88ae7f01d18e6a5a47f8abe63d168c8333467ea8674617a0d369c8c4730044e3

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Control Panel\International\Geo\Nation	Solaris-A65BA.exe

Executes dropped EXE 1 IoCs

pid	Process
5340	Solaris-A65BA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = ba4e923345a4d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "178"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "796"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "408"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "16"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "150"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "284"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394651596"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "150"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "204"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "378"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "801926001"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://any.run/report/6041e808b7a64364575143489653ceff59556a2623437cfda44253cfe488e9c1/71461f89-1dd6-4749-a4f9-e37706aa9669"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "422"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000296578183db0944ba1870415c077a6bd00000000020000000000106600000001000020000000447e334cea458d6971f20d45464017d695f62fd45d2995439c11961bccf57bd0000000000e8000000002000020000000127617f0fb61db3ba9a1832a4d7d66eba802c02a08bb6cffc8df4cee77bc0820200000002a4ff141f5a00b3f522707e9e713e9beaafa8c7b3ae9ed595855115ef3c7c20c400000006a73f277301815630882a96b68daa949f5a58cb00381e64e7d1d55876d21436de1675b1600f7101803d22c33388c2eca4bd2bfe07bb1b2aa394c042b013961db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "62"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "151"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "252"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "260"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "260"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "452"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = dbf03b231ca9d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "62"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "167"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "378"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "134"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "479"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "837"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "438"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "252"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "300"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "655"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "771"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "35"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "112"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "527"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "99"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "392"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "737"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000296578183db0944ba1870415c077a6bd00000000020000000000106600000001000020000000c64d5a8446aa511715c929587d2ee1d88c953a674dfccd2be8cb97f5ea625ce5000000000e8000000002000020000000f4e59922bdb7dfef107d27d3ca86b3f24144dee1ccbd657bd66122a8cc5e50a6d0000000bf34f220d61bc1999c48dcf427eabe6c4526a23db3d455fa26e45f3722a0aecc835090a45523dd92c720cb844eef03a1cdfd5c3327d664db969f5f41c43d075dfcc3d6046b8cf24684d7175d7f3c334229850aed806bf4992d2584c3043e39769aa3d353278c0f2c14c748bf98daca430b8c72964b7b6054ee334a302476c1fe7ab8244f199bce2c032a167c9ea69d9ae1c0babf6561aa4b51e942ead3f1c2fa032f639dfdb783e271041e4a3c1e13b93cd7397b222fd81e3bd89c4b638486afd76f413b477666082895d3c54aab72b740000000ca846738e7de995d91eff55817844d41eafdc3d376371809fd389911bb88b2bb07930bef2ed70c3f0b91363a5dce4b2d29da902c02c15c24f499bf1d08e38e75	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000296578183db0944ba1870415c077a6bd00000000020000000000106600000001000020000000c9efd69a5d823bc0651e9137de89c41e0001ec221b3f7d94835bf5c689be443c000000000e8000000002000020000000bc4383d7fa9210e26d96cacdb0de48aed6f25e1d912cf4887b88c7229444a39ed000000038d4c1e39538eead364ab64c7a353931cd45375093b4dc55daec51b92ae9e860a51bfcd4acad36cd304c91c9749d9f14a5c520c46fc8bc1031a3599924cacbc426198eb6deec37bdd24556a8010f4ba10abe124b01b72c619d211a03b204c06196b562c15752363bb5f40e637b9159421582b70e9e1b40b2d27c7d28f20c87459cdd38c92ec2ada9ff6f49c6a26d5d581f79d76fec15a05a4ebafc7c5dee909ceefc7db1065c988179127c7057d54b21c5d590ee2f6e19e6ca30f4c2ee7ffd351f2b4e2766e5c5486ac554af9d8314ed40000000f03b7ecc7d43df2d0f7f7fe2a8feb61edbdfb74773b3871b450df49b002d89ff678e393eca94098987d1bc4b811350b932e5358e1e0a98377c2a34d141a7a505	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "230"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "452"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0671ce61ca9d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "230"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "276"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\Total = "527"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "720"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "112"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DOMStorage\any.run\ = "438"	IEXPLORE.EXE

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133323607371752445"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000059e0f12bb9a1f35ca3996885f2fd8a05e9eccfd4fdcb6c83ce2a03c0521ae917c0276cf2826bb45a5b5c171f9b5549ecba041cc0302489b284410feabf746dc45d386d6d4ada4463e52f2baf582b668ee4873165e7d47da92cde	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1b185d6b1da9d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsTime\url5 = 0000000000000000	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "600"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomai = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 70aa5a6b1da9d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000e9de8a3709e676d92f0df4bac2e4a8c8797835314e69fe09de9207b26822b0a52a50aa3ee63193326049b48a8fcefc5256da0dffd0e3c24b3044421783aec4678ecaf6c2fe62f15dbad6b99894c5d25860152fccedd243081e9663337458afe463ee428e2598441ee2552432dae9c02435c98d1524579bb45729eae6be3e65b7895ac91528f3754a4b6536c3e25a53ca1d96f64d6c9025f0169dfe622182c71af0af3c35be92ff8e88a5cfeedc38260d361c8626f19e64b394927ca08a422c826e8ecb7f95973c85acb7b38094a31a1aacfad164baa1a8c8e2a810ee67a05df0f095b41ec2219115013aa310bfbb861094d29c4744ba049df77f6e89debac82d2966053d4850372eebcd557e76a19459cd433c80b607415830b8f64711b291c6bf9f650a79444bc7f412d55c6973b2d1c8ed15b6a7a9e14d26f142528da617ddc6e1b944e51cc63348a845f7735257c0ee70d19f48c1e3b41dcb5cf105b89ac847cd965beffa36cbae2e5760615e77a0106c05a7016d58b8e5e684648c06bc86ba01051b1dfdcedbe84612985fb71eb95f81d522a2ce19d2cba5f2e4fcc61e925a656ac90321	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsTime\url3 = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsVisitCount\url3 = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000c64a00ce7056548a689f72cb738078ee6ea934b884cac6d035932cbb23b5565f4edbb509dbc42fc336f46bb55d941921169010e9216126074f82	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\ = "0"	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MEMZ.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5668	[email protected]
5416	[email protected]
5668	[email protected]
5416	[email protected]
6008	[email protected]
6008	[email protected]
6008	[email protected]
6008	[email protected]
5416	[email protected]
5416	[email protected]
5668	[email protected]
5668	[email protected]
3368	[email protected]
3368	[email protected]
2012	[email protected]
2012	[email protected]
5416	[email protected]
6008	[email protected]
5416	[email protected]
6008	[email protected]
6008	[email protected]
6008	[email protected]
5416	[email protected]
5416	[email protected]
2012	[email protected]
2012	[email protected]
3368	[email protected]
3368	[email protected]
5668	[email protected]
5668	[email protected]
5416	[email protected]
6008	[email protected]
5416	[email protected]
6008	[email protected]
6008	[email protected]
5416	[email protected]
6008	[email protected]
5416	[email protected]
5668	[email protected]
3368	[email protected]
5668	[email protected]
3368	[email protected]
2012	[email protected]
2012	[email protected]
3368	[email protected]
3368	[email protected]
5668	[email protected]
5668	[email protected]
5416	[email protected]
5416	[email protected]
6008	[email protected]
6008	[email protected]
3368	[email protected]
3368	[email protected]
2012	[email protected]
2012	[email protected]
2012	[email protected]
2012	[email protected]
3368	[email protected]
3368	[email protected]
6008	[email protected]
6008	[email protected]
5416	[email protected]
5416	[email protected]

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4276	MicrosoftEdgeCP.exe
4276	MicrosoftEdgeCP.exe
5076	MicrosoftEdgeCP.exe
5076	MicrosoftEdgeCP.exe
5076	MicrosoftEdgeCP.exe
5076	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
664	chrome.exe
664	chrome.exe
664	chrome.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: 33	3224	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3224	AUDIODG.EXE
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	5200	MicrosoftEdge.exe
Token: SeDebugPrivilege	5200	MicrosoftEdge.exe
Token: SeDebugPrivilege	5200	MicrosoftEdge.exe
Token: SeDebugPrivilege	5200	MicrosoftEdge.exe
Token: SeDebugPrivilege	3296	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3296	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3296	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3296	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5200	MicrosoftEdge.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeDebugPrivilege	2120	firefox.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeDebugPrivilege	4860	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4860	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
5920	iexplore.exe
5920	iexplore.exe
5920	iexplore.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe

Suspicious use of SetWindowsHookEx 61 IoCs

pid	Process
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
5920	iexplore.exe
5920	iexplore.exe
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5920	iexplore.exe
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5200	MicrosoftEdge.exe
4276	MicrosoftEdgeCP.exe
4276	MicrosoftEdgeCP.exe
5920	iexplore.exe
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
5920	iexplore.exe
5920	iexplore.exe
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
3796	OpenWith.exe
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
5920	iexplore.exe
5432	IEXPLORE.EXE
5432	IEXPLORE.EXE
2120	firefox.exe
2120	firefox.exe
2120	firefox.exe
5280	[email protected]
5416	[email protected]
2012	[email protected]
6008	[email protected]
5668	[email protected]
3368	[email protected]
5940	[email protected]
2652	MicrosoftEdge.exe
5076	MicrosoftEdgeCP.exe
5076	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2568 wrote to memory of 2120	2568	firefox.exe	69
PID 2120 wrote to memory of 4820	2120	firefox.exe	70
PID 2120 wrote to memory of 4820	2120	firefox.exe	70
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2960	2120	firefox.exe	71
PID 2120 wrote to memory of 2632	2120	firefox.exe	72
PID 2120 wrote to memory of 2632	2120	firefox.exe	72
PID 2120 wrote to memory of 2632	2120	firefox.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tokyo-japon-2769148447.jpg
1⤵
PID:1396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.0.851686503\1772393006" -parentBuildID 20221007134813 -prefsHandle 1668 -prefMapHandle 1660 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04fa213f-dc07-427d-b1d8-2416b34b1d06} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 1748 20e2d8fae58 gpu
    3⤵
    PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.1.1081546999\2042389092" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20969 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1e7b960-7bc6-4786-afc2-b0f7b59dbf5c} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 2104 20e2d80df58 socket
    3⤵
    - Checks processor information in registry
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.2.1567021130\1058019115" -childID 1 -isForBrowser -prefsHandle 2852 -prefMapHandle 2848 -prefsLen 21052 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba6f4ca1-3ceb-45c5-8641-585dd1d52f10} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 2864 20e316f7858 tab
    3⤵
    PID:2632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.3.2132343084\799299004" -childID 2 -isForBrowser -prefsHandle 3256 -prefMapHandle 3252 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64d2ef2e-110a-47a6-9977-158bf546b992} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 2260 20e22172858 tab
    3⤵
    PID:4448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.4.103065354\621835320" -childID 3 -isForBrowser -prefsHandle 3756 -prefMapHandle 3752 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fcddc61-3a39-4b77-b9d0-207beaeeed3e} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 3768 20e2fc0a858 tab
    3⤵
    PID:3384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.5.1615012867\1454686603" -childID 4 -isForBrowser -prefsHandle 4824 -prefMapHandle 4816 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fabe55c-25e9-4318-ab86-07bd9ded3ded} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 4804 20e31687358 tab
    3⤵
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.6.1211458827\1799467393" -childID 5 -isForBrowser -prefsHandle 4984 -prefMapHandle 4988 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5276279-8dff-495b-b564-57a75182c2fa} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 4872 20e33c68b58 tab
    3⤵
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.7.1998358054\600360785" -childID 6 -isForBrowser -prefsHandle 5108 -prefMapHandle 5112 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4efc2f8d-da94-4a29-887c-32a37956f56c} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 4764 20e33c6bb58 tab
    3⤵
    PID:3992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.8.875928427\1453391037" -childID 7 -isForBrowser -prefsHandle 5608 -prefMapHandle 5604 -prefsLen 26877 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9fa0719-0be0-4840-b1eb-416f32663401} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 5620 20e33be1d58 tab
    3⤵
    PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.9.1047089524\1761449578" -parentBuildID 20221007134813 -prefsHandle 4536 -prefMapHandle 4544 -prefsLen 26894 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab93f1e7-b5a7-4744-9356-b7ab63bde80a} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 3076 20e33af6d58 rdd
    3⤵
    PID:2244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.11.1685440276\1706764901" -childID 9 -isForBrowser -prefsHandle 6140 -prefMapHandle 6136 -prefsLen 26894 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fc4dbb8-5fd4-4853-8560-e9b2497fdd2f} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 6052 20e330f7358 tab
    3⤵
    PID:868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.10.955993521\634114157" -childID 8 -isForBrowser -prefsHandle 2756 -prefMapHandle 1068 -prefsLen 26894 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8f7631d-d82a-479a-816a-2e0a0eaea8f4} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 4208 20e330f6458 tab
    3⤵
    PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.12.818073658\45315103" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6288 -prefMapHandle 6292 -prefsLen 26894 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7af1e52-ca4d-48b2-b807-70243fffae16} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 6312 20e3016f658 utility
    3⤵
    PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.13.292016063\787725347" -childID 10 -isForBrowser -prefsHandle 6412 -prefMapHandle 5036 -prefsLen 26894 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c94f3e3-5ced-4454-bc4f-fbf48c860762} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 3068 20e22163e58 tab
    3⤵
    PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.14.1203629509\1759434183" -childID 11 -isForBrowser -prefsHandle 10052 -prefMapHandle 10048 -prefsLen 26894 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7596b6e3-eda2-463d-9d01-bdad0b731e66} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 9412 20e330f5858 tab
    3⤵
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.15.1511970684\349211908" -childID 12 -isForBrowser -prefsHandle 9656 -prefMapHandle 6244 -prefsLen 27238 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2515ac9c-d9a4-4e9d-90e5-07e84e994ef9} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 2588 20e37a8e158 tab
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.16.1538091506\632003569" -childID 13 -isForBrowser -prefsHandle 4992 -prefMapHandle 8072 -prefsLen 27374 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b24a0d7-1b1e-4a1b-b916-8709d4869ea8} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 8060 20e36c3c158 tab
    3⤵
    PID:3976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.17.1645751680\1854631628" -childID 14 -isForBrowser -prefsHandle 4584 -prefMapHandle 10192 -prefsLen 27374 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4df43b70-c51f-457c-ac02-43505fca2a74} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 5168 20e30ac4d58 tab
    3⤵
    PID:528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.18.1763876087\1101073557" -childID 15 -isForBrowser -prefsHandle 6224 -prefMapHandle 6156 -prefsLen 27374 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {482c953d-2e14-4a28-8942-32e704c70c8f} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 6200 20e358cfd58 tab
    3⤵
    PID:3688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.19.683298750\1315477716" -childID 16 -isForBrowser -prefsHandle 5028 -prefMapHandle 9924 -prefsLen 27374 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ef0c2f0-2d7c-4472-a6ad-5e20369ef939} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 5972 20e30788a58 tab
    3⤵
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.20.1798186605\72124277" -childID 17 -isForBrowser -prefsHandle 10192 -prefMapHandle 10024 -prefsLen 27374 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ac3f882-9130-4b6d-8a7d-e0ed9b9abad8} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 9940 20e3016de58 tab
    3⤵
    PID:1476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.21.78982118\1717726938" -childID 18 -isForBrowser -prefsHandle 8116 -prefMapHandle 9964 -prefsLen 27374 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f928052e-c1e3-4f6d-b369-fcea6e7dfb9b} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 9392 20e2dba6c58 tab
    3⤵
    PID:316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.22.1401310010\767709387" -childID 19 -isForBrowser -prefsHandle 5604 -prefMapHandle 5832 -prefsLen 27383 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e4a29f3-3118-4dd6-b555-32e0b8e82064} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 5568 20e358d7158 tab
    3⤵
    PID:6036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.23.1377212240\1435934518" -childID 20 -isForBrowser -prefsHandle 7668 -prefMapHandle 7664 -prefsLen 27383 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1262034-457c-404f-9966-9d28358f2f1e} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 7676 20e358d7d58 tab
    3⤵
    PID:6100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.24.28945763\833524815" -childID 21 -isForBrowser -prefsHandle 9520 -prefMapHandle 6264 -prefsLen 27383 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4de8be7c-9d25-42d3-b527-dab99d1cfece} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 5224 20e3016f958 tab
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.25.1263329101\646040756" -childID 22 -isForBrowser -prefsHandle 4640 -prefMapHandle 4252 -prefsLen 28193 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78be1b26-1aba-47bd-9252-2b4d53e6883e} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 4960 20e328aaa58 tab
    3⤵
    PID:2060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.26.653004033\1970510962" -childID 23 -isForBrowser -prefsHandle 4832 -prefMapHandle 4260 -prefsLen 28166 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8482d73-bafa-468f-9e67-0c643dccf1d6} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 5092 20e30910958 tab
    3⤵
    PID:1528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.27.1477536663\1321363283" -childID 24 -isForBrowser -prefsHandle 7676 -prefMapHandle 6316 -prefsLen 28184 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c01cd62-dee7-4712-aaa0-dbdbfb6b6265} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 9496 20e3016ea58 tab
    3⤵
    PID:356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.28.572482909\292966105" -childID 25 -isForBrowser -prefsHandle 1528 -prefMapHandle 8084 -prefsLen 28184 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2e9669a-2dc6-4f28-818a-3a820d0ebabb} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 9464 20e2db09c58 tab
    3⤵
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.29.1191168635\2069788924" -childID 26 -isForBrowser -prefsHandle 4388 -prefMapHandle 4380 -prefsLen 28184 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cb38aa1-cbf2-4a20-949f-b2a454024f1b} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 4280 20e22165358 tab
    3⤵
    PID:1416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.30.1783281541\531948238" -childID 27 -isForBrowser -prefsHandle 9960 -prefMapHandle 3060 -prefsLen 28193 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd2d4b15-1f33-4fdd-8e02-4bcca838f77c} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 6496 20e2dba4b58 tab
    3⤵
    PID:4288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.31.1460355447\1631271712" -childID 28 -isForBrowser -prefsHandle 9752 -prefMapHandle 1288 -prefsLen 28193 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {868acf87-6e28-44f1-ad37-3b183acb9f47} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 3436 20e22130558 tab
    3⤵
    PID:1804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2120.32.1118995870\1724672108" -childID 29 -isForBrowser -prefsHandle 6488 -prefMapHandle 3636 -prefsLen 28193 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4eb6073-600c-44f6-8789-96a31c794135} 2120 "\\.\pipe\gecko-crash-server-pipe.2120" 3640 20e375c6c58 tab
    3⤵
    PID:6064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5920 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5432
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OXL802X1\Solaris-A65BA.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OXL802X1\Solaris-A65BA.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5340

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5200

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:1396

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2084

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5280
- C:\Users\Admin\Desktop\[email protected]
  "C:\Users\Admin\Desktop\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5416
- C:\Users\Admin\Desktop\[email protected]
  "C:\Users\Admin\Desktop\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2012
- C:\Users\Admin\Desktop\[email protected]
  "C:\Users\Admin\Desktop\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5668
- C:\Users\Admin\Desktop\[email protected]
  "C:\Users\Admin\Desktop\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6008
- C:\Users\Admin\Desktop\[email protected]
  "C:\Users\Admin\Desktop\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3368
- C:\Users\Admin\Desktop\[email protected]
  "C:\Users\Admin\Desktop\[email protected]" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:5940
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:4708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff969169758,0x7ff969169768,0x7ff969169778
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:2
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4308 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 --field-trial-handle=1856,i,12604077692044559607,14463259837841071993,131072 /prefetch:8
  2⤵
  PID:5048

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2652

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:6088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6040

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3afd855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
PID:2528

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:316

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

T1102

Credential Access

Discovery

Query Registry

System Information Discovery