5f4efebe2df2bb5e99c74f7abba2332025a1054b1227f11ea5b3a223ce6699e8

Analysis

max time kernel
186s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoEXE.py
Size 1KB
Sample241109-xeszhszell
SHA256 5f4efebe2df2bb5e99c74f7abba2332025a1054b1227f11ea5b3a223ce6699e8
MD5 48bf799b6130baba4ab66cb980daf664
SHA1 a3269aa9a7b3d13832cfd4083b63ba2ffe80f90e
SHA512 b006da1ea7527273203728c45fb0b27628294402dd8ac5d5c5dfeff42a191ce18104234d6fd67967735cdf91ef9f05a90a96265fac5c2b21a540b693b27a78cb
MD5 SHA1 SHA512

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\CisUtMonitor.sys	UninstallTool.exe
File created	C:\Windows\system32\drivers\CisUtMonitor.sys	UninstallTool.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	uninstalltool_setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	UninstallTool.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	UninstallTool.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
5008	uninstalltool_setup.exe
4348	uninstalltool_setup.tmp
4736	PinToTaskbar.exe
3808	UninstallTool.exe
400	UninstallTool.exe
1628	UninstallTool.exe
1460	UninstallTool.exe
2200	UninstallTool.exe
5320	UninstallToolHelper.exe

Loads dropped DLL 2 IoCs

pid	Process
2692	regsvr32.exe
3152	regsvr32.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\{FE8E6AD6-DABE-45E1-88C2-48DC4578924C}\ = "UTShellExt"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\{FE8E6AD6-DABE-45E1-88C2-48DC4578924C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\{FE8E6AD6-DABE-45E1-88C2-48DC4578924C}\ = "UTShellExt"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\{FE8E6AD6-DABE-45E1-88C2-48DC4578924C}	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 54 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Tool\languages\is-UMHSI.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-6G4B7.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\is-R3LM7.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-C3ESR.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-D7F6R.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\is-EP57T.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-1SG63.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-K5TOE.tmp	uninstalltool_setup.tmp
File opened for modification	C:\Program Files\Uninstall Tool\UninstallTool.url	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-QKNQC.tmp	uninstalltool_setup.tmp
File opened for modification	C:\Program Files\Uninstall Tool\unins000.dat	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-2TRL8.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-DUTHM.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-C8FS1.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-3SP01.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-EKP5A.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-TKRT7.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-7J1KM.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-C73RR.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-9U0JE.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-HI5B1.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-I5L9T.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-UEVR0.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-F61JS.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-755PQ.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-G54N6.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\unins000.msg	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-NSDP7.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\is-7B27U.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-65EED.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\unins000.dat	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\is-16U9J.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-FD95S.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-BUM5I.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\is-RF8H0.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-CD4KV.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-817ME.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-D8C1V.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-EJTDC.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-3S5HC.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-1EC3G.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-DFV2J.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\is-5TB2R.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\is-4LCP4.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-8NL0B.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-PJ8T8.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\is-HT6CO.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-TU6K4.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-36C7J.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-0GAU0.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-F32UF.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-VTS7F.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-ODQLQ.tmp	uninstalltool_setup.tmp
File created	C:\Program Files\Uninstall Tool\languages\is-DC0FB.tmp	uninstalltool_setup.tmp

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\uninstalltool_setup.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UninstallToolHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstalltool_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstalltool_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\6\MRUListEx = 00000000ffffffff	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	UninstallTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5\NodeSlot = "7"	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupView = "0"	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\6	UninstallTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE8E6AD6-DABE-45E1-88C2-48DC4578924C}\ = "UTShellExt"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	UninstallTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE8E6AD6-DABE-45E1-88C2-48DC4578924C}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\6\0 = 6c003100000000004759a14b10004f4e454e4f547e310000540009000400efbe4759a14b4759a64b2e00000016290200000001000000000000000000000000000000dbdf0a004f006e0065004e006f007400650020004e006f007400650062006f006f006b007300000018000000	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 66003100000000006959fa951000554e494e53547e3200004e0009000400efbe6959fa956959fa952e000000b5e70100000002000000000000000000000000000000a2223b0055006e0069006e007300740061006c006c00200054006f006f006c00000018000000	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 06000000050000000400000003000000020000000000000001000000ffffffff	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5\MRUListEx = ffffffff	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	UninstallTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\{FE8E6AD6-DABE-45E1-88C2-48DC4578924C}\ = "UTShellExt"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\6\0\0	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\MRUListEx = ffffffff	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	UninstallTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	UninstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9ce424a8-8388-495f-a400-2bd50eb35657}\Shell\Open	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	UninstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9ce424a8-8388-495f-a400-2bd50eb35657}\Shell	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\6\0\NodeSlot = "9"	UninstallTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\6\0\MRUListEx = 00000000ffffffff	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	UninstallTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	UninstallTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\NodeSlot = "5"	UninstallTool.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	UninstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	UninstallTool.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	UninstallTool.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	UninstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	UninstallTool.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	UninstallTool.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\uninstalltool_setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\localtonet-win-64.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	PinToTaskbar.exe
4736	PinToTaskbar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2200	UninstallTool.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	firefox.exe
Token: SeDebugPrivilege	928	firefox.exe
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	928	firefox.exe
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	4348	uninstalltool_setup.tmp
Token: SeDebugPrivilege	2692	regsvr32.exe
Token: SeDebugPrivilege	2692	regsvr32.exe
Token: SeDebugPrivilege	3152	regsvr32.exe
Token: SeDebugPrivilege	3152	regsvr32.exe
Token: SeDebugPrivilege	4736	PinToTaskbar.exe
Token: SeDebugPrivilege	3808	UninstallTool.exe
Token: SeDebugPrivilege	3808	UninstallTool.exe
Token: SeDebugPrivilege	3808	UninstallTool.exe
Token: SeDebugPrivilege	400	UninstallTool.exe
Token: SeDebugPrivilege	400	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe
Token: SeDebugPrivilege	2200	UninstallTool.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
4348	uninstalltool_setup.tmp
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
4772	OpenWith.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
3808	UninstallTool.exe
400	UninstallTool.exe
1628	UninstallTool.exe
1460	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe
2200	UninstallTool.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 1192 wrote to memory of 928	1192	firefox.exe	96
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 2732	928	firefox.exe	97
PID 928 wrote to memory of 628	928	firefox.exe	98
PID 928 wrote to memory of 628	928	firefox.exe	98
PID 928 wrote to memory of 628	928	firefox.exe	98
PID 928 wrote to memory of 628	928	firefox.exe	98
PID 928 wrote to memory of 628	928	firefox.exe	98
PID 928 wrote to memory of 628	928	firefox.exe	98
PID 928 wrote to memory of 628	928	firefox.exe	98
PID 928 wrote to memory of 628	928	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AutoEXE.py
1⤵
- Modifies registry class
PID:1372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e25e3ba6-bd56-4c10-9dbf-30fb344ad3ff} 928 "\\.\pipe\gecko-crash-server-pipe.928" gpu
    3⤵
    PID:2732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9e92ad7-dbb4-4997-8f4e-e66a3f6815fb} 928 "\\.\pipe\gecko-crash-server-pipe.928" socket
    3⤵
    - Checks processor information in registry
    PID:628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2828 -childID 1 -isForBrowser -prefsHandle 2916 -prefMapHandle 3032 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18af402c-35d6-4ba7-a694-cd148aab8d80} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4020 -childID 2 -isForBrowser -prefsHandle 4012 -prefMapHandle 4008 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0c2ce97-358e-4cae-9022-b6e736dc2954} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:1852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4932 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4928 -prefMapHandle 4924 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d981b746-6229-4396-9cce-78a77fbc3ce5} 928 "\\.\pipe\gecko-crash-server-pipe.928" utility
    3⤵
    - Checks processor information in registry
    PID:5252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 3 -isForBrowser -prefsHandle 5344 -prefMapHandle 5328 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bf34391-decc-4086-87d7-45c276d81392} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 4 -isForBrowser -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2ae86e6-ad3b-4f07-8a8b-82f5fcdddc5a} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5700 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d99cf8d7-e349-4285-a635-fc99713376ef} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6216 -childID 6 -isForBrowser -prefsHandle 6192 -prefMapHandle 6208 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47502a05-4ee2-4229-948b-155d6e43a3d2} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:1312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 7 -isForBrowser -prefsHandle 4664 -prefMapHandle 3524 -prefsLen 27919 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd7ba1b7-00fa-4979-9eec-fff646c415bd} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6532 -childID 8 -isForBrowser -prefsHandle 6620 -prefMapHandle 6356 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a047932-20dc-49ed-bc77-90ac82624827} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6800 -parentBuildID 20240401114208 -prefsHandle 7356 -prefMapHandle 7352 -prefsLen 30572 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9e9cc92-d7de-40f3-af24-4054fdc9bb1d} 928 "\\.\pipe\gecko-crash-server-pipe.928" rdd
    3⤵
    PID:1188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7344 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 7368 -prefMapHandle 7364 -prefsLen 30572 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78b2defe-6da2-491d-8e9f-84daf34a6ec2} 928 "\\.\pipe\gecko-crash-server-pipe.928" utility
    3⤵
    - Checks processor information in registry
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6392 -childID 9 -isForBrowser -prefsHandle 5856 -prefMapHandle 5788 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac23c4e5-67aa-49f3-b2ed-bf3aa46f1b72} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:6068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7560 -childID 10 -isForBrowser -prefsHandle 5784 -prefMapHandle 7720 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6377b359-9a06-445b-bcf2-a9b67214c191} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:3968
- - C:\Users\Admin\Downloads\uninstalltool_setup.exe
    "C:\Users\Admin\Downloads\uninstalltool_setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\is-6E29P.tmp\uninstalltool_setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6E29P.tmp\uninstalltool_setup.tmp" /SL5="$E004C,4977297,845824,C:\Users\Admin\Downloads\uninstalltool_setup.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4348
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt.dll"
        5⤵
        Loads dropped DLL
        Modifies system executable filetype association
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt_x86.dll"
        5⤵
        
        PID:5064
      - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files\Uninstall Tool\UTShellExt_x86.dll"
        6⤵
        Loads dropped DLL
        Modifies system executable filetype association
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3152
    - - C:\Program Files\Uninstall Tool\PinToTaskbar.exe
        
