd41e27e92c558bc58bcb8051589558314ad68d46261ae2220f58f9b07648b9646c98310ef0f29734b0d8f26

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\54782813-4187-41e3-89f7-0925d4177205

Filesize
982B

MD5
0fbb7a374415ff9d7eb4cb552e57fcdd

SHA1
f9d484225797514c77a637bb2ef900202bd4fc6a

SHA256
39edf3928d1509c3d8ad37d9a5f29b1e618b2d76e0377223933fff84a9cc64e4

SHA512
ebd6703ca2e9359029e89f0474f862822edd45069fa3cb4b0c31830f1ea922f32f8fedbb2e0bdfe0e4b76aa1b16c4319d079461960f78b394e96dddb19ccc81c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\755d9328-0553-4579-8b4f-cedb2636b031

Filesize
671B

MD5
55a5949127188a3fbfd1b5e8226319c2

SHA1
b3eb7b9d75489182cb5b8bc00fdd0393c53010a5

SHA256
c9bd27ea63760959b2b47b12372128b01525ba024e994eabd04d1e58e539a957

SHA512
95c7d26057ab5c5af02f99c8864a42ea3770c2e4df02a04a70d3e9ab1927ee84edd47a924b0e1eabd3a5330a0d0bdc89c5fe2cee80be0656f408bb63d15425da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\b76fc4fe-5f85-45c5-812a-e9170c588d29

Filesize
27KB

MD5
cbcfe20064ed9cd823f063b5011067ba

SHA1
e52cce679305879825f1fb6d2f5527878f6add8a

SHA256
ef5dc9fa782e62c4ef6996255e0b51f1d65154da8c9d688ee2ec285aa7b068a1

SHA512
582f19abe239e856069857dbc0fd736b8cd29c59018d53d417690b78baa3c0807d7144782130d1223bd0714448ea5e8a4f83a9bde821e622bba15c4b23c23a5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js

Filesize
12KB

MD5
5131e84d734cd170dcc4dcd1cdeeb203

SHA1
7f2698623646313b2c0c7a934d704a8edff01ec8

SHA256
9b8a60cb3820493546dbee8c8774d7b9d99de0df1273bbbac50915971406f815

SHA512
35d39af1cfd7afa93c3db919e87c66b32f63654de8279129d9a44d66f3ee0f96ff32115ec9dc5bd8dc3c2a18c3e8db27a0fcb32229be4a3687a9949f1c454403

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js

Filesize
11KB

MD5
c537c83b31e31e77bdd8b28cfa177349

SHA1
7b879ad03610c81adeb0f0966e45a637aaa33809

SHA256
6158f0377f698a8fa5685ed73f1dddb4db1ad28c0ffe17de0f5a367407b3012a

SHA512
490f4e6d360fb5720edf5bff523dabf9e97021417de8e4280bb60cb3712c8ca968af88f2cd570e52d182d780db4604f701b43d9303e93e34915ea4b86a83381f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
b0cbcd082f50dae0ddc743e38b84c965

SHA1
16ce5122f341938f916c8072f4f024d08be8625f

SHA256
2b5894d958468deae940c8fceae542b63e860c7b19445d65d39a8099f1297576

SHA512
c9f97bd2d0f48e9d1bb87085cb983267172846329fabfef1f460a8c1e5424d70e86ee3fa9818c87d5a83f65759a819ecd2fb0b056021876d717788bde0061eb0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
846a2c289a841327c74afe2bb67984b9

SHA1
5d080c9fa6871978f506373255a5afc18f756293

SHA256
bd81d8ef8267d8cb35a8f46f5a6331adaebfac3cdb92a3316f9d9e3c4610855f

SHA512
a04d49cda2dbdb597a2c41132a0ffb4f8c9567a4091eaa504bc9bf4abeba0652b683cae8457a1207c71dfdce706b5d1cfd45e4af32b44c4f55f722385b2a1e32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
b689ce3989a8d58673f48b87adc2437e

SHA1
390c184ec8c0e6ee8d551b57adbb68fda1e1789b

SHA256
4865756ce9424ff489b2f7995f0bccde59c08c726a069993f7387957bbc3958f

SHA512
3b9d31c2b7b238d58af67c9f0214d380439da7da794b56e8e896a1ca511b32ba20ec7cbbe4c32a8447677acbf35fcf1c6dc0ff23a547f7424167a3dca01aff03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
3c20abda9e0ea2fe8ca743089fe034f6

SHA1
2fa45a67034ff6f753d6bea70279a09c1bff6f8e

SHA256
2daca9fd1d9345a42149a69aac8872f159a78851d25bab15c7769307b9149065

SHA512
aae685ba73e48cc20a49edfbefa72e858310c7bb58ca1806b11d8a4604f5a257af2253557c34bccf3c3b4e9ee0a1148e8e5c2bcbc4e780225d08a1bac73888f3

Download Submit
memory/5992-717-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-722-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-723-0x00000291C8840000-0x00000291C8841000-memory.dmp

Filesize
4KB

Download
memory/5992-724-0x00000291C8830000-0x00000291C8831000-memory.dmp

Filesize
4KB

Download
memory/5992-726-0x00000291C8840000-0x00000291C8841000-memory.dmp

Filesize
4KB

Download
memory/5992-729-0x00000291C8830000-0x00000291C8831000-memory.dmp

Filesize
4KB

Download
memory/5992-732-0x00000291C8770000-0x00000291C8771000-memory.dmp

Filesize
4KB

Download
memory/5992-721-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-744-0x00000291C8970000-0x00000291C8971000-memory.dmp

Filesize
4KB

Download
memory/5992-746-0x00000291C8980000-0x00000291C8981000-memory.dmp

Filesize
4KB

Download
memory/5992-747-0x00000291C8980000-0x00000291C8981000-memory.dmp

Filesize
4KB

Download
memory/5992-748-0x00000291C8A90000-0x00000291C8A91000-memory.dmp

Filesize
4KB

Download
memory/5992-720-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-719-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-718-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-716-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-715-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-714-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-713-0x00000291C8C20000-0x00000291C8C21000-memory.dmp

Filesize
4KB

Download
memory/5992-712-0x00000291C8BF0000-0x00000291C8BF1000-memory.dmp

Filesize
4KB

Download
memory/5992-696-0x00000291C0640000-0x00000291C0650000-memory.dmp

Filesize
64KB

Download
memory/5992-680-0x00000291C0540000-0x00000291C0550000-memory.dmp

Filesize
64KB

Download