discordrat | 35aab316cd44d29aa09a4b470cb6e645b3a23c33ca1f2b3861ba2c9fa78e309f

Resubmissions

24-10-2024 14:40

241024-r2atkavfjn 10

24-10-2024 14:39

241024-r1k8xaveqn 10

24-10-2024 14:31

241024-rvw38avdmj 10

Analysis

max time kernel
528s
max time network
529s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-10-2024 14:40

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

e7619dea03aabbb3b878797dade39f74
SHA1

f33fa0a714510ee2e51f62e2b6e2b4167cdf2f09
SHA256

35aab316cd44d29aa09a4b470cb6e645b3a23c33ca1f2b3861ba2c9fa78e309f
SHA512

f8c846b05b3c19beaaa1aefde43bcd0d5baa19e63dccaeaa1851c6b9b2da631cbd537116750122197a872e0be34b8bf2ec5cb8c22dd9592ea37b056c3d0dc44b
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC

Score

10^/10

discordrat defense_evasion discovery evasion persistence privilege_escalation ransomware rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0MTYxNzM4MTMzMjM1MzA4NQ.GA3DCO.ayqPnboYWnJ5Am6Uc_homjnJm4X0Uts_rRRS7g
server_id
1299013032357269526

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 3800 created 632	3800	Client-built.exe	5
PID 3800 created 632	3800	Client-built.exe	5

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

NetSh.exeNetSh.exeNetSh.exe

pid	Process
1976	NetSh.exe
4728	NetSh.exe
1888	NetSh.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

Processes:

svchost.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

Processes:

flow	ioc
360	discord.com
19	discord.com
43	raw.githubusercontent.com
109	discord.com
177	discord.com
182	discord.com
345	discord.com
359	discord.com
301	discord.com
107	discord.com
140	discord.com
144	discord.com
170	discord.com
174	discord.com
216	discord.com
218	discord.com
306	discord.com
44	discord.com
129	discord.com
148	discord.com
175	raw.githubusercontent.com
282	discord.com
339	discord.com
173	discord.com
300	discord.com
312	discord.com
334	discord.com
335	discord.com
337	discord.com
340	discord.com
171	discord.com
297	discord.com
331	discord.com
95	discord.com
293	discord.com
336	discord.com
356	discord.com
227	discord.com
302	discord.com
358	discord.com
71	discord.com
97	discord.com
121	raw.githubusercontent.com
147	discord.com
219	discord.com
243	discord.com
341	discord.com
183	discord.com
217	discord.com
295	discord.com
298	discord.com
342	discord.com
353	discord.com
70	discord.com
146	raw.githubusercontent.com
213	discord.com
294	discord.com
329	discord.com
330	discord.com
3	discord.com
123	discord.com
181	discord.com
235	discord.com
255	discord.com

Drops file in System32 directory 9 IoCs

Processes:

OfficeClickToRun.exesvchost.exesvchost.exeDllHost.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\$77Client-built.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk	DllHost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Client-built.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpBDDC.tmp.png"	Client-built.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 3800 set thread context of 5952	3800	Client-built.exe	93
PID 3800 set thread context of 4284	3800	Client-built.exe	122

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

NetSh.exeNetSh.exeNetSh.exe

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies data under HKEY_USERS 56 IoCs

Processes:

svchost.exeOfficeClickToRun.exesvchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C157B569-A6AD-404B-92E2-034D7844B4A5}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1729780964"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 24 Oct 2024 14:42:44 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe

Modifies registry class 64 IoCs

Processes:

RuntimeBroker.exeDllHost.exeExplorer.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0eb066ae-b105-4fcf	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b235b289-123a-4ece = "\\\\?\\Volume{280CC82F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7ef449dd95ec63133f79d0e334d9d1c1f8758c260def41917cc070ef923a4bce"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a35d7cd6-3a34-4f98 = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4cf6877b-bcad-4933 = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b235b289-123a-4ece = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c1c77bdc2226db01c1c77bdc2226db01c1c77bdc2226db01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000058593a752000376566343439646439356563363331333366373964306533333464396431633166383735386332363064656634313931376363303730656639323361346263650000b20009000400efbe58593a7558593a752e000000000000000000000000000000000000000000000000003f30c000370065006600340034003900640064003900350065006300360033003100330033006600370039006400300065003300330034006400390064003100630031006600380037003500380063003200360030006400650066003400310039003100370063006300300037003000650066003900320033006100340062006300650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000061061f3c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37656634343964643935656336333133336637396430653333346439643163316638373538633236306465663431393137636330373065663932336134626365000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000076716f6b70716b7100000000000000002613ec81be65ea4a8d0c78006277c37b5ddd56eca884ef11afae5a97962828602613ec81be65ea4a8d0c78006277c37b5ddd56eca884ef11afae5a9796282860d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310030003800320036003400360034002d0032003300350033003300370032003700360036002d0032003300360034003900360036003900300035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002fc80c28000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71f2caec-9711-493b = 25e5b6dd2226db01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTr = ":BackgroundTransferApiGroup:"	DllHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59019bd5-3246-4184 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f648beac-c116-4c95 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71f2caec-9711-493b = "\\\\?\\Volume{280CC82F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7ef449dd95ec63133f79d0e334d9d1c1f8758c260def41917cc070ef923a4bce"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59019bd5-3246-4184 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f648beac-c116-4c95 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f648beac-c116-4c95 = "\\\\?\\Volume{280CC82F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7706aacb6a91a0977bd29fdeffd6b7355845f97c5db76d78803cdc1a55b97461"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b235b289-123a-4ece = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\47654831-1511-4b8a	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\148ea4cb-489a-4650	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4cf6877b-bcad-4933 = aa2d79dc2226db01	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a35d7cd6-3a34-4f98	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a35d7cd6-3a34-4f98 = "\\\\?\\Volume{280CC82F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\ba5db159b07906a995a91d58d2d21114e955abe13050a22e2d4be2e8f7677fe3"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c546048a-de98-4840 = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0eb066ae-b105-4fcf = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4cf6877b-bcad-4933 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001a3377dc2226db011a3377dc2226db011a3377dc2226db01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000058593a752000343861666631383339653131646438636261323163386239613363633031386238306230666635343131646531633831356361383661333533343131313732390000b20009000400efbe58593a7558593a752e00000000000000000000000000000000000000000000000000e6c4c400340038006100660066003100380033003900650031003100640064003800630062006100320031006300380062003900610033006300630030003100380062003800300062003000660066003500340031003100640065003100630038003100350063006100380036006100330035003300340031003100310037003200390000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000061061f3c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34386166663138333965313164643863626132316338623961336363303138623830623066663534313164653163383135636138366133353334313131373239000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000076716f6b70716b7100000000000000002613ec81be65ea4a8d0c78006277c37b5bdd56eca884ef11afae5a97962828602613ec81be65ea4a8d0c78006277c37b5bdd56eca884ef11afae5a9796282860d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310030003800320036003400360034002d0032003300350033003300370032003700360036002d0032003300360034003900360036003900300035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002fc80c28000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\47654831-1511-4b8a = "0"	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0eb066ae-b105-4fcf = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\19e93c5d-f558-4e66 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001b67c7dc2226db01129e6edd2226db01129e6edd2226db01828e09000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000058593a752000383234313836666434626566613632326661353031303766346638333934666633306665616334633265353164383366653139636531303534666639343131390000b20009000400efbe58593a7558593a752e000000000000000000000000000000000000000000000000003d58c900380032003400310038003600660064003400620065006600610036003200320066006100350030003100300037006600340066003800330039003400660066003300300066006500610063003400630032006500350031006400380033006600650031003900630065003100300035003400660066003900340031003100390000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000061061f3c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38323431383666643462656661363232666135303130376634663833393466663330666561633463326535316438336665313963653130353466663934313139000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000076716f6b70716b7100000000000000002613ec81be65ea4a8d0c78006277c37b62dd56eca884ef11afae5a97962828602613ec81be65ea4a8d0c78006277c37b62dd56eca884ef11afae5a9796282860d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310030003800320036003400360034002d0032003300350033003300370032003700360036002d0032003300360034003900360036003900300035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002fc80c28000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c546048a-de98-4840 = "\\\\?\\Volume{280CC82F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\38cd721c7573aeb8aeb2bca135cc08bed04ae62c309f1669ebe0e5906bcb5cf0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0eb066ae-b105-4fcf = "\\\\?\\Volume{280CC82F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\824186fd4befa622fa50107f4f8394ff30feac4c2e51d83fe19ce1054ff94119"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59019bd5-3246-4184 = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c546048a-de98-4840 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000b52d67dc2226db01b52d67dc2226db01b52d67dc2226db01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000058593a752000333863643732316337353733616562386165623262636131333563633038626564303461653632633330396631363639656265306535393036626362356366300000b20009000400efbe58593a7558593a752e000000000000000000000000000000000000000000000000004bcad400330038006300640037003200310063003700350037003300610065006200380061006500620032006200630061003100330035006300630030003800620065006400300034006100650036003200630033003000390066003100360036003900650062006500300065003500390030003600620063006200350063006600300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000061061f3c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33386364373231633735373361656238616562326263613133356363303862656430346165363263333039663136363965626530653539303662636235636630000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000076716f6b70716b7100000000000000002613ec81be65ea4a8d0c78006277c37b58dd56eca884ef11afae5a97962828602613ec81be65ea4a8d0c78006277c37b58dd56eca884ef11afae5a9796282860d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310030003800320036003400360034002d0032003300350033003300370032003700360036002d0032003300360034003900360036003900300035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002fc80c28000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0eb066ae-b105-4fcf = "0"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59019bd5-3246-4184 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000005eea74dc2226db015eea74dc2226db015eea74dc2226db01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000058593a752000626135646231353962303739303661393935613931643538643264323131313465393535616265313330353061323265326434626532653866373637376665330000b20009000400efbe58593a7558593a752e00000000000000000000000000000000000000000000000000a20dc700620061003500640062003100350039006200300037003900300036006100390039003500610039003100640035003800640032006400320031003100310034006500390035003500610062006500310033003000350030006100320032006500320064003400620065003200650038006600370036003700370066006500330000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000061061f3c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62613564623135396230373930366139393561393164353864326432313131346539353561626531333035306132326532643462653265386637363737666533000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000076716f6b70716b7100000000000000002613ec81be65ea4a8d0c78006277c37b5add56eca884ef11afae5a97962828602613ec81be65ea4a8d0c78006277c37b5add56eca884ef11afae5a9796282860d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310030003800320036003400360034002d0032003300350033003300370032003700360036002d0032003300360034003900360036003900300035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002fc80c28000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f648beac-c116-4c95	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a35d7cd6-3a34-4f98 = "8324"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\47654831-1511-4b8a = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000ecf9cbdc2226db01e0d750dd2226db01e0d750dd2226db017f1308000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000058593a752000373730366161636236613931613039373762643239666465666664366237333535383435663937633564623736643738383033636463316135356239373436310000b20009000400efbe58593a7558593a752e00000000000000000000000000000000000000000000000000d97ac200370037003000360061006100630062003600610039003100610030003900370037006200640032003900660064006500660066006400360062003700330035003500380034003500660039003700630035006400620037003600640037003800380030003300630064006300310061003500350062003900370034003600310000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000061061f3c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37373036616163623661393161303937376264323966646566666436623733353538343566393763356462373664373838303363646331613535623937343631000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000076716f6b70716b7100000000000000002613ec81be65ea4a8d0c78006277c37b61dd56eca884ef11afae5a97962828602613ec81be65ea4a8d0c78006277c37b61dd56eca884ef11afae5a9796282860d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310030003800320036003400360034002d0032003300350033003300370032003700360036002d0032003300360034003900360036003900300035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002fc80c28000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\148ea4cb-489a-4650 = 5a31a2dd2226db01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4cf6877b-bcad-4933 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71f2caec-9711-493b	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c546048a-de98-4840 = a9b16bdc2226db01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2747257a-8863-4317 = 76a849dd2226db01	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2747257a-8863-4317 = "8324"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2747257a-8863-4317 = "0"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\19e93c5d-f558-4e66 = "\\\\?\\Volume{280CC82F-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\824186fd4befa622fa50107f4f8394ff30feac4c2e51d83fe19ce1054ff94119"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71f2caec-9711-493b = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0eb066ae-b105-4fcf	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4cf6877b-bcad-4933 = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f648beac-c116-4c95	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71f2caec-9711-493b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\19e93c5d-f558-4e66	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59019bd5-3246-4184 = fb1577dc2226db01	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\47654831-1511-4b8a	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\59019bd5-3246-4184	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c546048a-de98-4840	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\19e93c5d-f558-4e66 = f92277dd2226db01	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\148ea4cb-489a-4650 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000003de5abdc2226db017c239add2226db017c239add2226db01629b0a000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000058593a752000343861666631383339653131646438636261323163386239613363633031386238306230666635343131646531633831356361383661333533343131313732390000b20009000400efbe58593a7558593a752e00000000000000000000000000000000000000000000000000e6c4c400340038006100660066003100380033003900650031003100640064003800630062006100320031006300380062003900610033006300630030003100380062003800300062003000660066003500340031003100640065003100630038003100350063006100380036006100330035003300340031003100310037003200390000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000061061f3c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34386166663138333965313164643863626132316338623961336363303138623830623066663534313164653163383135636138366133353334313131373239000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000076716f6b70716b7100000000000000002613ec81be65ea4a8d0c78006277c37b63dd56eca884ef11afae5a97962828602613ec81be65ea4a8d0c78006277c37b63dd56eca884ef11afae5a9796282860d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310030003800320036003400360034002d0032003300350033003300370032003700360036002d0032003300360034003900360036003900300035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002fc80c28000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71f2caec-9711-493b = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001f8ed0dc2226db012c12b1dd2226db012c12b1dd2226db01416808000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad0132000000000058593a752000376566343439646439356563363331333366373964306533333464396431633166383735386332363064656634313931376363303730656639323361346263650000b20009000400efbe58593a7558593a752e000000000000000000000000000000000000000000000000003f30c000370065006600340034003900640064003900350065006300360033003100330033006600370039006400300065003300330034006400390064003100630031006600380037003500380063003200360030006400650066003400310039003100370063006300300037003000650066003900320033006100340062006300650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000061061f3c1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37656634343964643935656336333133336637396430653333346439643163316638373538633236306465663431393137636330373065663932336134626365000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000076716f6b70716b7100000000000000002613ec81be65ea4a8d0c78006277c37b64dd56eca884ef11afae5a97962828602613ec81be65ea4a8d0c78006277c37b64dd56eca884ef11afae5a9796282860d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0032003400310030003800320036003400360034002d0032003300350033003300370032003700360036002d0032003300360034003900360036003900300035002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002fc80c28000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache\BackgroundTr = "C:\\Users\\Admin\\AppData\\Local\\Packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup"	DllHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f648beac-c116-4c95 = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2747257a-8863-4317	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\19e93c5d-f558-4e66 = "8324"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\71f2caec-9711-493b	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c546048a-de98-4840 = "0"	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

SCHTASKS.exe

pid	Process
5208	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Client-built.exedllhost.exe

pid	Process
3800	Client-built.exe
3800	Client-built.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
3800	Client-built.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
3800	Client-built.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
3800	Client-built.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
3800	Client-built.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
3800	Client-built.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe
5952	dllhost.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

Client-built.exefirefox.exedllhost.exesvchost.exeExplorer.EXEdwm.exedllhost.exeAUDIODG.EXE

description	pid	Process
Token: SeDebugPrivilege	3800	Client-built.exe
Token: SeDebugPrivilege	2440	firefox.exe
Token: SeDebugPrivilege	2440	firefox.exe
Token: SeDebugPrivilege	3800	Client-built.exe
Token: SeDebugPrivilege	5952	dllhost.exe
Token: SeAuditPrivilege	2584	svchost.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeAuditPrivilege	2584	svchost.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeAuditPrivilege	2584	svchost.exe
Token: SeDebugPrivilege	2440	firefox.exe
Token: SeDebugPrivilege	2440	firefox.exe
Token: SeDebugPrivilege	2440	firefox.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	476	dwm.exe
Token: SeCreatePagefilePrivilege	476	dwm.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeDebugPrivilege	2440	firefox.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeDebugPrivilege	2440	firefox.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeDebugPrivilege	3800	Client-built.exe
Token: SeDebugPrivilege	4284	dllhost.exe
Token: 33	3508	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3508	AUDIODG.EXE
Token: SeShutdownPrivilege	476	dwm.exe
Token: SeCreatePagefilePrivilege	476	dwm.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeDebugPrivilege	2440	firefox.exe
Token: SeShutdownPrivilege	3800	Client-built.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

firefox.exe

pid	Process
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe

Suspicious use of SetWindowsHookEx 33 IoCs

Processes:

firefox.exeExplorer.EXE

pid	Process
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
3336	Explorer.EXE
3336	Explorer.EXE
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe
2440	firefox.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

RuntimeBroker.exeExplorer.EXE

pid	Process
3872	RuntimeBroker.exe
3336	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	Process	procid_target
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 4012 wrote to memory of 2440	4012	firefox.exe	84
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 1804	2440	firefox.exe	85
PID 2440 wrote to memory of 4116	2440	firefox.exe	86
PID 2440 wrote to memory of 4116	2440	firefox.exe	86
PID 2440 wrote to memory of 4116	2440	firefox.exe	86
PID 2440 wrote to memory of 4116	2440	firefox.exe	86
PID 2440 wrote to memory of 4116	2440	firefox.exe	86
PID 2440 wrote to memory of 4116	2440	firefox.exe	86
PID 2440 wrote to memory of 4116	2440	firefox.exe	86
PID 2440 wrote to memory of 4116	2440	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:476
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{db557490-85d8-4b40-b74b-62fb8b597518}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5952
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{a16f6887-7329-44e8-a493-a6ba333bf9ea}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4284

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1516
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1864
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004DC
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1816

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:684

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2716

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:3336
- C:\Users\Admin\AppData\Local\Temp\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Sets desktop wallpaper using registry
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77Client-built.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Client-built.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5208
- - C:\Windows\SYSTEM32\NetSh.exe
    "NetSh.exe" Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4728
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1188
- - C:\Windows\SYSTEM32\NetSh.exe
    "NetSh.exe" Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1888
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4800
- - C:\Windows\SYSTEM32\NetSh.exe
    "NetSh.exe" Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1976
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8f7ba2a-6540-4b4c-aff0-92538ab7705c} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" gpu
      4⤵
      PID:1804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2332 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ea32f76-b507-497c-bff2-e3d90008ef34} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" socket
      4⤵
      PID:4116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3236 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3224 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de5e2966-362d-452e-b700-cd3a872d3634} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:1568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3524 -childID 2 -isForBrowser -prefsHandle 3584 -prefMapHandle 3600 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee0fe35f-f2ad-4ef0-b780-883208c5f2a6} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:2480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4720 -prefMapHandle 4716 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3eba9ee-ed33-4b18-8bc7-41b1e2af22f6} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" utility
      4⤵
      Checks processor information in registry
      PID:4940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5384 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5068 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fe551ed-972e-496b-b7ad-3f763d761c9d} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:5600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 4 -isForBrowser -prefsHandle 5292 -prefMapHandle 5284 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1767bc15-e2db-4e6b-b27b-aa374ed80e48} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:5608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 5 -isForBrowser -prefsHandle 5504 -prefMapHandle 5516 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7f09307-562d-40b4-b490-937e028486ac} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:5624
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6208 -childID 6 -isForBrowser -prefsHandle 3768 -prefMapHandle 3600 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51f1d4fa-4300-4cc0-80f0-f88bf9a7ff26} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:2388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6432 -childID 7 -isForBrowser -prefsHandle 6260 -prefMapHandle 6068 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b17f48b-359c-447c-b476-d55beb7f6d5b} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:5448
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6640 -childID 8 -isForBrowser -prefsHandle 6668 -prefMapHandle 6648 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f3c9976-7377-4562-b9d1-1195903fa619} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:3160
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6616 -parentBuildID 20240401114208 -prefsHandle 1440 -prefMapHandle 6820 -prefsLen 29355 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33156395-531c-4674-85b3-32c4650a7cba} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" rdd
      4⤵
      PID:5996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 3976 -prefMapHandle 5176 -prefsLen 30530 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b7bf8ec-2e1f-4353-9b6c-2cd66fdb56b5} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" utility
      4⤵
      Checks processor information in registry
      PID:1424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6232 -childID 9 -isForBrowser -prefsHandle 5048 -prefMapHandle 5512 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5121a15-600e-46d0-b4c9-39874055dddd} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:2052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1596 -childID 10 -isForBrowser -prefsHandle 2676 -prefMapHandle 6112 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07bb953b-54be-43c6-a752-0cee0deb070f} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:1320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 11 -isForBrowser -prefsHandle 6372 -prefMapHandle 6368 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3973484b-e1b9-49a3-9ab9-f6faef3843ac} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:4768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6532 -childID 12 -isForBrowser -prefsHandle 6504 -prefMapHandle 6520 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d4fd679-cc3a-4001-91dc-11cd7b9d0361} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:5772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6244 -childID 13 -isForBrowser -prefsHandle 6312 -prefMapHandle 7056 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cf74bbf-e55e-4c86-b289-50dcaf2dd7a9} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:5464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5768 -childID 14 -isForBrowser -prefsHandle 5684 -prefMapHandle 6572 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93aea7c6-c412-4a3f-a453-07380cce45be} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:5816
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7312 -childID 15 -isForBrowser -prefsHandle 5476 -prefMapHandle 5600 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56435740-72b3-4120-b6e4-e496e4b7d5d0} 2440 "\\.\pipe\gecko-crash-server-pipe.2440" tab
      4⤵
      PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4000

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Modifies registry class
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3472

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3084

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1348

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2204

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops file in System32 directory
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1164

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4636

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5356

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:1492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3660

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5436

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\maevrvll.default-release\activity-stream.discovery_stream.json

Filesize
23KB

MD5
6a001ce2d65b502b9fe01e0ceb4b0a7c

SHA1
e92698d71c3eff29c54c980d1fb4018a02ceb987

SHA256
027ca607b7f57a34ffa8a9253751bc65681e62298be77d23b4f9529f15add592

SHA512
ef8fad826ba8dc4c2aa98579c94753e3777dd81d022fdaf66e7857c7f845c9c4dc70dc37aa0f83d7c0f862705524efd1afbfecacc13da36abe010dcb90cb83b9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\maevrvll.default-release\cache2\entries\0B2847671C6BD5B74F17AA46CBE52D42C991DF60

Filesize
224KB

MD5
4fd062697fc0648ded03198793d0ae62

SHA1
925a2b4352b5bbae6eb548cd7c04ddc8cb95014d

SHA256
30e3bdda22f9d0119543c9b04889c706dee69cd69e19f611bbd546fda337f0ca

SHA512
e263d7e66b5c25c828fa4e759b4703d50cc2256e34f1df739c19a6107f87f87903418aaac976860431e589b63ef40d6672953485ea6dc5ffe8336a083827701c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\maevrvll.default-release\cache2\entries\137CCA6C5BC516957A4A0D96BE287830C9662274

Filesize
61KB

MD5
98d69681eba18a4e9f56b2b47491d06c

SHA1
d95477ac7bf47da5bdab9d349a741f6bf86b8633

SHA256
1ac712a0950479349657bc4f8f6fba5c547bc44c864a543348dbd64ce815c2e9

SHA512
efad1ca68e71e619962208629e3f1ace3a0c538cad0875d40414f6fd8ffa7963b5cd57f75bc6300d837910130db3df17bbd50347b919bed02b7595708b21705f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\maevrvll.default-release\cache2\entries\229E63D122FA6526AD4C91C3EF6E7CAE6EFCB94F

Filesize
44KB

MD5
2b9d9ab8b59e3f4d2917f262e5b1bd39

SHA1
6a1f67b040980af1833ee6b2da4adf81e4e46b56

SHA256
cb78e7e32c08aa73e49fef9e7a35ab87b408a7042735af0832d6fa897e5bd3ce

SHA512
16d810bf98d4fe1319bc0c010e2da59b77a6e0b5ed9fe23d41f91204bc95f50bacdc9b1c949a6a57669efcba5965792ab2b9239e4672be727d49f155a0730b17

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\maevrvll.default-release\cache2\entries\DD90BB4086070DE29BAFB5288E225407A58A6675

Filesize
120KB

MD5
98b72f049684cb8f95fa7f50eb68171f

SHA1
13376924ceb76c133386c894ec863d97b1bef754

SHA256
384323f75608773c1a857a0f5588d7104ccf3d85dfb1c9d2ccb488436ed3f4e4

SHA512
84911931f086fb2fb7a7e5c42d2f3afe36b697e4ac8751ed209824fa8e9c23f03e9cb7487cec3179a5601aaa1ddc4ff010ca3141046dcaed25807ba488b02d48

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Filesize
330B

MD5
471d2c640dfe8b23d67d0119066dc264

SHA1
c550fab4823a5750b7c905efd8d1a4d55193a04f

SHA256
c4d38ce563179fa54f890db59a546dfc10e019b17bdb746e1a2eba239670266e

SHA512
7e6a9e0603a4f3489231ee3a5cc0bebd3720b82565b97da35ac849cb7ac6a5dfc0f74354391ff9a8b57946b4a08a540a20225243f0aad9ef73eea4ee140585c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBDDC.tmp.png

Filesize
18KB

MD5
dcb810e0af4ab681dba6d2d356498a8b

SHA1
ab02e3f87cb02d20b08186611952569461bb9197

SHA256
559a7668ee4bf3c21097019f986e8866427d59b000a14f067d18b19a50c17afb

SHA512
35994fad1d0d5cd911840be50cddf52f3c2a4cb397b8c6173856cb1a2cdab0d53f73d4ba9a5d5594889b083bad4f8242a30092d75a7453ce229ad170be86b861

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
d64d9b11e0be447dd671734a96669063

SHA1
54a7ebf161d1c27388ba05374aa2ae09f4323302

SHA256
0bff011f51e06ff6cafc1c0c7186efc0bf025139c92162a1d0d138e04d1e79c3

SHA512
2cb5fd36181ceb3266ca672163170afa29d540fe7e6b6debe2aca6070d1fbcd6b718a37e55157ed1bff152a3b71df54fb92395a398d12b32adf947d081addece

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
4c56ef07ee499f8cd4fce4109b2296d2

SHA1
dc93f4716d36bf2f49f2c0f420a453b9bb61964e

SHA256
017d2186930f27eee70c6f10cbdcc10d25893facd1fe93fc038c43cf3d88fe8f

SHA512
c4aced9832bf6ca2b882bc8ccf4c7fdbd155588fa92df6e34a496e447c4edeea746548d98ee5b64c1de29d79c7af527b8e08dfb692fc6adc598cf2312c8ad078

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
12KB

MD5
4ad37b2743546e0a26590902c9e52895

SHA1
efa48e79208c310d40aabccd75aad4b7efd59a1f

SHA256
38e252d3c042ea14c64e2c2196d26b2b32422d78eab7c8d96cd97bafc7599298

SHA512
b76ed1a228d8161d3e05b5b0f0d3e8d2c08c739eb42d3177bfc37052daa5d9338f686ae7a914e42e92d5f27032dcf2b85cb3bb5ad61d0f9be5968bb50dbb2c4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
7550908dc4c28dc5137e4004d4142364

SHA1
996ec4dbec2284f05eb77f61cec2e26a75d789a2

SHA256
6e3b1cfb2890fe13c9d4c2d41e0cf1118d1873db24c77f51ab3aef82f919296b

SHA512
89c2711c9e58011e74858aad70712bbf833b9c10899c4aa486cd1ed17d2c4201b2b21d1f360a4599f77a80bf5c98067c8d364157b6e706f11497d45752064394

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

Filesize
16KB

MD5
2fa8cbb3ea054466a4926b88f5247b76

SHA1
fd95d3e5af22e78a323ef1dd1ad0cff1311bbd5c

SHA256
fa80548ffed7441b860fc2271f5aa5049e632fd83ce136c4139b490ea7d8fb67

SHA512
4bfd20c244243cc3df71cd2113e3977473524e6142b945c96c9be327deb46b2bfa4a26824888b73e718d22d2c274650ead4c27a32d08998c823f1615f4542fc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\AlternateServices.bin

Filesize
16KB

MD5
078da318dcd00f97810efee98473ba0d

SHA1
9383bd98add55622b281193316d1d1e067726e60

SHA256
302afc60ebb66f41db8d80501b625542ebfc1099a7372bb3390cbb63bd63ac0c

SHA512
6abe8adcdbdb1113c2fbe87824a8046c464912d231956693aa9ea64ff5ae7b35972377aa07fc4f0b8e1ab8a390f127f46772130662d4b3695abcec185a5e7483