        "C:\Program Files\Uninstall Tool\PinToTaskbar.exe" /pin UninstallTool.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
    - - C:\Program Files\Uninstall Tool\UninstallTool.exe
        
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silent
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3808
    - - C:\Program Files\Uninstall Tool\UninstallTool.exe
        
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /init
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:400
    - - C:\Program Files\Uninstall Tool\UninstallTool.exe
        
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /add_control_panel_icon
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1628
    - - C:\Program Files\Uninstall Tool\UninstallTool.exe
        
        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /skip_uac
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
    - - C:\Program Files\Uninstall Tool\UninstallTool.exe
        
        "C:\Program Files\Uninstall Tool\UninstallTool.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Modifies system certificate store
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
        
        "C:\Program Files\Uninstall Tool\UninstallToolHelper.exe" /pid:2200
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4556 -childID 11 -isForBrowser -prefsHandle 6220 -prefMapHandle 5876 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {597beb6f-a807-4f77-9de3-411705a8f622} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:1064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5756

C:\Users\Admin\Desktop\localtonet.exe
"C:\Users\Admin\Desktop\localtonet.exe"
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PinToTaskbar.exe

Path C:\Program Files\Uninstall Tool\PinToTaskbar.exe
Size 386KB
SHA256 e87288744cc29c5ab81d9c3fa78653cacd87bc74bf5a3abc4f38afcd6a1a5c16
MD5 4de7220115fe537eaf6c5776e83f0064
SHA1 e81a7feab77203266a8afb379ff93025c923f28b
SHA512 b33113314636a491c35dea215c3cd75f74797223d5b6b7ca88b790b9ddc9969c8759b61e354e753db2476dd65953664cf321940be811c6c9fc01391f0490c02f
SSDEEP 6144:YoQA01BB3yF+yBsrTL15AdKSj91++BsRX5vqdvflNohVDyAa+pL1vvwUwN:0Aiv3yIyBsrT3Adj7+nXSflNoQ+px4jN
MD5 SHA1 SHA512 SSDEEP

Submit Download

UTShellExt.dll

Path C:\Program Files\Uninstall Tool\UTShellExt.dll
Size 516KB
SHA256 157b1afebd03b3325bb13bb229caebe2e3c73360250fe689af1635a670487e17
MD5 c836d4008d50fdbb49101eea1d49a57f
SHA1 ebfc097ecde12532d0ac8d76dd67df79c8007e77
SHA512 eab2b799a2ac670dcce82429139ec7482c1ac9d9c2ed028f926add1c462d8347bd293f284fba3fb91a61d0c48b9a63829c895ba300d3f6ff07cfa1977ba138f3
SSDEEP 12288:lHD7N1CHnIpIMH22QcvWZduMRyET+IHqolc+3Yx6:lHD7lVPnMRyENK3x6
MD5 SHA1 SHA512 SSDEEP

Submit Download

UTShellExt_x86.dll

Path C:\Program Files\Uninstall Tool\UTShellExt_x86.dll
Size 422KB
SHA256 6a9e6a25e9fe6c5503dfcc606e0392f6dcbe71a1e9dec010cde7ff82b7cd52f7
MD5 7460a0e0c7cd0d14649eec1688322505
SHA1 e7b1fc34362123f8bd95eac5996d7788e618c0da
SHA512 44e1bcac6f4cac6ca39aea60da403bd09e8eaf82e40984bb1c676828373e5af160b99aea186b71e9be69f4ecf2090de9fa5d79cf50c3c348545f25454d361e40
SSDEEP 12288:oFO1h1VKWCtErqJXica3bL5IsYWbJhc2xEjt3rWK:oFOv1VKxo3bL5VbJhcPxrWK
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallTool.exe

Path C:\Program Files\Uninstall Tool\UninstallTool.exe
Size 5.6MB
SHA256 6095e41aed91326a12acd02ae988711befd3e3ad2d280ca5d0c2647cb0f781f1
MD5 3314588abbe3e7e976ca664886e691b8
SHA1 91ab07ccf95e087c3878c3e2d93941e561ed979a
SHA512 77fbc216f0c6633f39ba6e0490358276e977e7dc981e7f164328a92f5a014d90b1aaf41819519bd3313b8ddfded4b98c069eaae15f2057e5f42d8177facc700f
SSDEEP 98304:hYy6f59Qk38T+Pcuv2ePDLkk6p5OjLJDbaM+2yon:hYzf5mkMk2e0kEUl5yon
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallTool.url

Path C:\Program Files\Uninstall Tool\UninstallTool.url
Size 49B
SHA256 f5b831cbd09d64293e82d2f1f85c5787bd79599e64aab7128bdfb3c05e98b499
MD5 5ee9ab72918050713bedda542ed7a563
SHA1 2bbb225a7d2dbb4c71b7487fabb84fe82d84f95f
SHA512 33c4dc5d45c26799a42608590deb295ee3ad4bed36030874adb8bb43a611bfa5ee3335f318832c0d155824fd808fe7a9b657b7761176595bf79c6f73af2be497
MD5 SHA1 SHA512

Submit Download

UninstallToolHelper.exe

Path C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
Size 463KB
SHA256 ba8d7b5662f85aa901fd6bcf86fc5989013577b18c81a91bffc1211fec31d6c8
MD5 d82e0a3786dba17f88929d11d6b00b96
SHA1 098f9b676677dc3a30530ad5254b7fb41e1391d9
SHA512 4df64c5f421103fabf156342d41ff2cece82ce6b7015c454ac78680611d4ab64788c7ed50b0505edcd4cc704fdbe3c118370464c476f8047bd0e022ddbc3424d
SSDEEP 12288:jDrJL3QCiSt7hMYDbInjPp7ormE3Lu4iPnOEAPiWTydl6:jDrpQCpXZbCj5Y3C4MXlbK
MD5 SHA1 SHA512 SSDEEP

Submit Download

English.xml

Path C:\Program Files\Uninstall Tool\languages\English.xml
Size 40KB
SHA256 bbd3c410b5519170b3c002e9c8c4eb3a5599439f00f5e1d3c3037a484c35c907
MD5 955f262f1ab8f37793ad91945a01d01d
SHA1 859828af13645c29878b67f300820b4d31fac352
SHA512 c8e120533e41f7e02ac0368c0a06b6bfc4da2192bb2282daaba1d27a81780ae6001834fbe1333fca89da1db137941fcf6be80924359031b0ba6289b3c8cfceb1
SSDEEP 768:+6jxmmLPaLaTFafBfgXz1SvuwllNRnqA+D+ksFmiFDgiJyMfDwn:+6jxLaWYf9CyllNCiTJyIDwn
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json
Size 19KB
SHA256 ea186f2dd9f0537fcbcb67cb3f0184e30dabc0a575a9c4a47b0657bdf7bf7ed5
MD5 f6b94e8b12b1e7e2e3965f69cef429f6
SHA1 0e5820300693c30bedab166ac2d3c4853cf6e2b5
SHA512 b89482b85964fabdf0071c1ab09c2d8a3785ca646950fc2ddf3e1d8a1bcc38c8e0d05c0aa5cfc8425354b9e6cec021284ca587128950d75ac1f83aacb16cdb23
SSDEEP 384:XbtL0iy7/WRpZxpKFCsXHi/SayUQWdqn/IgIEL5VOrrtejhgyaE:ZQh+RKgsOSayU/8wPuOygyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

5EFB7B0E6074226F79A8AA9919C3E295081C6B61

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\5EFB7B0E6074226F79A8AA9919C3E295081C6B61
Size 61KB
SHA256 cd32807597f84661f43cd1e463eef606398b40815c346ddaac34034d877e72e3
MD5 b2acdb6ec5e17be4ad0575aecf205585
SHA1 331df33db12de0e6efc9f108faea2705b3e3b222
SHA512 dfe72adc45eda699224a4f5d7b2bf990ea315cb05e20470dd3442c0faad953687fcfe48b4eeab5baf641e4f9de1b576315f884ab29eada1ed8d2f517decd5037
SSDEEP 768:74MMCvD80D9p1ae0zqllG+D9p1ae0zqlBGXgCy6c4Knr4EgXfgLJKAvKiw2BVS:HxezqlfezqlTjNhLBw2XS
MD5 SHA1 SHA512 SSDEEP

Submit Download

6AB77199AA81103EF9EDDBA840BB48441F8B86DA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\6AB77199AA81103EF9EDDBA840BB48441F8B86DA
Size 224KB
SHA256 6fbb1a900c9f6f56c8f84a4d1d0f40b63c8c109f4c554c5d293b70f0e6bc5013
MD5 c1a2dd0fffd28ff8f0c15d030a9bdca6
SHA1 704615ec48754dabb65c7d9424669f5b2f475d00
SHA512 c551971f3df22c13d7a4bbffd08fb887bedce25161fe0759de42acc7b546bd7d4f8c6335e01ab1a5afffc72a57b8bd453fefd5b22320f4e6a4b1af2f3d4b36b0
SSDEEP 6144:p44SMI+nILK22Fp9P9xp1mkXRVxCKl6n3P2dQktzsDb1Q8k:pSDu2yf9xTXR7zYPTk5ubq8k
MD5 SHA1 SHA512 SSDEEP

Submit Download

6FCFE6617A7BA72620CD183FF1A968A312778458

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\6FCFE6617A7BA72620CD183FF1A968A312778458
Size 49KB
SHA256 afaa42353a5bfe44e1651f6fcc5d3b93e1c33163c2c75b2c768f0b7aece6f024
MD5 75f061f1f1d67ec23da3d4384b635aaf
SHA1 79952a9bce267f0fe005a543d1c4b3828580000f
SHA512 0ec3c6b33e9efcd1d2688497c4c6ea5da26291c80441a096ec4e863dde52e261935946f4f39e96f5e70528931e16c080c60c58f35af7a65df9b72dac29260817
SSDEEP 1536:1REwy68Myso4yE4WmW/IZZC40L+7vcHaokUFB:HQyo474DTZI+bhokUFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

CisUtMonitor.sys

Path C:\Users\Admin\AppData\Local\Temp\CisUtMonitor.sys
Size 56KB
SHA256 917572f2a45f7b8312ed09d783418534e95888c10f3e0b6cf40c5df58a7c390d
MD5 1b16fa25136adb7b3c41a3f1d474c901
SHA1 d6d0fc8367c3939fedc45474c37ed16b83b53f15
SHA512 e67e214b87b7b5ff9a678d4ccf4c65f8f828e46969498e8163b565658baccb3d72c60c43e8b5a459ec0215e079949182c92c750484f1b3dfd0e5af21634cf236
SSDEEP 768:5kq8HUW9WHiE2bN+xp9E+8iRO5bN+cmp9E+8iROqw63MyxLVNe9zJz3:c9WHA0xQ+8iA50cmQ+8iAqw6xnNazJz3
MD5 SHA1 SHA512 SSDEEP

Submit Download

uninstalltool_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-6E29P.tmp\uninstalltool_setup.tmp
Size 3.1MB
SHA256 5fe7888a8a41638e457a1d52369701f33b2084aeeb32a3c4fc996b1487a8fadd
MD5 8c1451188764f81954e6d4672100433a
SHA1 c01d90c825b3ed029eeb45017fa37d40bd1fd32b
SHA512 a2a4d1b8801893cb1a6820233c8b78f272869224471f72aee82b18aa1001cd3b68955121c6f38b9318c6093f0089bf6afac89979668381eaa587241af8824164
SSDEEP 49152:cWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbe333SK4X:4tLutqgwh4NYxtJpkxhGp333z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

CachedData.dat

Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\CachedData.dat
Size 2KB
SHA256 67cad49aab4506de9c444fea7349df3491cfa38c0519c25cec2a01e528f29f25
MD5 3acdfb7cbbfc976c454f270325cec456
SHA1 582f9a9df0896a1c273684e96f023e1409bcd2b4
SHA512 7119a86901aea31a17debb3eaaf2f40ea6e510f728f60c2c76efea185c2b92e3c1e8419a0aadeece08092e10ef60660cb8cabf12ae6c8b9b5144518c2d1017fc
MD5 SHA1 SHA512

Submit Download

preferences.xml

Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
Size 1KB
SHA256 0237bf82b7610c21bf77e99037ba18d73c9fccec531b49f08e9b821825cbfa00
MD5 23618daa6d7d186c500d713997df0031
SHA1 aec490f22c95101f8dc2f6c7d6c6d04bb32b966f
SHA512 fc2045ae65cb289ea1a89a908f0598ba6c78279ae092e41e4966504a5aef6927ad4825d142f4a88c1c54da6f531e6ace0a9588930f037416fe154256dffedf73
MD5 SHA1 SHA512

Submit Download

preferences.xml

Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
Size 2KB
SHA256 d3adb2b6f28fb9afa600e9d863960bcb77aefd6fd8b7ae63b0c987584d86eb2d
MD5 6b77b81113ac684c3ed8a2be3ef3db30
SHA1 dc1bfaf67027c06bf4c1a796a1383ca85ee46dcf
SHA512 6363a31d19ca9af7bd919dcf349de570645328ade803e07e5033f48b05037bef8f42378faba94a8ece14bf2d37aff6fe8fa6bfc125a0d8e7a398c157d0951500
MD5 SHA1 SHA512

Submit Download

269c0465f0b4b6ee.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
Size 5KB
SHA256 a369123acc6e2ef68dc3826197cce1b8feee4ed0556f2dd959c51aba6725f831
MD5 f65135d88f19d1c51064bdcef4a05c49
SHA1 96ea2699d5cea1b8769e84851c9d5225aaad6e5e
SHA512 7688dee251f27dfabd85f9138e85539ad163425ac42b007951b406a4e697fbed2b62e59b16e075ebb94039b552e6f85314107e40660c36b106b88c571f9be4da
SSDEEP 96:rdoOx5QMwDIm3DfhXh37hXhsvSx5QMwDIOZhXh37hXhWMNRx5QMwDIyMmM4hXh3q:rSPHLR1RoLHPR1RTuHRR1RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

269c0465f0b4b6ee.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
Size 5KB
SHA256 d371c91f132e653fbbf50b2cee79bdf6dd98507b5660f152dbb1a0e140a11c57
MD5 802fdefae0cd6a9b8d7f64dafd4b47a8
SHA1 6372c8351b4920412c58822387cc1b59398b4968
SHA512 3465aece34acbb34e3975afcaab5c3d0743ced117fad13855c07f24b9959e7b9783297d0fc3833723a1b428d164fec30a1847ec57f4e2e372fd944bfe13199e7
SSDEEP 96:rdQx5QMwDIm3DfhXh37hXhshx5QMwDIOZhXh37hXhWMUx5QMwDIyMmM4hXh37hXU:rnHLR1R5HPR1RHHRR1RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Size 6KB
SHA256 dcdffacd2cd843ae73dbda668ce9a584fa52539a466290a9dd47f8e4319b5718
MD5 46715550c86be640a320a99e8f943c4c
SHA1 4be2962dfd96a09be9829e6f60e01f1811d04436
SHA512 30148e841f9a8b71e29473a4c5f9ec6d87ba1ee48eb4d972be822c0796fc4d613afa6abcd76e8d74d4e8548a8e7bad858d3a73630b01a50fe898811a53a4305a
SSDEEP 24:CuB1ov3RFsh2F3LFHnCgu1xgRblfYpR5cOmQBuhMZly:C31C5olY9cOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin
Size 11KB
SHA256 75290585f0e0d5728186d14d3a55c0c9f61264189c16c37a3b397b209bf5b693
MD5 c6776c4ba0815ab6c420afd899ebd153
SHA1 3eed08b2abede0af11d0f27570d5fabb795abd71
SHA512 e7edb62d588ef2aab603900d32ab36eb8275830df413f6758eb0c6f9066ca782faa81890d72aefb947a301ccd3765b894a6e7ccbfef5282dc62ad4fe245455ad
SSDEEP 24:auQuB1olL3RFsh2F3LFHnCgu1xgRblfYpR5cOmQBuhMZlyZc918KiwXC9BUXiUPW:PG31C5olY9cOjuO4SwzU1Y0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 38861396739d81ebc421101d384ec80bc27ed2f33c1456abea73d4ed3c5c3f43
MD5 496f444acdc67b799a8dd03e49d0594b
SHA1 78a6030389380fc3133df7b8fe7b96d8317f5f2d
SHA512 1226a4d21aabf5f1a3c8b41db03051c1d48f28aa5487bd11d87b6a736639df61ae7ff883300d64e0c1b1083ceec902b9d371af76d96eb00758dee7da9186c480
SSDEEP 96:AHQ5b7rlFl66JozGzgClKtmSSZSMF9ZbkW6ShmYuPP/PrWI:hB/66JozGzgCl6mSSZrvZboShBgPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f706659cdb60533646767dac64d13c484cd095fe4e952e892b39fbee9ebdc137
MD5 8049817b851e4e8cb51dfb34b7ff0fc2
SHA1 c38223ba1036e318cc86df7645ba45ebe13c6b44
SHA512 28872a45aea66a0cdf1ee72ddb7fb12af8a38f415959bf99b64bb38d06157b92bb7e63f74dea534d0c493d97e866c9ae84017d64b449518f0b3221fcdf84005b
SSDEEP 192:SkbrvZboPuhr1uLPdcWMB/66JozGzgCl6mSSM:Skxbo2LuLPdG/66JozGzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b00d50a8eb672206f4fe41c994898de07c2b8db4d1817c4f0541d224eac0d4c6
MD5 958f617d131ad8af6b63d272aa7862a2
SHA1 f52ab3b422a38fdafa252d14bd3723ffbeeee595
SHA512 4a28469071ea20045c28f52117e018951daa138ab4ab32d5f6cb9aa6fe318393e76e385c23e0478645d88d1f4d112da0a40ef9477899d3fb9b6a50d5652b7b4d
SSDEEP 192:jkbrvZboPuhr1uLPdcWv2/66JozGzgCl6mSSM:jkxbo2LuLPd2/66JozGzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

08d9573f-9511-4361-b3c7-7830ecceb4c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\08d9573f-9511-4361-b3c7-7830ecceb4c3
Size 671B
SHA256 aaeee103e117c2780c4cea4bcfa66326fcf1da9ebd7da6d40b40d22061129a23
MD5 3c1d376cc3899ef210d664c517ebdc00
SHA1 c86afb62c94b6a770d2c6afa614f536136ba007b
SHA512 157e48ee99070e89e6dd4f7de06dbad9eb48557d3f546aeebf8845176ab48d2dc07800b651b94b41c5a8c585ad7cfc80a1f6420c4dc182334d8a59a5687a823f
MD5 SHA1 SHA512

Submit Download

5941abdb-f9fe-43a2-ae51-c1b9c53895af

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\5941abdb-f9fe-43a2-ae51-c1b9c53895af
Size 24KB
SHA256 27a063a25bfcc1b19160f3811f9c09e074e1c45edde33d176b39c5c45e1a5731
MD5 3b63ad6d0702319993872ea291f7b821
SHA1 b91b18bc1e3ec0c6232b583a1c62e1e34314dd1f
SHA512 dd2505d73d854ec8c12e8ff9b5df3ab21f1072a48c72630e2f252880cfeabf90c0890d81f9996367c020bbe96ff94f57d193057ded8eea40f4c3a75a1472dd29
SSDEEP 768:aQu5YXS1bRSqyhpLGh2/24ngOA0ZOS+H6UdWnV2:lXHqcpLGg/3g+OH6QWnV2
MD5 SHA1 SHA512 SSDEEP

Submit Download

d23b08ac-297f-4366-9d0b-d0ce79554fd7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\d23b08ac-297f-4366-9d0b-d0ce79554fd7
Size 26KB
SHA256 2462d95582d9bf56f696f0bca1a98754f9e717a1d8c3e6c0d761cbb7d5c5b38f
MD5 359c02bd5f04a66300b2ea8f12410f15
SHA1 cad40573718dee53b267acd0fe5fce4ae427dec2
SHA512 bf2a713e55c8c3855ee26e4d7a9707ed5eb847ca9ea081e4ac11e400cab9f4f468426803a77adf7b5cac1d12559d88b7320a13b580d3dab071515df1ebb42645
SSDEEP 192:D/plB9jluj2/sQr7eCXOZlwOxsP4Hgf51K22sLuaT4w5Pk7bxxJnMEyTzyJWkerP:D4chvyOSWtRcKA7XgOXvR9qs6XJX
MD5 SHA1 SHA512 SSDEEP

Submit Download

e9ef07da-b211-471c-b1bb-6f9bd650132e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\e9ef07da-b211-471c-b1bb-6f9bd650132e
Size 982B
SHA256 45c03061dc78b334d14b42032eafe40a9d8cfec22cdb747b12cf8e27e2fe6918
MD5 086d6ebf9418c82756036ffdf35fbbff
SHA1 bc505e9a164a696af43b76c5c6108284931b4e19
SHA512 199b971db8b61c081e80ff9da6e71fa49b290ff4e8879010f63279233ec07ae4c91018eea9e8f90fbd2d904c5f0a4768744060721a47333b69667171f079dea3
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 11KB
SHA256 aa227487720ad813a5765df878de0efc9c0ae1417136fadf9eba637195e61da2
MD5 ff0a45a8fc6f67eede583ad09240566e
SHA1 e418ff311d5781c8fb437fc1ddbe2545924b908d
SHA512 b2a83e1943044948a3a4a0983ed2299db82c2bb739fd0e3075524e3fb73c2d8468ff30e710ac628ee718f50f322fdcfa26b63e3370c72e3cf046ba9c6766345d
SSDEEP 192:XunZRVpf+2828nr6xnDd3SLQ0ESt3VQttCmjtJRVkkaXSVJJuBw8HP:2pAr6x9MElpJRWwVQwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js
Size 11KB
SHA256 42ac8e79b789303a616a8efb1eb8e5b6a65e730b078f92b88a9585c8b0d7e860
MD5 4c186e30d3dbd1a875365666a37e2b45
SHA1 633b902cb6b18f7668233780f8e3f2d2f74ee59d
SHA512 8647e16d39ed448ea5c91bf71547c06514e7c2eaa188ce38d9b4e569f5bb8b5af8260ccf6c651098390473732eb6e6362acab546fce076b5e67e06cf4e0c07b3
SSDEEP 192:XunBCRApf+2828nr6xnDd3SLQ0ESt3VQttCmjtJRVkkaXSVJJEiBw8VA:MpAr6x9MElpJRWwV7wr
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
Size 10KB
SHA256 7d0e8a2f2ded69c0c9b507a078aada07804b26bc6d3eab39a1c8ec598310e173
MD5 921c3635af0ef08f985e255b5c0d377e
SHA1 afa8486472bd18649fb5c00b7fd5fc68a7cbff87
SHA512 974a3d517c173867e9eaf13345f0bd43ecf8ce62001aed390707c747086baaaf5d8c1d1e03268130f048f8d0b3907769137c4c8d55b603bc1e12ae2b7e9904eb
SSDEEP 192:X5nZRVpf2DZPPVofAHBtq8prddx9y1ZO43XaXoVJJ/Bw8Va:HpgPVoIbpd9y1ZOiVlwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js
Size 11KB
SHA256 5a0f5b9e4a2af7f221556e18da83e74ba26b38e01f93616d234b1c470aff2348
MD5 881de7c89fce7eec075277cf5caf2c8c
SHA1 22be42b43fa2a07a7f22b269b7e2f2a3b940546d
SHA512 1b5a1dc7c60b66494ac55805759a847350735a4f2acadd6cce6e1aea7be8974820236bbdff646754dbcde4fed7a2ffbe0ef08f7cdb922bf3f890cef1e52bd8a2
SSDEEP 192:XunBCRVpf+2828nr6xnDd3SLQ0ESt3VQttCmjtJRVkkaXSVJJEiBw8HP:BpAr6x9MElpJRWwV7wC
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 8895e92ec015a1ab10103576e2b94cf81a084fa0804811da023a6c926bfa221e
MD5 96de4b4fdd17ae3e2de834391cef742f
SHA1 4f85978f6a208f4c4b99432b9028a552c09cac32
SHA512 efa87590c81ebdcd6f8b475a89d7884026f3934e970b889aae0fc7e46ebd2e841793489c8b48cf75f9099d80abe820f30229b33a6f662c3dd78e2054d251aa12
SSDEEP 192:/kMw897xbp9sere2DoRloazeu5IPdmNu1aisM+LEJjJli+iU+2dS8S:/7Ztxbp95e2xrPkuc1M+LE5iTp
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 40a6be97f6b217572c2f7a70880af3a12f98477fd6c5ad803e04c15a3a7810df
MD5 778012eb8718911d04922432fdb6c16b
SHA1 a997d06f08d53d5c199e605a3ed91f146df65375
SHA512 976c29751b091c1bd58d5c349e88e6b22f723bbf5549d3258bd885e39edd200a5463fb3dd131e13a9394a19018c59ddab5f8afc69c7f3da9a22f4abc5b06c72f
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 ac21fd5a07b047a1e8e85e85150b5955b72f7070680acf0f404eb53625f8932c
MD5 0ce3179a0ee1eb857b66b2950850dfbf
SHA1 c47a7fc386f912d65817ea93eda913e951eaecd4
SHA512 4f5dc54e6a8e4e8ad89110fcd5bcd2429e7181fbc055101f881d38d2f71b8905e56ca6f8e3550f6d8f4f81597c99052f2c43588668ad0c5f8433c395d809f96d
SSDEEP 96:xkMwAt97xxCE18ZShjfGWDger5/GeBGWCBOYNk:xkMw897xbp9serJGeUQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 e4fe69d936ab58f89eb0ab8d8da29e29d0eaeaf7267acd469af58e04be8abdcd
MD5 95e35cc2c0d8a61776176802d6b0df51
SHA1 4065b55c27e3baf8fc62efcd02a33240ac646373
SHA512 fb729d5fa37b26e14748efef61dbe9f39f6a153b9c4080eaeb60764ca4d47da461679a53d29cc289e07609eae7bd3d1ba0340f04911b69494b2ec55ad5e4bed3
SSDEEP 192:MCkMw897xbp9sere2DoqhTePXVQDdmNu8aiAMSLEJjJBi+ixyqodGpMS:MC7Ztxbp95e2LDkuhxMSLEdinD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 3837a8fe4eb0e0261d0e2258ffea6f551a7753b0b6a4c2e1425b03eab21d50ca
MD5 561c570d37f928dc608863eaaed55be6
SHA1 4118ef9c0aa2ca08efb44f61ad2f0ba0c011d2e7
SHA512 c1a3ec3a993b7a2d4ab60a0a9fd77ce9352e477ad9dc4f28efc00bd017783989ac9a79229202412d40c6dbab40ec12a0ab7c164cce1eb74588faaefd752300bc
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 85261a00559a8264b89e70fcf979568cd2367776119602fd7c2c5e23f391d200
MD5 11eb24189b9b843ae5f0db7442c4d8b4
SHA1 50e972cf827dd4f4c45690054c55a55c293530fa
SHA512 ff852cf8e1b0af20507d5a1bf865800504cbe0bea5e78e8a8da3d544d6b28abd02ee3fa631a906d25c1c8b0c0af3267331aaec312dd927e2257809c28a70c70d
SSDEEP 192:ukMw897xbp9serVMx5LSsmL4CeaYKOdmNua+iDMTLEJjJ7i+iIQcdKz0JS:u7Ztxbp95k/cOkuvyMTLEvip0I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall Tool.lnk

Path C:\Users\Admin\Desktop\Uninstall Tool.lnk
Size 927B
SHA256 52e1e61772bcfd5d643b66ca39ba7fe0f3ac94c8d015a83a42e4b668ac4ec59f
MD5 3967165bbe856a6ddc4e088cc37c9d3f
SHA1 4c774e1af3070d04338e11d7d4aa47b85ca9245c
SHA512 368fef7fb54085b6ae9f0a1f0dd385f01d29b616c8ff242ca01406652acdd41b32f5412ae283ecbfc5a113688bcda69fe02126403b32bb6ff0a2f9ecaebb5944
MD5 SHA1 SHA512

Submit Download

localtonet-win-64.NRV1tDyq.zip.part

Path C:\Users\Admin\Downloads\localtonet-win-64.NRV1tDyq.zip.part
Size 35.3MB
SHA256 46e54f7d45b372e3742618d55eb7985b540b6618f90c3cfba2c6f4105115473b
MD5 9578fafb9e165a46d2983f010c289683
SHA1 17325623e47a0bc8440577f78c55c713c42cc086
SHA512 e81c06112e0f6d021842d8caf9267a369cc7d8b7fc36034f60caf2cf97ebe2be16e5cb9d583808085d4e4398a3887bc6be9d98867c99e7d6b9c5dda19c1483bf
SSDEEP 786432:nSwTqwOOnITXt/4/uTvko+ZMdteO7Nww5FtB+MfMb8qiuTnoSEHYLd4Dk:9OwMF4esBqdHd5FtBHMbTTnhE4Ld4Dk
MD5 SHA1 SHA512 SSDEEP

Submit Download

uninstalltool_setup.tc6Uk-PD.exe.part

Path C:\Users\Admin\Downloads\uninstalltool_setup.tc6Uk-PD.exe.part
Size 5.7MB
SHA256 66b696e76af8e72272883e22e7f5e42e168195c2e42fddf6d9e4e59c8a003ee4
MD5 417161bef8a9990d7d99cd660042608d
SHA1 8b319c3ec6cff5a598f7ee3be643a1e13ac85a1b
SHA512 3603a744fad93c6b0f48a9ab5795193b0c5c5e145fa80d5c5b0214efc62b39e80d3c83fe04b90b48aca2dd504c4b4f6cfa3f896f66cf76dc204e661ba36b0ae6
SSDEEP 98304:mkL6cnCk9EjDxlSQSk0StENJ6+t22o0LPfG8I2zCFqCmRY4z6FSQ8l5ocPCfEWa:Rt92xcQF7tETN22o6XGN2lRqcr5bWa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4348-1258-0x0000000000400000-0x0000000000717000-memory.dmp

Download

memory/5008-1259-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/5008-1076-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/5320-1263-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5320-1336-0x0000000000400000-0x0000000000474000-memory.dmp

Download