108c653754974b226c02fdd256ed598148bc073a150900af7881964a099fa5ce

Analysis

max time kernel
1166s
max time network
1176s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo
Size

297KB
MD5

d28287eff114ac63c2f2e2da5da5a56e
SHA1

e5ac91a7954d28ae97d4d5eead00b840d7faa176
SHA256

108c653754974b226c02fdd256ed598148bc073a150900af7881964a099fa5ce
SHA512

9e3dd4993b072009458501559cb2fe64a4ccce18782db10ba6d5b3fae0d496b2bd8396551b942122704985e552825788404d2651cac994163b5e0f94860115c1
SSDEEP

6144:wdo/SpOL/saqkPV9FxLtcsDSsmwI9nvZJT3CqbMrhryf65NRPaCieMjAkvCJv1Ve:Eo/SpOL/saqkPV9FxLtcsDSsmwI9nvZT

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\IPMIDrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mcd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storqosflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbuhci.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\cxwmbclass.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pacer.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pmem.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\qwavedrv.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hvservice.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\errdev.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\KNetPwrDepBroker.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\refs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbaudio2.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dfsc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\volmgrx.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mslldp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\NDKPing.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sfloppy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\smclib.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fsdepends.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hyperkbd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdiWiFi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Acx01000.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mmcss.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\spaceparser.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Udecx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vhdmp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndiscap.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidusb.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\hidscanner.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\umpass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tdi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ufx01000.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\USBAUDIO.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\filecrypt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rteth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\urscx01000.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cimfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\IddCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wmilib.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\afunix.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bthenum.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rdpdr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\RNDISMP.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WppRecorder.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\fltmgr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vmbkmcl.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\EhStorClass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelpmax.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpsd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mshidumdf.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidspi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\iagpio.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vmgid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winnat.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dxgkrnl.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\serial.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sdstor.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SpatialGraphFilter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\SensorsCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\csc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidir.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tsusbhub.sys	cmd.exe

Manipulates Digital Signatures 4 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	cmd.exe
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
persistence

Print Processors
T1547.012

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll cmd.exe
Loads dropped DLL 3 IoCs

Processes:

pid process

3476
3476
3476
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

description	ioc	process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	cmd.exe

pid	process
3476
3476
3476

Drops desktop.ini file(s) 39 IoCs

Processes:

cmd.exeexplorer.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\AM26C1~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\AM60C1~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD8BC~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1A03~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\AM3CA2~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM10F5~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM73FD~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME369~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\AM82AF~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7F8B~2.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMF414~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMB420~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7F64~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA417~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM52EB~2.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM031C~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\AMD8B8~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM33F5~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3600~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM91A0~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMBA5B~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\AM2651~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\AMA114~1.423\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC81E~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5D45~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6E1C~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Windows\WinSxS\AMBE63~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM066F~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0A9A~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMB161~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME3F0~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\BITLOC~1\autorun.inf	cmd.exe
File opened for modification	C:\Windows\WinSxS\X85378~1.1_N\autorun.inf	cmd.exe

Drops file in System32 directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\spp\tokens\skus\PROFES~1\Professional-Retail-4-ul-oob-rtm.xrm-ms	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\MSFT_ScriptResource.psm1	cmd.exe
File opened for modification	C:\Windows\System32\DefaultHrtfs.bin	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\uk-UA\c_net.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\ntvdm64.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\wininet.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\msdxm.ocx	cmd.exe
File opened for modification	C:\Windows\System32\wpnpinst.exe	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\BthLCPen.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\netrasa.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\cmbatt.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\ndfetw.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_PrinterDriver.format.ps1xml	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\polstore.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\eUICCsCSP.dll	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\cryptext.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\winjson.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\cmstp.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\RacWmiProv.dll	cmd.exe
File opened for modification	C:\Windows\System32\MSHEIF.dll	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\sihclient.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\QuickActionsDataModel.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BITLOC~1\BitLocker.psm1	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\uk-UA\MSFT_FileDirectoryConfiguration.Registration.mfl	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\bthspp.inf_amd64_bdb56f181ef6934c\bthspp.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\usbaudio2.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\storufs.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\esrb.rs.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\mimofcodec.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\WindowsUpdate.psd1	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\eventvwr.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll	cmd.exe
File opened for modification	C:\Windows\System32\CloudExperienceHost.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\usbcir.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\MsraLegacy.tlb	cmd.exe
File opened for modification	C:\Windows\System32\srchadmin.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\MbaeApi.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\intl.cpl.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\RDLSBU~1.INF\rdlsbuscbs.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\UcmUcsiAcpiClient.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\de-DE\MSFT_ScriptResourceStrings.psd1	cmd.exe
File opened for modification	C:\Windows\System32\CellularAPI.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\msxml6r.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ETWCoreUIComponentsResources.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\nulhprs8.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\SDFRd.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\pmem.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\rdpinit.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\connect.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\MSchedExe.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MI54F1~1.EVT	cmd.exe
File opened for modification	C:\Windows\SysWOW64\en-US\ir32_32original.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\en-US\neth.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\eqossnap.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\wdigest.mof	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\e2xw10x64.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\schannel.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\wbem\WsmAgentUninstall.mof	cmd.exe
File opened for modification	C:\Windows\System32\Windows.Media.Ocr.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\idtsec.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\storufs.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\Windows.Devices.Background.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\windowsudk.shellcommon.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\FirewallControlPanel.dll.mui	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol
T1021.001

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\termsrv.dll cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Drops file in Program Files directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Images\Stickers\STE7D3~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\3039_2~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HxA-Advanced-Dark.scale-150.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\OU0E3A~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\ja\System.Data.Services.Design.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WI54FB~1\NETWOR~1\wmpnss_color48.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\SplashScreen.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\jscripts\WEFGAL~1.JS	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI46F3~1.0_X\PEOPLE~2.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6EA8~1.SCA\Assets\AppTiles\CONTRA~1\WIDETI~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\LiveTile\10px.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\7734_3~2.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF104~1.0_X\APPXSI~1.P7X	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\ExchangeBadge.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\MICA65~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\it\System.Speech.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\Store\AP9424~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Cortana.exe	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI92C9~1.0_X\Assets\CONTRA~1\MIB7F4~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIEACE~1.0_X\Assets\VOBD34~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\PresentationBuildTasks.dll	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\es\UIAutomationClient.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~3\TABLET~1\TableTextService.dll	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\de\System.Web.Entity.Resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\ipscsy.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\APPXSI~1.P7X	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\SECOND~1\Work\CONTRA~2\LARGET~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI10D6~1.0_X\Assets\CONTRA~2\WideTile.scale-125_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\EMPTYC~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIE908~1.SCA\Assets\SECOND~1\Car\RTL\CONTRA~1\LARGET~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldContain.snippets.ps1xml	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~2\210x173\34.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HxA-Yahoo-Dark.scale-400.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\SYEFFE~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF781~1.SCA\Assets\Images\SKYPEW~3.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\Assets\STANDA~3.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MICC29~1.SCA\APPXBL~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\Assets\SQED9E~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\CONTRA~1\AP540F~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\Images\SUGGES~1\PUSHPI~2.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~2\ON75E3~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI10D6~1.0_X\Assets\AppList.targetsize-30.png	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\es\Microsoft.Build.Engine.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HXA-EX~2.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HX3000~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNoteNotebookMedTile.scale-400.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HxMailAppList.targetsize-30_altform-unplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\SY13BA~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\CONTRA~2\MEDTIL~3.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Images\Stickers\THUMBN~1\STICKE~2.JPG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI3DF1~1.0_N\APPXSI~1.P7X	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HxA-Generic-Dark.scale-300.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\ExchangeLargeTile.scale-150.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIE908~1.SCA\Assets\SECOND~1\Home\CONTRA~2\WIDETI~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\STOREL~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\fr\System.Data.Linq.Resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\AppPackageStoreLogo.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\PAINTS~2.WIN	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~1\ON6C5A~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~2\ON9B7D~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\CONTRA~1\APE65E~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HxCalendarAppList.targetsize-48_altform-unplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HxA-Generic-Dark.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI63E7~1.SCA\Assets\AppTiles\BadgeLogo.scale-125.png	cmd.exe

Drops file in Windows directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\AM7261~1.1_F\PNPCLE~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$240D~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO22FB~1.1_N\DISPBR~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO1ED0~1.1_D\IISFCG~1.MUI	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Drawing.Design.resources.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5EAA~1.746\tlsbln.exe	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\PR6216~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM4C5E~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMFA78~1.102\f\PICKER~1.EXE	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM2E0F~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM7209~2.MAN	cmd.exe
File opened for modification	C:\Windows\Globalization\ELS\HYPHEN~1\MsHy7de.lex	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.Hosting.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMDA3B~1.1_D\MIUTIL~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7553~1.1_E\MICROS~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA739~1.1_I\NDISCA~1.INF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\MSBB24~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC594~1.1_J\WINDOW~1.ADM	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WO929D~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\X86EA1~1.1_U\F12PLA~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMF15D~1.1_F\USBXHC~1.INF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMBC7A~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM0E35~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMA5CD~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WOA1DC~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO3EEB~1.1_E\l2gpstore.mfl	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM19FB~1.1_N\DOCUME~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMBA68~1.1_E\UIRIBB~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\Backup\WOD30F~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM0FF2~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOF686~1.1_J\wmiprop.dll.mui	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC1A1~1.126\f\ALLSYS~1.XML	cmd.exe
File opened for modification	C:\Windows\WinSxS\Backup\AM6B4B~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WOADB4~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WODB2D~1.746\spwizeng.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM4682~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMF081~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM4D06~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOF42C~1.153\AVTRAN~1.XML	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO1749~1.844\msxml3.dll	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\dom\domExplorer.css	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5B91~1.1_F\COMDLG~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\Backup\X85634~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM686A~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA6C7~1.1_N\BdaSup.sys	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM253D~1.126\f\WINRES~1.EFI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM04FD~1.1_D\FOLDER~1.MFL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2D14~1.1_D\NFSCPR~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM35C6~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO16F4~1.0_N\DATASV~1.CON	cmd.exe
File opened for modification	C:\Windows\WinSxS\X8A77C~1.262\CMIADA~1.DLL	cmd.exe
File opened for modification	C:\Windows\Boot\EFI\ko-KR\bootmgr.efi.mui	cmd.exe
File opened for modification	C:\Windows\Cursors\busy_m.cur	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6D82~1.126\f\APPXBL~1.XML	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4190~1.1_N\CONTAC~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMBE47~2.1_E\BTHCID~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO3274~1.264\r\WINDOW~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC219~1.1_F\UMPNPM~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMAFA0~1.746\r\IdListen.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\MSC8D5~1.1_N\MICROS~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO3611~1.126\f\spwmp.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO9D3A~1.1_N\wksprtPS.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\aspnet.mfl	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM81A0~1.546\f\dusmapi.dll	cmd.exe

Checks SCSI registry key(s) 3 TTPs 52 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1456 taskkill.exe

pid	process
1456	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

SearchApp.exeSearchApp.exeSearchApp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

Processes:

SearchApp.exeSearchApp.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeSearchApp.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exefirefox.exeStartMenuExperienceHost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\ = "0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2045521122-590294423-3465680274-1000\{B143F8C0-AFD2-48AC-9397-EDD319260BE5}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\NumberOfSubdomains = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search\ = "0"	SearchApp.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exesvchost.exeSearchApp.exetaskkill.exeexplorer.exeexplorer.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1552	firefox.exe
Token: SeDebugPrivilege	1552	firefox.exe
Token: SeManageVolumePrivilege	4108	svchost.exe
Token: SeDebugPrivilege	1568	SearchApp.exe
Token: SeDebugPrivilege	1568	SearchApp.exe
Token: SeDebugPrivilege	1568	SearchApp.exe
Token: SeDebugPrivilege	1568	SearchApp.exe
Token: SeDebugPrivilege	1568	SearchApp.exe
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeShutdownPrivilege	1008	explorer.exe
Token: SeCreatePagefilePrivilege	1008	explorer.exe
Token: SeShutdownPrivilege	1008	explorer.exe
Token: SeCreatePagefilePrivilege	1008	explorer.exe
Token: SeShutdownPrivilege	1008	explorer.exe
Token: SeCreatePagefilePrivilege	1008	explorer.exe
Token: SeShutdownPrivilege	1008	explorer.exe
Token: SeCreatePagefilePrivilege	1008	explorer.exe
Token: SeShutdownPrivilege	1008	explorer.exe
Token: SeCreatePagefilePrivilege	1008	explorer.exe
Token: SeShutdownPrivilege	3912	explorer.exe
Token: SeCreatePagefilePrivilege	3912	explorer.exe
Token: SeShutdownPrivilege	3912	explorer.exe
Token: SeCreatePagefilePrivilege	3912	explorer.exe
Token: SeShutdownPrivilege	3912	explorer.exe
Token: SeCreatePagefilePrivilege	3912	explorer.exe
Token: SeShutdownPrivilege	3912	explorer.exe
Token: SeCreatePagefilePrivilege	3912	explorer.exe
Token: SeShutdownPrivilege	3912	explorer.exe
Token: SeCreatePagefilePrivilege	3912	explorer.exe
Token: SeShutdownPrivilege	3912	explorer.exe
Token: SeCreatePagefilePrivilege	3912	explorer.exe
Token: SeShutdownPrivilege	3912	explorer.exe
Token: SeCreatePagefilePrivilege	3912	explorer.exe
Token: SeShutdownPrivilege	3912	explorer.exe
Token: SeCreatePagefilePrivilege	3912	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe
Token: SeCreatePagefilePrivilege	3936	explorer.exe
Token: SeShutdownPrivilege	3936	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exeSearchApp.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1568	SearchApp.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1552	firefox.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3912	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe
3936	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

firefox.exeSearchApp.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exe

pid	process
1552	firefox.exe
1568	SearchApp.exe
4940	StartMenuExperienceHost.exe
516	StartMenuExperienceHost.exe
4416	SearchApp.exe
2416	StartMenuExperienceHost.exe
1792	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 968 wrote to memory of 1552	968	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 1884	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 3160	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 3160	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 3160	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 3160	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 3160	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 3160	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 3160	1552	firefox.exe	firefox.exe
PID 1552 wrote to memory of 3160	1552	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo
1⤵
PID:5108

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b0b0feb-c21f-4923-bc2f-cf62df38fd9f} 1552 "\\.\pipe\gecko-crash-server-pipe.1552" gpu
    3⤵
    PID:1884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ea510bf-0be0-4035-9112-58627b0d0a6b} 1552 "\\.\pipe\gecko-crash-server-pipe.1552" socket
    3⤵
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1448 -childID 1 -isForBrowser -prefsHandle 2828 -prefMapHandle 3032 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c8acac3-f0a0-4316-81f9-afe93fa59740} 1552 "\\.\pipe\gecko-crash-server-pipe.1552" tab
    3⤵
    PID:3692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4216 -childID 2 -isForBrowser -prefsHandle 4208 -prefMapHandle 4204 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d20c3a7-4ecb-4de6-8865-fb62ec564edf} 1552 "\\.\pipe\gecko-crash-server-pipe.1552" tab
    3⤵
    PID:1692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4844 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4800 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6324578a-6c78-41d3-a694-9e04d3bd217a} 1552 "\\.\pipe\gecko-crash-server-pipe.1552" utility
    3⤵
    - Checks processor information in registry
    PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5284 -childID 3 -isForBrowser -prefsHandle 5212 -prefMapHandle 5276 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b39d5eae-d3eb-41e7-97f8-5217e8bde1ae} 1552 "\\.\pipe\gecko-crash-server-pipe.1552" tab
    3⤵
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5008 -childID 4 -isForBrowser -prefsHandle 5424 -prefMapHandle 5428 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44387af7-d041-4811-a839-1103c3a45e83} 1552 "\\.\pipe\gecko-crash-server-pipe.1552" tab
    3⤵
    PID:968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 5 -isForBrowser -prefsHandle 5200 -prefMapHandle 5196 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86205159-f3ad-4d3f-ae4f-ddd93669a6d4} 1552 "\\.\pipe\gecko-crash-server-pipe.1552" tab
    3⤵
    PID:2364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3152
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1008
- C:\Windows\explorer.exe
  explorer
  2⤵
  PID:4696
- C:\Windows\system32\net.exe
  net user /add Tesr
  2⤵
  PID:2624
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add Tesr
    3⤵
    PID:2824
- C:\Windows\system32\net.exe
  net user /add Test
  2⤵
  PID:404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add Test
    3⤵
    PID:1264
- C:\Windows\system32\net.exe
  net user /add Test
  2⤵
  PID:1832
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add Test
    3⤵
    PID:4720
- C:\Windows\system32\net.exe
  net user /add Test
  2⤵
  PID:2076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add Test
    3⤵
    PID:2100

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:4520

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:4320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:744

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:4728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4360

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3744

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\9a1325aaf5254712b8ef8557b1bb005e /t 1436 /p 1008
1⤵
PID:1812

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3912

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4940

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3936

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:516

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4416

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:1012

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2416

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1792

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
PID:5572

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5940

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3992

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2504

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5840

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6060

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3fee055 /state1:0x41c64e6d
1⤵
PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Print Processors

T1547.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Print Processors

T1547.012

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\MOZILL~1\PROFIL~1.JSO

Filesize
78B

MD5
69fc4661a720a5b18c617f8aba669086

SHA1
34d23900376f6b998de7395a173a9be240ec0637

SHA256
095e42f401add68acfc017a51c8da1bb79a6313328c50d9423a41314d4c979b5

SHA512
167a2d594f2aa1a9987b67e4345bef1bd7e56deac1ef6994d7324299b9ebbe19e8760b88d490b48d51062654c2112c30767dc7687f3ddd86ffda11378d6a0ae0

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
1.7MB

MD5
c606bd7c9c733dd27f74157c34e51742

SHA1
aab92689723449fbc3e123fb614dd536a74b74d4

SHA256
606390649012b31b5d83630f1186562e4b1ce4023d8870d8c29eb62e7e0769e0

SHA512
5f8fabe3d9753413d1aedcc76b9568c50dd25a5a6aeacd1ce88aecc28c0ba96dac80177679d380708213a0997946e49383bdaca7114c8c9526a24ed999194e38

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll

Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll

Filesize
83KB

MD5
1453290db80241683288f33e6dd5e80e

SHA1
29fb9af50458df43ef40bfc8f0f516d0c0a106fd

SHA256
2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c

SHA512
4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini

Filesize
174B

MD5
e0fd7e6b4853592ac9ac73df9d83783f

SHA1
2834e77dfa1269ddad948b87d88887e84179594a

SHA256
feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

SHA512
289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

Filesize
1024KB

MD5
b689365d014c23c2993be952c4505ed3

SHA1
ff9a766868444eb4af361ef58ef5d230d8f1ee1b

SHA256
f1e0491311282e26ef0a8e897bb529e5c749d9f82a17055c47643fb4674ba5a2

SHA512
e6fb02ddf1a35eaaa18aa6fcb5fb05ec196fa6716ebded145b68fec3a363c50671a38a7d89dc2cc73a3d966758a6c8bf6428e2a606fc6350f5912a868980b4b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
7KB

MD5
40f4f601401e9e233c4c791c2cb83481

SHA1
2029fb2dabfb7c0d85b42bffd946279ad9ebc75f

SHA256
a67ca563706c15aeabe091a4abedd0e31797f98f995a978fc91d38d6f3841046

SHA512
748217e966a6fd114cd2839808cfe5843139d4a9bac1320eb30cc56f152f77bfb71fb30467e2333d9fb7de4d24960f01cb0d5cb17c9451351787aaa4f5609efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

Filesize
24B

MD5
419a089e66b9e18ada06c459b000cb4d

SHA1
ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a

SHA256
c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424

SHA512
bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
7KB

MD5
f6b8a516758bd894b7399fac6fea14fa

SHA1
2167bf9326269d26b50d57f6f7f1faa7ef0f3251

SHA256
8059e464ef8789e65fd9b130aef5189a1b90281df38b946a56d216873ddc541e

SHA512
21cc9f42304df49959e615650d7c31260a6c9376e4591104bd56ebe5eefb332d97dcaa865342d15c1c1afebd5af76c5cab95529816d2e5ba514a6a04c7ede29d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\ACTIVI~1.JSO

Filesize
21KB

MD5
9b37ed1497824929bee12af4f74399a5

SHA1
db73274ba6e9e15e1ae55de3f77e494607d2613d

SHA256
6833cf5be9965558490b78566dff8bf252bd7b14c5e2534047e11eaaacb2b7a4

SHA512
7706fd57ff471b541d021928e6b53549bb00d4f279e6cb03ff9f22cc7ad1c469d05f79bbb2a1aae448565087690a07bf28c79f15371a38762057a08b1ecc5024

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\STARTU~2\SCRIPT~3.BIN

Filesize
8.6MB

MD5
2ae73e613d775bb5f40c73799e7923e9

SHA1
28bfc274950ff1e34f7d03a57100401f0339e40a

SHA256
e4da92dbcd80e3db16aab95366c65880a4859f39357400f4f8946e53c0ff3b5e

SHA512
25953b8ef950bd7e60ba51ad724b4edf2f0eac7b6add06ebee3e738a4a4f5193f2e173826e894614fc777775126ee0cd036e8be9194d7cdb04d6c098ed1b5b93

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\STARTU~2\WEBEXT~1.LZ4

Filesize
107KB

MD5
29c3ff60853db6f892501ec8869d8099

SHA1
3b0e2c08208e61e883fdd0ef11c5d25fb01180e5

SHA256
887d68e6834e3364b29b334222a7a5b296f11d8354d817ae02ab85d2931b383f

SHA512
7b4099b36645168f46c2a38a42f9fafba3eb9f73a82b79b9753d94cfd45251f28ccecd04f77ac7609c86b6a2e73fabc23aba7780d15744329bb5952837d479ff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\STARTU~2\urlCache.bin

Filesize
2KB

MD5
2639b269874aba39adc4f7fd7dda66f0

SHA1
3e5b39f943379fc2fd153b23fa047eb04c1d0e6d

SHA256
1966d4633167bc6415560cac0b6d702e34804d7a1153dfd86b3c03e9479fb331

SHA512
74877e733e13acf4464798c3d5f439bd3de7e82f3f023858b03aaa18b1c91e90f068abbcb26cd9148d76406d002553ae0ef2c393c16d84336864458731742dda

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\0305BF~1

Filesize
13KB

MD5
b38605fb06e7d0fc2559282bbe4c9432

SHA1
1e5a45e0ad225362bec72846a1b991045a7798bc

SHA256
ad0adafa172658b18b11b46d4e3ec713028da39d1492fb61b6c26deee01b0428

SHA512
984c93a96249f022faeb77f7a9ecff1c4a694b595e753d574b59b77619fbd6f850db1b027053fbc80dda330cc21a6f668aa07caa12e389841ef4dbbf04e51516

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\0EA2E1~1

Filesize
480KB

MD5
78b99b3970a2a9e64f659d5f734687e9

SHA1
26f8757c8bbcbe7139da0c24167885a76f31ecee

SHA256
c36443b97bdd4bc0442c92098f470d10be3f7beb24786f727cbdc386ce8a17db

SHA512
852f88a13f660b92ae8ed00e982c66f842aa85ec204bec9e29eddf2085c14670b85fe4027d1ba56131cd6c1d55935912937b72ebc8490f23c799efc88829c85a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\254256~1

Filesize
9KB

MD5
f7a6a2b4515b9a360465005b351c957b

SHA1
de8fe80ded4d566a7da4b69a2009dc6d21d9fc00

SHA256
5ba9ae89767bbe5024498f8ebeeedde2b6b5676962b0ed5748f971489a9ff079

SHA512
63443985c6c7d400d8792ee3e07bff5324923513db77f04181c2f8a3e4924cd83341dc4128ab689da26ec8ae8775feaea9333d22e6386b8f5d332a0c17bb5ae4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\262148~1

Filesize
13KB

MD5
81a455dab178502809dca7e8d5e0ee11

SHA1
49bfee92cb7ca762c841823e74d1954ef014af09

SHA256
fc4e89f7129cea1d47425001350c7831a3990b63c62ccb762308ff991607da66

SHA512
349c55453314fe0829fab91015ef2fbfffe4caa433a3c2ca6e0de6e3b9d39b70ff12036b3d7603652a4beaf4362967537e79595518f7f5d4ff81980d648107b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\4BCE83~1

Filesize
12KB

MD5
0f18e5a4cde6175e51258b2f64f6de7b

SHA1
ebfa23fa221bcc2b699575da62fef005343ebdc0

SHA256
72a5e2ef9c1dce5dafa331c0e08102e456091bd541e8e2cd8182038b0acbec18

SHA512
ef3ec9020e25eb9e959377294420f7d50e34ca64b8c0eef8e7f31bfdb3e0096a8cc8fbfcc6618009d0a87e9e09fb305731fc4d9aab4281cef03a588515a5e496

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\6D8934~1

Filesize
15KB

MD5
f189bc04f2334f366df8f982e02a9c60

SHA1
3b76ff33963cfd55b757add0de69f14064d36d07

SHA256
8db520fb75e9094d71823755e5098d08a4885cf218822d264ac1ddff2f229ec3

SHA512
ff49824aa37795e1ef84394e4665e8f00529b500700324768ab25b5e98b3b7f243d0a12b57d2f1fd522e64ee7405626c593580a31386cd0889f8afb213bc0cdb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\794379~1

Filesize
38KB

MD5
8d10f9fd061c11899cd141d457e0e519

SHA1
0d4f76d4897bae204c8580bd6ef40d995db6a82a

SHA256
fd1ab4294ab36479c337dc91722fc2cd93b9229602fc02f5e873035100e69702

SHA512
cb917f804dc0652bbab5e887737f96d0779219b7f06939473fa0c579a23419a75c336016e6422d0879dcaba99bc2b999f2157d5d06755fb61ca6f8e3a95e23fa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\7BFCF3~1

Filesize
16KB

MD5
3f6c8d8f5596b9f4407df5cb6ff78de3

SHA1
b99793c131693b5b098340eb0fe94a5575d20872

SHA256
7177bb11564f29e9fc3a11238ec419a3574c635053b347f304e608e22934315c

SHA512
1b2622e50f71e8d129a2fd8985888c677a1b4efe16a90ec7df977e2109e53fecea5a784a5a008cbece6a244dfa9a3682434a1f85bd036ac82bcffb04d5083990

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\A18D0B~1

Filesize
13.8MB

MD5
be2dc5437c379a210d9afb0aebe0093c

SHA1
93da54c7252c61f15df2a2ccd5469835c006fc01

SHA256
95ae41b56d39f83c52e08d02ae7f5229b07b72db88cb7bde6a045348c627ed37

SHA512
4091836ca88503055924c6d6cd41835f7db12fccde5adc4307743e33df053c6a553a7bdc4a14ea0e2a5698fcc6136103843ab0203ab0b3d25d43db510021105b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\CA3292~1

Filesize
38KB

MD5
3064e827aee8a78f98fbcb85ec84ac5d

SHA1
9e8dd00dc7ef65d8d384029eb3e565002bdee502

SHA256
2b8db23b5007fa20d9101baae7398622c124fc1f2d54bee3fe13a25e2a30e76e

SHA512
3c3080ac815c2c5f00204a26b6c0b068ca93adaf691f7c46f2fad5754ec26ac95a7a55e96b5b8b1dcd7a0ab75915989b09ad4347b035492b99ec2e89a43d5f4e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\D059FD~1

Filesize
14KB

MD5
3a45f7eb648cc32d21ece6862723d13b

SHA1
2835292f6c309087a4840074780dfbaa78014c9f

SHA256
b49644fc2afc706c17ef4fb91b074419cbc27ed2720dbf9bb05263e2365f328f

SHA512
3b2ca4f4d086980abe07741d18d67e166fe395c51ea04a0882835b63b83c093ebbd441fb4946467e37f70904bb49b610a39948a43c7b47129f1579c3fadabc03

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cache2\entries\D0F48A~1

Filesize
132KB

MD5
3b1a1851adaa6b6e1536669f0c922527

SHA1
981a0ecdeabf6ab7b436cf0e4e399e8da185c1f6

SHA256
70a936ad3222c757032083bb8558d2dddeb3fc8198c3f512cbab27e815c10a96

SHA512
e72ce53c360901baafa61ad01c204a5f87cd1d31aac2983187ba4243c52b56fb04aa2196f05e249860ed755466c5d9a4ad69e337ba1e5fe3c703b1183303a669

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
d59a52e83167da830a9ceb90bce3efb6

SHA1
7249edc7deabb7da4c58e5f76c019eeff2a4c175

SHA256
93bfea0dbf22a19c15aa96d2100a117634eba08191c6b2640a39f29e712dcf00

SHA512
f342d46fd4ef3848a0fe601cae8f2e6c725cb23f8dc68379737ca29a394bbdb1aa395d375bf2d78e511e4325e6cf4a7c0a1b1564d1c7e628d7a1b68e2a189896

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8D37TE9D\microsoft.windows[1].xml

Filesize
97B

MD5
808a2f5b66c49a05f7d19e5029adec9b

SHA1
f59d5b652dd001eee7933b2ff806165628fbb85f

SHA256
59b84be37368c5064b3d8934a1a578cf64ca84e7434f19579ca603686a27e215

SHA512
16a23983c121fe0d3664667cc41c60083678283d7790fbf9a0457145b4a7c49866f9d62fe7f189ec3a53db4752e9e923f431055c1ce8dc0a406d2dfc4f4b593f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}

Filesize
36KB

MD5
bad093419be1135cfe9694ea77088c78

SHA1
76204c7ca72cf666add9c9931389d635c82e8af0

SHA256
136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c

SHA512
3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe

Filesize
16KB

MD5
987fa60665ab15ba306df1f9ef30d5bc

SHA1
2daee868cc9914eb7cbf1ceed0107e5d2267dcb9

SHA256
277660b4840649422ddd0633e561c446bee224b956850532ff0573eae34fb61a

SHA512
2913ee54036ceb12affe5a5fc8de35143b4e19c1f4c44e62e974752c3217f10aefb4a9d41ff54ea5aa9e6957a2d49c8dc84103706e19b459428de200ae8d5b75

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9e3509d6-5c53-4922-9b83-08cbbf08e2aa}\0.0.filtertrie.intermediate.txt

Filesize
28KB

MD5
ab6db363a3fc9e4af2864079fd88032d

SHA1
aa52099313fd6290cd6e57d37551d63cd96dbe45

SHA256
373bb433c2908af2e3de58ede2087642814564560d007e61748cdb48d4e9da3f

SHA512
d3d13d17df96705d0de119ad0f8380bfe6b7bc44c618e2fcd0233061a0ab15beae44d38c48a880121b35f90f56c1529e5f4cf1a19acb9e2cbba5d1c402c749c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9e3509d6-5c53-4922-9b83-08cbbf08e2aa}\0.1.filtertrie.intermediate.txt

Filesize
5B

MD5
34bd1dfb9f72cf4f86e6df6da0a9e49a

SHA1
5f96d66f33c81c0b10df2128d3860e3cb7e89563

SHA256
8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

SHA512
e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9e3509d6-5c53-4922-9b83-08cbbf08e2aa}\0.2.filtertrie.intermediate.txt

Filesize
5B

MD5
c204e9faaf8565ad333828beff2d786e

SHA1
7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

SHA256
d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

SHA512
e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9e3509d6-5c53-4922-9b83-08cbbf08e2aa}\Apps.ft

Filesize
38KB

MD5
84ac0c242b77b8fc326db0a5926b089e

SHA1
cc6b367ae8eb38561de01813b7d542067fb2318f

SHA256
b1557167a6df424f8b28aabd31d1b7e8a469dd50d2ae4cbbd43afd8f9c62cf92

SHA512
8f63084bd5a270b7b05e80454d26127b69bcb98ec93d9fad58d77203934f46b677a3aaf20f29e73dcd7035deb61f4c0aa3b10acbc4c0fc210632c1d74f705d2f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9e3509d6-5c53-4922-9b83-08cbbf08e2aa}\Apps.index

Filesize
1.0MB

MD5
f4514c93191e0efc0f61036e4ebb341a

SHA1
c80478e9a734790c18584f67a43518aa4a7dcf58

SHA256
43da4fa5f62affe399ceaac2d489b7cde610963a48e72d445bebe6f2c63a3600

SHA512
8aecb3491767e040a52f351908004db2c8f2f083397744585c2832212ec8aa288d3492be941a48b04774e16b43672ab167209776cbdef6692fef684fc54666a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{747f2a0c-2016-4d22-9159-1654e543b457}\apps.csg

Filesize
444B

MD5
5475132f1c603298967f332dc9ffb864

SHA1
4749174f29f34c7d75979c25f31d79774a49ea46

SHA256
0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

SHA512
54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{747f2a0c-2016-4d22-9159-1654e543b457}\apps.schema

Filesize
150B

MD5
1659677c45c49a78f33551da43494005

SHA1
ae588ef3c9ea7839be032ab4323e04bc260d9387

SHA256
5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

SHA512
740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{747f2a0c-2016-4d22-9159-1654e543b457}\appsconversions.txt

Filesize
1.4MB

MD5
2bef0e21ceb249ffb5f123c1e5bd0292

SHA1
86877a464a0739114e45242b9d427e368ebcc02c

SHA256
8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

SHA512
f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{747f2a0c-2016-4d22-9159-1654e543b457}\appsglobals.txt

Filesize
343KB

MD5
931b27b3ec2c5e9f29439fba87ec0dc9

SHA1
dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

SHA256
541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

SHA512
4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{747f2a0c-2016-4d22-9159-1654e543b457}\appssynonyms.txt

Filesize
237KB

MD5
06a69ad411292eca66697dc17898e653

SHA1
fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

SHA256
2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

SHA512
ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133732857759717529.txt

Filesize
73KB

MD5
4c036314f080c753345c8481caf9ae5f

SHA1
c90add2903b9de1bfac12a139e2551af8ec71745

SHA256
ca7a49706055df15b0d7f15795ca9846c18f76f20ce135c039f99096bf164b71

SHA512
2c42b710436c2153a935fdbee7399177deca03c9c877cff99ef2dfa237fc7da5cc0dfbd93129122b268f8eda79f34e41ea5f9c901e5dee35861a2c9dce09bc38

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Filesize
670KB

MD5
9eb5f69e443e7d835e78519e5f3b3ef4

SHA1
5ba40cd4a127359dbd006eb3b0f800809c138659

SHA256
4aa1fa29fd0a2d15b9204426cfee2e348dcf65f5b444b53fc5425a0418a3fdcd

SHA512
b14fd14a1ac0aa59e0b648b64af0fa4848a4601124fe8b37d0c3f7e4066908237eb1c9d01a43aa45444db104c68380a60e1e1625d1f4eda5d501a3c33206cf4f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Filesize
232KB

MD5
8add554f741fe41ea1f257a4cab1e70e

SHA1
ab3ee9daea7247a77ddcd9042dc76486ef4d57ff

SHA256
2d0e027f1d5d80c158760f3e19327709847b01e17c512360aa50732fb2ade108

SHA512
2ef7e8b94d34dac71ca8fff8f7ba2a18072391cc63790ae5fa804c4dd4f02ce9830cfbf6d74ef69fad27afd6dfba37c5f3d6ef24b1944d2164e0952d5dae4ba2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
10KB

MD5
3cdc8d32e648799d76ce87039f01c80b

SHA1
97374dc6766d40cbd93813602fb2d4edddd214f4

SHA256
53e8f9473414f6311527ab72894612d53eaeb6d14cbfcd5fb0775dfb75d81029

SHA512
015dbb349f93bcb8e8569ce8da68a962504300b9eaabc18d368287541fd9bfbba1cd572668babf244e086dc34b6c6cde296ff46773e3d022d95d05c9967f29fb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
10KB

MD5
7b9b38603337c75585d9324320540ecc

SHA1
98c5c747f8bd23c83cc3ffe9de80dc76b9d74dc0

SHA256
05f91fb55a7f759876cf5f645443dba6eaabd15c5c2d8ce91fabbd5619692ae9

SHA512
865050c160469fa4648f52769afcaa7c652ae6ece2220e689ee74d82304bafcba453351880e334394065ba106619b1d8c3feaaea92b024009d488f15e8371537

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Filesize
13KB

MD5
5257c866338c914a6676973d68393e4b

SHA1
2442ef4c2f7d890fc65da19861fd2994093b538f

SHA256
c0893352155b1a5fee6088b8f54e857a58b72cdb6acc04a8d93c6b0ddbd2e70c

SHA512
4342deebf9c3ad00933815ddb12daf61ee78f34ba5972ed07f7cfb25f3be842a95652ee7831a1f4822d59a87306ff457b7c7e26027df90e18ff47e3358781430

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini

Filesize
174B

MD5
17d5d0735deaa1fb4b41a7c406763c0a

SHA1
584e4be752bb0f1f01e1088000fdb80f88c6cae0

SHA256
768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed

SHA512
a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

Filesize
174B

MD5
a2d31a04bc38eeac22fca3e30508ba47

SHA1
9b7c7a42c831fcd77e77ade6d3d6f033f76893d2

SHA256
8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531

SHA512
ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg

Filesize
14KB

MD5
2257fa8cef64a74c33655bd5f74ef5e5

SHA1
b9f8baf96166f99cb1983563e632e6e69984ad5c

SHA256
ead48b70e048de6ccca219a229ca90b49a9d1b9c14bf3a7c5eaad544294fcfd3

SHA512
7792be9b935a46a923e97bb76b76957070e116dcc4cb6fcd8b883c2d6f142285ebc9fd26cdf29bd19c8bdff412487f586abaa1724332b613e71afa45d7f3e4f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\ADDONS~1.LZ4

Filesize
5KB

MD5
e0573c5353827e3636ad1ecc967688fe

SHA1
516468aac41d97bed72ed2113b4314c8749a389c

SHA256
480b99af5bc1c56109d54dcdbfff1bcda29852a454150b6cf09af4fd8adcb331

SHA512
d2469436afcdb4f295d5a461f1a34162f795c81b9bb75cbfa33e5eb55c384bcb36914518ced53d8c2c97735bff61191e649c5ce212562273f028998531ae1b9e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\BROADC~1.JSO

Filesize
209B

MD5
97c3738563a9448365a735f5f29ed3d5

SHA1
15a81433236ca6e6ecc4e1c8d0fdb8523b265c57

SHA256
63221253f5c30efa214c2cd2adcf51a9c9f9a2c05f119b00a51c9579825c2c24

SHA512
ed98f42d5d02ab53a9e50f80b312bed4b5d05d053bec582cf9d619ef91251e86cf4f4d1123c645500fc1dc4673b49a8b7badd3f3a39f565ac643ca4fd0157ae6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\CONTEN~1.SQL

Filesize
256KB

MD5
b5acd9cf58ba89e643e7b2e839e0707e

SHA1
82c2b9cbea4acb50b446b786818287be7b0b8b61

SHA256
4d4fd87f1cdccc9f826ab7de2b3980db6fe4ed328f079ceb24f680557da9667e

SHA512
1fdaf5173a2fa956e3793b3643b44d928a4c81a1599bdf4b057396bfca5948ce1097194dbb5f528959c8cf4e34d058922828236c6060b41510e9ea2cb9ed424b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\DATARE~1\glean\db\DATASA~1.BIN

Filesize
23KB

MD5
65fb212d55173db6704d31d9dc3963fb

SHA1
4bcca739416f3f097555f3cd59ae32bdd47fbb3c

SHA256
5088de38cc7086483a23c82c8e24f2bfb8cf8729bd997df6ff52173493f25923

SHA512
0c7fae65d9aba817502c9302dc17ba8cf4ee926c7c0f5165510921d2531acc5c0f526215407fcd6bbd82bf65aa5a27667d9f88e9aa6571d69f585e6ed3371db0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\DATARE~1\glean\events\events

Filesize
438B

MD5
f2d456688ed360b8e09a0bc980140484

SHA1
bbcc69fbdbd394ef906f423b0c44f399baa3ec8a

SHA256
0dcbfef16377f88ac584a590b6ef6d6117d871c2a1cf5cd600ea03b20fb9fb1a

SHA512
c1bc0aeb051e10bdd56f38a896880b5c6bdc8d037a2a673171c85ff71d0b687f8348faafb97406a54ccb750413bb638c626ce2166c20a51688a74319a1984751

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\EXTENS~1.JSO

Filesize
37KB

MD5
0b2a6cd75d84232ed64bd75375aacd3f

SHA1
305543411488fdb995f0ab9ac581e3e96f8325ee

SHA256
559906b8c1aabcccc1c0e395eaac9d4f41ae19800eb95f9db5d59d3c49acf40d

SHA512
aa19dcf6fa1edf7dfcb54f717153fb836fb6ccb4c9d017c7b829fe52a7dd2e0622f18de893b2a7f900f461bf121f49ed79541016be62bc9b81c9420bab55afb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\GMP-WI~1\410271~1.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\GMP-WI~1\410271~1.0\WIDEVI~1.LIB

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\GMP-WI~1\410271~1.0\WIDEVI~1.SIG

Filesize
1KB

MD5
36e5ee071a6f2f03c5d3889de80b0f0d

SHA1
cf6e8ddb87660ef1ef84ae36f97548a2351ac604

SHA256
6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

SHA512
99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\PROTEC~1.SQL

Filesize
64KB

MD5
d7e5433a87ae3a30de4ab9adc47023bf

SHA1
4edaec48083abd90bc532ba8dd015fe209b0e439

SHA256
c2da29c9c40900e9ae211f9083849b86355850faa503062d14ced549563f273e

SHA512
9b28c36dbe02dff99519fac684c8cb88b8a40b06454524ebf79e576bd22cd94ae0eabb2655aba32bc118767f645d4e12da06764ca5d73c4e42fc2c2e0c343961

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\SESSIO~1.JSO

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\SESSIO~1\RECOVE~1.JSO

Filesize
1KB

MD5
1822c31f1b9a7a249a1573fa3ff5f085

SHA1
11b0378f8f0ab5e056686e83d0b92e111b1deb5c

SHA256
691b93221a06f37c98d388c9080e767546b1105f908a54a521dbc27575af1057

SHA512
3242d2ad70256047f03068e035b1fe7efd55f6034c75d9c34de885410583d0c7bf1b6878a57673e1aed274365509a8a3248e3bed8653e2e7126c06482844e5ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\SITESE~1.BIN

Filesize
1KB

MD5
18628f10b77dc66590b07316bc10af8f

SHA1
a50f2b8bfd03edee00022185bc0f7a79c83eca07

SHA256
f8cc001dc9300615361c58116c2970a8ce7ef0140606fb1661cc83b10592e8f7

SHA512
4a4f2e9e74d0024fe0d352074c0000a16230aa7c5a04f05bc3f2f7525618509d6e04626474614fcf8ddd2de40da2456fb686a06410a8592d01e687faf9647394

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\TARGET~1.JSO

Filesize
4KB

MD5
ed3fc485a7ada0e95e3efc468d53dc97

SHA1
6e777639452a978673606e5920c0519b444df2d4

SHA256
7fe4b32415c0735298e7d225a8988eacd899018d5c41ba822a940cd74137afce

SHA512
6d7a015283ad6c3b27a4690827ee48bc7d07c99a671ab33305af88cb0d68128818738241b58cb0a76068a0d0cc86b3ad74d74a46b07384a1a74c8331d8d8771e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\XULSTO~1.JSO

Filesize
141B

MD5
d7a9c29a5421078a9135ccf1cade552a

SHA1
e1b43108778d359d8d9287cf59225617e1769463

SHA256
bade20948c677d1d458e39a4cf6d8c4d8237263d55e63370d6272fa3243ffe28

SHA512
49553b13fa1cc8d257f2ca9056742e6e11fbdce21633edeb5af6f863294f97ccf3cabe851d94bcedba03e2716311a48dcf8064eb1500f8a7c400b049bf48296f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\cert9.db

Filesize
224KB

MD5
58d879ec26f0e6a12c498752aa4442f5

SHA1
c53714fd0ea1b535e0aebc618e77732a98fb16c8

SHA256
7cc3edbb1178128cefc58e5bc0a4d19d730e5d34bbdc59c7ea6416fd987079bb

SHA512
bfb25508672e3da79d60ea1dac35c7cb1ae3b6b91791915c38e25b1414dde2418705fb80a34b3f09f54a7b1064557f08dc79cf133955ba8102f67a61a70b3e48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\crashes\STOREJ~1.MOZ

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\G9PER0~1.DEF\prefs.js

Filesize
12KB

MD5
b373654b781a465a52e51d551a221e67

SHA1
45e3aeeb269d54f2c541d9b0415d06d5aa48dfbb

SHA256
21c7ab6bc9fd9f7774f346eb889269f9ab01640285076bc1522f00404ff51aed

SHA512
11b3067d069264a2da0215ee56e2d0352862406ecae74416a616be35c9bc7488c75b7a2bcf017d23c81d761761e4fdf3c10ca158409401063a291550970933f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
8KB

MD5
d526434afb327a1e937947c98d0c47f3

SHA1
34f9f43a020d8fcd0ed56e88160afc40e40feb25

SHA256
95a0bd95dfaf5b7e09e036a60074a95aaf1836eab82a5718fa9684f644c69cfa

SHA512
c1007e5eb618a56e7978d2a274395a9c23c7beb10c614f7a088d40a04bbbbd85d895fba7731c2b12e187f3e84e4e9d0d572319c7c87d9e1ee69220d32be52c60

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e59f9bc3264d31600b74d93b0518b66a

SHA1
c6eaf2e2e8d85328ea930d7f9c999151e36f2551

SHA256
758302e5d28252c86d7b5f0df579f0517bc191d18e6de36966601def64c97d7c

SHA512
b49903eeee2ff79583b76799a24e0bc8a249c7f7c9ce0cc79e997689ade99e538f087f224d8fa02db4057c655d6125cd307393a3739184a89d9a142b77ed573b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
6982f8e6b9da9737f3e8a61f1fe0b7e1

SHA1
c79875fca0bfaaf8ae147d7d6334cac60e39f8d9

SHA256
db0e214ed5befd03bc14f380a5a6a3ac58b881c0df13b36366a3660a2c067411

SHA512
e7b6e896853b86a616e255c4184a9633ca9717aa7a8f152a6c893a547586fa8ffadf43feebb7f62ab623c9a6e4aac6175f1838b8288df54e6bc01cee2aaeb5d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
2f61c91290b0a868d04ba39ac26c3fcf

SHA1
32db82bc20fa73ed7c0afda7ccc84a1e8a4458ad

SHA256
833a848270391a133127862f5b946fd1a5b425a954fa4923c2f21636d9538bea

SHA512
3f01182d44b64e9f1a06a16b26c172e55e7d1bb110b63af982c775d1d90757e2e9d3263319468ab8049697a7c2048ddb2fe97ccae7ec8637fe9a611d6877d4a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
85088ae0302620e9b851b35509c23c59

SHA1
838ac7db0e929e58907ad1b491f661126d8fefbc

SHA256
74bf01c6f2ab33ad1ff6f31cd1fc10d07f6543f06087d808f10a2c5e3c9a573f

SHA512
063c7692f17110d81fb8638a8ab9918a35ad25f54434be8090f5d409593a9146e045da8ce1b1bcdd66c2421c2f7a7a3f0609234262b67664e37378007f08e53b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\12059aab-ff30-4344-baff-46be0e8d3136

Filesize
28KB

MD5
80840d085e632e30c01c1280f58efbb6

SHA1
b146935a63b47b4fac348c786e9ccd72ec58ef9c

SHA256
f6c82348401e464f1f60e8bd3f0295127a7e7223f1ba2f9c89814e09c750aaa7

SHA512
5a27744326ce2d4a6072085497c8fab87c18db027b20ca8c5ccae5a7a9b404c1470a5437f4a4f3d1eeaa7cb0d1a942a7284be1bc8baecc1e38008d18e6eae9ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\290a0a97-3595-4731-9093-99a11b349ce3

Filesize
671B

MD5
3cfc071340af75a0125e1cde1575a616

SHA1
73d9c0f0d10facb06653d6bf8934a4ab8052b3bf

SHA256
452ea6c27418c718b8ae6b8b6f2a149d5be2a61d685ce18fb6b5d84b9be12b22

SHA512
7bcd0042a9a6ee58c6436f838edd0f58d8e971c0c46cc0f69bea59739c609e88a6fc06240114fcb69be8100e6d1054bfae3d05b54a00bb87acffd7e1c954ed71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\4819bf0f-c220-4909-bdba-9b1799a7fcc6

Filesize
982B

MD5
966d32d2f2079d651dfa41498f880aa2

SHA1
4fc282bb7350feb162788d50eb4cf669f9d620df

SHA256
db6a944e4ab99782f84efc61e5796bfb823a0b8f5c3c8a618139eddc1191dc60

SHA512
361ff4814a88f03012e3fd2cf2efa6af5b28b5fed2e6bd25872d8cb88eeb60cf312000239dfec4a767b4f3861dca8118752761a37c5db58dc783c4e466eab046

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
12KB

MD5
724112819c6ba5bf753efe9975f84dd3

SHA1
cbeaeb32307305d20c8729e0b29faa097d420131

SHA256
5f3d097ac1c665da97166a410806d8c3ecb755ea388e195264c7e041810490ed

SHA512
cb1bd468f0a95c79d8bfc5f11559b8342601afbafc58c3f02194e90f6b1e35b9a270b3b17eaddf157b676a54d72512eb4edfe08d34be08c3ef4cb6f7eb02f2ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
11KB

MD5
422b934e2c241379c6bc9df3fc8ac2d2

SHA1
9fa09331197cbbe77d55885787e5e71d144f0fb7

SHA256
6bfd1e466c92fe65cdea0b7e51986b2031984d0fbed5d568efdc868cb5559b2c

SHA512
f7aeb7f4eb8a9645f51f26a8ab736d2b4cc57cca74b4e4c55742cff943d5d11235d858ac09a19f1391e6a2b3f0658dedf81ff5719181f5f34c5a2c4378c737bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
11KB

MD5
21789bfb8514afc4dc6a86064258aa0f

SHA1
187ca53f7d6e35b0f8be4dd634bde75f38cf3d76

SHA256
ceeefb12ca91f87b2ed5da3c208361433ac83c65c4cc88dd8ae8c484221061e2

SHA512
d158c10fe6509ef178f2e1fcc9c1993af311e766cf6169a6bc09ec902f1cd9079ed1dd0f2b4d90872806109c854e324f7b8a1c263dafb40dc39129e40172554d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
10KB

MD5
a81c7bfa1afedfb75f8c612ed77fe972

SHA1
0d5b8229c718dcb521b8d07482b3928e9a0f3916

SHA256
8442fbae3c1212ee63cf3d9a794e6883708adff13f7197f269193513e0ddc74e

SHA512
f3d40d0d5322a50eb6c8968321268e1cff4893a909808e322a588e4183b63fe03947ce11e0955e70d48bee08450455c2c54ef5922e8a39c824b741d3aca7c9ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\sessionCheckpoints.json.tmp

Filesize
212B

MD5
29ce37dc02c78bbe2e5284d350fae004

SHA1
bab97d5908ea6592aef6b46cee1ded6f34693fa2

SHA256
1bfee61e2f346959c53aa41add4b02d2b05c86c9f19ffefe1018f4a964bf4693

SHA512
53a9eb746e193c088210d8eaa6218d988f3a67ee4cb21844d682ff0178db040932404f5ce2f3cf8b4576313ba0ec33c04ca288c3412bfa5df7dd8230cc2068bb

Download Submit
C:\Users\Admin\Desktop\desktop.ini

Filesize
282B

MD5
9e36cc3537ee9ee1e3b10fa4e761045b

SHA1
7726f55012e1e26cc762c9982e7c6c54ca7bb303

SHA256
4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

SHA512
5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

Download Submit
C:\Users\Public\Desktop\desktop.ini

Filesize
174B

MD5
dc723b859dec1526568ad581aec334d5

SHA1
74e7432df4a66f246b5214d60b190b67e2f6ce52

SHA256
7148fbbf1aac8b5a54d248df19b60c00d3c0dcb2fd5bb2a1efd4e0f0eac6dd0f

SHA512
9bb97339f18dc8744bfb7cb8fd9392c580765e707ddc228ef5045150375510b43f1f4c310274e20fc1c0c51f50f40d4430f40561d5cff46ff42214e465490074

Download Submit
C:\Users\Public\desktop.ini

Filesize
174B

MD5
7220fad57a4b3d9d9755c51198cc0386

SHA1
bd2d52d62d3e9810e1072cc5ca6285da5e5c3853

SHA256
6de1a716b5c49541ebc9692b16efa6fdb75b18c2a210974f94f83dcfdf8800d7

SHA512
e46df475a3e52535913ae369fe56a1230fa11656b6fe31cfd160302a56f599cde45841d10f5faa53ac4c7f2da4a1de34d362153c35dc47cf87a4a8358625b9bf

Download Submit
C:\Users\Public\desktop.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\INF\machine.PNF

Filesize
150KB

MD5
342c5c14259f9774d6a3aaafb9e821f7

SHA1
d7e6cf4841cd89c79144512528826aea985892d3

SHA256
11d55ebc52907a9c4989901a02938248d478d083f133dce94a6709fb46cab060

SHA512
8c556826b72db758751e7689f12ca3bb7c5e802bca6f0a3c0c81c7957ce0741948e52349fe8d5b9b4d350d7cfa69b13da3d0a9d761ae4b520c9f2b157c0e905b

Download Submit
memory/1568-533-0x0000029759560000-0x0000029759580000-memory.dmp

Filesize
128KB

Download
memory/1568-555-0x00000297598A0000-0x00000297598C0000-memory.dmp

Filesize
128KB

Download
memory/1568-546-0x0000029759520000-0x0000029759540000-memory.dmp

Filesize
128KB

Download
memory/4108-500-0x0000025B2D8B0000-0x0000025B2D8B1000-memory.dmp

Filesize
4KB

Download
memory/4108-524-0x0000025B2D940000-0x0000025B2D941000-memory.dmp

Filesize
4KB

Download
memory/4108-523-0x0000025B2D940000-0x0000025B2D941000-memory.dmp

Filesize
4KB

Download
memory/4108-522-0x0000025B2D9F0000-0x0000025B2D9F1000-memory.dmp

Filesize
4KB

Download
memory/4108-521-0x0000025B2D8E0000-0x0000025B2D8E1000-memory.dmp

Filesize
4KB

Download
memory/4108-520-0x0000025B2D8E0000-0x0000025B2D8E1000-memory.dmp

Filesize
4KB

Download
memory/4108-519-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-518-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-517-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-516-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-515-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-510-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-511-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-512-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-514-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-513-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-509-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-508-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-507-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-506-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-505-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-504-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-502-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-503-0x0000025B2D8D0000-0x0000025B2D8D1000-memory.dmp

Filesize
4KB

Download
memory/4108-501-0x0000025B2D8B0000-0x0000025B2D8B1000-memory.dmp

Filesize
4KB

Download
memory/4108-498-0x0000025B2D8A0000-0x0000025B2D8A1000-memory.dmp

Filesize
4KB

Download
memory/4108-499-0x0000025B2D8B0000-0x0000025B2D8B1000-memory.dmp

Filesize
4KB

Download
memory/4108-496-0x0000025B2D8A0000-0x0000025B2D8A1000-memory.dmp

Filesize
4KB

Download
memory/4108-494-0x0000025B2D760000-0x0000025B2D761000-memory.dmp

Filesize
4KB

Download
memory/4108-475-0x0000025B25540000-0x0000025B25550000-memory.dmp

Filesize
64KB

Download
memory/4108-459-0x0000025B25440000-0x0000025B25450000-memory.dmp

Filesize
64KB

Download