69e43fe7ea3817134874b2da967ff6d590b0513e125580179c0410df9cfef39f

Resubmissions

24-01-2025 18:53

250124-xjqd7atrcr 8

24-01-2025 18:37

24-01-2025 18:35

24-01-2025 18:21

24-01-2025 18:11

24-01-2025 18:05

24-01-2025 17:27

Analysis

max time kernel
107s
max time network
113s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xeno-v1.1.35-x64/Microsoft.Web.WebView2.Core.dll
Size

557KB
MD5

b037ca44fd19b8eedb6d5b9de3e48469
SHA1

1f328389c62cf673b3de97e1869c139d2543494e
SHA256

11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
SHA512

fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
SSDEEP

12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv

Score

8^/10

microsoft defense_evasion discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
103	2648	firefox.exe

Executes dropped EXE 3 IoCs

pid	Process
2616	VC_redist.x64.exe
2132	VC_redist.x64.exe
3200	VC_redist.x64.exe

Loads dropped DLL 4 IoCs

pid	Process
2616	VC_redist.x64.exe
2132	VC_redist.x64.exe
2132	VC_redist.x64.exe
3808	VC_redist.x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{804e7d66-ccc2-4c12-84ba-476da31d103d} = "\"C:\\ProgramData\\Package Cache\\{804e7d66-ccc2-4c12-84ba-476da31d103d}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
112	3488	msiexec.exe
114	3488	msiexec.exe
116	3488	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
65	2648	firefox.exe
65	2648	firefox.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f78a11f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f78a11f.msi	msiexec.exe
File created	C:\Windows\Installer\f78a122.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA401.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7F1.tmp	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	VC_redist.x64.exe
File opened for modification	C:\Windows\Installer\MSIA734.tmp	msiexec.exe
File created	C:\Windows\Installer\f78a149.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f78a132.msi	msiexec.exe
File created	C:\Windows\Installer\f78a133.msi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	VC_redist.x64.exe
File opened for modification	C:\Windows\Installer\MSIA4AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f78a122.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f78a133.msi	msiexec.exe
File created	C:\Windows\Installer\f78a136.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f78a136.ipi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.42,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{382F1166-A409-4C5B-9B1E-85ED538B8291}v14.42.34433\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\6CF2091E324C9174BAA8CAB762493B76	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.42,bundle\Version = "14.42.34433.0"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6611F283904AB5C4B9E158DE35B82819\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.42,bundle\Dependents\{804e7d66-ccc2-4c12-84ba-476da31d103d}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.42.34433"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.42.34433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{E1902FC6-C423-4719-AB8A-AC7B2694B367}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	firefox.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\PackageCode = "C029B57ADC55135439F2BCC435C9148F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\PackageCode = "C115E40EF1D73624BAA68F6193F24D7D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76\VC_Runtime_Additional	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\Version = "237667969"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CF2091E324C9174BAA8CAB762493B76\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{E1902FC6-C423-4719-AB8A-AC7B2694B367}v14.42.34433\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6611F283904AB5C4B9E158DE35B82819\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\6611F283904AB5C4B9E158DE35B82819	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.42,bundle\Dependents	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\Version = "237667969"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{382F1166-A409-4C5B-9B1E-85ED538B8291}v14.42.34433\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.42,bundle	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6611F283904AB5C4B9E158DE35B82819\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{382F1166-A409-4C5B-9B1E-85ED538B8291}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6611F283904AB5C4B9E158DE35B82819	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
3488	msiexec.exe
3488	msiexec.exe
3488	msiexec.exe
3488	msiexec.exe
3488	msiexec.exe
3488	msiexec.exe
3488	msiexec.exe
3488	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeDebugPrivilege	2648	firefox.exe
Token: SeBackupPrivilege	3304	vssvc.exe
Token: SeRestorePrivilege	3304	vssvc.exe
Token: SeAuditPrivilege	3304	vssvc.exe
Token: SeShutdownPrivilege	3200	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	3200	VC_redist.x64.exe
Token: SeRestorePrivilege	3488	msiexec.exe
Token: SeTakeOwnershipPrivilege	3488	msiexec.exe
Token: SeSecurityPrivilege	3488	msiexec.exe
Token: SeCreateTokenPrivilege	3200	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	3200	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	3200	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	3200	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	3200	VC_redist.x64.exe
Token: SeTcbPrivilege	3200	VC_redist.x64.exe
Token: SeSecurityPrivilege	3200	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	3200	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	3200	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	3200	VC_redist.x64.exe
Token: SeSystemtimePrivilege	3200	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	3200	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	3200	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	3200	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	3200	VC_redist.x64.exe
Token: SeBackupPrivilege	3200	VC_redist.x64.exe
Token: SeRestorePrivilege	3200	VC_redist.x64.exe
Token: SeShutdownPrivilege	3200	VC_redist.x64.exe
Token: SeDebugPrivilege	3200	VC_redist.x64.exe
Token: SeAuditPrivilege	3200	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	3200	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	3200	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	3200	VC_redist.x64.exe
Token: SeUndockPrivilege	3200	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	3200	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	3200	VC_redist.x64.exe
Token: SeManageVolumePrivilege	3200	VC_redist.x64.exe
Token: SeImpersonatePrivilege	3200	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	3200	VC_redist.x64.exe
Token: SeRestorePrivilege	3488	msiexec.exe
Token: SeTakeOwnershipPrivilege	3488	msiexec.exe
Token: SeRestorePrivilege	3488	msiexec.exe
Token: SeTakeOwnershipPrivilege	3488	msiexec.exe
Token: SeRestorePrivilege	3488	msiexec.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2648	firefox.exe
2648	firefox.exe
2648	firefox.exe
2648	firefox.exe
2132	VC_redist.x64.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2648	firefox.exe
2648	firefox.exe
2648	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2648	firefox.exe
2648	firefox.exe
2648	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2792	2876	chrome.exe	31
PID 2876 wrote to memory of 2792	2876	chrome.exe	31
PID 2876 wrote to memory of 2792	2876	chrome.exe	31
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 2604	2876	chrome.exe	33
PID 2876 wrote to memory of 324	2876	chrome.exe	34
PID 2876 wrote to memory of 324	2876	chrome.exe	34
PID 2876 wrote to memory of 324	2876	chrome.exe	34
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35
PID 2876 wrote to memory of 2292	2876	chrome.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.35-x64\Microsoft.Web.WebView2.Core.dll,#1
1⤵
PID:1728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7f79758,0x7fef7f79768,0x7fef7f79778
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1240,i,676167088481553078,11419857568221341404,131072 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1240,i,676167088481553078,11419857568221341404,131072 /prefetch:8
  2⤵
  PID:324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1240,i,676167088481553078,11419857568221341404,131072 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2132 --field-trial-handle=1240,i,676167088481553078,11419857568221341404,131072 /prefetch:1
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2160 --field-trial-handle=1240,i,676167088481553078,11419857568221341404,131072 /prefetch:1
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1424 --field-trial-handle=1240,i,676167088481553078,11419857568221341404,131072 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3040 --field-trial-handle=1240,i,676167088481553078,11419857568221341404,131072 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 --field-trial-handle=1240,i,676167088481553078,11419857568221341404,131072 /prefetch:8
  2⤵
  PID:2000

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2536
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Detected potential entity reuse from brand MICROSOFT.
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.0.697661698\1302261921" -parentBuildID 20221007134813 -prefsHandle 1168 -prefMapHandle 1132 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cd064dc-159d-4796-800e-5b6a01cd8a92} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 1276 f4d6558 gpu
    3⤵
    PID:2844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.1.852586274\684490650" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c0e9b84-076f-41a8-996c-d43c7f05c5d1} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 1480 e70d58 socket
    3⤵
    PID:1768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.2.83543472\41567712" -childID 1 -isForBrowser -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c537de9-6818-461c-817a-065e406b8d23} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 2152 1a481058 tab
    3⤵
    PID:1952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.3.1246122446\1695938802" -childID 2 -isForBrowser -prefsHandle 2568 -prefMapHandle 2564 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73fbc396-9e85-41b0-a142-8ffb9ebbf9f0} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 2580 1c0aa958 tab
    3⤵
    PID:2856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.4.1843022918\1167445629" -childID 3 -isForBrowser -prefsHandle 2888 -prefMapHandle 2876 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78ffb6c1-0c08-46ee-8ca1-3349d7c67616} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 2928 1c2efd58 tab
    3⤵
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.5.1022346815\2026160491" -childID 4 -isForBrowser -prefsHandle 1976 -prefMapHandle 1964 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a796d660-1f9c-4036-aeb1-4f634c037f5a} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 3900 1e8b6e58 tab
    3⤵
    PID:2064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.6.1325906831\1515266106" -childID 5 -isForBrowser -prefsHandle 4004 -prefMapHandle 4008 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3abd474f-6606-4d8f-b907-62283c1960da} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 3928 1e8b8f58 tab
    3⤵
    PID:1036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.7.995954299\520032326" -childID 6 -isForBrowser -prefsHandle 4168 -prefMapHandle 4172 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cfda935-8388-4c13-aba6-16000c917ad3} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 4156 1e8b6558 tab
    3⤵
    PID:884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.8.1442602031\1082171983" -childID 7 -isForBrowser -prefsHandle 1048 -prefMapHandle 4504 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80c50416-d420-4f13-8782-90854d253b61} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 4540 21d07258 tab
    3⤵
    PID:480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2648.9.28818891\1511481294" -childID 8 -isForBrowser -prefsHandle 3200 -prefMapHandle 3196 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfbc92bb-af22-4dc1-a54e-23affaa1531c} 2648 "\\.\pipe\gecko-crash-server-pipe.2648" 2884 216e8058 tab
    3⤵
    PID:1420
- - C:\Users\Admin\Downloads\VC_redist.x64.exe
    "C:\Users\Admin\Downloads\VC_redist.x64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2616
  - - C:\Windows\Temp\{F5C7145E-5CC9-405B-91B4-3345D23879B3}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{F5C7145E-5CC9-405B-91B4-3345D23879B3}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=288 -burn.filehandle.self=292
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2132
    - - C:\Windows\Temp\{2E2BA4E0-EF39-431F-9423-BD786F1C5F87}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{2E2BA4E0-EF39-431F-9423-BD786F1C5F87}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6A1710C8-0F52-4A0E-A7B3-DD89F9B7E70F} {0EFF0C7D-F0BE-40D8-A533-752DAC61D50B} 2132
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=496 -burn.embedded BurnPipe.{B2D3CC5B-6936-4D5E-B739-6D5202BFC40A} {5A965923-117F-4B36-9E61-42459978AED2} 3200
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=496 -burn.embedded BurnPipe.{B2D3CC5B-6936-4D5E-B739-6D5202BFC40A} {5A965923-117F-4B36-9E61-42459978AED2} 3200
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3808
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0A47C532-26FE-4F51-B1D2-C9273BEE16C5} {3989C405-8D1A-4F0B-B6CB-12E50DAFB7EC} 3808
        8⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4024

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f78a125.rbs

Filesize
17KB

MD5
e401c61ba1213459caabe7bdfb8443bb

SHA1
849d5ca7f936794e3f6d9ebc980108f5f4de0dc1

SHA256
fb55dae53ff278a7f85f865a2726ff1037586c31624aa7d269071cb2fed151fa

SHA512
7a367aa8fb5568a77706174046caaabfcfb44831608569f83b70ed58dd8a4f7aacac381caea0ff40dda00de9c0c09b9d690c66d059ab521c2ed13f6da9a68de0

Download Submit
C:\Config.Msi\f78a131.rbs

Filesize
16KB

MD5
4ab49c5be2b018b307eb45997524cca7

SHA1
7fabcb367980a87b3d2301674653af13a43efebc

SHA256
7e2b2c085b2fd9d7bf6293d47931f3d44cd30afcfcf584316b4d369843a2f416

SHA512
c906e0e36d95b105c7ad03ca0879dfcffb1e39a3beeb6e5e2620590dda786007fe1d33af2ad34f8cd1b2c8b936522de5d25f6955fa7dc2f1b19a0a2fe7bea38c

Download Submit
C:\Config.Msi\f78a139.rbs

Filesize
18KB

MD5
f3f49b2d83f169fdf42a0867b4f56e7b

SHA1
7b603ddd35d187e17e31a62f19789fffb3208941

SHA256
28fa0d48ac5e345c2b3298e3315146f5741cf3bf9ef4e0386b83ca8afb309448

SHA512
7b65c801654daa5d49857adca3e6cee42d3678edcef3aea26fd1279364fd1ba68a9c08b1fe3ec7e8467258e2f65b2ff5d16f2f4d3d7fe377b90ce68936270956

Download Submit
C:\Config.Msi\f78a148.rbs

Filesize
17KB

MD5
7558be0d91667bdc183a57b5ca4b4e52

SHA1
c0084d2245df1e4c916f6dbaa96fa7333d1aceb8

SHA256
0ca5095cced9da146676a3a7aeb2f35781fa4673b9c9fc76dd6afd1bd1323dfe

SHA512
291fc2d7d7e6ae3c9a3fe38d6de3a965e667c08153559a62d3d6744f50a8f2754c996c5b2529e1b80018911f11a17940bd383c4f6cb684319c78b12e8f8b33bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e2ea989d699afe2540ffd50726aaff2

SHA1
5ddb650ed9c59cbf126586cbecbccd4ea8e6e842

SHA256
a6668ca379655b43b34f73a66fee11e837d9a3fba67fcabb3e9949c17c6779b4

SHA512
6198de2c92c4964af916b37351a9e003d77cdd399a3d92abc08455ed488ccfe1f19ef66f82b1aae1f832c735ffea13d04bd32b46fc62573aa96443a013dc7d12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\18125227-ad43-4e76-bf34-adb8b481d429.tmp

Filesize
347KB

MD5
d432b67ea298627a4388b5dac641f5a9

SHA1
fa3b66b9c367948f7ecd8bf5dec9eb9809cdb716

SHA256
23769a538fba82444374b76cca96a94732ead2d806da711825979d3b2ff2f964

SHA512
904557a0ab4705258621dfa9eec51eba8d66ecc67f9f2dd742dac97f849f9bc446496cdf7d715d4dacaf94fa4bef89772cbb01e9f9b43b572e1217d7016b5595

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
6d7ef232cd6499f9c98f1d0349a0fbd4

SHA1
3cff5534601a9b2882a158d8b183ea7ef32cf5ce

SHA256
2a051acc19d3e99968b3612c371a0c7a3931484eeb1955debdc1b63a8e4166c8

SHA512
51d007cbcc79203c160e421cc63eb0f7216a4b7bd510b51a74bad376c99ec6988318360ac5e722fe7e2b2c993195418bc0a5d2e98aba2f210b218e9320e8dc4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
347KB

MD5
cbd6a993686de9b1da6d33966d79f825

SHA1
8c81d4090e5fe7a4a8e302213a53b31d8891eeac

SHA256
cf3f885dbf77f4052dcfacafa0f816e59883c9170c4c3cfeaf0e6abd97dd7ee0

SHA512
edd5d49fec5bfca2dcf67fff1c1f7d3ff43028762d2579178e447fdae02c35f6229cb347260329c84097664c61c065620d6c7046e4eaabc1a089615d4378e783

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhg31lui.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
1fe55d4472afff209e98ae09a972b24b

SHA1
4354439e6450b437b87b499ae85099573dbd6568

SHA256
bc35e2d294819630ba5b61f6c24b5c56a00b42cd6a2be963d1e179f738d5e319

SHA512
5efbbf70aaafe2e066c049dbee6af8dadb025f5e595871d7605f5c9c94e156b578c6cf3bd87e4c8f3b4d93565926cdcc27ccd964df3525dae7bce6472f8a953e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhg31lui.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6319.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar632B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250124185558_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
7bad6539abf5ed38f49e0e0d75ff2109

SHA1
315525a6ab0ace5ced177c37066173919a54bffd

SHA256
b65b5019e374a9323570c213b70d6dbdaf628cc0167d26028f9dfe648b697161

SHA512
b350bcdb6d3760251338b8d7a665379f56ff40d12ab7c1a4eac3e86be832296761e69278936d61ae27029dfe518eeab777e9e3bdccaff06829aed4010485cfd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250124185558_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
522fe30741d388af434f28b20d993b30

SHA1
0cbaa7453d3f2dc7d834f3a8d20ed15889453a1c

SHA256
a129a8433e84746cf77783de04a33fa60d0e7c9d9ae23acfce02a446eabebdd9

SHA512
3bf8e593232c2ca8b837756e3939f11f500308091ba092ea6cb53790da959468eb6f65a9270cca70affaac5386d51a7d2c67ea9f0d3426ea326b9f377b8880cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
d810b8054a4e9bd50530d01a78795eae

SHA1
62a8e26834109d56a7709a6b5af7e51caa3420f0

SHA256
cda8027492ada8acc54463700cbdc16fb2d8615987e795ada1974720d3e56692

SHA512
9067711929652b155e2ed5c20c19079e8eb3ce8d1903e0e3d3c5ee43f2735afe07601ac53268e2ff42ca191636ac5626eac7368446dc999eac53bc04b430f4f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\pending_pings\d7dce499-d62c-482f-a22c-f43fe30dcab2

Filesize
12KB

MD5
a93e05067613931bd8e64a6bb17f95ca

SHA1
22023273902b57d619944b5fd5a5a964ecf90b5e

SHA256
34991fec480dddee5503c8e754f36f2f7c2f587e89486fbbea7f54943222f9a7

SHA512
e35d3d26bc9e9ae5ecd2ebf3afb29044d62ee42e2cec8ecf3af7adaeccb4c829fddd203e3e4824ffff039af2a1084f2bc4575b10f90d156b67f31f3a7cc9a79c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\pending_pings\dce1d1d3-79cb-499b-ab02-0a22d5422896

Filesize
745B

MD5
121ccbbf40ea80a62325725fa7f89e08

SHA1
0d8464410ef7ec7cec536dc6c0496032e7a9bd9a

SHA256
b5aa5bf866bf410dbbb735c1dd9726cfa2143d50f816b6dd78d14594e1437a6e

SHA512
7b1704e3026df66551c81509f4db2d8e84ca8b909e0f739caefe22a0c13017cf35427daa055c85f366d35f9d67a86479a8f865e02e0eb9707b1d63ae742b3802

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs-1.js

Filesize
6KB

MD5
8e40f8598b4e0d7af880f276d7271405

SHA1
f37a0e54ae746a8354649ae52cc81262328f3504

SHA256
55054b3e8e13858a470e6f75e181950b9d70702b75c41017048ebf858e1a14b3

SHA512
17d2b77caf28b1c3d2356cd59d3a021cca1cd6d26b338db1c338254623727c79d9524d1be8c0c84cd05fcb1fcacd0c248b79584182a708a329a2f7e167c562a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js

Filesize
6KB

MD5
70cc5e0c4f8087a557e22bc9b34fba13

SHA1
bb7ba794d1b9cb6d5311b9667a1b12498a128951

SHA256
67013eb77adea37aa39e0d2cc37041eae5ad53e59bf855eb9e07a4108dffb696

SHA512
728248eded62fc6d1414b7360d6b2b42f6160a41c133ee7eb2708794701b62ab12e9c1ebc9a2463bcb36a34b0e9ba0402053afb9f0715fe5fc1c3685abf93b1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js

Filesize
6KB

MD5
fd3e1513d0ba6c0bc478bf785e885a67

SHA1
9bfec62cbb373e07ee5151a12c9ac0af6315127b

SHA256
cb00858b6dad0033204e8b770ae4c6bb8da2c04085203d0c2356591a91f10426

SHA512
2f6ce58646eed4a5771feb14cb19e19e1cd2837e17bf57eae636e52d64b1a9c53e1ec03985d0520bcaeb591b87a212c01ba810d6331a4a51e6d9020d10645978

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e95f2458abc1c1e1d2efff219adb4c87

SHA1
1acbb5f1c5ee6417843f3732db1b1d714b621a3f

SHA256
5ac6b09cbbfb7dca44f8dcb7fea366da0c01f0ed2fe49290b16007bf308ec402

SHA512
e3c2c04825f7e153e733e2f33923fd00630bf9dc6e09f6410f130f9b8889aca8064e444ae6a1c6303618a1004c26cdfaa9f3649e39d52df31a21406adc161cb1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
711f85cf9f40d8b60e92f2e8bf1b1864

SHA1
a1e08e8b1758e17650926ca378289b2f3843d953

SHA256
b04a8673957a7e8230f7ddd26c639b3d8ae10cc6a0a20d4fc2d938a62c859758

SHA512
ae38c4b521a7b9e78b195790cdff72b3bdc2b5337cf323b4adbd50b122015ae7916d60211087db0b1d259c7e6199e55c9f99053629984afbdca7b74a1f6b6d8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
1b3db75e58e9d10f3985f6c590823de9

SHA1
886ec0ce59745613b7725f416895437142c26f37

SHA256
a98ab1f60ad1ab48433218f26740ae1061a0c352bcf14a1218c52096a53d1993

SHA512
2038b583f2594188a18c4eb2b3dbdd8223280ee0996da04046818d81a928179860bc4a8b572961b16f579a48eaf5ef4b9f04b2a448037de1eb2caa103045d7f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
bce7db9576ed59fc58fda2798b5e62de

SHA1
644e6885539d28d5fed92fb50999664d1b672665

SHA256
cbf727987fa1c32be2f95b1a41968a34b32483b5618897ee5651066207a73c2b

SHA512
dde5b4242a3fb8d7d30c03c88e0ab5679fdb279b5892dab777e9b602bad40692685b171881fc899bc992cb1b9cfc58de93b3759ff465b43bed5599c29e577c66

Download Submit
C:\Users\Admin\Downloads\VC_redist.n1qNbHqb.x64.exe.part

Filesize
47KB

MD5
b825ea8b99674512806b46f28360a7db

SHA1
2e3188b9d4f3ddb49d1611e10bb7e8aa8868436b

SHA256
13c0579dc7754d79c89948a1059ccacc294cafeaac08501b5dc29f26f98fd880

SHA512
41207bfa8712835a2d4fbf2f654062ff7bfc38cebe1de28e82085d1d5dc059aecf6e8fd22fbf767e8626f2fb7c87e900e771a757fe2c5057387d91d5d64581f0

Download Submit
C:\Users\Admin\Downloads\VC_redist.x64.exe

Filesize
24.5MB

MD5
223a76cd5ab9e42a5c55731154b85627

SHA1
38b647d37b42378222856972a1e22fbd8cf4b404

SHA256
1821577409c35b2b9505ac833e246376cc68a8262972100444010b57226f0940

SHA512
20e2d7437367cb262ce45184eb4d809249fe654aa450d226e376d4057c00b58ecfd8834a8b5153eb148960ffc845bed1f0943d5ff9a6fc1355b1503138562d8d

Download Submit
C:\Windows\Temp\{2E2BA4E0-EF39-431F-9423-BD786F1C5F87}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{2E2BA4E0-EF39-431F-9423-BD786F1C5F87}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
5866203168b27f18c1b47abfa6823e02

SHA1
3b696be0a4cf750965d74263e43b8e302cb1b318

SHA256
7d48e0905ebea9b14a07cff687705dfdc50d795cd4c32e5ed87a0e344884b430

SHA512
037f793f60be84f1da005d47e21783e719a85b5c12c4d20050ad9d3254ac99ba8eb30b4b1378bac69379dbc659427dc1ae4a19062ecd337d47d480d047afb669

Download Submit
C:\Windows\Temp\{2E2BA4E0-EF39-431F-9423-BD786F1C5F87}\cab5046A8AB272BF37297BB7928664C9503

Filesize
969KB

MD5
8c302e40fbf614896ba36a75f3f8977e

SHA1
991af1495f7783173d0c5691be38ff8648f2df12

SHA256
b384b812dc59c2081cee080ea6bba748e02ecf3c0800d8dcaf9607a20a4f3290

SHA512
53b1d7d8ab495931f50b5d815afe04d52f9e0bbafa0a5f3e4f6605b6e4f2a85c583abf9014dec41481439827bb6bab23ac439d4fd7d0c3f191f21b2bf5afb11d

Download Submit
C:\Windows\Temp\{2E2BA4E0-EF39-431F-9423-BD786F1C5F87}\vcRuntimeAdditional_x64

Filesize
208KB

MD5
351d8e8c804f6c6aab4c718977b1817d

SHA1
1b680e5e2ed548e5636f9d656c49c87cf9a70da8

SHA256
cf584e5132ef3766a088f824bd038494713a7168cdddd44e3f8c4ad581e2206e

SHA512
d0613c6b1a72c73013c0519619c557811a1d20fcddc8361d391a31fc4aa9c70173b907957babb049067111427a81e48a82e5467a15dae8bebb55b048993c93a4

Download Submit
C:\Windows\Temp\{2E2BA4E0-EF39-431F-9423-BD786F1C5F87}\vcRuntimeMinimum_x64

Filesize
208KB

MD5
09042ba0af85f4873a68326ab0e704af

SHA1
f08c8f9cb63f89a88f5915e6a889b170ce98f515

SHA256
47cceb26dd7b78f0d3d09fddc419290907fe818979884b2192c834034180e83b

SHA512
1c9552a8bf478f9edde8ed67a8f40584a757c66aaf297609b4f577283469287992c1f84ebe15df4df05b0135e4d67c958a912738f4814440f6fd77804a2cfa7d

Download Submit
C:\Windows\WindowsUpdate.log

Filesize
16KB

MD5
07f1099d8849fc739ae7532761203671

SHA1
846d70f2ebaebea96d94ba2772cec9f973b8cd99

SHA256
5178382ba9c1981720d59481b1bfdabac8b4ef325f21da6c8907902834f6eeba

SHA512
1fc656706a426d33c7c2872ac35f3943ee549123784b2f394b7c83c1ac92d63fc892ccc547fd9481fd176b52c9dcefa1dafd36a80e096eb3a7d549c190d9962b

Download Submit
\Windows\Temp\{2CD773BB-2F9A-4A2F-A46A-D178C8A0CE54}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\Windows\Temp\{2E2BA4E0-EF39-431F-9423-BD786F1C5F87}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
\Windows\Temp\{F5C7145E-5CC9-405B-91B4-3345D23879B3}\.cr\VC_redist.x64.exe

Filesize
670KB

MD5
3f32f1a9bd60ae065b89c2223676592e

SHA1
9d386d394db87f1ee41252cac863c80f1c8d6b8b

SHA256
270fa05033b8b9455bd0d38924b1f1f3e4d3e32565da263209d1f9698effbc05

SHA512
bddfeab33a03b0f37cff9008815e2900cc96bddaf763007e5f7fdffd80e56719b81341029431bd9d25c8e74123c1d9cda0f2aefafdc4937095d595093db823df

Download Submit
memory/3796-927-0x0000000000AC0000-0x0000000000B37000-memory.dmp

Filesize
476KB

Download
memory/3808-926-0x0000000000AC0000-0x0000000000B37000-memory.dmp

Filesize
476KB

Download
memory/4024-889-0x0000000000AC0000-0x0000000000B37000-memory.dmp

Filesize
476KB

Download