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\AlternateServices.bin

Filesize
25KB

MD5
e74dc2a7b484aaaa263a02dc38f7b248

SHA1
028c06f459be8800fcf3b084e127c8ecc62c2982

SHA256
d29479031d797570c7acd3ef8efc6565b9393c9601d36349ab1a3611f190b30e

SHA512
006a84b81bd10974c5c8ccec04073e6e3b28ebd7a8bfe312894915af3b2dec1cda60dcf5a78b585f492a329226dcac06e9aeda667012392b615c8f283c0672f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\AlternateServices.bin

Filesize
8KB

MD5
8f4f1f99737b75c8b201c38dc8b5f247

SHA1
7d5da263a1b40e7520e34cc9fae92c1695651599

SHA256
524dbb064333a37ff9a5aebd97fd5604ccdc74ff79ee30429c662a1c5bc0a322

SHA512
a076bc2e3057a2f9db6774263057fad1ed8d2254c791a3d7adadd27782a5c916a67301d2399463a1c09570abc77324a2f19a904f0e852e9334f14f681bb4c3b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
160fc5a43bd0d2b595415f7a387c1a1f

SHA1
0a4d58dfd4e51eed28cd73e6da360ec0e00a7d8b

SHA256
81ab879edbd6abc320410e6cabce69ffcc15c1bb5dfdabb7db1b50617a894ff1

SHA512
ed807f81eba37c57540cfbd4473bdb8497c8e03faa487c883b6acaa9262bd9d109db772b17ac83406d45b1e2b29c8d3bf556cf05d3c044b27f1f2a69b5ac65c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\datareporting\glean\db\data.safe.tmp

Filesize
69KB

MD5
e31b4133cd0225c82d00b3c027519f9f

SHA1
f59892953f19f2c0b548af1890b5d4ac8088766d

SHA256
87d9918521068320dee44bb0220d9dc5333b488e9eb8a73fac34c2f1d64e004d

SHA512
bce180c0ac164db60f47f793f73acfec7851645e94d082f518a6d0238b34e66fb6b53dad07487c1eb4267863a78229b78d8da4bc6a5a73e256fd9a7cdd8bed4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\datareporting\glean\db\data.safe.tmp

Filesize
57KB

MD5
c1a5d31c03b6f18ac2c9286bd975eca4

SHA1
bd73059d3130373aea2db255bfc7665a8d262a31

SHA256
24fbdd50f41895cd1bfefd817824deead558318465e91b77c053ff96882bbef6

SHA512
c86f65b3ce836ed63e132e77e865b0d587f3049c496d10f165fb6e7ad8d1a5d6379fa6050fd8a7735ad2d7a48fbd0eb1416e665e67ced948b66425f4d5d7047c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
18db43f571072c9aa92c27044bee1925

SHA1
a63a5353755a38b3c737a9529f145234a09605f9

SHA256
d7e66cdf83346c1fe98dd7c91e1c8fba72c5d18a6670989aa47e1a1100cd4898

SHA512
a46e187a2df6aee1ff2c6e2fb85e3d3c6736913bb844da51ebba2ceb11d73154f92f50e233118b23f1a23055c3c0535dcdf12ef019010279364fb2799c666a4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\datareporting\glean\db\data.safe.tmp

Filesize
17KB

MD5
240718890629856a84818670c9cd91d5

SHA1
5d271be4a34bc7cf43d8599d8bf1923712ba2d08

SHA256
7c7eff70502fb87163422ca5c35d4e012ab1e7d7db1f1686953d942699273747

SHA512
209972fedb6e794422f81f7cc6783d412628a3ad1fb0142514cbce21e6c045255261d899845f7afc75b0a2f820100d397749d8664b12b38f347f5d2173923ab6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\datareporting\glean\pending_pings\243d82c8-0db6-418d-995f-2bab53e77262

Filesize
25KB

MD5
70336c56816cc289d7351e37d39ccc69

SHA1
ff4d13c9c7e82019e7c7d2340e1d9c2a72618086

SHA256
e6b9628fcfce2e570129a618952f938b8381476e3fce1aeb63b2d6ee7aa59585

SHA512
20aee7453c52b965e95acd2b7e18e5d12c3791daaec7b6f5e91734e840942320cadbcc9a24be65a6c2b3618481951ac16e6a7fdddc77b580d992ea08f8d02a6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\datareporting\glean\pending_pings\3a3c7392-757f-43c6-a641-119c3f1539ff

Filesize
982B

MD5
a29bbfb6f541c21c04d2feca45d09efc

SHA1
c842b125e9b7550b9145adebddad7334bd7fcddc

SHA256
cfb647814e03ed8e2944c2c79088e3708ec8a26395bcd6f57053a451eadda1a9

SHA512
187afb0de54be1714a5a8eef5a12dc9bee0a962cd33edb48e268036a021f5729013cb98538059cf74c6d1bbb8baee1f40fdce7f2691abee716aeef4413c46865

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\datareporting\glean\pending_pings\3be7df37-e48d-4946-af19-c4f78af620da

Filesize
671B

MD5
a161548c40f1f8babede09dfa21e831e

SHA1
5030ce27598d5cc04d3294343b9ada7c49a25653

SHA256
f83e9258f71e74d2264a8e434bb3ee9851d99d95dd7fcf546ba4ebfd65ef977b

SHA512
32d08159df86332d48fed30bef4c4015f90ad78a6fb65d1427ab0b8f45882ba8aa26f43890f8c0a64e549b792c42f50eb4dda5d1768d27e5c2605bf5db63be3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\logins-backup.json

Filesize
740B

MD5
1c11025825b1e81c32f0a93da1e3b92f

SHA1
03ac1f1b9f01a9de06200a131ad94f03f0bf0452

SHA256
6f4abd0a9e1a3e96e942f6967d37a61be5d3ace6ca9d56f136af79e3a9d69495

SHA512
40acadf20a8a43373d0f21fd50ea7364343a5955dac31d17f5da676859b2ddad2a58736442abeac295756cb6a5a44794d96e8ba9946f47beba1986c6028d9ebf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\logins-backup.json

Filesize
810B

MD5
bc9f68dd5332e864957b30a501dcb543

SHA1
e1fabcd04fd1829efef5240460b1f9a6bdf6b997

SHA256
b895fa50cb4f9b9d404b7a2cec6d6b2223073acc12b0f62267996aea34806cde

SHA512
723937f56ffeee5d7a05ef364cc2bc8d4a8706d5cb1a91d6a54ede6e2dc9c7545bed02dd1ce8bba074257fa4649a7b50539b996cb7293aaa1430c4ea97e32d51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\logins-backup.json

Filesize
1KB

MD5
40483f9c1ea76b744fe940c8a69020e7

SHA1
842f18b5d0de274e4ee02c4598162fdac42037fd

SHA256
f41d02e806cd28c11efc30fcab1b4d1584095e881f6e2d298ca32c9d182cfa72

SHA512
8a72a813a5e7f87a1540fc400c668ad48daef8362968a389f3200c949f3592a5848024236ebb72c2dfcc968f6d04a773a771cf1ce2eb1b6372ce3ad1953e98bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\prefs-1.js

Filesize
11KB

MD5
35ec0066dd86357940c634463872aad3

SHA1
5624782fcefc37a3adb568050a30c3e1d57b754f

SHA256
266adcf6c72ac070c758d79bcc149d7849752b0e8a8460322e804ebeaf0c9ac8

SHA512
2a84dcc9e7d60ed18735a1ac1cf4643950e3f23e906e380f79502b1ce1b69f8bdc960bfdbb97806ac104d8104c34862cb57dae4df3a1a58cf224cd1f841f0c39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\prefs-1.js

Filesize
11KB

MD5
9e5d9f8d38889b6d51b291bd5a24e527

SHA1
bb7120cae8fba00e74ee820bcb9b62efe5e3403d

SHA256
645ababa075c6dcd8f148a2417f2931ba589936f38c23bf09895c26036354f42

SHA512
c969f5747788fa1afceee3f7083846e9c7e788a224cb62a3b6f51059db7ddb6d83aa87e80b347dc3acc48f2cec751f30e7c3d93b8d7d98327fda9aaf8a484d61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
0953237cafcded3f5af7ed32dc0c9097

SHA1
555ad3dbc0ef7815ae4d232255b4b04d286b5c16

SHA256
e02f334d0d1d4766124097b0e3030bb9cc52205ae56d7695c20f06cc597b146b

SHA512
6e8a69b724e70024b0950fbfe6168a4e0e7b1b48bbff3c5a10da03e4e869071e78e623af71d0d2c356707416a39a5e1b9250ed749722a4f25134bd0799f719ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
6301ad488a1fa5174b9cae47dfac2d0c

SHA1
3f9bb9f8e2ca0c558076ee4c528c7d09c030ff95

SHA256
d53ae5e3197af5de0cdbcdbf3a49c25d5e62a2bd03cc439ec48621bbe3dc94b9

SHA512
75740a138c90525d532dc1847ff972af89f2632d4f48416a3e5be1b1d1511a32c126d45b45cc74062f1b78991df1010ba093605a5ca97c2b32867b74103d2b22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
c12e70c799ed185a868977e2e6231d0e

SHA1
f66eab76b56ff2af27ccee04ad63da5550d8d2e7

SHA256
0e9f0b0fc02c07702139bf05a4697088a0e51786db524446d805a46ba883f865

SHA512
e6414869ea337996582f3e04ec80358238e0f8d86a3720c5640cf451e1fe9bf95a51b0df05ca560ee04d8b3571e9170b373c1fd447cf5560a45c783785fbcd2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
16KB

MD5
94a9d505c1c2aa14681dec86aa2b6053

SHA1
7ba8aeda33292c187ac2975878232446dacc2dea

SHA256
09ceb64e20754fc5592f07b200f03e991d457546833f879dd0718d9eea1126a2

SHA512
40ae31f6d52790654a8b6d83e3e64d728dbfaae5f8bf1b3ee31f008fff1e86d2c17e8656ce90c212446b1c85502a6a1cd391766f7d01dbc598222f5f327863ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
2fb4ab983efb19c87a20d5664d57594c

SHA1
35c81423a16e43eb3f18a9e192902a4f1fed52f4

SHA256
90f4bad5f868601d8c460c7d25a0b939459be62594c8a4893fd3f37360538685

SHA512
1eca5f824908962a12c61c82f8a6fa0d0c37d81e1b2cb6205db6c242be5c2457f6d3c0b42cbca240ef08cd2bf474ef9288cf9835886ad5a393786050e498d907

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
f4840cb759eb9ee98822540432ef24a4

SHA1
a1700aaeb555db3e2105ace35ccb13082abb9564

SHA256
9ef704fc82c9c8d7cd3ad46ceb1ec7321ec8c623f3baba0352da7c6842c5f0bc

SHA512
87b0b73959cd153b46383b48dd2972efe820e454ccfba17a0f16ef940da8c65e3972969608240d81faa737a4ed10e37b010b7b008e7ee616e17a5e8ff1c50c90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
34c5aba562673b1c80b57b3e79502ab1

SHA1
8028183de20cce76fb6967b4738468a89502e91a

SHA256
a61dd7fe5a7698262f28776506987905e88cbb38e87554e35dd34d7d8e142f0a

SHA512
7411de73b0bf3f119b74e8c75037d312cdfb8b29b1537885bedab152b5678136dc33c5166f5cd1d57aed8fa6aaf675f3c019c43152f66a38d3085047a247d048

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
26KB

MD5
47347cd3346d81d4bc8f85546024e657

SHA1
6b7a45307b986bae12dd23a676c3ce99464da97e

SHA256
f9eb8173d1bd1595f860dec7d25041012943a742616315afa47a153185e5ff71

SHA512
5fb9774478dcbf2671df3507b83eda84c1d250d242c67ba3fb9f74db4e6d56f6082b1d7b9f7091b7f8e981bbfa295fa5a9cdb99868a0aa8520292f637266ce15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
44KB

MD5
54f5560d1c6c60d97f45f5d3592c3651

SHA1
d246d07b893037fc30c4ac8d929340e60d3475d9

SHA256
de18a7241b80ad0fde8d55ec6b49e369ca48233e99b9ad7cf8f8e23e39f67625

SHA512
e451595e814911e25651a8136f96891605d968bb2fcce35b263c6bbe1e18288e640ca9d181c1bce9cf1e8bc7bb5198c3996df8cffbef16d8befd01465a9c0465

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
45KB

MD5
6a857ac6d3693385ade1ff93ea0fcd8d

SHA1
6334500b7790894835bf5b4831532fa12d80ebb2

SHA256
be1cbaa4c45b53fca7a4db3f15a779e9c9fe94b0444d88b34093b69d5994817c

SHA512
2a5506e368ddad1dbbf703f8588dd88000f1e92a331e6ce1ca7413897fe02e19081a5c4b48662d13b4e241ca1ab3fd76525401dcfde7fc8deadaf33102b2582c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
ad16a468fd6d753cb7ef7e3210b8084b

SHA1
7685028e03e8e6dfdbe5cf812ffcc2226ecace04

SHA256
3c8cd77cef7af1cfec086e04fd712822a59e71bb5d7652f54618fc82b5f3d8eb

SHA512
07715b85e24c9ba09a77ddbcd1bc87f582e32f28301d95b22f1ef9af3c4220e3e6fef1b0d0a65839c85a01c680311bf390fd9621e10188d5acd24a8ab072b4b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
e4f4cbee24279c50962b8ea8523514f4

SHA1
5cd6181e46e5d1bb119beaf484ef0e1d1c6dfe28

SHA256
4ee2d9397d8bdecdb00816ed9fae637ec5f2cc09dfa886c77739c57c81f80500

SHA512
d71bf572e99d5336c3edec85076a07d8cb6792cbf90b51e290cb002dd551adf373479f58159ebda96cdc5e2f1300e8ca88f11c131e1e80959f309513b3bf8b55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
12KB

MD5
e1b3001d23dd6d12528ae877b465af37

SHA1
112d77517891de5716f0e15b8a7432ce14a83fe0

SHA256
5f05416bd4f39a11cd6536aa4394d655b46236a7384d3f5686d87f8e11ad61e4

SHA512
42f7c6d037a8227d0951acd7b76d8d50086b6086983ea43ce7dba21ffb4923bf5334d1d0b1b3abfc9b68a04c7790b84c35a0435f012c08180c17af9f8abe30a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
c3e4b1ee3c6f9342c32d55d5fe233f07

SHA1
968f9d4854c90312271d4b95e71f6d126b3e1849

SHA256
354cb7ea98a2f3b34fecc770317bfd73a6b7bb289c18229198436bdd71cbeca8

SHA512
320cd3adcedfd5491b88df99f71c4ba623c70da6e62a5a8d6139744c347d1a323aab38a6bd5610fca3424fd8d457dad60b6c12648a680df2b08dff89c5655cdb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
cda99fe88bc88273052d0baf1bcc1731

SHA1
d9ce68a0e2948e35cbc2d16ade723e383bf056bd

SHA256
43a6c26d04408267eaae69ea3aef155b06e01b41518176aea87e9aaee4f72da3

SHA512
0ae4feb72ef678494cd7cfd9174bf3571a22f771d3bab298d3d645489028fc3bfa7672a70f4e20795a3b20fd9d7b4e127439afc728e0da09d6bbe697a5f55e0f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
12KB

MD5
d67bd7998547ebfd7d1c0229506adecd

SHA1
52075c8334d54e768513fcc7a9ee834d243f5a4b

SHA256
196b842b5299631b11d605bfef838664652ced3c8c575e292c3793c33b6cb12e

SHA512
d1341a33cb6badf0f3170f6ea8f9c4a9f3e744a5eb07e5bd5c69840ee87f16090f7415ba60ac941da5ce580c0b42a60479e80aff62f350c561f8e28c71d4d946

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
12KB

MD5
1cd1196cf3abefcb4fa29b940539c7a7

SHA1
bc1cd9b69189324353c4fa7a48c8b177f21b2dc2

SHA256
27c015f685a55735bf4b2a2846a6a25f9474b7aa4c5b4c1122c488dbd11b4a60

SHA512
dede500ac08d6897bfe1b923767c94e2605d026dee8132be7c95b2be1261ba85187fac3c353931475e2516060e56d4c99d73f1172c69e51472c8699fb869a994

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
ee741dc897b1bd5684ca34cd0c71e1f3

SHA1
15d7be2feab235245a38d0ab96093aba7e38aecc

SHA256
1eb0d6a622a37ae2edba6b94f7afc67e8e0db91287a607594e271dcd839a5165

SHA512
d08af29f9067cd929042005a66615f2328a73275ce38acc559c4746b8f1b21c0316cb694948b7cbe89ca0d4336cc271256006e910b7f2e8ac74f4d953af55043

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
a0d709e41a3b03021589c760342bca20

SHA1
99f1d9ee4aaa3a931d09ed45fecf2cff6fa3023b

SHA256
cdd3b060d8008df47ea400b0f780200e257417470ef6d26b7e22993398501112

SHA512
2afd16774920345cb1620930145a49dcfacca8901ef0a05715d19dc1468f4626591e0f067fc7bd7015c50587a7c6b3f594dde31f0e62a3d662d8886750202faa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
3cb82acc570d8677cee0161b562be046

SHA1
ff8cc5bb41017ed9120f3483c636eb1364232c5a

SHA256
1c6ecf9ecc6c97d1229a4807ef791141dafdd8b74a8c5d5c380099ad8a652c1c

SHA512
9f52f8d4747a3de7aed3dc1ba18b0ac1b53885fdcf235fdd9bcb8c138d39199a46dce7c03eb07db3a00f8761596e9c7af07c4c7f70b442d356aff8e8fc266fd7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
f7293f468b4f26acbb2aabb12a639f58

SHA1
b114619bdc476e194b0c7fa9fdb575ad52a32306

SHA256
3c6128280d48b42f882a5be3414a3d7716e4f86dbb808ef750bb020774f6022d

SHA512
0eb551819870cfbfe1aeae74c2805ebcfae7378170ab638b26715972de1e64a2a5b3e236b252cf87257167193e8b3dada08101f540a4c017bd75af1108b81416

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
fd914e11fb8d70589042379cd1d97bbe

SHA1
ee67a22fde9004ef301818086372a9cb732fab89

SHA256
a381bdd8928f85460790b7396c38f39b53e158f2311c85278bdaa0058237a0d6

SHA512
22f197dc45e821776aacbda63730e086fe05b96eebd9c4175f98ff9570f7b33be08d234a9073422514c3e403f65c98ee3b5594cd64f73c56e53cc947040ae702

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
cf8c6cd9fe378c689bf8c81c226c7281

SHA1
8023923db5fc538dfbfd13469e5f377318ab2a1c

SHA256
4ed4c39ceba2ef6fdb1b4f1cbd91650c3c61a005a3e6969a8a7f0d6c53d65df7

SHA512
e2d00008f335b1bf50db3ff88b3ebea2b2243df058b93951d3226d7526c54814f9c6cf3774eff07731982c2682ab2d57177f56ed18411416f965eb3d612116bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
44KB

MD5
74b35ec4b7ed4c709ddcc499ecbe6126

SHA1
cf44508a34b4de070b26e19db3809a31a433272f

SHA256
a5664a26d749a72fa53507238336bd14969f87b0ae483453d80f0a6f9f5734f2

SHA512
a5eed392acc689a0b4abe676c1f6ded294ddf011128e1ae2375fdc0442826466756d3e3ba81fd93487f50b402ee472fb01a136cbb5d41a88c81a2cefaf2eebe4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
45KB

MD5
804aa1893ad525cd5b84d153784b4e71

SHA1
16e8e14b4569158eee8af7ce324172ae6c2665f9

SHA256
7fa626c566e1ce376f5beeba08085494121912bd035453f031d314256f750b8f

SHA512
6e97219e63c21dbdd41d438e286316212e58e1a16a55c1f17f7d7df3f76a6965c6e81a037b25ba0f4be17a243b12047b2bc30011aa8c557ebe21cea325207767

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\sessionstore-backups\recovery.baklz4

Filesize
45KB

MD5
8659c3fd7287658a37a9909c5164dcb8

SHA1
94513e567e58022f34504a90f074d5b280cec6b0

SHA256
d9e59e791d6f1023f9d4b0fc582e9a538742b713ff2672692103b4c28c7dcf42

SHA512
db8cb7252ed1d298d08a6d4cd0ac7b94989babe881ad09767976966e6535a3760767d60e3fe81bfe8fb17c9fc3a072ab2c91d39ffb421c0e98417bab073d5d96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\storage\default\https+++www.reddit.com\cache\morgue\238\{4ba9d1f5-4aae-4918-8bae-7ffa256df6ee}.final

Filesize
2KB

MD5
d106e9d73e807ce0916ac3fa51d1461b

SHA1
a1138b90f539ebe70efe33fa35f96f237fc2c059

SHA256
1ddaf57a54e90c2f53b0f3479651a124f56d1ea3ade097cd0bfa0157de62f942

SHA512
28a0a450cb47d9dbdc743a5ff5e472ace7ffcdac7644d155378e9a848563b58061110f7fd1e2006c4baf1229efc138f6f3ddda847f1191557765529a8e3517ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\storage\default\https+++www.reddit.com\idb\2728594770keeryovtasl-.sqlite

Filesize
48KB

MD5
70f96a64eba95d4b12c36d851c4c158d

SHA1
de7ed3e365175db689ec7ac8fd3c7a92dcb7e9f7

SHA256
cd1a7d9de4cde068318bfe158f6bbcc8ae37016473ccc6231178828e09f13e55

SHA512
aec1626cddf770a03176822a8c0f1ade00367b983442baa8df08228b4121ba3bea5dc5c146280edfcb2dcd1b94653d911403f06e71cc4239b7e93352dcffebf3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\maevrvll.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
792KB

MD5
74461c0c320fc7901c37a6abcb997408

SHA1
d013bf8f76c82bfebf8ef78b9f584715268d6267

SHA256
9940c2720cf06d582536f970be55e51589cf936b7555152e891567d13a6ca340

SHA512
850fb7b2a092e0b28969f2915ca7903e4d87e1a09038f99d68a9b5a3db545f8d133786356e75561dc960cf62f9bed5026378692b6cbd5c376e4158e5ad69d832

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
f9971441e16b51dba5b6dfc4cef93540

SHA1
dd22af7971c845e034fe92bdd3147461f64c339f

SHA256
b6eb0d9a206d615a015ba76d47749e9bc8f8a5c5f17174a89641d555ff7844ff

SHA512
8902c1e6b151bf4da94f6ac7e067be92a5019f051d04c125e428b86401967d77adffec9ae7ac2c90980cfcc6d8c2ea570a1eef7cca0855c431eb4062947e8673

Download Submit
memory/352-321-0x0000019AEBB10000-0x0000019AEBB3A000-memory.dmp

Filesize
168KB

Download
memory/352-322-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/352-953-0x0000019AEBB10000-0x0000019AEBB3A000-memory.dmp

Filesize
168KB

Download
memory/352-327-0x0000019AEBB10000-0x0000019AEBB3A000-memory.dmp

Filesize
168KB

Download
memory/476-308-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/476-307-0x0000018795E40000-0x0000018795E6A000-memory.dmp

Filesize
168KB

Download
memory/476-317-0x0000018795E40000-0x0000018795E6A000-memory.dmp

Filesize
168KB

Download
memory/632-300-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/632-299-0x0000014686A80000-0x0000014686AAA000-memory.dmp

Filesize
168KB

Download
memory/632-314-0x0000014686A80000-0x0000014686AAA000-memory.dmp

Filesize
168KB

Download
memory/632-315-0x00007FFD18524000-0x00007FFD18525000-memory.dmp

Filesize
4KB

Download
memory/632-297-0x0000014686A50000-0x0000014686A73000-memory.dmp

Filesize
140KB

Download
memory/688-303-0x000002E2B7BA0000-0x000002E2B7BCA000-memory.dmp

Filesize
168KB

Download
memory/688-305-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/688-316-0x000002E2B7BA0000-0x000002E2B7BCA000-memory.dmp

Filesize
168KB

Download
memory/984-318-0x00000167DC3D0000-0x00000167DC3FA000-memory.dmp

Filesize
168KB

Download
memory/984-310-0x00000167DC3D0000-0x00000167DC3FA000-memory.dmp

Filesize
168KB

Download
memory/984-311-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/1048-328-0x0000027925DD0000-0x0000027925DFA000-memory.dmp

Filesize
168KB

Download
memory/1048-325-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/1048-324-0x0000027925DD0000-0x0000027925DFA000-memory.dmp

Filesize
168KB

Download
memory/1048-954-0x0000027925DD0000-0x0000027925DFA000-memory.dmp

Filesize
168KB

Download
memory/1060-330-0x0000023BC4140000-0x0000023BC416A000-memory.dmp

Filesize
168KB

Download
memory/1060-331-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/1068-338-0x0000020C08570000-0x0000020C0859A000-memory.dmp

Filesize
168KB

Download
memory/1068-339-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/1180-342-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/1180-341-0x0000028BBF760000-0x0000028BBF78A000-memory.dmp

Filesize
168KB

Download
memory/1240-345-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/1240-344-0x0000026991B60000-0x0000026991B8A000-memory.dmp

Filesize
168KB

Download
memory/1264-347-0x0000022F92200000-0x0000022F9222A000-memory.dmp

Filesize
168KB

Download
memory/1264-348-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/1336-350-0x000001FCA9A60000-0x000001FCA9A8A000-memory.dmp

Filesize
168KB

Download
memory/1336-351-0x00007FFCD8510000-0x00007FFCD8520000-memory.dmp

Filesize
64KB

Download
memory/3800-926-0x00007FFD18480000-0x00007FFD18689000-memory.dmp

Filesize
2.0MB

Download
memory/3800-277-0x00007FFD18480000-0x00007FFD18689000-memory.dmp

Filesize
2.0MB

Download
memory/3800-1577-0x00000262B3420000-0x00000262B3432000-memory.dmp

Filesize
72KB

Download
memory/3800-1576-0x00000262B4710000-0x00000262B4786000-memory.dmp

Filesize
472KB

Download
memory/3800-1393-0x00000262B6060000-0x00000262B632A000-memory.dmp

Filesize
2.8MB

Download
memory/3800-1240-0x000002629AB80000-0x000002629AB8E000-memory.dmp

Filesize
56KB

Download
memory/3800-0-0x00007FFCF6F23000-0x00007FFCF6F25000-memory.dmp

Filesize
8KB

Download
memory/3800-1-0x0000026298CB0000-0x0000026298CC8000-memory.dmp

Filesize
96KB

Download
memory/3800-808-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download
memory/3800-2-0x00000262B3430000-0x00000262B35F2000-memory.dmp

Filesize
1.8MB

Download
memory/3800-3-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download
memory/3800-313-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download
memory/3800-293-0x00007FFCF6F23000-0x00007FFCF6F25000-memory.dmp

Filesize
8KB

Download
memory/3800-294-0x00007FFD18480000-0x00007FFD18689000-memory.dmp

Filesize
2.0MB

Download
memory/3800-4-0x00000262B48B0000-0x00000262B4DD8000-memory.dmp

Filesize
5.2MB

Download
memory/3800-276-0x000002629AAC0000-0x000002629AAFE000-memory.dmp

Filesize
248KB

Download
memory/3800-278-0x00007FFD163D0000-0x00007FFD1648D000-memory.dmp

Filesize
756KB

Download
memory/3800-1578-0x00000262B4670000-0x00000262B468E000-memory.dmp

Filesize
120KB

Download
memory/3800-289-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download
memory/5952-288-0x00007FFD163D0000-0x00007FFD1648D000-memory.dmp

Filesize
756KB

Download
memory/5952-286-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5952-2463-0x00007FFD18480000-0x00007FFD18689000-memory.dmp

Filesize
2.0MB

Download
memory/5952-287-0x00007FFD18480000-0x00007FFD18689000-memory.dmp

Filesize
2.0MB

Download
memory/5952-290-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5952-291-0x00007FFD18481000-0x00007FFD185AA000-memory.dmp

Filesize
1.2MB

Download
memory/5952-292-0x00007FFD18480000-0x00007FFD18689000-memory.dmp

Filesize
2.0MB

Download
memory/5952-285-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5952-284-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5952-896-0x00007FFD18480000-0x00007FFD18689000-memory.dmp

Filesize
2.0MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads