cb6f4fa8f278f1b1089d848ca9e66979e3ce01b75c3fc879dc6e917a0d5cfc4e

Analysis

max time kernel
479s
max time network
454s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06-10-2024 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Debug/Guna.UI2.dll
Size

2.1MB
MD5

c97f23b52087cfa97985f784ea83498f
SHA1

d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89
SHA256

e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd
SHA512

ecfa83596f99afde9758d1142ff8b510a090cba6f42ba6fda8ca5e0520b658943ad85829a07bf17411e26e58432b74f05356f7eaeb3949a8834faa5de1a4f512
SSDEEP

49152:cvrqKk8q2gqi2OXCt6kuSw9g8PTNTN/23uxjPHEiCAjFcm:cvrqZr

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation	randomimgooey.exe

Executes dropped EXE 3 IoCs

pid	Process
4048	randomimgooey.exe
2376	randomimgooey.exe
7140	randomimgooey.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	randomimgooey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	randomimgooey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	randomimgooey.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "122"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 02dc4df1e617db01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cd514afce617db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9b5732f1e617db01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "539"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "789"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000711caefc714dfd9e6b7610546ac7c4c681700e4735a16d52268b4b0b4a59af90d94abbed3a6261d71558c17e31b0f69d1de8289415fdfaee7c15	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 5022e3aa9924db01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomain = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "539"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "321"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "728"	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Debug.rar:Zone.Identifier	firefox.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	firefox.exe
Token: SeDebugPrivilege	3656	firefox.exe
Token: SeDebugPrivilege	3656	firefox.exe
Token: SeRestorePrivilege	3788	7zG.exe
Token: 35	3788	7zG.exe
Token: SeSecurityPrivilege	3788	7zG.exe
Token: SeSecurityPrivilege	3788	7zG.exe
Token: SeDebugPrivilege	5536	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5536	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5536	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5536	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	6064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	6064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3656	firefox.exe
Token: SeDebugPrivilege	3656	firefox.exe
Token: SeDebugPrivilege	3656	firefox.exe
Token: SeDebugPrivilege	3656	firefox.exe
Token: SeDebugPrivilege	3656	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3656	firefox.exe
3656	firefox.exe
3656	firefox.exe
3656	firefox.exe
3788	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3656	firefox.exe
3656	firefox.exe
3656	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3656	firefox.exe
3656	firefox.exe
3656	firefox.exe
3656	firefox.exe
376	MicrosoftEdge.exe
5456	MicrosoftEdgeCP.exe
5536	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
5168	MicrosoftEdgeCP.exe
5168	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 2640 wrote to memory of 3656	2640	firefox.exe	75
PID 3656 wrote to memory of 3612	3656	firefox.exe	76
PID 3656 wrote to memory of 3612	3656	firefox.exe	76
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 2508	3656	firefox.exe	77
PID 3656 wrote to memory of 1504	3656	firefox.exe	78
PID 3656 wrote to memory of 1504	3656	firefox.exe	78
PID 3656 wrote to memory of 1504	3656	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\Guna.UI2.dll,#1
1⤵
PID:2912

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.0.1173124113\33282256" -parentBuildID 20221007134813 -prefsHandle 1720 -prefMapHandle 1712 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9584468-de1a-4ed3-b5f2-6d7c77b3c390} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 1796 15fa77d6358 gpu
    3⤵
    PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.1.1243460309\1197924314" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4df3256a-0f73-4e83-a13f-0442134b4898} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 2152 15f95472558 socket
    3⤵
    PID:2508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.2.472871954\903413072" -childID 1 -isForBrowser -prefsHandle 2920 -prefMapHandle 2916 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1544ce2b-8ff5-421c-9d80-28c1882c71c4} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 2928 15fab999158 tab
    3⤵
    PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.3.58805520\2100981149" -childID 2 -isForBrowser -prefsHandle 3164 -prefMapHandle 3160 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40db4bad-c9d7-4c29-a845-6772a299e407} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 3528 15f95460a58 tab
    3⤵
    PID:2216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.4.270123549\2048392605" -childID 3 -isForBrowser -prefsHandle 4440 -prefMapHandle 4436 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {323671de-e5c2-46e4-af60-31e6d09254d4} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 4452 15fadb23e58 tab
    3⤵
    PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.5.93620694\2126422974" -childID 4 -isForBrowser -prefsHandle 4792 -prefMapHandle 4440 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9178f7af-6d8b-4799-af45-6e9fd5827360} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 4804 15fadb20e58 tab
    3⤵
    PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.6.1151403631\1855763859" -childID 5 -isForBrowser -prefsHandle 4960 -prefMapHandle 4964 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8198c115-4dd0-41c1-863f-569b64b5fdae} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 4952 15fade06258 tab
    3⤵
    PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.7.480704584\1788945484" -childID 6 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {41aea150-9103-4eb5-a5af-91f1290e48b9} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 5124 15fae4d5158 tab
    3⤵
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.8.1388390801\2108753702" -childID 7 -isForBrowser -prefsHandle 2788 -prefMapHandle 2752 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dd8d3ae-887f-4a76-aefc-2a2864296cf0} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 3220 15fae23da58 tab
    3⤵
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.9.1162420413\881656197" -childID 8 -isForBrowser -prefsHandle 1556 -prefMapHandle 2672 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ed9d034-100f-439b-a651-5d0926f30c6e} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 2680 15fae23e658 tab
    3⤵
    PID:4168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.10.2101174898\587789717" -childID 9 -isForBrowser -prefsHandle 4072 -prefMapHandle 4068 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7131cc28-00dc-4284-8633-a5b89374e98f} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 4504 15faa1a6458 tab
    3⤵
    PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3656.11.658948725\1412857481" -childID 10 -isForBrowser -prefsHandle 5412 -prefMapHandle 5360 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {964097dd-5251-4964-a960-c6cae7dfed3a} 3656 "\\.\pipe\gecko-crash-server-pipe.3656" 4296 15fb0d85258 tab
    3⤵
    PID:6104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3936

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Debug\" -ad -an -ai#7zMap1171:72:7zEvent31182
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3788

C:\Users\Admin\Downloads\Debug\Debug\randomimgooey.exe
"C:\Users\Admin\Downloads\Debug\Debug\randomimgooey.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4048

C:\Users\Admin\Downloads\Debug\Debug\randomimgooey.exe
"C:\Users\Admin\Downloads\Debug\Debug\randomimgooey.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:376

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5216

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5536

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5628

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6064

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5912

C:\Users\Admin\Downloads\Debug\Debug\randomimgooey.exe
"C:\Users\Admin\Downloads\Debug\Debug\randomimgooey.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6164

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:7116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCFODRP5\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\2515

Filesize
15KB

MD5
bc3dc8cde99063e5c8967774949c215c

SHA1
369360e9befcb97b22e4b5aade0a8733a1022a3b

SHA256
9ba15fb99ec1fc513d01554072fe1de5b6949810b6154c63d573cc2ab93dddd6

SHA512
fbc9ddfa0a91ab59a196961b748d20524cf14bff5ce59d185e3d30330d78ba26da8404ef4eebf4e78abece7215a96b2971554bb5a0230d1685953652c7230887

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6738ED417ABC15DD7993802EF2A4ED577E300AE2

Filesize
61KB

MD5
bba636e2fccec34755995315365feea0

SHA1
42379031650c67eddbdb69e05e55cb0b5ea19b11

SHA256
9ca12bd9e04c46d449093b1b57db81ef9717b4113258fc336c1857b255670cc8

SHA512
cdccff412483ffcdfee8b55a29dc8b8dad53960543a10232356d400290223daff234afa84d6956e7dc44719e3dd92a3f104ea90bf3311c16330a2093a6a8a15d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\GKH8NJVT\www.bing[1].xml

Filesize
94B

MD5
772ebadbac24cc2481d3977748b94565

SHA1
ef5c61a59877b81d0f635a0cfdc90500f56472c0

SHA256
320f73ceb7c9577796045f0e11cfd536ddca364d16afdfb32b66d6325fa1e80b

SHA512
4ce87ad6b811c6e5799b1b185824e7444ce142ff900860cc6453be70fc5c9f81b05dc89889cf63d0c0892a8e0267680c0fe97941dbb7723de910978898129079

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\GKH8NJVT\www.bing[1].xml

Filesize
1KB

MD5
c3855e6ac7b97d08a03b781ff174a542

SHA1
9ce7a73744f71d6a39e20b00f2853371c5f3799c

SHA256
5dd610bf5b477a23e46054503e91c7e0a4fb429b57237182ae9ec5eee77ea6d6

SHA512
5cba8e212b16eaeb880f75a51434e8489b43f11ed567e2bd68bedf94947dd2e1da8013ff01064076a832e2928a54ebb06d5e17a41b5a2d9571ba93403eddbe91

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\8635Z59S\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ZE6UHZIL\favicon[1].ico

Filesize
758B

MD5
84cc977d0eb148166481b01d8418e375

SHA1
00e2461bcd67d7ba511db230415000aefbd30d2d

SHA256
bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

SHA512
f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
471B

MD5
2d936701bc89fd52f620842120ae0fc6

SHA1
ea719b84fea999ab078483d973773a68fe843d5a

SHA256
1eea756a4c975901e858c3ba8743f682d946af21127018c1c8c6ec4a653f710d

SHA512
4f0007aeb75671f2335e1835039483fdf9e4d2d748439c3d273ca1bdcf1518b1a05c069143d1c80a43cc3e2fdf95582f242df6f0770e9fd7115f1e0c7c30f36d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
471B

MD5
db9a44eba7ce72f926d55631a7f6f5f6

SHA1
480245c88923bce9ab1f33400d5ea28c18ee4f61

SHA256
7333d3d605375721818e5d243de781db861541fa09507a3eb418a0a11aa7facb

SHA512
c64b11699fdf2ee1b3f841c923589a0ba9b9bd356b1c5f5909794e1d397620a419fc2ffcad67873b1e62a6068157dbb7e6b5d5232ac2f8669928574cdec8e189

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
e7697241b4fbc3682b0319f987413494

SHA1
d0d85ff1ac2d97d07346f1706a95c0d182ad8ac1

SHA256
b64a2ce0fd6a86261143bc514b7baf7b85350c7df0d9eee9536ab15e145ea58c

SHA512
88c9f9ae31fbf7b88100fd9296a1389f452f297956a97f0cb069a46d19e52bcb41de56939528d100eb271f17cc32c8e9c665fafc03e39dccdbeb41d071272733

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
412B

MD5
81df580f774734cca93967310b4080a4

SHA1
d860e67d6b08dfe2318182a9799f466f116b97ae

SHA256
72443ee12d61af6482f5aede0855e6b2535de0ff2e16688689db5b5ae17faa74

SHA512
fd95518883fef3f339fcddf1a6b7d7f01d79368cfd2e29e1f657b17438046169bc40a0f810497585939ebcb660801c23b289252d400aeb4cd37f33effaa8e572

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
e5729a6a8004ffa0088527b94d566113

SHA1
4a9c38d4b26b8bc4e580b06560d93d2366f1182f

SHA256
a832f4fbdb4c94b4315c2dd83efab7ed044755ae8552f8f4016bd9055d40c8e0

SHA512
4d1c51eb8f83e26501f29f7a9acf932ba86eef0393d61878972e5c8246318cf7f865717c16a4c3955d7fe3ce9bf138337c4ac0d70221817b90dbdf3af9809991

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\bookmarkbackups\bookmarks-2024-10-06_11_JYHA1IDH37kjW2ud4k03lA==.jsonlz4

Filesize
948B

MD5
7c618c5385632ed123b3929e89a9104a

SHA1
877eef304b5bca587c7f990c0b187b1fbe666e04

SHA256
0c052f029079668e4dc8f63800c6b2fd173fd97de4739e5a66d017df726f519c

SHA512
78e0c287f8367a1fb67e816d2ca7a675cf880d1a245ebc1f4633c52a54bd7fb8ba4564d7c07ceddd9f56c9efbaadb2da1ccc928f679645b3d91dcdac7c87d64e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
a3a6df43403718e31e9aaf2de2ed470d

SHA1
6784bd8e1dfe40013c612f6faf0a706a5ac30cef

SHA256
39ed37ec23dfc6b8414443eb32c7f9b9802fd7fbbbaeaa50e073970294ee1576

SHA512
fa7de55a56e31fd86cf92d9f8f2134aac0dd34effadeb21d83c73df51e0b86eb524d2725be2f5a61ea7c9891309ac4634734ad8a649812738f4b3de334ea0eca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\1e0ae291-6b93-4669-92ab-ad29a15d4cff

Filesize
10KB

MD5
5d9a13b6725d30436df5e81b45739e9f

SHA1
e7626320aa40579d19893a0c66220ccb05737dcd

SHA256
4efd66c31ce331999054b374646e99cc9eb9ab2cc9679fc272610357321fb44a

SHA512
826f6463e8d26d97520e85dabc79a662ce6b5f9811c18eec1a9924d1c5f959b31280d4a16e458a1ad51e7691ff648cf65f766243567c837a4c6a0280770b02dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\e6aa5eee-9e9f-4adf-908b-39abc8713eac

Filesize
746B

MD5
415ff365acbdb65325ece332b642f1be

SHA1
fc0a3966b93ee536b2ca826b8da5949bf69c8ea7

SHA256
a4f154c677ff632617bf64aa8f07d7e2c5cac259dd5cc012b05b80ebf2987a8d

SHA512
01b5633a8956766547c4e6fea6c96e074e040c4e0d16cd2b924133132a24c53c6cf43320c4337b36811c9c6ad7b809037ecf660df43096f98bfb8e36ef3223b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
7KB

MD5
940d3ce8898bc1a7c396d2c298577560

SHA1
11fe4225a8ac37004abff9c0d94531800c5f7116

SHA256
5e841b21656208dc1df2a154b6a4bfa06c42cd01184d78c992c4ddbb5a39e628

SHA512
c8d741188bb714c4f28300d1bb82c7333e1a8210cb2e78facbc4f711d6edfc95db77238c95e0c8deabe097e27eefbdaedcd8d23d786079352993e7ab368958da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
246f5293360f53f1cb1a0ade5fd579bf

SHA1
c78ef4afd8cd3450e2a2496705e1218c1a1a1b08

SHA256
c077c77f7ec19bf95ba70ea12a8fe30ecc9030f50480ad364d59e6297f55fd75

SHA512
795b43272e1b28e38964f7b6f4de0ee1894ac76d4f5a35a2743c78e867a5e00d856380d34e522e8c9b168f8daf7896f158d3726993b761ce0e12cffee3fb6602

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
7KB

MD5
21003343e301177a1f218c69e90d8a57

SHA1
53e6d50474a25af12ea17a7b0a6400e4cde3b3bc

SHA256
44e6c7731d7c935cbf2fc4a6d879fa888bd3b42ab101dc74a45d1d3e0b7138ed

SHA512
72b75266aa0fec31c794c54d39f0e4a3eaa282991afe225974c1e148e2728dcc961272c947203a61576dde4d9410fd851aa39b4b489392488447e346fb25ff01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
4de0be42b0b7ceda96f78abc1120ef0d

SHA1
f47ea84bd57b567c46d457c5f1d39e831508d914

SHA256
6b0bdd2e6b1398111becb215991a05f21841acf91aa0fda4a90a425ebfd4de33

SHA512
c1f6deb716e994f7a742c6a06813445c6ce8c99f8bf5d7845f727077735742b17c9b895f496e25a09def28744549ed485650d52508ee9c3a3f9814f59de886bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
700ffc5961b808e92cfba43f3f4fee2e

SHA1
08075c56b238289b0f8204ab93d50d2f2eaf4754

SHA256
d688504eabd24d8a570f4c4e7faba0eec63cf0532e75f14ae5965996aa269eb5

SHA512
4e79d3815f404e6ba06eef28f0e940a43d98f3c29525daab4107f08e6a264927855f22418e46ec4b51466916c7480e5bb3edb21c5f53bb585cf362c91a7a4c66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
e791abaa08fda177ef1f752ec41e4ad4

SHA1
9522d113082b28334f232e209eb42c7a1ec6dfa1

SHA256
ffcff07b6bc33ad041ba2a063aab5e3ec95a851e1eef64ba36f9397c21771437

SHA512
bbc0c8430f00b5fc0324cea18689a7f8d990ef046548df11ebc1fcd8fdcc84abc60265a706df530e5ec16cd99606ea11d50d937de3a70e20111f73d2565c7853

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
a0dd8083b9a37491c707ce2ec0908dfc

SHA1
ad083bd12b161f20f49428b0c23c4ef6829e3541

SHA256
a39237d279c551b7de1e3e0c0c743297f452f3ce16f10608f79b39d4ba30a757

SHA512
b16f55dff3ed4a205920949ae0975838276bf0256dc471fb020b0b489ec721465b04344f31fc1e5b8042fc4ff877f518577033e92448806a21a9af5f8b8591d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
86dc3dfca8038c8bae3b9f679a292d11

SHA1
9a8580f5483aeaedb8d1a5cbffb423b515c55726

SHA256
3ca91c0478f7acbf721d899a9cd59dd3498d8eedfc7f2be059528ee8f0663b20

SHA512
590df84232d807ef461024a7cf1501ed7227115b53c1145bc5c124cffea2bebb4f368310c6b5458c078d47c421bb916d425b4770ab6d7fa384d7c83809597dfa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
ff3594894aca4c0d0486f049a4050672

SHA1
6b1df30b145e4bf1b439ffa23166b3fd3a643eb5

SHA256
6fe7f82b098ab743924cc0576ec3a60d37eb928552071aab140807d5f7bf9d81

SHA512
0cbdc74b4a00ce445ffb1030354408a7620705d66f1fd4d16d23079f9c0fa02b47661923db22522dc9bf50c92b0e22d8fb9463089499a2b1a6eb62c31db6eac1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
500e49b5ff645886daf10d8e0efd4248

SHA1
b19f763a826cbb46f2fee3907df3ad161894e044

SHA256
dded04ff9eb3cb4d06c158136199bf548b9b341164f2778882e25695a7db5df4

SHA512
cb692abac86a8fc6e542dc02de602f483e33a298ae39abcb77cda88a195eeffe75e61d68c2a3b792fc5a25d0ef2db1ddb96d967b2e4750dac515e0680227872b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
e3eb584716b9581a31353d0545471872

SHA1
bbb4a63cd760d3781c631497271f968eaae9d563

SHA256
605cca15f45cebd480dd248f5fde3223382ff61497dd813d8c938aaf4329f988

SHA512
734a1157a7dfd64ac4b81a74200fd404a9d8a84143374bdbf83486982fc7f9c3e18c628356db486f131b6751ef48be53af2e68859a84b819e45360276ef520e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
752eadeb62a7abe8c7dd0935bb7ef82e

SHA1
77e6900e38e86959e349bf277bb4d0f88c489521

SHA256
b6e39c853bcffd7fed62ff6f5d6cf7973c0c03e402f26f5c6a72fbbdc3f65d3e

SHA512
37baf490044ee6b69a817ead2f26d04ce63d283291bb651d287531edf43161fb748b24cd2eb415baf7ad837282e64f4d6e06acb2b0bdb351e870114c0b2370f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
1e31f68fbd855e2a4f5824d020bfcf9c

SHA1
b007f9e69741f9b3bd8fbe3bc7f1ec51fe644fc0

SHA256
795d8710052f9bd4359cc1b3111e0d60d69dde0323ec173b7a333347323848bb

SHA512
6063680dcec65cb7546bad341d932b3bf9af58e70184330ec00cfc350a0f330ba669433a41953f45dac475715bab7af7044a3009d703e2f8205d69afc3c18430

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\targeting.snapshot.json

Filesize
3KB

MD5
f5b6d852d3d835b00c4cac4426d1f2d7

SHA1
ed6e590be0d8f08e4b25a84e41a8034f7114c339

SHA256
7fe901f7ec94fc4cebe9fdfd7fa0e5cc6341fcd6ae96ed6d0c50b90cae2cf656

SHA512
941528d512b0d61a23bf1e85e9077660ee6a2413a4c2cceefe7baa2c34f7225f50df452e7181ca1cc64e4718160d668761d73b7cb52b0172251fed8725904f22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\xulstore.json

Filesize
141B

MD5
1995825c748914809df775643764920f

SHA1
55c55d77bb712d2d831996344f0a1b3e0b7ff98a

SHA256
87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776

SHA512
c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

Download Submit
C:\Users\Admin\Downloads\Debug.rar

Filesize
1.9MB

MD5
e063dd2cfad14dc4c00544d58fdc46ae

SHA1
239a736f74b01c5f098743a0c04f9ea8251b4f7f

SHA256
cb6f4fa8f278f1b1089d848ca9e66979e3ce01b75c3fc879dc6e917a0d5cfc4e

SHA512
319982e10b35e0ce78a605149c4c7b5018c83e1e6ba70ebdc904fa9c4334105a876d7a9b8e533cb7edae33eb2a4ab88d3a8873b4b8a84cc5b6f851e9b938c42c

Download Submit
C:\Users\Admin\Downloads\Debug.sbWlPT7V.rar.part

Filesize
4KB

MD5
c80c894936be665be0396de73955b87a

SHA1
10d85eb1f24188ae2f222ce75f5c070b4b901c38

SHA256
7bb3163cb2f098197d39306eede6c92155e8ba687e5dfd1b50f68803e541c480

SHA512
5056f053a60cf9061ed317247f1ab52c54f76f10152aa3a697338f1ee3dc36563a76c9083837a39ab55e5ace2b4c2d6143de67ae0aa5911aac076f88979a1534

Download Submit
C:\Users\Admin\Downloads\Debug\Debug\randomimgooey.exe

Filesize
628KB

MD5
696e624ba6409163bbb26a60aceed608

SHA1
9240eb4d53df335d534e6dbec7016cc439415f88

SHA256
a317209c1db75938b05c69ff70d8098c763e19dcb68bf9dbf7094124a0683b08

SHA512
c87f7b80edcc19aed52e7e90ee7edc24241d76a7dc63b9b14f11d9a067aafd9fedc98dffac84d8370ef6aef82f01e14732878ecd6abf446d23b4f1194e484e9c

Download Submit
C:\Users\Admin\Downloads\Debug\Debug\randomimgooey.exe.config

Filesize
187B

MD5
15c8c4ba1aa574c0c00fd45bb9cce1ab

SHA1
0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8

SHA256
f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15

SHA512
52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4

Download Submit
memory/376-410-0x0000018C8AB40000-0x0000018C8AB41000-memory.dmp

Filesize
4KB

Download
memory/376-409-0x0000018C8AB30000-0x0000018C8AB31000-memory.dmp

Filesize
4KB

Download
memory/376-235-0x0000018C84520000-0x0000018C84530000-memory.dmp

Filesize
64KB

Download
memory/376-219-0x0000018C84420000-0x0000018C84430000-memory.dmp

Filesize
64KB

Download
memory/376-254-0x0000018C81990000-0x0000018C81992000-memory.dmp

Filesize
8KB

Download
memory/5168-346-0x000001B228200000-0x000001B228300000-memory.dmp

Filesize
1024KB

Download
memory/5168-383-0x000001B239480000-0x000001B2394A0000-memory.dmp

Filesize
128KB

Download
memory/5168-373-0x000001B249370000-0x000001B249470000-memory.dmp

Filesize
1024KB

Download
memory/5168-370-0x000001B238820000-0x000001B238840000-memory.dmp

Filesize
128KB

Download
memory/5168-359-0x000001B2490B0000-0x000001B2491B0000-memory.dmp

Filesize
1024KB

Download
memory/5168-626-0x000001B248420000-0x000001B248440000-memory.dmp

Filesize
128KB

Download
memory/5168-585-0x000001B246D00000-0x000001B246E00000-memory.dmp

Filesize
1024KB

Download
memory/5168-518-0x000001B241720000-0x000001B241820000-memory.dmp

Filesize
1024KB

Download
memory/5168-404-0x000001B2391A0000-0x000001B2391C0000-memory.dmp

Filesize
128KB

Download
memory/5168-495-0x000001B23C600000-0x000001B23C700000-memory.dmp

Filesize
1024KB

Download
memory/5536-261-0x0000019B09000000-0x0000019B09100000-memory.dmp

Filesize
1024KB

Download
memory/5536-262-0x0000019B09000000-0x0000019B09100000-memory.dmp

Filesize
1024KB

Download
memory/5628-283-0x000001D574C00000-0x000001D574C02000-memory.dmp

Filesize
8KB

Download
memory/5628-277-0x000001D564640000-0x000001D564740000-memory.dmp

Filesize
1024KB

Download
memory/5628-278-0x000001D564640000-0x000001D564740000-memory.dmp

Filesize
1024KB

Download
memory/5628-287-0x000001D574C40000-0x000001D574C42000-memory.dmp

Filesize
8KB

Download
memory/5628-285-0x000001D574C20000-0x000001D574C22000-memory.dmp

Filesize
8KB

Download
memory/5628-280-0x000001D574AD0000-0x000001D574AD2000-memory.dmp

Filesize
8KB

Download
memory/5980-304-0x000002E9C9900000-0x000002E9C9A00000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads