fecbf15e41c3e54ffae04b2a6b39ec748a185f85b8c7a6407a329e6959e9317f

Resubmissions

02-07-2024 16:16

240702-traf6a1blg 4

02-07-2024 16:07

240702-tkq6bsvbqm 10

Analysis

max time kernel
381s
max time network
379s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02-07-2024 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.jpg
Size

10KB
MD5

521f078abbeb8edbef8a197da243001d
SHA1

4d0b123160c4a9fe95567b78bfad6e1c8040fa5a
SHA256

fecbf15e41c3e54ffae04b2a6b39ec748a185f85b8c7a6407a329e6959e9317f
SHA512

2b063ef18a45187ab4d8c59ca029ce0b1900a5bb3dc25f7d9e982fbe3f0b85b2ae8b05ac1627705eac1ab34e4130c22078d456f8c14d9104ec23b9c8bc820d12
SSDEEP

192:oybUDmI7lgqVr4hhKIhc4DsLY57TSNDs1yZXpO92Bg3mk+hN:7bUDmIJEhtacsuGDayZXk92Bg2kW

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 11 IoCs

Processes:

taskmgr.exetaskmgr.exeMicrosoftEdge.exetaskmgr.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeSearchUI.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exetaskmgr.exeperfmon.exeAcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

SearchUI.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

PaintStudio.View.exebrowser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeSearchUI.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions\Cached	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\LowRegistry	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies registry class 64 IoCs

Processes:

SearchUI.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exePaintStudio.View.exetaskmgr.exeOpenWith.exeOpenWith.exefirefox.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cbff69a69bccda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{1299E765-A3FD-42C8-B2CF-B8BF78086372} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 23775fa69bccda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe

Opens file in notepad (likely ransom note) 3 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXENOTEPAD.EXE

pid process

4448 NOTEPAD.EXE
5492 NOTEPAD.EXE
5548 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

PaintStudio.View.exe

pid process

3816 PaintStudio.View.exe

pid	process
4448	NOTEPAD.EXE
5492	NOTEPAD.EXE
5548	NOTEPAD.EXE

pid	process
3816	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exetaskmgr.exeperfmon.exe

pid	process
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
4684	perfmon.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
4684	perfmon.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
3640	taskmgr.exe
4684	perfmon.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe
4684	perfmon.exe
3640	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

perfmon.exeOpenWith.exe

pid process

4684 perfmon.exe
5680 OpenWith.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

1324 MicrosoftEdgeCP.exe
1324 MicrosoftEdgeCP.exe
1324 MicrosoftEdgeCP.exe

pid	process
4684	perfmon.exe
5680	OpenWith.exe

pid	process
1324	MicrosoftEdgeCP.exe
1324	MicrosoftEdgeCP.exe
1324	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

Processes:

taskmgr.exefirefox.exetaskmgr.exeperfmon.exeklist.exeklist.exePaintStudio.View.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	3596	taskmgr.exe
Token: SeSystemProfilePrivilege	3596	taskmgr.exe
Token: SeCreateGlobalPrivilege	3596	taskmgr.exe
Token: 33	3596	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3596	taskmgr.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	3640	taskmgr.exe
Token: SeSystemProfilePrivilege	3640	taskmgr.exe
Token: SeCreateGlobalPrivilege	3640	taskmgr.exe
Token: SeDebugPrivilege	4684	perfmon.exe
Token: SeSystemProfilePrivilege	4684	perfmon.exe
Token: SeCreateGlobalPrivilege	4684	perfmon.exe
Token: SeTcbPrivilege	5412	klist.exe
Token: SeTcbPrivilege	5460	klist.exe
Token: 33	3640	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3640	taskmgr.exe
Token: SeDebugPrivilege	3816	PaintStudio.View.exe
Token: SeDebugPrivilege	3816	PaintStudio.View.exe
Token: SeDebugPrivilege	3816	PaintStudio.View.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	3192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	712	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	712	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	712	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3640	MicrosoftEdge.exe
Token: SeDebugPrivilege	3640	MicrosoftEdge.exe
Token: SeDebugPrivilege	5624	taskmgr.exe
Token: SeSystemProfilePrivilege	5624	taskmgr.exe
Token: SeCreateGlobalPrivilege	5624	taskmgr.exe
Token: SeDebugPrivilege	4872	firefox.exe
Token: 33	5624	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5624	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exefirefox.exetaskmgr.exe

pid	process
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exefirefox.exetaskmgr.exe

pid	process
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
3596	taskmgr.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe

Suspicious use of SetWindowsHookEx 49 IoCs

Processes:

firefox.exeOpenWith.exemspaint.exePaintStudio.View.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeOpenWith.exeSearchUI.exeAcroRd32.exe

pid	process
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5644	OpenWith.exe
5860	mspaint.exe
3816	PaintStudio.View.exe
3640	MicrosoftEdge.exe
1324	MicrosoftEdgeCP.exe
3192	MicrosoftEdgeCP.exe
1324	MicrosoftEdgeCP.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
372	SearchUI.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 4872	4844	firefox.exe	firefox.exe
PID 4872 wrote to memory of 656	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 656	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 1952	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 2504	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 2504	4872	firefox.exe	firefox.exe
PID 4872 wrote to memory of 2504	4872	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\download.jpg
1⤵
PID:1844

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.0.2045178889\1581963649" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1744 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ce27eff-97b7-471f-8701-9eea23300fb4} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 1828 2a2956d4058 gpu
3⤵
PID:656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.1.575706423\1098966597" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22240ade-5621-48d9-83a9-112e6e935171} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 2184 2a29560a258 socket
3⤵
PID:1952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.2.1361380426\849169112" -childID 1 -isForBrowser -prefsHandle 2768 -prefMapHandle 2744 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb3b6bba-674c-418c-be6c-45d2c6bd39f6} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 2672 2a29969d058 tab
3⤵
PID:2504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.3.1941307956\1279121525" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3500 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {469ed792-d8e3-4547-ace9-58aa1cd1b82e} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 3516 2a283162558 tab
3⤵
PID:3116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.4.1904261263\656281836" -childID 3 -isForBrowser -prefsHandle 4356 -prefMapHandle 4352 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94fc02cf-b01e-4faa-840b-2dbc5233df83} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4368 2a29b4a5b58 tab
3⤵
PID:1516

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.5.2001475916\264786842" -childID 4 -isForBrowser -prefsHandle 4712 -prefMapHandle 4840 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e7e1fb3-a276-404c-aed9-1d374a70e963} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4800 2a29bced858 tab
3⤵
PID:1844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.6.1894302046\1080732036" -childID 5 -isForBrowser -prefsHandle 5012 -prefMapHandle 5016 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {398134b6-f5d8-4d6a-aa52-8a6fec5a7a4a} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 5004 2a29bcede58 tab
3⤵
PID:4912

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.7.253755030\350667306" -childID 6 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff210f33-cdee-408e-8bd2-d0d2693c061c} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 5188 2a29bceed58 tab
3⤵
PID:4700

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3640

C:\Windows\system32\resmon.exe
"C:\Windows\system32\resmon.exe"
2⤵
PID:348

C:\Windows\System32\perfmon.exe
"C:\Windows\System32\perfmon.exe" /res
3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:5324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5368

C:\Windows\System32\klist.exe
"C:\Windows\System32\klist.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Windows\System32\klist.exe
"C:\Windows\System32\klist.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Windows\System32\ksdydr.exe
"C:\Windows\System32\ksdydr.exe"
1⤵
PID:5508

C:\Windows\System32\ksdydr.exe
"C:\Windows\System32\ksdydr.exe"
1⤵
PID:5552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5644

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\79a0bc87-9289-4828-b86b-d22cf35d208a\3950266016.pri
2⤵
PID:5708

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\download.jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious use of SetWindowsHookEx
PID:5860

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3640

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5732

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
1⤵
- Opens file in notepad (likely ransom note)
PID:4448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5680

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\026d1a02-fa0e-4291-9639-232e7cae9f72.tmp
2⤵
PID:5640

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
1⤵
- Opens file in notepad (likely ransom note)
PID:5492

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\jusched.log
1⤵
- Opens file in notepad (likely ransom note)
PID:5548

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:372

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Windows\System32\iexpress.exe
"C:\Windows\System32\iexpress.exe"
1⤵
PID:5452

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5360

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
14KB

MD5
a32627c0bb4eb2b4cd89e5a72e681eaa

SHA1
8a027374ab717cb3a4f1d836c10e2acc56894d99

SHA256
e4fbc3b1334f59edd413505dea5ba7c69506e3b530936fcc1032dc054b0a56f6

SHA512
ac311be71365476609c605837c592ee09c37a40f5c3c323b29a7e50a238c9188ca24ab6c55ab853b275c0a8889c31ed21dd6ce834a9a46263b1bccca0e58f93f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\1601268389\715946058.pri
Filesize
171KB

MD5
30ec43ce86e297c1ee42df6209f5b18f

SHA1
fe0a5ea6566502081cb23b2f0e91a3ab166aeed6

SHA256
8ccddf0c77743a42067782bc7782321330406a752f58fb15fb1cd446e1ef0ee4

SHA512
19e5a7197a92eeef0482142cfe0fb46f16ddfb5bf6d64e372e7258fa6d01cf9a1fac9f7258fd2fd73c0f8a064b8d79b51a1ec6d29bbb9b04cdbd926352388bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\4183903823\2290032291.pri
Filesize
2KB

MD5
b8da5aac926bbaec818b15f56bb5d7f6

SHA1
2b5bf97cd59e82c7ea96c31cf9998fbbf4884dc5

SHA256
5be5216ae1d0aed64986299528f4d4fe629067d5f4097b8e4b9d1c6bcf4f3086

SHA512
c39a28d58fb03f4f491bf9122a86a5cbe7677ec2856cf588f6263fa1f84f9ffc1e21b9bcaa60d290356f9018fb84375db532c8b678cf95cc0a2cc6ed8da89436

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\12953
Filesize
11KB

MD5
66de2e38c42bf02423010e12ed4ee396

SHA1
46c313014d2770d2bb8b5e82b23d4ef013072560

SHA256
4f62f2e2182aeb9ba1fff951dbb328fb15ce2ad3a2621f750e478d8f62368142

SHA512
fb04875fce9861052c16d69faab9e4f6457e9ddc3a77eacb5cefce571596ba03f57dcb19f17ca07173b6f5ec93684cc01c12168366b187118e955684296082fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Filesize
13KB

MD5
9be6b73a00ae0dfb67258de7d53e2c0d

SHA1
d43e2de4f973ee3da7d1b2694ab474c55bde3870

SHA256
41d1d0314faaf58b4dcb0d6ffc568bedeae7858a94d4b8532a85e493bdf62f8e

SHA512
f339915b764ad1244df8f21c59daed2c7404f44d239c897dcd0c92d993c4305cff19016026801153d351483829ba1aa0640cb2ceab88fe4f6d006202661415b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
Filesize
237B

MD5
031f04743fd1e7986a78799edd5e5cf1

SHA1
4e6ca3e8cf7fcfd886a22c6fce095fbdf819274f

SHA256
80a4e68a1b2f91729091dc912484978e354992af337c3e4156c9510e61810ef5

SHA512
c3ea456c4980664836dfb2ff15fce10eabd8402c1505ac0bfd3ef9ee421d2575ab57a696cf71dc9ca14ab638335bc6956a8f01844c39ac66c58758639683e48e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
Filesize
2KB

MD5
404a3ec24e3ebf45be65e77f75990825

SHA1
1e05647cf0a74cedfdeabfa3e8ee33b919780a61

SHA256
cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

SHA512
a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF86359FD0988C9851.TMP
Filesize
16KB

MD5
4902e4264b875f8042ed843fc3cf16bc

SHA1
cf5271dac283889f0e7a644e454df467314017f0

SHA256
722806574b5cf0a5b95017336d255101729d67468e12b0adac2d2942b5217fb0

SHA512
43683f55420663b8cb7cb08b29cdbe0ff47f12e8f1b1dbe47552d5497c63a35cfb0c64ed7b0c12c7a12f9f8909e801e3fac240776686a568af38d4e3d7a2102a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
5KB

MD5
88a967baca69bc6ae29db7f0d7458f2c

SHA1
57e94e7ce403d88282bf4cad468f0596890977b5

SHA256
4f82f2d624684d7e92f38afb2dc48ba44be147ab07a333176909c27548715b09

SHA512
58d59cf9efa8b0755acf938bc7995a9719733c5b03e900c29f652aa406a2010dd7453fe8f272fd6eadb1efab393ac61c39869592d8fdfebaacfb716dcedf2863

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
5f4662c6e8ef263ee46cb866f032209d

SHA1
ba8b50c0f400e1619785d0e67fb991f6ebe50dbb

SHA256
930267d47affdfdb42858614fe5dc8b28a3ad99d030f20e6a3448aab1e99299e

SHA512
dacbd15a18e61f5fe63435907dfd9438a8adfaaad10c32cd3ad4c773a9d12be28042a602e2d810d10fbf8fe768fcd207aec231cc756b21c3d69f38e36041a33b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\15d198da-c108-454a-b80e-969199318cff
Filesize
746B

MD5
fd3787f06e5e236574f6b06d4a18798c

SHA1
fa1853467d9cfa6cb354e536773f3f6968308725

SHA256
a013ca8eeab8d366e7eeab0b8f445ff453e30e88acc6b701893733f6393c4d00

SHA512
bf706f5ff606f207476b62278db38c3f05cddf2362ea11716bfa83a5d3e5d035e47b96801e55e816ed125bbdd96748af45977ed432b6abf1eed17d53e564cfcc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\e2f61dd4-fe10-4398-91c8-b0be76a7449e
Filesize
10KB

MD5
cfe0719168df55910dfcb447584bea88

SHA1
1d95a0ef7aaae5b9bbb741ac99357fe9dc992536

SHA256
fb2293abec46c65c9ebcc1fc4db3a0c7d5817500e001a01cb5ae171a8ddaa1f0

SHA512
c481ae3c27c284921788cff0ef8713dc307072eb1b4da3f1debe70cbdb14c4e205691cc9462f189c58f58158a309cb9c8d7836303dad73ad206f9996cedbee67

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
Filesize
7KB

MD5
a57ede6ff9905184210be5a9f299ae5d

SHA1
d55af5e6e672c8a7ec28f8992af8702ff50fcfbd

SHA256
ff110cc68e2f80c5b8e0a77fa44f209dd708037cd3eaf10f37d2a94fbf3c9534

SHA512
c7083b719be387b3981c9082d36601d16e84e7fde6bceaf8ffc6f745ad9ca27253fb4e1ab1015d2a5efb32a974812e92f8c386ccad4a0d059300eded96867818

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js
Filesize
6KB

MD5
a93f2a1f367de74da5104b3b7da8467d

SHA1
3f4809b467c4134cf1bfa48fc583bec49c542df3

SHA256
a2f57f46a59496305dee6c997626548fa3f2ede39420e2d5e87ec3c381e7bb7c

SHA512
299a93216a27b27bfdaba287ed34cfce2b8b431e8114eac036e7658ccba72d06d8bcd1037ce4334775ad6f0f46677df5833c8e3ea16835d9cf705cf7daf7dfe5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
Filesize
6KB

MD5
0feea4039c94f96eec1f16cb028def64

SHA1
d10f5d743ce89abbd1f4bc406155c058cc52f4b0

SHA256
7216ef13063b985590d2c3c922cfb3529702790e0c426bfaf54a839d9f98a1ab

SHA512
73e5fdfbcaf29a1378d4c3cf9dbfd21dba8b840f6696c4f739de3696b520e6bc195a55052993ab1d71354761641b1d41cb5aabfd565a447e57c521e78e1036f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
Filesize
6KB

MD5
cff0622fa91b0cac5bf8ad126818deb2

SHA1
56278751ac16386c76f119bfbc4379dc6dc6ba51

SHA256
a071e9bae1dfec2be7bbd6567a3f35bb694e32d0bb8d92e2fa560fd02be7d106

SHA512
b0b513d427e4526195ee931fddd7af84af574c063acfa7f1595a37a5d2cb6f4e1286cadde378000dd2c24cf3e2e0ada2629552a473e4baeb371f927cb5fd4934

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
098e84d75da7828912825603a091d7b7

SHA1
9476e3f0a554406cc5f3de685b0ad981305d5879

SHA256
38b7c5c02c0c8cba714d8f5e06ecdcedda70b7d84877bd76605b686ad2c9f337

SHA512
7b81b8ee973be682f426740697ddf0f5ce939da1d0afee6c3be8ca13897c484ff61f29f15a6f514325e6de1742a3b07cf294375a282b6c7e710fcb76df449126

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
8.0MB

MD5
568e68ef4ab99174ef26093335e1f719

SHA1
7e521982df6abfc0446ad65fa82ad61d7bac0352

SHA256
d013ff6ca645fc743a207a15189dbec30a6a5ea80fa47765ecf8b03f4fca6eda

SHA512
f8a1d357830fa6a6f1264182ba439a1692f00ac880f214c5a260fa194fa9ea710eeafef80ad265a6bacfda4841be467f95e03bf0a1bcc36d45221175d343c819

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
584KB

MD5
018b3407fee004e8033f17430ef22647

SHA1
751aa5df4b2a4084fbff34150f1eed1ab86a39c1

SHA256
71a39e120b76315dd041c47bf73ffad9581b948e6834043df803fad8df1d7e28

SHA512
96051feb816c9639b76ee314d00b55c713893fbb6f2d4326feb0e6a98490998d751d36989e236505a61351d96413febe3aa8312a3355e799d19fee6b26e43f76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
731c0e733fe1e3123d366af7c8e578ae

SHA1
9756304ea773dd9cd96e5996dc79de2ed6a9ae9c

SHA256
8f426b4be5e3440fa14d37480f018b7dc3d1a547b0e91c2fbfc6e31d9054a359

SHA512
d29e0f2356a3226f64692b390c122d4d70f09f677d9f5d086f2babaeba6574d670171edb24ff52f928871ec489680f57910e21fac1ca8ec08783a07d21b1f427

Download Submit
memory/372-299-0x000002848A320000-0x000002848A420000-memory.dmp

Filesize
1024KB

Download
memory/372-304-0x000002848AB20000-0x000002848AB40000-memory.dmp

Filesize
128KB

Download
memory/372-325-0x000002848ACA0000-0x000002848ACC0000-memory.dmp

Filesize
128KB

Download
memory/712-261-0x000001854A040000-0x000001854A042000-memory.dmp

Filesize
8KB

Download
memory/712-259-0x000001854A470000-0x000001854A570000-memory.dmp

Filesize
1024KB

Download
memory/712-266-0x000001854A090000-0x000001854A092000-memory.dmp

Filesize
8KB

Download
memory/712-264-0x000001854A070000-0x000001854A072000-memory.dmp

Filesize
8KB

Download
memory/3192-253-0x000001B033DC0000-0x000001B033EC0000-memory.dmp

Filesize
1024KB

Download
memory/3640-225-0x000001DC17A30000-0x000001DC17A40000-memory.dmp

Filesize
64KB

Download
memory/3640-208-0x000001DC17920000-0x000001DC17930000-memory.dmp

Filesize
64KB

Download
memory/3640-243-0x000001DC14E50000-0x000001DC14E52000-memory.dmp

Filesize
8KB

Download
memory/3640-286-0x000001DC14EA0000-0x000001DC14EA1000-memory.dmp

Filesize
4KB

Download
memory/3640-283-0x000001DC14EE0000-0x000001DC14EE2000-memory.dmp

Filesize
8KB

Download
memory/3640-290-0x000001DC14E40000-0x000001DC14E41000-memory.dmp

Filesize
4KB

Download