de32062cca28c71c2d281234f795376c7868410f65e2fb3fd21f1b67ef44a60d

Analysis

max time kernel
449s
max time network
446s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-01-2025 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

270KB
MD5

05fcfcf0b3855a3449db9971b8410ffc
SHA1

100b7887a4ff455aa7a6792961b675802c219595
SHA256

de32062cca28c71c2d281234f795376c7868410f65e2fb3fd21f1b67ef44a60d
SHA512

8e919190c2e905a48463d020d7766660c2db97b71212b96cca237792b68e4cdc9ce8dabd627523ae83dc19c3f4adbdaa73188524063711968636eeac50dff9aa
SSDEEP

3072:Aw/LvIzNaEZZ01ITaQljV5A+JejuezroAxPIcX5AwtN+25/j9Y:Aw/LvcNaEZZGITFV5NfezrpIyh9Y

Score

6^/10

collection discovery upx

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aida64.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\drivers\color\CalibratedDisplayProfile-0-Temp.icc	DCCW.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2648-997-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1098-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1099-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1101-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1103-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1104-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1105-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1106-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1107-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1108-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1110-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1155-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1188-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx
behavioral1/memory/2648-1194-0x0000000000400000-0x0000000004FA4000-memory.dmp	upx

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_media.PNF	aida64.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\INF\c_diskdrive.PNF	aida64.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File created	C:\Windows\INF\c_monitor.PNF	aida64.exe
File created	C:\Windows\INF\c_volume.PNF	aida64.exe
File created	C:\Windows\INF\c_display.PNF	aida64.exe
File created	C:\Windows\INF\c_processor.PNF	aida64.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aida64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks SCSI registry key(s) 3 TTPs 17 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Address	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Address	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Driver	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	aida64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	aida64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	aida64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LocationInformation	aida64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	aida64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	aida64.exe

Checks processor information in registry 2 TTPs 27 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	aida64.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	aida64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aida64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	aida64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	aida64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	aida64.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\MultifunctionAdapter\1	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	aida64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	aida64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\MultifunctionAdapter\0	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	aida64.exe
Key opened	\REGISTRY\MACHINE\Hardware\DESCRIPTION\System\BIOS	aida64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	aida64.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\aida64extreme750.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\AIDA64Driver.sys\:Zone.Identifier:$DATA	aida64.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2648	aida64.exe
2648	aida64.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	aida64.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	firefox.exe
Token: SeDebugPrivilege	2656	firefox.exe
Token: SeDebugPrivilege	2656	firefox.exe
Token: SeDebugPrivilege	2656	firefox.exe
Token: SeDebugPrivilege	2656	firefox.exe
Token: SeDebugPrivilege	2656	firefox.exe
Token: SeSystemEnvironmentPrivilege	2648	aida64.exe
Token: SeSystemEnvironmentPrivilege	2648	aida64.exe
Token: SeSystemEnvironmentPrivilege	2648	aida64.exe
Token: SeSystemEnvironmentPrivilege	2648	aida64.exe
Token: SeSystemEnvironmentPrivilege	2648	aida64.exe
Token: SeSystemEnvironmentPrivilege	2648	aida64.exe
Token: SeDebugPrivilege	4568	taskmgr.exe
Token: SeSystemProfilePrivilege	4568	taskmgr.exe
Token: SeCreateGlobalPrivilege	4568	taskmgr.exe
Token: 33	4568	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4568	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
2648	aida64.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
2648	aida64.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
2648	aida64.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
2648	aida64.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
2648	aida64.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
2648	aida64.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe
4568	taskmgr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2656	firefox.exe
2648	aida64.exe
1772	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 3252 wrote to memory of 2656	3252	firefox.exe	77
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 4004	2656	firefox.exe	78
PID 2656 wrote to memory of 644	2656	firefox.exe	79
PID 2656 wrote to memory of 644	2656	firefox.exe	79
PID 2656 wrote to memory of 644	2656	firefox.exe	79
PID 2656 wrote to memory of 644	2656	firefox.exe	79
PID 2656 wrote to memory of 644	2656	firefox.exe	79
PID 2656 wrote to memory of 644	2656	firefox.exe	79
PID 2656 wrote to memory of 644	2656	firefox.exe	79
PID 2656 wrote to memory of 644	2656	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aida64.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\sample.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\sample.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17fa31db-8e4d-47d4-900b-3de91fff2875} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" gpu
    3⤵
    PID:4004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2368 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bbc2b6d-5b9c-450c-a798-4388e3af8f54} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" socket
    3⤵
    - Checks processor information in registry
    PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2860 -childID 1 -isForBrowser -prefsHandle 2900 -prefMapHandle 2616 -prefsLen 24739 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a517790-2121-446e-8127-e332b49c75d3} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:3520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3376 -childID 2 -isForBrowser -prefsHandle 3620 -prefMapHandle 3616 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2545742b-f844-4f2a-ac16-861c96969a4a} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4964 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4956 -prefMapHandle 4952 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61c12a87-9ff9-42a0-a74a-a186772b8ec9} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" utility
    3⤵
    - Checks processor information in registry
    PID:3728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 3 -isForBrowser -prefsHandle 5336 -prefMapHandle 5276 -prefsLen 27139 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17cf1f31-8001-41b5-8612-76586a5a77ea} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5852 -childID 4 -isForBrowser -prefsHandle 5828 -prefMapHandle 5844 -prefsLen 32604 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02458e75-3da3-45ab-b177-a8fb60548c43} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:1372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6044 -childID 5 -isForBrowser -prefsHandle 6036 -prefMapHandle 5984 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ff15175-06e8-4ae6-bda8-ee099aefaf01} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:1460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 6 -isForBrowser -prefsHandle 6148 -prefMapHandle 6152 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7753c2b0-baee-4a3b-b5ce-34e956dbf337} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:1564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6428 -childID 7 -isForBrowser -prefsHandle 6348 -prefMapHandle 6356 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee6dd8cb-02b7-4277-a031-0df0df78dbbe} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:32
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3048 -childID 8 -isForBrowser -prefsHandle 3132 -prefMapHandle 6600 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1516961-8710-4724-b406-3089150d90ee} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:2280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 9 -isForBrowser -prefsHandle 3436 -prefMapHandle 5644 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ab48d06-ceca-4523-b2fd-e563c8f03f36} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:1052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6852 -childID 10 -isForBrowser -prefsHandle 6324 -prefMapHandle 6552 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea89660d-4ecf-4798-ace3-6bce5fb1d404} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:3856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6196 -childID 11 -isForBrowser -prefsHandle 6104 -prefMapHandle 6360 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36bfa07c-4e6b-4be9-913f-f92ee0baea67} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:3476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6348 -childID 12 -isForBrowser -prefsHandle 3068 -prefMapHandle 1552 -prefsLen 27299 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d11cb8e-8824-4c79-a2a4-344357d3b3b2} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:3956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4768 -childID 13 -isForBrowser -prefsHandle 4796 -prefMapHandle 4700 -prefsLen 28086 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba8dfab3-302e-44c8-a267-ed67adb90d19} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7116 -childID 14 -isForBrowser -prefsHandle 7124 -prefMapHandle 7128 -prefsLen 28086 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f162334-1fae-43cd-9b7a-e66214c2d40e} 2656 "\\.\pipe\gecko-crash-server-pipe.2656" tab
    3⤵
    PID:3144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:608

C:\Users\Admin\Documents\aa\aida64.exe
"C:\Users\Admin\Documents\aa\aida64.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- outlook_win_path
PID:2648
- C:\Windows\System32\ie4uinit.exe
  "C:\Windows\System32\ie4uinit.exe" -ClearIconCache
  2⤵
  PID:1404
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4112

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2760

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3440

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:5100

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1772

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4568

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1988

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" display.dll,ShowAdapterSettings 0
1⤵
PID:4796
- C:\Windows\System32\DeviceProperties.exe
  "C:\Windows\System32\DeviceProperties.exe" 132610 "DISPLAY\RHT1234\4&27B1E55B&0&UID0"
  2⤵
  PID:3824
- C:\Windows\System32\colorcpl.exe
  "C:\Windows\System32\colorcpl.exe"
  2⤵
  PID:5064
- - C:\Windows\System32\DCCW.exe
    "C:\Windows\System32\DCCW.exe"
    3⤵
    - Drops file in System32 directory
    PID:708

C:\Windows\System32\DCCW.exe
"C:\Windows\System32\DCCW.exe"
1⤵
PID:2604

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4612

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-1-20.98.3440.1.odl

Filesize
706B

MD5
762519452683971d2b9c6bc434da9d62

SHA1
b1afd086d1122c3a311ddd745c37f83b34044803

SHA256
6ccdf84d3930d0a8b67cd410d9e899d93b762bf505c20cb23caa4023ca5f9985

SHA512
4ef1ee2a249fbef39cf78d52a47f6fbcea37f6facca995b4e5a21b523934cd91c7f6ae019ec87cca5636912a54b949b88039d5d826388ca2d6e6916616c5e99e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-1-20.99.2968.1.odl

Filesize
706B

MD5
1fa20ebc2ace23c301d9f543f6b23bd8

SHA1
7c17b396de9af146b096c4b8067ddfdb04bf6b4a

SHA256
c85694f3632eb134d5f28d222ffc18a3c16d8af66991aa49f8bffc4f40f8ec04

SHA512
3ac8ef430b4a6cbcf0a4a0e8470da27c78f3012ce84026af67fbcea8a13f5bb422b31e1d8cc2e6a6b59c00acf43b7fab595ac5436101ece75dff619a5356a61f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
69fdd4a3d8ee4a7c7a148d3c0f0d415c

SHA1
c9442a9656d4591a6dad32673d9674b9cd329eb4

SHA256
4fb1a0afdd63fbaf424e90cddfa1eae2f62cfca89291a9deb80d7a720573150a

SHA512
d30fdbbaf47eb3613de1f81aa61e351e6145b1b0cf7a6936e673c88f3d5e2e90893af3edba8fd62704a46f8e4118058f244350e52611098b18f0c52aab5cf197

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\cache2\entries\37373F56CBD822F5FCF64BA01E1320A0924D8460

Filesize
24KB

MD5
13ffcc2d3491d0695537d27b56759e8d

SHA1
951492cb83b6a009e667fb4fed84a53c1b69ca92

SHA256
f2a292ea9643bfbecff02cf3242e40b84959958535b8b563c6b100533884baa1

SHA512
24ce870b98b2c73f19c64efeb75616dbca3a3cdb29a0a1778adbc54a121b020188e3e5953e061b2c88607116011f220928b0bcee24f7d2c04587709b4b3325e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\a8d8ff3d-b1e2-42ce-99d9-3b45690f9267.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
069c37bf9e39b121efb7a28ece933aee

SHA1
eaef2e55b66e543a14a6780c23bb83fe60f2f04d

SHA256
485db8db6b497d31d428aceea416da20d88f7bde88dbfd6d59e3e7eee0a75ae8

SHA512
f4562071143c2ebc259a20cbb45b133c863f127a5750672b7a2af47783c7cdc56dcf1064ae83f54e5fc0bb4e93826bf2ab4ef6e604f955bf594f2cbd641db796

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
eed640164203d0d0a2a1e7919a6fdbdf

SHA1
9af74121e090cf2970beee82d22ef4ebb886c0ae

SHA256
4ca7fe712b4322fdb497733e015f4ae4496d3998772a6c37305da3cbba3eb7ae

SHA512
1bf6de193ae00189525ea9a685bbe3dc7722eceb6ccfb83c70adc766b6301b4978abf73b2f8f41b865f1521925308e4f96285dca569e9c2b2c61e79db1100e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\AlternateServices.bin

Filesize
7KB

MD5
cde7eb3036d6a557d566bdf29460c143

SHA1
4b5784522969ff91feb28c49e30ba3bb32476768

SHA256
9609db2503575f92d58c0981f69ab8160bb5c71e2de315162ddf338529156282

SHA512
6709c844905bd540bb7b70cd7b65cc609d61d9c42aab57e127332bf71bce97ae8769d7867d3f2c19cebd8f612ea9bbf3a91d71d5b7c4ad81619f2fc0fd0514c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\AlternateServices.bin

Filesize
11KB

MD5
a1ec6042e55cd2949b4e7d31e8b5571c

SHA1
045210b6f5d86494501d3faa92bb3e2761784f95

SHA256
fadcad407ff244ad9115d9ea5e9b660e4ea20799dd7842041abe75187a0a4350

SHA512
949fb4ee6ae92a2a7a0a75dbae924430b8c4045787c34dc78c47804ca0847b1f4e7945b229ff5fb4e11725bf8f6fd5b6a6879ceff5768724b8c3b1f4188c9cc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\AlternateServices.bin

Filesize
40KB

MD5
bb04319797e09314f0f9f346d7f1dc82

SHA1
a31d9d93d5e7417f497b8983aae4adfa6760ac31

SHA256
4a5cd639af0445a6ceaeb796b3fb17012a72517a9c6055f02096c1f037c91195

SHA512
c363cf421cd399eb9663b03dec1763c90f374ebd54b21b845ca7432768ca40daf424ec479f47b24bbeb8575fa2ac994a364fe87cf2df8ea09c6ffbaffda0c9a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
878520690786ce3b4af1acf8bac10737

SHA1
d6b580e0efc952a2aa03feaa1082ce07095f8a6e

SHA256
1e4f6af2f52f8424fe2dfb433f564d46f0eda1263570ca6440fbe40eaa739df2

SHA512
3825bade854017e5c590fb194622bc7f724d546345652d4bd362d80aebf2417e51e3adc8d9ddeeab07b16a12ab154d9f06c981fbaf38fbf82e74065be86eb86f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f316d865ff2fd3d87823077363866363

SHA1
3c309b0a8391cbf86e265b951ae607258ed6631f

SHA256
c5659ba1d283cc52c5fe7160662f5d74c45b206b71e8e2bfaa316677cc7a1fcc

SHA512
2a31888a39751708b6afcb9322b5dba6f022be581d03aea336a542b6af18d147a7a7ed03f354580a0e17d3e8857f8b879673d5d0a33196b0143eea79f4e68a27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e5ff1648b1a6c271fdec5140cab8bdd9

SHA1
ac3ef3b4886d014eeee9e47f764ee5f8bcdfec8b

SHA256
3c0a2ad945cee7671f5f7c71c26dc2fe01cbefb5c971cd7f4bc90d6ba5a49e07

SHA512
1d621448e7b1272153e20d26f4354210e9e5784e8880d6573172a89d8c4ab97928aa8fbba58f4df21d07e15d9b3f0b556bf6af99ca8bfa13dfd1532c782e6a64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
48KB

MD5
81dd9250bbb2d11e51d5257811ce2ffd

SHA1
23cce71bbc74eae962cee41920d58fb06ab8197c

SHA256
5de9ccce9057199353422a71c5727e5a8a0c8c7efb30ee1aa0f39999c3c497bd

SHA512
542d1f97a04e39a276cabbde56e65364f81e4a78bd12ea90f3dd4fadd58ec4f853a27a125fb60758e88d9e08f1f8e2f25ddcc8835f1e5138e00d680c65479ac9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\58596fe4-1a53-4232-85ea-b4f8a254a67e

Filesize
671B

MD5
720ee08ccd33c3f4e70d25499c2cc1be

SHA1
d392d80d38e18842b02b1e78cd0854fd33a9df52

SHA256
022e3fe04f7ab06905a7b291bcfaff20652c6712e4d8bac48c8a513d0d632b8f

SHA512
47563b647bcfe501a6297a4a51d124b7beee1aec25aad09ee941677c42332120221fe234907403835848343813ff701484b0ce4a9e48aea5d54d34c75105bc97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\e290d088-da94-4c8d-b889-c691c4ef7cb9

Filesize
25KB

MD5
b41a591b522e865485a7d9f9912cd201

SHA1
4801dd7523192799617618b1c0eb1f65034f4dbe

SHA256
f0f381a6e6266f4b4823aa0d15ffa6933648af720cedfe116d93f375c9c64654

SHA512
9dd615e58edfce3d0092f1eba07b0a7575c0776add4e396bcc2ebe4af0f11e0e01a005077735213d472a7fd36a1683769c007ff0f57dd8e7bd9e18a0e54eb0d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\e714d0e9-ce5c-4557-ad3f-86f274d3cdee

Filesize
982B

MD5
5e840c3183714a8a1a1322e87ccda391

SHA1
5e8b8f281e4d810e663906262d06de9b95be77ad

SHA256
909d0fbc85d59df5d7b622e401b46d9f0f58e6b3833152a239ee69e73b849917

SHA512
6c241733d872634b29eb2e74cddb4b79f90eb4e84005f20f68253b5dd92f3a641d0d1ee12dfe2d5c20b2dd153f750d5bdc45c8b8a5931fa2e50db51048c6246f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs-1.js

Filesize
10KB

MD5
43d605259d25fd879f667917dc44bf2b

SHA1
a61e8db51048c06e4276beba0b23bdf456935572

SHA256
f8e8abc54bc92c206deb068d2d34d144e5c90b626cbda0221db199c615e831e3

SHA512
03f7c3cc910fb6d0bd0bb4df2bc35938359a9c63ec1d6be55fcff76bbf250d5537d8e052e341bd1e09caa9181b0b5bd9da9622291c41a61d126456ad70ebf080

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs-1.js

Filesize
9KB

MD5
e480a6f1a84d02102a76e76407b06d8f

SHA1
45e8a8d3c09bb010c9185450a126abeb4939efb4

SHA256
2409f2164aa22b379a3e45177f26034928f24adeb615e98b5f1f261a9603939a

SHA512
f0eaa0e54039a5ed6216f5f30f833f8d00085bbcb5dd0c289c1b50ac3c08c15c8ddd6ace3724262483d2b4eddc3619389d77a6943cba9b84b9e1b25a1aa32329

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs.js

Filesize
10KB

MD5
1c3f1873961a0c7e00452455df58190f

SHA1
568792d07bf450af2c764edee1166d84fefc5930

SHA256
7f55265d3c302d74d6c6b651933f741cd0f1a422a715f303c4e654dce6c5bf34

SHA512
368557341b1aa0a13c6b736810fe004679dec3cd1e513ce4853ca3b23a007e65a26664286b7dbcd393c609d67342f6a241433808fe97a7d474d82fa430d3a9a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs.js

Filesize
10KB

MD5
8b2a03e139d233f5b52db5f371af5aed

SHA1
61da15607e9684c30772ce5d83d2d5b55636a652

SHA256
e39cdbf0b21e4eba649e941b9179fa959037c1aa11e82ceca315ceac574d384c

SHA512
cd371a9b5360e31af6123c51f45acf8d41a64375fa347ed714e56acbac76da79b2f119672f53a5bc913bbd281ebbeacaa9462ecf4c91966470b6fbbe4943110b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
cb834a297bdfb1c078000b73fc3cf528

SHA1
42e97195ff6a686c81a14a57c21db54cd2c269b1

SHA256
336abb4ffaadba2b6af287bb07d4ae2fb3f51b6593b2cb1e5d00459046b83726

SHA512
1815db049296d66abf20d7bd7d81f8174de02fef10a61c0f1e163d78d7dd4cce4c11ce2ff721cbf1b2fd8ba483549ea554fdf02d6b87adedade17760b0b0275c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
16KB

MD5
ca8edf8e78dd5660e4027ce4e215daa4

SHA1
474b5d77b4e2df04ad3392f24f1265e6b7555b26

SHA256
bf7e073962f151b86ea3973f06491715dd7b143f02b4ca171e08e6e5bb20a9bf

SHA512
6620756d35796ca3aa1beccdb85a30c143c710e0316d9df83d9dee255b689f9d6e63cdc18350362667cc7b892f3cdc5dffeb012cef41fb8febb52340917ff670

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
15KB

MD5
4435c57fb8c0006db01b8de204e32de4

SHA1
244dcfbe3f34d97ebecd2496c072610eb6da95ff

SHA256
84489211c4ffb05d9c986287c5cf0fb0f5dbdf4db0dc26d492c2bf7d4ed3b581

SHA512
3bfe0b90606494be2be925f45991b70c12b5efe29368db34aae9c913ddb6025b001c0a872fc3e97dccc07aafbe71c9bdc6b49db22af78202845870a1d0df7fd8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
16KB

MD5
62a8d3b79df15433b56a1c1c8e2dd90f

SHA1
57238c65f23b298b2d4eb51d55367549ac0770df

SHA256
427a532537fcb015d5711288a0e56d4e4dacd944bba3875863cb1a19bd248b43

SHA512
3db1b1cfa5f04521ab990e1f288236ec4823e83bb9c9017aed34fbbf1100b28eea3fe5f8005c315c7341cc0858f22a09e58cd9da8b122fb14e6c582cd06975b8

Download Submit
C:\Windows\INF\c_monitor.PNF

Filesize
6KB

MD5
d89c8bb612c903ae295b0f14e53bef15

SHA1
2b0d9058d682a69b275c661a46754d3efbc1ef42

SHA256
c59b7887b17be50f981509d822648bb3caae5173ca099c1dcf67e046acc13a82

SHA512
06f2e9bb9e46e3a80e29ff4ef6b2263b51973566026d068edc1e5070d93af7433cdb9e0f6671add4a444f9b646a84c94fe26315e97f4174bb9b4d5b7badf9359

Download Submit
C:\Windows\System32\spool\drivers\color\CalibratedDisplayProfile-0-Temp.icc

Filesize
9KB

MD5
25a5c21f237b3867ee0daebe5d6527e6

SHA1
fb851b9f8b3078c4b985e554b1f4564405e7b904

SHA256
25a176dd50eda19b6732c1eb99bb5adbec62513463c4b93dbb3889ef8b2cc609

SHA512
9a31a7db33451ca40c39e9e249d1b2e158437eeee28ea9d376119138892204a79f7e5c617c332a2e7c75ac5a71a072f41b0fbb15a4fd8665fd90dbfdaa178ecd

Download Submit
C:\Windows\System32\spool\drivers\color\CalibratedDisplayProfile-0-Temp.icc

Filesize
9KB

MD5
e6807b7eaf8131001e3b743775287958

SHA1
a2855ced30cfe0d74fa8a5bd2b80303bedb27b36

SHA256
d9c7f50c308d2530c2de2df21b72a1057ec0f7461856523882616bcc5f86d447

SHA512
58d310f76babcf701ff86fbd96d2f13ead08b4c1a426fd28e69f1e1ca1ece139583af6e79a89e4e81abce2c7e64c3a2c86a7c5afa2020829e22325d95085a9fb

Download Submit
memory/2648-1099-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1101-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1107-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1108-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1110-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1105-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1104-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1103-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1194-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-997-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1188-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-998-0x00000000093A0000-0x00000000093A1000-memory.dmp

Filesize
4KB

Download
memory/2648-1098-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1100-0x00000000093A0000-0x00000000093A1000-memory.dmp

Filesize
4KB

Download
memory/2648-1106-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/2648-1155-0x0000000000400000-0x0000000004FA4000-memory.dmp

Filesize
75.6MB

Download
memory/4568-1149-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1148-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1150-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1151-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1152-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1153-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1154-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1144-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1143-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download
memory/4568-1142-0x0000025CABBD0000-0x0000025CABBD1000-memory.dmp

Filesize
4KB

Download