hxxps://crackedithere[.]com/comodo-internet-security-crack/

Analysis

max time kernel
151s
max time network
322s
platform
windows10-1703_x64
resource
win10-20230915-es
resource tags

arch:x64arch:x86image:win10-20230915-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
06/10/2023, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://crackedithere.com/comodo-internet-security-crack/

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5380	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "2792"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{23B2B30B-A805-4D22-9F26-945C8112DCE = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001056093a3ef8d9011056093a3ef8d9015d95f33a3ef8d901fe83a2000000000001000000000000000000000000000000b50314001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800b0003100000000000000000010004d6963726f736f66742e4d6963726f736f6674456467655f3877656b796233643862627765007c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e004d006900630072006f0073006f006600740045006400670065005f003800770065006b00790062003300640038006200620077006500000034005c0031000000000000000000100054656d70537461746500440009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000540065006d00700053007400610074006500000018005c00310000000000000000001000446f776e6c6f61647300440009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000044006f0077006e006c006f00610064007300000018007e003200fe83a20046571c52200053455455505f7e312e5241520000620009000400efbe46571b5246571b522e00000000000000000000000000000000000000000000000000a346e700530065007400750070005f00500061007300730077006f007200720064005f0034003300320031002e0072006100720000001c000000ae0000001c000000010000001c0000003400000000000000ad00000018000000030000003ac06fca1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e4d6963726f736f6674456467655f3877656b7962336438626277655c54656d7053746174655c446f776e6c6f6164735c53657475705f50617373776f7272645f343332312e726172000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000007879716a676b61630000000000000000c0b884b4c2e2334887d712df5dbb3bed76df83ebbe53ee118567ee5ebadb3220c0b884b4c2e2334887d712df5dbb3bed76df83ebbe53ee118567ee5ebadb3220ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800340034003800330037003600300038002d0033003800370035003900350038003300360038002d0032003900340035003900360031003400300034002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000007eb0469a000000000000d01200000000000000000000000000000000	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "605"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 093d1b203ef8d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000518161cbd19e4e084b02daa5caa32ffe615b7798956036fd06cde69baa13fde1b99b73ce9aef531df52f97c295de751b3c5d737a970828491cdb	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7b79d81f3ef8d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{23B2B30B-A805-4D22-9F26-945C8112DCE = "0"	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\es-ES = "es-ES.1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Setup_Passworrd_4321.rar.t0n7e0l.partial:Zone.Identifier	browser_broker.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1260	NOTEPAD.EXE

Suspicious behavior: MapViewOfSection 12 IoCs

pid	Process
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4620	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4620	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4620	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4224	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4224	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3784	MicrosoftEdge.exe
Token: SeDebugPrivilege	3784	MicrosoftEdge.exe
Token: SeRestorePrivilege	464	7zG.exe
Token: 35	464	7zG.exe
Token: SeSecurityPrivilege	464	7zG.exe
Token: SeSecurityPrivilege	464	7zG.exe
Token: SeRestorePrivilege	3948	7zG.exe
Token: 35	3948	7zG.exe
Token: SeSecurityPrivilege	3948	7zG.exe
Token: SeDebugPrivilege	1844	firefox.exe
Token: SeDebugPrivilege	1844	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
464	7zG.exe
3948	7zG.exe
1844	firefox.exe
1844	firefox.exe
1844	firefox.exe
1844	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1844	firefox.exe
1844	firefox.exe
1844	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3784	MicrosoftEdge.exe
4860	MicrosoftEdgeCP.exe
4620	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
3972	MicrosoftEdgeCP.exe
3972	MicrosoftEdgeCP.exe
1172	OpenWith.exe
1844	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 3388	4860	MicrosoftEdgeCP.exe	74
PID 4860 wrote to memory of 476	4860	MicrosoftEdgeCP.exe	77
PID 4860 wrote to memory of 476	4860	MicrosoftEdgeCP.exe	77
PID 4860 wrote to memory of 476	4860	MicrosoftEdgeCP.exe	77
PID 4860 wrote to memory of 476	4860	MicrosoftEdgeCP.exe	77
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 4860 wrote to memory of 4984	4860	MicrosoftEdgeCP.exe	79
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 5084 wrote to memory of 1844	5084	firefox.exe	91
PID 1844 wrote to memory of 1108	1844	firefox.exe	92
PID 1844 wrote to memory of 1108	1844	firefox.exe	92
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93
PID 1844 wrote to memory of 860	1844	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://crackedithere.com/comodo-internet-security-crack/"
1⤵
PID:2096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3784

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
PID:2020

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:476

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1172

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Setup_Passworrd_4321\" -ad -an -ai#7zMap19807:244:7zEvent15941
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1480

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Setup_Passworrd_4321\info\LicenseInfo.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1260

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" h -scrcSHA256 -i#7zMap31634:110:7zEvent1608
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.0.1716831011\266709822" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1692 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a92bb82-38dc-4209-b4ab-97e7090b89e2} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 1796 1c99f7ef358 gpu
    3⤵
    PID:1108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.1.1151477050\182581761" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 21017 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dca656d6-e084-48a6-afc3-62f8306be768} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 2152 1c99f70b758 socket
    3⤵
    PID:860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.2.118754164\532443224" -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 3060 -prefsLen 21120 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7a1bb0a-1e34-465c-ab9d-c7c36850f020} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 2768 1c9a37b9258 tab
    3⤵
    PID:1260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.3.78636110\146844508" -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3648 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8023d38-630d-4d68-829f-1579796a6055} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 3668 1c994661358 tab
    3⤵
    PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.4.1858816426\585488814" -childID 3 -isForBrowser -prefsHandle 3876 -prefMapHandle 3872 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e63f642e-d1a2-4548-9e60-80f36f232c08} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 3864 1c9a48e2158 tab
    3⤵
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.5.140332767\1602664226" -childID 4 -isForBrowser -prefsHandle 4776 -prefMapHandle 4704 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e158b83-c1d2-4445-8e4a-b7fe92df35dc} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 4796 1c9a5dfaa58 tab
    3⤵
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.7.432326219\323645364" -childID 6 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dac35771-38d9-4621-8436-e1c912fdfe92} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 5124 1c9a5f0e458 tab
    3⤵
    PID:5480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.6.1011619208\1285720950" -childID 5 -isForBrowser -prefsHandle 4940 -prefMapHandle 4944 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84516fc8-7f29-410f-8349-575206b51cbd} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 4932 1c9a5ee0458 tab
    3⤵
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.8.733864071\1834118157" -childID 7 -isForBrowser -prefsHandle 5524 -prefMapHandle 5516 -prefsLen 26795 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89bd1c15-531d-4879-aa89-42dcee99faac} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 5536 1c9a7caea58 tab
    3⤵
    PID:5988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.9.1776597466\1550957341" -childID 8 -isForBrowser -prefsHandle 5196 -prefMapHandle 2716 -prefsLen 26795 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dded444-705f-476a-8a8c-2b227aedffe8} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 5324 1c9a3752b58 tab
    3⤵
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.10.1323218084\1510207084" -childID 9 -isForBrowser -prefsHandle 5324 -prefMapHandle 3964 -prefsLen 26795 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d178132f-5af5-405e-935c-d265ea9c3feb} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 3984 1c9a203a858 tab
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.11.44613805\639298462" -childID 10 -isForBrowser -prefsHandle 5836 -prefMapHandle 5832 -prefsLen 26795 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72462981-61f5-4c9d-852c-511723266838} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 4572 1c9a8399358 tab
    3⤵
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1844.12.243486915\1993138966" -childID 11 -isForBrowser -prefsHandle 6260 -prefMapHandle 6264 -prefsLen 28071 -prefMapSize 232675 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b9fa290-4713-4c31-a27f-4148247a38cb} 1844 "\\.\pipe\gecko-crash-server-pipe.1844" 1576 1c9a286b258 tab
    3⤵
    PID:5888

C:\Users\Admin\Desktop\Setup_Passworrd_4321\setup.exe
"C:\Users\Admin\Desktop\Setup_Passworrd_4321\setup.exe"
1⤵
PID:5864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.dat"""" /st 00:01 /du 9800:49 /sc once /ri 1 /f
  2⤵
  PID:6044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.dat"""" /st 00:01 /du 9800:49 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:5380

C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.exe
C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.exe "C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.dat"
1⤵
PID:5244

C:\Users\Admin\Desktop\Setup_Passworrd_4321\setup.exe
"C:\Users\Admin\Desktop\Setup_Passworrd_4321\setup.exe"
1⤵
PID:6040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2RZQZMR9\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
17d6c6cba2a123df11a198a30e5bed44

SHA1
7da0473bf6f8b62a72f26c427170efd0493e5719

SHA256
914a50d74576e3e0843713e03dba40f236c4985a8e552720bcea89291ae91af9

SHA512
5385601d1d0b290340f612142d2476a6935b410ce8a9758bc82551cc86783fda4a6c16fa363c3fb3690de63110e673843346a3c669fc3db8ef1b5090587890bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YQES3QNL\warmup[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\4S8D272W\favicon[1].ico

Filesize
6KB

MD5
7f969f62ee272a3be19966806fff4ad5

SHA1
07ed688be6d6288a669778f65f7eccdd96770925

SHA256
2ee43237d196100210f1786e7b73b57cd140f6013c072c70dbdffd9e9bc695f8

SHA512
a062273d97ab52b9e954b70e60114af4c4910bad902d619f1a2c38afb7ea7ae243301afacee748a229941c9389f4a3167ecc07f004dc3b55251ce5a27914412d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\6ZJ35P56\suggestions[1].es-ES

Filesize
18KB

MD5
e2749896090665aeb9b29bce1a591a75

SHA1
59e05283e04c6c0252d2b75d5141ba62d73e9df9

SHA256
d428ea8ca335c7cccf1e1564554d81b52fb5a1f20617aa99136cacf73354e0b7

SHA512
c750e9ccb30c45e2c4844df384ee9b02b81aa4c8e576197c0811910a63376a7d60e68f964dad858ff0e46a8fd0952ddaf19c8f79f3fd05cefd7dbf2c043d52c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\LVGTDV2G\w-logo-blue-white-bg[1].png

Filesize
4KB

MD5
000bf649cc8f6bf27cfb04d1bcdcd3c7

SHA1
d73d2f6d74ec6cdcbae07955592962e77d8ae814

SHA256
6bdb369337ac2496761c6f063bffea0aa6a91d4662279c399071a468251f51f0

SHA512
73d2ea5ffc572c1ae73f37f8f0ff25e945afee8e077b6ee42ce969e575cdc2d8444f90848ea1cb4d1c9ee4bd725aee2b4576afc25f17d7295a90e1cbfe6edfd5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Setup_Passworrd_4321.rar

Filesize
10.2MB

MD5
442f1c120a5f678801dfde64045cfda1

SHA1
64582b1edc3a1485af228b29bd82e9bcc63a3fb6

SHA256
2d21893daae2c4100bcc1fb04cd8c3393fc51ac8f93f02c56f339e31eb442033

SHA512
e20bb3655145b3ed04a7d027562fdc9c330922fb2d6cc22bdba5c7100e3ef3300b667d20dd0303d2618d47363ac5077557e41a2d71f680b2ea557f3b7beb66fb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Setup_Passworrd_4321.rar

Filesize
10.2MB

MD5
442f1c120a5f678801dfde64045cfda1

SHA1
64582b1edc3a1485af228b29bd82e9bcc63a3fb6

SHA256
2d21893daae2c4100bcc1fb04cd8c3393fc51ac8f93f02c56f339e31eb442033

SHA512
e20bb3655145b3ed04a7d027562fdc9c330922fb2d6cc22bdba5c7100e3ef3300b667d20dd0303d2618d47363ac5077557e41a2d71f680b2ea557f3b7beb66fb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Setup_Passworrd_4321.rar.t0n7e0l.partial

Filesize
10.2MB

MD5
442f1c120a5f678801dfde64045cfda1

SHA1
64582b1edc3a1485af228b29bd82e9bcc63a3fb6

SHA256
2d21893daae2c4100bcc1fb04cd8c3393fc51ac8f93f02c56f339e31eb442033

SHA512
e20bb3655145b3ed04a7d027562fdc9c330922fb2d6cc22bdba5c7100e3ef3300b667d20dd0303d2618d47363ac5077557e41a2d71f680b2ea557f3b7beb66fb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0G3LOC08\Setup_Passworrd_4321[1].rar

Filesize
32KB

MD5
f28c338c903f0b08b6168e64a58ed600

SHA1
ecbf4da4a0d05e7ffdbd2dda33eec77ca8cc398c

SHA256
29af8fd195f27f4ca3f777e754991c61e31324120bf783c86cf5b4c6109a6ede

SHA512
31cf0e75baaefbc45ef7b77a775d6b943445b8a8c430ea860517c452072a8345e617504abbd14082b067502d2162da372016705cde74915a1d55653eade8389c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
300B

MD5
dec6bbe308eb44937f77160a25ee32db

SHA1
8f08a4b641b564b67205e00106ca6bd9ca46fc6e

SHA256
68a71de28f488586c2b169f4652347e0a1fd632d48a6d6725393607bfa18bc7e

SHA512
6c2d684af52588cfd34a682337749b829c2336b34d6add7e8bd6e0c641862c26889617b4d6e9f298fd177b89527deb696c493a205ea8490bb8aee60090a68475

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
1KB

MD5
027af02a11dcb425b2b452975772aab4

SHA1
5474a7b42166416ae4211e4eca7e8ab4004fb78e

SHA256
f4e4dda404f55aa38b9f4501bafa86ff8493027c821b3a511e3bf04bf4e1c6f3

SHA512
cb02aa0ba1c23bde5d81d93e64b8f3363e1bd6c20dc0e38a07092bc1db23d25e1aee30e88647932978cc6f1acad2eebbbc0e5033a8f01a24d6c5b7277e6e483e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
1846ab09c7c42c6209e2ed4499488431

SHA1
0fe53ca788a663a51cbfe2a7d385216db7fe8711

SHA256
f53812a0f0c41556b286cc1d5d47850483ad595781dc0efec53de671560c5fef

SHA512
c84451315f8d9f4cb59a2d8e7d53eb325219a9db26721e8b4a090de511b4af83db7ccb79a415ca68e266c1a38409a19031cf144bf86d5a5bed51bd492cbdb28a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
192B

MD5
e1fda104b29313f4828d94b86b494a6a

SHA1
658917769c2659e991c78263c5a5d0bb8681bdc7

SHA256
be576b799efb6faa04ec8c79d61a5df9d58a045d00ed8baf0fa9bac9cba6f209

SHA512
e2073068fd58726275b0ead27796aaceb535f59ac1aa53a2111ff13a3771d901d6f0a509eefc88ce0930acae73f8efa9e256f10e4cb3bb3e82657dba6f24c26f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

Filesize
404B

MD5
d5e0883fdf9f678a016d47895829503a

SHA1
55949dd7fc70448402949c569238d8cdbe087687

SHA256
6b159796182bbbd03df98f2dbcd0c746eed5e905cdd6e9e59c1f5e8408204d6b

SHA512
cffde2df30978213a511e0c4f140d5b61c83e63c491999a8ffcff29225807b93ef93caa64c00fa58dd28f9a4487ad0f94e557d2d7f710ec8e898aa5f74a893a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\cookies.sqlite

Filesize
512KB

MD5
53e30cd8bd980376f7fb44432536e3bc

SHA1
487c672f865327903b9f3f58b82070db4d74aeee

SHA256
9f6586ad23610b338870bb30713669d97d2e29b9bb50911e7ffe6ba79caaf1ab

SHA512
93304375edbb2294df9a3ccd34b804bdd2e01dd41acce2867f7364a0989af5a2d5560b1fe47198ed2df87e47369998e4034893932a33468e0bf0bd2a6ce4d82f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\formhistory.sqlite

Filesize
256KB

MD5
01d2b032ed8ba864fe6f4cf00e868a9e

SHA1
a8fbbd119b34849452be2a371f18b425c8d014f6

SHA256
37072fc63d3e649b8d414ce356e3e5651a991c23943421505285fb701441f192

SHA512
c3f260435cb7903ee812fca9fcf7bf37ff1d625359f4e5580ef3cc0e92e0f6e925db3136176940b06daafe434b845178c9865a3e1a0437e64d9852b315a8f86e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs-1.js

Filesize
6KB

MD5
771c03d8d8553ccba3e3ae135e60ae1d

SHA1
f15422a4091af8a628b043778b51e02eec054f82

SHA256
8d9de786cbf2209f640d12de039b0deb3569fb19c17791c2b16810018c2509db

SHA512
333929be548d6c4edaa8868d07ef8f3ff312587a55b88c3208374f1c3506615cd939015262bd4c5270748f524eef42d4b7da30c00247303bf0cf636501f11f6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs-1.js

Filesize
7KB

MD5
0afd24fe7d0af26b31d1e144b7643df9

SHA1
d879c08498346c29ab66ee4fbc57896373a5f3c5

SHA256
152ec766a0c3f82f4786e6f408fb148596a4935d68cfc91e27ec602ea38c892a

SHA512
e4f80e9134952975da933c8fac3fe42163fd7fc8310739cb261573904f354dcd16d454a6b789047ea75dcea4d4d10874d55406775e5549f93d86a32000bb53f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs-1.js

Filesize
7KB

MD5
d21402380bd2bb25b5b6e8be2619e358

SHA1
e482763edd995c465e5339c91318f133a2ea5f24

SHA256
40fc463b0e3f949126d2c933949bfe055f0d0136e6312610f9fdde56e4b6173a

SHA512
5a33a7742b6e2ba5bb8db2142c1bee432125772c51efaafdb16638122dc5af4514ebbf8767d7598b73036e6a880b5faea8d3738254fda059e23290c0eaa22bbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs.js

Filesize
7KB

MD5
620a2443e96c68f2571fa8029a2d204d

SHA1
3334935b4731966e7d3cdbfb2d5fb93444cb6558

SHA256
02e6698e64fc6fc262fb4ea1938329d283c5f138bf67dfde49e2cd711b014b55

SHA512
0651958a00ee9f39780f1b0e1ad1adf02ffb574b383f3c632d65d34984b2d2ce0915631960a3dccfa1c1dc63873744e0c743f96db1dad9fb2d5e926e5ccf59d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
93109d2b95cd00429f2e32c56ec0742f

SHA1
ceb70b87526f18a1239cf872ef5ec08dd136a2c8

SHA256
88831997f4167f53c90f1c013dd73b2b85f33292f8aa7ee7f1f36191aba8f4de

SHA512
6900a4381513b7f5521fd048c0218e4fc688653ecbb3384a9a02d67be3ddc55bf731a245bd028ef3f4a4e48254fcdd541170ebba6f9a9c43536dfca9ef348351

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
04c95dd94b0fc58e7309c48fadfb9d5a

SHA1
6d1835e8e90be91bb83f04ab38c3aba2a5a2b058

SHA256
d08d1a1127578da021f778cc1a91758c979399a5b0ccb2ae5a00fea39a290a17

SHA512
bf0503e26da0e710a8d4322bc0bece4c885cd4073eb877ae43a90dec574febcef5e3c9c46a7074c664d29115f0beace9cb3456172adc08d2aa1ed16c79ee13e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
56d6992da75114ab73ff0c1565b448f2

SHA1
e46397badb4e4a7e9cfc686f7376c44ad96fb565

SHA256
7ac86bdfc7fe3440e04d82550c1721e933d80ffaf82f549c7c43e483a53c67da

SHA512
b90191025447ad3a89b3ac47b2224a6542e7fc27cec54e43d2cbe0a2d865660801163f3e4757001d2c646c4953393976006d9386172ee5a5d0d9469395959fc6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
3693bf48b3f9d27986c3f5ffb77913c9

SHA1
1bf496f3783a337ed83378ae8fa7ad587b6e4b5d

SHA256
117a2f8a8ab578b172fe15f4ec7f761ed93fdc0bd7370eca76e3738c57f98e13

SHA512
5c54668f5d4c85cbc5259dd69be5ac20bacf7b03cac424e6c56ff0922a8fd5be0a7089ff7903a1bb5f1ea699bf0e2618c2976762481cacaa6feeaa519f9dd729

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
df55260c6a3dca52c755136d2b5e8c03

SHA1
2f40773fde533a9234102c1752906c977b0be792

SHA256
8d3becb19f133537d774f9c031df3ae7f3ebc3c31a74c8c4096ef58b426ddf9d

SHA512
7de42301aaa9ca403fa0669d6ed3bf92135deb697bda1adafeb4b690a33f21c38a0b3a2ac80b80c4fea998fc55253413d7aa685f415a4a6e73885e4eca9414c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c2acac6e812a278a1f87fa180899ae14

SHA1
64a314df82780c45990152775c00d33b3404587a

SHA256
f875e8bd6db9179f8045627a6dc9cfe5adf03f7b9f46c406f237d6c13fc77b68

SHA512
b28e1bb188206c22899fb4776c7f5e64a940f7f1817633f3dc244f52681f3f6fd7c18e10b0ac6e3de523e2e8bdfaf9156f218d1f593cc8f6f315f74baccae2ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
f67b69b8afa66eba61f2086d224fd8d4

SHA1
e48f501c934d3155be8a1b2a5d4060a84fa0369a

SHA256
7e4a559bc9c8e514b7b4557bc124292604effa777ff8c103da8c964501dfd9d1

SHA512
8b213f3f5b61640f793c853122c1a250f4c6d46ed5434245c5f089d2281f6f1228306c1b254bc7657726c28a67412568058a279393d6cfadff32c9ee89a910ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
2be5946df2d7c11fb3c5910334874f39

SHA1
941163bf21faca98667ed79b7ceffed0b77f8cf5

SHA256
04c2e54b897d1301a43b25f59554f7c727256822557ff26b3221002dbb77e386

SHA512
66410c112f90527bbc083927771af359621cafafd55d8e90c952db61f415b08ef2081e7e817209c644d61183050256112cb84b30d86f05a33648f2d14eced2fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\storage\default\https+++www.virustotal.com\cache\morgue\107\{705dedaa-15f4-4be5-ad3a-788eb9ef3c6b}.final

Filesize
45KB

MD5
2571f03f8e7b7bedf2497e2b311d1c8b

SHA1
7ac0fdc8e86727140133bcc99b9d564adfcf654a

SHA256
4b17e700973326f944ffadad20a0d78708241d124bca010b971bbde613bdb08d

SHA512
8ec1541e88961bc4a48e08116e7034907cc886f38cfd7a705e1c629bf3e03ff955331721624a18cb48ea0d150c770193294073b6ec7dc3313aa77b2f85e29bad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
79f7f17b14e938190032b1f1a961c3ad

SHA1
78f2d1a6384bd8b9f9d14cdac56040c5f1bcd38d

SHA256
00b094ed2e4cb11301f79299f5a88c8aca9ee39e07460187c538d1c393a6e104

SHA512
bfc3428263fd08989c1bca44d34b4dda1194664e25ffe0ac9e99111a438b087af87952e3e6240fee112f20570097058286ef734da2472df9973ebf61cbad0e61

Download Submit
C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.dat

Filesize
57KB

MD5
588ece9b869693cab504ca528364b431

SHA1
53cd16043fff4ba3dce78282c1ebef1a78e59f0b

SHA256
aebaaf2b227982b50711a5ed131f405a8552fc211b8ce50b6cc659e5a03509c1

SHA512
1d5bd9181b045863647134921332d3bf85e2c66a6bbfd2d542e23ac507a0b9d1c7c85f64566a109124dad77df29ed823534cad6ee60b2313ef574468214238e4

Download Submit
C:\Users\Admin\AppData\Roaming\ServiceData\Gedapoko.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
C:\Users\Admin\Desktop\Setup_Passworrd_4321\info\LicenseInfo.txt

Filesize
1.2MB

MD5
4c1743dec32ebafd96f01265a7316cda

SHA1
ea1ca92942b3e2ba6f9a64ca178d3dad8d761bc7

SHA256
60aa8a2a29c3823098029715cb66c071099111249d23ea36c5a2125c738e90ce

SHA512
add32e0b44f89018d999735117c516eb01dfa410ae470eabbceba30bbea6fefd84aa777ff1aeb6b266251ef3af8032a3f7f56609101eb54c29637d21ee87144e

Download Submit
C:\Users\Admin\Desktop\Setup_Passworrd_4321\setup.exe

Filesize
201.1MB

MD5
8478f6d0df6b8a30f51f9f5941cf2119

SHA1
8d576a738ce76eb1c8ab1455efb19b5512446a58

SHA256
b7df6ef59f6eb85b10c874baf88414ffe08e8f6489f1bc928a38781c83d7abcc

SHA512
b0d739f074a12e572942e457e5481dd6461c71d4c314da0286bb23943ef569101bec23c66f281946bc26c1a731758a2d324dcb92e9f1d008740013bae5611728

Download Submit
C:\Users\Admin\Desktop\Setup_Passworrd_4321\setup.exe

Filesize
687.6MB

MD5
68335781a4463a2f5ebfa56edeefc92a

SHA1
93782a17e78f43eb10acb9a19e160039e14a01db

SHA256
509b47d0c74c14190f535bb4b4715bd89afaf254d7a034186d6178b182364c4a

SHA512
f2393facef22f4d03a4f51628e556c99bf5010447f0ee852ce5c3190fcfcdb2ff0d3e47118b383f67a3aff89f31f59dbe4a37c626ec1d88600c62b76f3093acb

Download Submit
C:\Users\Admin\Desktop\Setup_Passworrd_4321\setup.exe

Filesize
687.6MB

MD5
68335781a4463a2f5ebfa56edeefc92a

SHA1
93782a17e78f43eb10acb9a19e160039e14a01db

SHA256
509b47d0c74c14190f535bb4b4715bd89afaf254d7a034186d6178b182364c4a

SHA512
f2393facef22f4d03a4f51628e556c99bf5010447f0ee852ce5c3190fcfcdb2ff0d3e47118b383f67a3aff89f31f59dbe4a37c626ec1d88600c62b76f3093acb

Download Submit
memory/3388-136-0x000001B963F60000-0x000001B963F62000-memory.dmp

Filesize
8KB

Download
memory/3388-143-0x000001B963C70000-0x000001B963C72000-memory.dmp

Filesize
8KB

Download
memory/3388-125-0x000001B963E00000-0x000001B963E02000-memory.dmp

Filesize
8KB

Download
memory/3388-243-0x000001B9638B0000-0x000001B9638B2000-memory.dmp

Filesize
8KB

Download
memory/3388-138-0x000001B963C50000-0x000001B963C52000-memory.dmp

Filesize
8KB

Download
memory/3388-132-0x000001B963F40000-0x000001B963F42000-memory.dmp

Filesize
8KB

Download
memory/3388-245-0x000001B9638C0000-0x000001B9638C2000-memory.dmp

Filesize
8KB

Download
memory/3388-150-0x000001B963D90000-0x000001B963D92000-memory.dmp

Filesize
8KB

Download
memory/3388-134-0x000001B963F50000-0x000001B963F52000-memory.dmp

Filesize
8KB

Download
memory/3388-239-0x000001B961CF0000-0x000001B961CF2000-memory.dmp

Filesize
8KB

Download
memory/3388-129-0x000001B963E20000-0x000001B963E22000-memory.dmp

Filesize
8KB

Download
memory/3388-147-0x000001B963D70000-0x000001B963D72000-memory.dmp

Filesize
8KB

Download
memory/3784-35-0x000001C751BA0000-0x000001C751BA2000-memory.dmp

Filesize
8KB

Download
memory/3784-231-0x000001C756EB0000-0x000001C756EB1000-memory.dmp

Filesize
4KB

Download
memory/3784-232-0x000001C756EC0000-0x000001C756EC1000-memory.dmp

Filesize
4KB

Download
memory/3784-16-0x000001C751040000-0x000001C751050000-memory.dmp

Filesize
64KB

Download
memory/3784-0-0x000001C750820000-0x000001C750830000-memory.dmp

Filesize
64KB

Download
memory/3972-360-0x000001CD3F9B0000-0x000001CD3F9D0000-memory.dmp

Filesize
128KB

Download
memory/4984-448-0x000002089FFC0000-0x000002089FFE0000-memory.dmp

Filesize
128KB

Download
memory/4984-504-0x00000208A0AB0000-0x00000208A0AB2000-memory.dmp

Filesize
8KB

Download
memory/4984-522-0x00000208A0CB0000-0x00000208A0CB2000-memory.dmp

Filesize
8KB

Download
memory/4984-525-0x00000208A19E0000-0x00000208A19E2000-memory.dmp

Filesize
8KB

Download
memory/5864-977-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads