hxxp://a0945546[.]xsph[.]ru

Processes:

dxwebsetup.exedxwsetup.exeserver.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\DXTempFolder = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\DX23.tmp\\\""	dxwsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\c15cd7ce3aae2bd6036dd10a665f69f9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c15cd7ce3aae2bd6036dd10a665f69f9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .."	server.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

dxwsetup.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini dxwsetup.exe
File opened for modification C:\Windows\assembly\Desktop.ini dxwsetup.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dxwsetup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

dxwsetup.exe

description	ioc	process
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

Processes:

flow	ioc
404	raw.githubusercontent.com
405	raw.githubusercontent.com
560	camo.githubusercontent.com
380	camo.githubusercontent.com
347	camo.githubusercontent.com
348	camo.githubusercontent.com
349	camo.githubusercontent.com
381	camo.githubusercontent.com
382	camo.githubusercontent.com
383	camo.githubusercontent.com
384	camo.githubusercontent.com
346	camo.githubusercontent.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

3 https://cheats-pack.ru/webchp.html

flow	ioc
3	https://cheats-pack.ru/webchp.html

Drops file in System32 directory 64 IoCs

Processes:

dxwsetup.exeExtreme Injector v3.exe

description	ioc	process
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2005_d3dx9_24_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Dec2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\vccorlib140d.dll.tmp	Extreme Injector v3.exe
File created	C:\Windows\SysWOW64\vcruntime140d.dll.tmp	Extreme Injector v3.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_d3dx9_33_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_d3dx10_40_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dx10_42_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Dec2006_d3dx9_32_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx9_38_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_xaudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140d.dll	Extreme Injector v3.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Oct2006_d3dx9_31_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_d3dx9_39_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_d3dx10_34_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_x3daudio_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_d3dx10_40_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_xaudio_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2905.0_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_d3dx10_41_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140d.dll	Extreme Injector v3.exe
File created	C:\Windows\SysWOW64\mfcm140d.dll.tmp	Extreme Injector v3.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_d3dx9_40_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2005_d3dx9_26_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2007_x3daudio_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_d3dx9_37_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_xaudio_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_xaudio_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_xaudio_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2908.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Oct2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_d3dx10_37_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\mfc140d.dll	Extreme Injector v3.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_x3daudio_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2904.0_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_d3dx9_34_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2010_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dx9_43_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dcsx_43_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Oct2006_d3dx9_31_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2007_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2007_x3daudio_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx10_38_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2903.0_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2910.0_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx10_38_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_d3dx9_41_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dcsx_42_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2008_d3dx9_39_x64.cab	dxwsetup.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

x32dbg.exe

description	pid	process	target process
PID 9220 set thread context of 9980	9220	x32dbg.exe	DLLLoader32_6E80.exe
PID 9220 set thread context of 9980	9220	x32dbg.exe	DLLLoader32_6E80.exe
PID 9220 set thread context of 9980	9220	x32dbg.exe	DLLLoader32_6E80.exe
PID 9220 set thread context of 9980	9220	x32dbg.exe	DLLLoader32_6E80.exe

Drops file in Windows directory 64 IoCs

Processes:

MicrosoftEdgeCP.exedxwsetup.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\msdownld.tmp\AS5BAB85.tmp\Nov2007_d3dx9_36_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BEA72.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BF986.tmp\Feb2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CDAFC.tmp\MDX_1.0.2906.0_x86.cab	dxwsetup.exe
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5B7A05.tmp\Apr2006_xinput_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C0B29.tmp\Oct2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C8B46.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CBC59.tmp\Feb2010_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CBDC0.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C10B7.tmp\Dec2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5CDEE4.tmp\MDX_1.0.2908.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BBB73.tmp\Jun2008_d3dx10_38_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C4AB3.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C7889.tmp\Jun2008_xaudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C7F5F.tmp\Aug2008_d3dx10_39_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C8CBD.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CD36B.tmp\MDX_1.0.2903.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CD6D6.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B9108.tmp\Apr2006_d3dx9_30_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BB7E9.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C1386.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C397D.tmp	dxwsetup.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5B8F52.tmp\Feb2006_d3dx9_29_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BAB85.tmp\Nov2007_d3dx9_36_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C1E15.tmp\Apr2007_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5C6C64.tmp\Jun2008_d3dx9_38_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CB738.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B94A1.tmp\Dec2006_d3dx9_32_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5BDF18.tmp\Jun2010_d3dx9_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BFED5.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C04A1.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CBB6E.tmp\Aug2009_xaudio_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5CBF56.tmp\Feb2010_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C126D.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5C181A.tmp\Apr2007_d3dx10_33_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5C1E15.tmp\Apr2007_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5C9652.tmp\Mar2009_d3dx10_41_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DXError.log	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B7C66.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5BC4CA.tmp\Nov2008_d3dx9_40_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BFD9C.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C2038.tmp\Apr2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C8CBD.tmp\Nov2008_xaudio_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5C8DB7.tmp\Nov2008_d3dx9_40_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5BA962.tmp\Aug2007_d3dx10_35_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BCDB3.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C89DF.tmp\Nov2008_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C9C2E.tmp\Mar2009_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5CB738.tmp\Aug2009_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5B82EE.tmp\Apr2007_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B97DE.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5BC0D2.tmp\Aug2008_d3dx10_39_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BC4CA.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BECC4.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C8B46.tmp\Nov2008_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5BB7E9.tmp\Jun2008_d3dx9_38_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C445A.tmp\Nov2007_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C752E.tmp\Jun2008_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C251A.tmp\Jun2007_d3dx9_34_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5C827C.tmp\Aug2008_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5C8347.tmp	dxwsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

svchost.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exetaskmgr.exefirefox.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exex32dbg.exeExtreme Injector v3.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c39c37f4628fda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	Extreme Injector v3.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\moneyz.fun\Total = "189"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "253"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\moneyz.fun\ = "672"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "62402"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 07606e1b638fda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\moneyz.fun\ = "12"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "89"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "52762"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 828d5281628fda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 70474e6706a1da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "546"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 544abbcc628fda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "124"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\virustotal.com\NumberOfSu = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "52951"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "45870"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "649"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "708"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 286efd8b628fda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\moneyz.fun\Total = "139"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Extreme Injector v3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9cc43115638fda01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "3159"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "45870"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsTime	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\msn.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\moneyz.fun\Total = "168"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 672eaa87628fda01	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

x64dbg.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	x64dbg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	x64dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	x64dbg.exe

NTFS ADS 5 IoCs

Processes:

firefox.exefirefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\eclipse.dll:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Extreme.Injector.v3.7.3.-.by.master131.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\dnSpy-net-win64.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NjRat.0.7D.Green.Edition.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\snapshot_2024-04-11_18-47.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

x64dbg.exex32dbg.exe

pid process

11632 x64dbg.exe
9220 x32dbg.exe

pid	process
11632	x64dbg.exe
9220	x32dbg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exetaskmgr.exe

pid	process
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

Processes:

MicrosoftEdgeCP.exetaskmgr.exeserver.exex64dbg.exex32dbg.exe

pid process

4296 MicrosoftEdgeCP.exe
6392 taskmgr.exe
8128 server.exe
11632 x64dbg.exe
9220 x32dbg.exe

pid	process
4296	MicrosoftEdgeCP.exe
6392	taskmgr.exe
8128	server.exe
11632	x64dbg.exe
9220	x32dbg.exe

Suspicious behavior: MapViewOfSection 29 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

6484 chrome.exe
6484 chrome.exe
6484 chrome.exe

pid	process
6484	chrome.exe
6484	chrome.exe
6484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MicrosoftEdgeCP.exefirefox.exetaskmgr.exe7zG.exeExtreme Injector v3.exe

description	pid	process
Token: SeDebugPrivilege	2884	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2884	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2884	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2884	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1856	firefox.exe
Token: SeDebugPrivilege	1856	firefox.exe
Token: SeDebugPrivilege	1856	firefox.exe
Token: SeDebugPrivilege	7092	taskmgr.exe
Token: SeSystemProfilePrivilege	7092	taskmgr.exe
Token: SeCreateGlobalPrivilege	7092	taskmgr.exe
Token: SeDebugPrivilege	1856	firefox.exe
Token: SeDebugPrivilege	1856	firefox.exe
Token: SeDebugPrivilege	1856	firefox.exe
Token: 33	7092	taskmgr.exe
Token: SeIncBasePriorityPrivilege	7092	taskmgr.exe
Token: SeDebugPrivilege	1856	firefox.exe
Token: SeRestorePrivilege	3488	7zG.exe
Token: 35	3488	7zG.exe
Token: SeSecurityPrivilege	3488	7zG.exe
Token: SeSecurityPrivilege	3488	7zG.exe
Token: SeDebugPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: SeDebugPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe
Token: 33	6900	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	6900	Extreme Injector v3.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exetaskmgr.exe7zG.exetaskmgr.exe

pid	process
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
1856	firefox.exe
1856	firefox.exe
3488	7zG.exe
1856	firefox.exe
1856	firefox.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exetaskmgr.exetaskmgr.exe

pid	process
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
7092	taskmgr.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe
6392	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeMicrosoftEdgeCP.exefirefox.exeExtreme Injector v3.exefirefox.exefirefox.exe

pid	process
3220	MicrosoftEdge.exe
2116	MicrosoftEdgeCP.exe
2884	MicrosoftEdgeCP.exe
2116	MicrosoftEdgeCP.exe
2932	OpenWith.exe
4172	OpenWith.exe
4136	OpenWith.exe
3660	OpenWith.exe
4296	MicrosoftEdgeCP.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
4296	MicrosoftEdgeCP.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
6900	Extreme Injector v3.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
4296	MicrosoftEdgeCP.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
1856	firefox.exe
11164	firefox.exe
11164	firefox.exe
11164	firefox.exe
11164	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe
10524	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MicrosoftEdgeCP.exe

description	pid	process	target process
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2116 wrote to memory of 2212	2116	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "http://a0945546.xsph.ru"
1⤵
PID:4092

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3220

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4136

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3660

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4296

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.0.231834306\905092395" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {905da002-f240-4247-be39-f827a05db92c} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 1776 2a78abd9658 gpu
3⤵
PID:3888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.1.245443718\1801106351" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91f5161d-c424-46a4-ac2e-dd3ebb4c8c26} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 2132 2a78aafcb58 socket
3⤵
- Checks processor information in registry
PID:4772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.2.1856557062\203128576" -childID 1 -isForBrowser -prefsHandle 2880 -prefMapHandle 2876 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f27a1a05-d39e-42c0-bb45-34b8ba652f9f} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 2892 2a78eda1e58 tab
3⤵
PID:5200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.3.85685762\74534419" -childID 2 -isForBrowser -prefsHandle 3604 -prefMapHandle 3600 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f129c3b-5bd6-49d2-9947-ff03c05dc6a3} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 3616 2a78d6e9158 tab
3⤵
PID:5404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.4.1925656352\1488847583" -childID 3 -isForBrowser -prefsHandle 3640 -prefMapHandle 3604 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ff64d66-122d-45b4-a250-d9c8ab5d4650} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 3808 2a78f394e58 tab
3⤵
PID:5416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.5.867204591\1264332232" -childID 4 -isForBrowser -prefsHandle 4932 -prefMapHandle 4928 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4108026-63bc-403a-a118-c8cfed639ed2} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 4944 2a791597558 tab
3⤵
PID:5272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.6.728792374\1360627020" -childID 5 -isForBrowser -prefsHandle 5208 -prefMapHandle 5204 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bc2a9f6-9dd7-46ab-be82-09dda00aa06e} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 5216 2a792408d58 tab
3⤵
PID:5648

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.7.2130009049\1539475948" -childID 6 -isForBrowser -prefsHandle 5340 -prefMapHandle 5344 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ea137e6-4368-4199-b372-cf0e6a4ba227} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 5332 2a792409f58 tab
3⤵
PID:5656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.8.1843862037\1849341984" -childID 7 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15409bff-698e-44b5-9886-9f94a2151cf2} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 5516 2a792409658 tab
3⤵
PID:5664

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.9.13026101\1456939353" -childID 8 -isForBrowser -prefsHandle 5344 -prefMapHandle 5524 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d90e77a6-04cd-4602-bc9c-482aa5407f52} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 5844 2a793908e58 tab
3⤵
PID:2984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.10.241628834\1454780388" -childID 9 -isForBrowser -prefsHandle 3800 -prefMapHandle 4784 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a907547-cbc6-46b0-968e-0fb606030976} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 4732 2a78fcec158 tab
3⤵
PID:6940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.11.645622397\222922244" -childID 10 -isForBrowser -prefsHandle 6160 -prefMapHandle 6156 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e683d13-1689-4add-8825-7a4b1c25827b} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 6168 2a7911f5258 tab
3⤵
PID:5864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.12.1277640135\1885923309" -childID 11 -isForBrowser -prefsHandle 5652 -prefMapHandle 5664 -prefsLen 27555 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fddd2128-28cc-4c98-ab06-bebebd99397d} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 5608 2a78f548258 tab
3⤵
PID:4268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.13.257587903\189414428" -childID 12 -isForBrowser -prefsHandle 7044 -prefMapHandle 7024 -prefsLen 27564 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5311f70a-6379-4a07-aff8-1b93ea16b64a} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 1588 2a7943f4d58 tab
3⤵
PID:5076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.14.169004203\2087489559" -childID 13 -isForBrowser -prefsHandle 6188 -prefMapHandle 11076 -prefsLen 27564 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99362c7b-46d9-4b1f-8c05-20a288b9cb2b} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 11056 2a78f5f7d58 tab
3⤵
PID:6440

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.15.1206705668\1093659460" -childID 14 -isForBrowser -prefsHandle 11072 -prefMapHandle 11060 -prefsLen 27564 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36ae35f0-6172-413e-a6d5-e8458f7462c3} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 11104 2a78f5f8c58 tab
3⤵
PID:1472

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.16.884628294\1106764851" -childID 15 -isForBrowser -prefsHandle 3176 -prefMapHandle 9712 -prefsLen 27564 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db491a0c-4e75-4ce4-8086-f83477f56f5c} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 9696 2a7911ced58 tab
3⤵
PID:7868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.17.1132356583\1251782331" -childID 16 -isForBrowser -prefsHandle 9724 -prefMapHandle 9728 -prefsLen 27564 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5672f2be-a2a8-4614-bf57-2f63b57c12d5} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 9720 2a7911f7758 tab
3⤵
PID:8448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.18.276987990\1709273897" -childID 17 -isForBrowser -prefsHandle 6940 -prefMapHandle 7012 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0caa619-f2c0-4e9f-9467-384c79e56c08} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 6844 2a78f7b6e58 tab
3⤵
PID:11900

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.19.330381555\1057612394" -childID 18 -isForBrowser -prefsHandle 9716 -prefMapHandle 7116 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af412e6b-890b-47a8-8186-417c9089ba82} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 9568 2a79171e258 tab
3⤵
PID:12244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1856.20.1409962266\648190548" -childID 19 -isForBrowser -prefsHandle 10688 -prefMapHandle 10684 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1108 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0088fa59-1550-4772-81a3-bfca4c828d64} 1856 "\\.\pipe\gecko-crash-server-pipe.1856" 10696 2a7911cff58 tab
3⤵
PID:6896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:2288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4188

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2152

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6036

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7092

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3700

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap27391:134:7zEvent14687
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3488

C:\Users\Admin\Desktop\Extreme Injector v3.exe
"C:\Users\Admin\Desktop\Extreme Injector v3.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6900

C:\Users\Admin\AppData\Local\Temp\3fhslkdb.0vx\dxwebsetup.exe
"C:\Users\Admin\AppData\Local\Temp\3fhslkdb.0vx\dxwebsetup.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:6404

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:3368

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6392

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:9656

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9908

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:9804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:7964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:10660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:7728

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:6484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa4e689758,0x7ffa4e689768,0x7ffa4e689778
2⤵
PID:11260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:2
2⤵
PID:7488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1848 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:8
2⤵
PID:7548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:8
2⤵
PID:7356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:1
2⤵
PID:9836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:1
2⤵
PID:9780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4400 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:1
2⤵
PID:11256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:8
2⤵
PID:9196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4796 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:8
2⤵
PID:7864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:8
2⤵
PID:9688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4916 --field-trial-handle=1812,i,17414827734046972114,7071660069385026264,131072 /prefetch:8
2⤵
PID:9140

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:10404

C:\Users\Admin\Desktop\dnSpy.exe
"C:\Users\Admin\Desktop\dnSpy.exe"
1⤵
PID:8076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:7480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:11164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.0.1304965512\2116219094" -parentBuildID 20221007134813 -prefsHandle 1588 -prefMapHandle 1580 -prefsLen 21578 -prefMapSize 233863 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9d01dad-fd3f-4e70-a707-08fde5e67dd6} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 1664 152394fa258 gpu
3⤵
PID:9032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.1.1248531989\1792400382" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 21623 -prefMapSize 233863 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a4dee75-3b06-4e1e-857a-180ac5bf635c} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 2004 15239136158 socket
3⤵
PID:11320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.2.814967336\1197832287" -childID 1 -isForBrowser -prefsHandle 2712 -prefMapHandle 2708 -prefsLen 22084 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a760d59-ff25-4ea9-ade3-bb7f1665f372} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 2724 1523955b458 tab
3⤵
PID:11372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.3.866228173\1440599976" -childID 2 -isForBrowser -prefsHandle 3416 -prefMapHandle 3412 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0906f0f-d44c-47ef-8eef-9bcea647ec36} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 3420 1523e15de58 tab
3⤵
PID:9452

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.4.2039325231\1710098493" -childID 3 -isForBrowser -prefsHandle 3664 -prefMapHandle 3660 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1718a38c-c010-4cde-b191-7701e8141c34} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 3676 1523e42b558 tab
3⤵
PID:11468

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.5.743180969\1937706172" -childID 4 -isForBrowser -prefsHandle 4584 -prefMapHandle 4580 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1680808e-8b86-482b-80c9-6fbc3856d040} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 4592 1523c04e558 tab
3⤵
PID:9892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.6.763143998\1795275622" -childID 5 -isForBrowser -prefsHandle 4608 -prefMapHandle 4104 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5c800ae-c99f-4e28-a9d1-aedec0712a79} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 4712 1523f6aa558 tab
3⤵
PID:9328

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.7.1899841459\1397631840" -childID 6 -isForBrowser -prefsHandle 4792 -prefMapHandle 4796 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54ad1869-00db-4e63-b59a-aa4c9866f85c} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 4784 1523f6a7b58 tab
3⤵
PID:11196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.8.1276431753\506407550" -childID 7 -isForBrowser -prefsHandle 5292 -prefMapHandle 5284 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be4e96d6-b848-4eef-b174-e4a1f9a9b91f} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 5304 1524189e158 tab
3⤵
PID:12088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.9.1730564690\207818525" -childID 8 -isForBrowser -prefsHandle 4652 -prefMapHandle 4564 -prefsLen 27262 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be7821ee-1951-434c-9c6c-b8a9ff2c8822} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 4568 1523e15db58 tab
3⤵
PID:10164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.10.374325428\14446450" -childID 9 -isForBrowser -prefsHandle 5932 -prefMapHandle 5884 -prefsLen 27271 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2849a4fb-ab7b-4a7f-b1d6-ddaa4dc56012} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 5944 15241f1cb58 tab
3⤵
PID:8228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.11.1442786431\640880412" -childID 10 -isForBrowser -prefsHandle 4780 -prefMapHandle 5000 -prefsLen 27271 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c2ad561-aa40-43e9-ab26-f2ce8f5872ac} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 5988 1524207d358 tab
3⤵
PID:8304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.12.744986784\837953067" -childID 11 -isForBrowser -prefsHandle 6192 -prefMapHandle 6188 -prefsLen 27271 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64a63369-636c-413b-b28e-6dcea0e6bf63} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 6204 1524207ca58 tab
3⤵
PID:8288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11164.13.1660019627\562222187" -childID 12 -isForBrowser -prefsHandle 6372 -prefMapHandle 6368 -prefsLen 27271 -prefMapSize 233863 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91116e4e-8689-493a-81a9-5d1792771a88} 11164 "\\.\pipe\gecko-crash-server-pipe.11164" 5964 152408ddb58 tab
3⤵
PID:9124

C:\Program Files\Mozilla Firefox\crashreporter.exe
"C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\minidumps\ded3d5d2-7147-4b71-ac6e-ef660e586059.dmp"
3⤵
PID:7180

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
"C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\minidumps\ded3d5d2-7147-4b71-ac6e-ef660e586059.dmp"
4⤵
PID:7380

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:10780

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:10524

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.0.1905246986\1480781087" -parentBuildID 20221007134813 -prefsHandle 1588 -prefMapHandle 1580 -prefsLen 21710 -prefMapSize 233995 -appDir "C:\Program Files\Mozilla Firefox\browser" - {264f3a46-b11a-45ed-8464-d26fc4d8f9b0} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 1664 23f29105358 gpu
3⤵
PID:5388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.1.1732029119\1219023389" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 21755 -prefMapSize 233995 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9da92ff-0227-487b-8217-7b1552e83348} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 2004 23f28d36158 socket
3⤵
PID:7444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.2.583154486\471245295" -childID 1 -isForBrowser -prefsHandle 2716 -prefMapHandle 2712 -prefsLen 22216 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {44a0c3bc-f2a5-4592-b309-496adab5d6e0} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 2728 23f2cc7d958 tab
3⤵
PID:5748

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.3.637440137\1656616840" -childID 2 -isForBrowser -prefsHandle 3236 -prefMapHandle 3232 -prefsLen 27337 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7880ee3-2c0c-4edd-9146-2a1442928be7} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 3248 23f2deec058 tab
3⤵
PID:4992

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.4.1324727944\1640165182" -childID 3 -isForBrowser -prefsHandle 4544 -prefMapHandle 4528 -prefsLen 27337 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4f195b4-9913-48a0-b892-ef545302970c} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 4556 23f2f5ec758 tab
3⤵
PID:8788

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.5.1466027790\515481192" -childID 4 -isForBrowser -prefsHandle 4696 -prefMapHandle 4700 -prefsLen 27337 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68df82ba-f5fd-4a1b-8c1b-a9888be4c387} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 4688 23f2fd6f858 tab
3⤵
PID:8780

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.6.873623489\48845301" -childID 5 -isForBrowser -prefsHandle 4888 -prefMapHandle 4892 -prefsLen 27337 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e624534-1b88-44bd-bc49-d4fa13824dc7} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 4880 23f2fdaa558 tab
3⤵
PID:8896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.7.1540576097\1012266194" -childID 6 -isForBrowser -prefsHandle 4528 -prefMapHandle 5132 -prefsLen 27337 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7a8a5a8-3cdf-4522-b531-07b67ed9001a} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 5108 23f310c5a58 tab
3⤵
PID:3500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.8.1393485682\2014351728" -childID 7 -isForBrowser -prefsHandle 5720 -prefMapHandle 5684 -prefsLen 27833 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a82c4f4-af84-4dee-9ddf-ce59add67d4a} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 5724 23f31885b58 tab
3⤵
PID:10492

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.9.968875532\968679922" -parentBuildID 20221007134813 -prefsHandle 5872 -prefMapHandle 5932 -prefsLen 27833 -prefMapSize 233995 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4d6f554-98a4-48b2-8567-604433fc1945} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 5940 23f32cf6958 rdd
3⤵
PID:10412

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.10.1110293960\1955717804" -childID 8 -isForBrowser -prefsHandle 4868 -prefMapHandle 4872 -prefsLen 27833 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b70bd04-0eff-4a6c-a024-861146cc91d3} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 5044 23f1e15c158 tab
3⤵
PID:8988

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.11.73623384\841357783" -childID 9 -isForBrowser -prefsHandle 4920 -prefMapHandle 4916 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a6ce6f1-b2e3-45ef-afe2-5a9a87b6c07e} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 4932 23f31886a58 tab
3⤵
PID:8460

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.12.1473161634\616512919" -childID 10 -isForBrowser -prefsHandle 10016 -prefMapHandle 4972 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d4c0903-cce9-4a1c-8fbf-a82be96e7e3a} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 5000 23f33fd2858 tab
3⤵
PID:12264

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.13.565574140\673069164" -childID 11 -isForBrowser -prefsHandle 9872 -prefMapHandle 10040 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ce3e30f-0ee3-4ba2-b327-af9acd07415a} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9832 23f33fcf858 tab
3⤵
PID:10152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.14.1627903557\1108870681" -childID 12 -isForBrowser -prefsHandle 9808 -prefMapHandle 9812 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c9fcca8-8c91-4a9a-aacf-ff32d46ca540} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9792 23f341afe58 tab
3⤵
PID:8124

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.15.2096595948\1392375869" -childID 13 -isForBrowser -prefsHandle 9312 -prefMapHandle 3872 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaa8fa14-ad2e-4b68-a3b5-1b5b095bd7f4} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9284 23f34a86558 tab
3⤵
PID:10520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.16.118825023\1557719386" -childID 14 -isForBrowser -prefsHandle 9856 -prefMapHandle 9844 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89376ef5-b5bc-4cff-a651-3675949ef910} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9688 23f34dae258 tab
3⤵
PID:10512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.17.1526721783\558907704" -childID 15 -isForBrowser -prefsHandle 4848 -prefMapHandle 4836 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b452639b-1655-435e-9709-8e69c29a10d4} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 4780 23f34dac758 tab
3⤵
PID:7316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.18.703648564\1332235405" -childID 16 -isForBrowser -prefsHandle 9700 -prefMapHandle 1504 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26171074-960f-4def-8f88-95b6440a2918} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9332 23f38370958 tab
3⤵
PID:5796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.19.759323424\119717656" -childID 17 -isForBrowser -prefsHandle 8820 -prefMapHandle 8816 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89afe148-9503-44dc-bfa4-3b279dbb68d4} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 8828 23f38371258 tab
3⤵
PID:6796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.20.1528571622\1627298230" -childID 18 -isForBrowser -prefsHandle 9856 -prefMapHandle 9516 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58032b27-740f-43b4-ba1f-2a0b7b1ce1ea} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 4008 23f2f5eeb58 tab
3⤵
PID:7660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.21.651523327\166495991" -childID 19 -isForBrowser -prefsHandle 9764 -prefMapHandle 9828 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20b1f1e4-2b6b-4d81-9915-3f12cdd0bdd3} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9836 23f1e166258 tab
3⤵
PID:10648

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.22.272985066\1613868352" -childID 20 -isForBrowser -prefsHandle 8208 -prefMapHandle 5020 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8209c011-8fb5-401b-9f90-d9b87f607f5a} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9856 23f32df8a58 tab
3⤵
PID:6356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.23.742343284\2102430048" -childID 21 -isForBrowser -prefsHandle 8472 -prefMapHandle 8032 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79ffb849-45c0-4789-aaeb-a2784c1db7a5} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 3784 23f3323e158 tab
3⤵
PID:10052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.24.766009596\1859238924" -childID 22 -isForBrowser -prefsHandle 8504 -prefMapHandle 8296 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0be8393-2648-4f22-b735-d8ee78fa5bba} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 8312 23f32acdb58 tab
3⤵
PID:11724

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.25.1048942924\707374469" -childID 23 -isForBrowser -prefsHandle 8472 -prefMapHandle 7904 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05ebf50c-3b5a-41f2-a862-a0bdb03efa6f} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9204 23f32ad0e58 tab
3⤵
PID:11332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.26.539739596\822712461" -childID 24 -isForBrowser -prefsHandle 7756 -prefMapHandle 7752 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d03fd5d-5fe3-44a9-ab01-d57b35825b11} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 7764 23f31ef9d58 tab
3⤵
PID:11616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.27.952904866\2116942441" -childID 25 -isForBrowser -prefsHandle 9856 -prefMapHandle 8416 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d301b62a-2c81-4f85-818c-ade524c38ac0} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 8064 23f3177ab58 tab
3⤵
PID:11556

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.28.1856728533\992913546" -childID 26 -isForBrowser -prefsHandle 3992 -prefMapHandle 8104 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ab922a8-d59e-441f-b024-e2cfa8407f3a} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9104 23f3315dc58 tab
3⤵
PID:8488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.29.385452415\1339082952" -childID 27 -isForBrowser -prefsHandle 7940 -prefMapHandle 7956 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51f2169a-090f-4ea0-9e8e-5385dd61eec5} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 8020 23f332d1158 tab
3⤵
PID:6476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.30.460122026\1019349209" -childID 28 -isForBrowser -prefsHandle 8348 -prefMapHandle 7852 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63510387-96af-41b0-ae74-f766c2ece97e} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 7776 23f341b2858 tab
3⤵
PID:9468

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.31.1225466650\521407765" -childID 29 -isForBrowser -prefsHandle 7784 -prefMapHandle 7724 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a4293f0-e2c4-4268-a2c8-63d4dfc5be35} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9044 23f34bca958 tab
3⤵
PID:6140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10524.32.927600727\65967130" -childID 30 -isForBrowser -prefsHandle 7916 -prefMapHandle 7656 -prefsLen 27985 -prefMapSize 233995 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {225c0cb2-5c27-492b-b686-530d00658870} 10524 "\\.\pipe\gecko-crash-server-pipe.10524" 9280 23f34dad958 tab
3⤵
PID:3928

C:\Users\Admin\Desktop\Server.exe
"C:\Users\Admin\Desktop\Server.exe"
1⤵
PID:9968

C:\Users\Admin\AppData\Roaming\server.exe
"C:\Users\Admin\AppData\Roaming\server.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:8128

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:12260

C:\Users\Admin\Desktop\Extreme Injector v3.exe
"C:\Users\Admin\Desktop\Extreme Injector v3.exe"
1⤵
- Executes dropped EXE
PID:6180

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19975:112:7zEvent2428
1⤵
PID:10384

C:\Users\Admin\Downloads\release\x64\x64dbg.exe
"C:\Users\Admin\Downloads\release\x64\x64dbg.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:11632

C:\Users\Admin\Downloads\release\x32\x32dbg.exe
"C:\Users\Admin\Downloads\release\x32\x32dbg.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:9220

C:\Users\Admin\Desktop\DLLLoader32_6E80.exe
"C:\Users\Admin\Desktop\DLLLoader32_6E80.exe"
2⤵
- Executes dropped EXE
PID:9980

C:\Users\Admin\Desktop\DLLLoader32_6E0A.exe
"C:\Users\Admin\Desktop\DLLLoader32_6E0A.exe"
2⤵
- Executes dropped EXE
PID:6040

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:10908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery