asyncrat | d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

Resubmissions

20-02-2025 16:40

250220-t62tyszmgp 1

20-02-2025 16:40

20-02-2025 16:08

20-02-2025 15:51

20-02-2025 15:47

20-02-2025 14:33

20-02-2025 14:15

Analysis

max time kernel
716s
max time network
719s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
15-02-2025 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.txt
Size

18B
MD5

5b3f97d48c8751bd031b7ea53545bdb6
SHA1

88be3374c62f23406ec83bb11279f8423bd3f88d
SHA256

d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b
SHA512

ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6

Score

10^/10

asyncrat default adware defense_evasion discovery persistence privilege_escalation rat stealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

necessary-spirits.gl.at.ply.gg:6483

Mutex

9drIAEcerY5l

Attributes

delay
3
install
true
install_file
asdwasd.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000900000002801d-1206.dat	family_asyncrat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
337	3904	Process not Found
624	3904	Process not Found
505	2152	firefox.exe
604	4776	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-156903528-2922517348-1168185335-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
1416	AsyncClient.exe
5732	asdwasd.exe
6004	setup.exe
6024	setup.exe
3840	setup.exe
4440	setup.exe
1728	setup.exe
1912	setup.exe
2332	setup.exe
5088	setup.exe
5400	setup.exe
3016	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
251	portmap.io
259	portmap.io
260	portmap.io
265	portmap.io
64	mediafire.com
67	mediafire.com
249	portmap.io
254	portmap.io
256	portmap.io
261	portmap.io
264	portmap.io
69	mediafire.com
246	portmap.io

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\PdfPreview\PdfPreviewHandler.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\es.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\internal.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\hu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\ur.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\bs.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\sr-Latn-RS.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\mi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\stable.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\edge_feedback\camera_mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\dxil.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\mk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msvcp140_codecvt_ids.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedgewebview2.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\fr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\pa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\edge_game_assist\VERSION	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\AdSelectionAttestationsPreloaded\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\el.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\es.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\kn.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\nb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\te.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\delegatedWebFeatures.sccd	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\elevation_service.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\pt-PT.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\sq.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\stable.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\mt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ka.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\dual_engine_adapter_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedge_elf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\lv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Trust Protection Lists\Sigma\Cryptomining	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Edge.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\hi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\cookie_exporter.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\AdSelectionAttestationsPreloaded\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\fr-CA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\gu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\ka.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\pl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\lb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\nl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\prefs_enclave_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\kok.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\msedgewebview2.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\el.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Installer\msedge_7z.data	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\az.pak	setup.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\AsyncClient.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdwasd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3844	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2016	timeout.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell\runas	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\AppId = "{628ACE20-B77A-456F-A88D-547DB6CEEDD5}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\AppID = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.html\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LoadUserSettings = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationCompany = "Microsoft Corporation"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\runas\command	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\ = "PDF Preview Handler"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/svg+xml	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithProgids\MSEdgePDF	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\win32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/html	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds\MSEdgeMHT	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdf	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithProgIds\MSEdgeMHT	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable\	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\EnablePreviewHandler = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\win64\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\elevation_service.exe"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\URL Protocol	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}\LocalService = "MicrosoftEdgeElevationService"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MIME	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xml	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\PdfPreview\\PdfPreviewHandler.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\ApplicationName = "Microsoft Edge"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib\ = "{2397ECFE-3237-400F-AE51-62B25B3F15B5}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\win32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\elevation_service.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO\\ie_to_edge_bho.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\CLSID\ = "{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds\MSEdgeHTM	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.mht	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll\AppID = "{31575964-95F7-414B-85E4-0E9A93699E13}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MIME\Database	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\ApplicationIcon = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\msedge.exe,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdf\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds\MSEdgeHTM	setup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\AsyncClient.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2592	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1416	AsyncClient.exe
1728	setup.exe
1728	setup.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	1416	AsyncClient.exe
Token: SeDebugPrivilege	5732	asdwasd.exe
Token: SeDebugPrivilege	5732	asdwasd.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: 33	6004	setup.exe
Token: SeIncBasePriorityPrivilege	6004	setup.exe
Token: SeDebugPrivilege	2152	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 3692 wrote to memory of 2152	3692	firefox.exe	90
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 412	2152	firefox.exe	91
PID 2152 wrote to memory of 1328	2152	firefox.exe	92
PID 2152 wrote to memory of 1328	2152	firefox.exe	92
PID 2152 wrote to memory of 1328	2152	firefox.exe	92
PID 2152 wrote to memory of 1328	2152	firefox.exe	92
PID 2152 wrote to memory of 1328	2152	firefox.exe	92
PID 2152 wrote to memory of 1328	2152	firefox.exe	92
PID 2152 wrote to memory of 1328	2152	firefox.exe	92
PID 2152 wrote to memory of 1328	2152	firefox.exe	92

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\test.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 27113 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {691d8262-9122-4b45-a392-f18bba8333c9} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" gpu
    3⤵
    PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 26991 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {363fa19c-77b2-4496-a9ce-3ec7da6ed924} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" socket
    3⤵
    PID:1328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2816 -childID 1 -isForBrowser -prefsHandle 3024 -prefMapHandle 2868 -prefsLen 22636 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c5d9296-acc7-4d95-92d3-c10d6f90209e} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:1312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4080 -childID 2 -isForBrowser -prefsHandle 4036 -prefMapHandle 4044 -prefsLen 32365 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6655b57-de7d-4c02-9d7c-8ee7eede8920} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4732 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4684 -prefMapHandle 4696 -prefsLen 32365 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a04c68a-9def-4dc8-a95a-daca23758186} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" utility
    3⤵
    - Checks processor information in registry
    PID:1120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 5144 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98f0455e-7f2f-40a1-9582-c3b7bdc8e4d6} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 4 -isForBrowser -prefsHandle 5240 -prefMapHandle 5380 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2f8b5fe-4d9a-4372-aa78-eb82b063edbb} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:1904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 5 -isForBrowser -prefsHandle 5664 -prefMapHandle 5660 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe4b2eb7-336c-401c-aae8-a825ba7b54bb} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:5024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6084 -childID 6 -isForBrowser -prefsHandle 5044 -prefMapHandle 6068 -prefsLen 32473 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0aca6721-5ad7-40f4-96bf-757cf6d32317} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5204 -childID 7 -isForBrowser -prefsHandle 3560 -prefMapHandle 2964 -prefsLen 27114 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38b974f9-d444-4d15-ad56-5b0e266c803a} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:2488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6764 -parentBuildID 20240401114208 -prefsHandle 2732 -prefMapHandle 6744 -prefsLen 32552 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c2a7e9c-71f5-42b9-8033-8abdd57c2730} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" rdd
    3⤵
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6768 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6728 -prefMapHandle 2736 -prefsLen 32552 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d04be3d4-297e-4828-a1bf-78922884e1cd} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" utility
    3⤵
    - Checks processor information in registry
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7724 -childID 8 -isForBrowser -prefsHandle 7696 -prefMapHandle 7464 -prefsLen 27680 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9df563f1-8cef-489b-9ea6-6941e86e54bf} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:2388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2852 -childID 9 -isForBrowser -prefsHandle 5228 -prefMapHandle 6396 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {299a764f-68e0-4dcd-8f78-d618b8d216c3} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8032 -childID 10 -isForBrowser -prefsHandle 4608 -prefMapHandle 7724 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0a89668-f01e-4786-87f0-b34e51c81401} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 11 -isForBrowser -prefsHandle 8044 -prefMapHandle 8052 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90c29d18-bf94-4b62-84c1-bc7b4906af52} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8012 -childID 12 -isForBrowser -prefsHandle 5228 -prefMapHandle 8196 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a16390c2-b404-4941-b571-f26717ba5a90} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8372 -childID 13 -isForBrowser -prefsHandle 8600 -prefMapHandle 8716 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afbb3490-6612-4f8b-82a9-7eed65fcc8de} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:5272

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjdGQ0IyNEItMjQ5QS00MkM0LUFERDQtODcxQjVCOTEyNzg5fSIgdXNlcmlkPSJ7QjJCMTRBOUUtNzkyQy00OTMxLThEMzEtRkQxRUZGNzc1NDIzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTg4NjY3ODItRDY1Qi00NTNGLUJGMTYtQTE5RTMyNzBBOTQ3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNCIgaW5zdGFsbGRhdGV0aW1lPSIxNzM5MjcwMTc2IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM3NDE5NzIxMjIwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTM0MjgwMDY1NCIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5280

C:\Users\Admin\Downloads\AsyncClient.exe
"C:\Users\Admin\Downloads\AsyncClient.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "asdwasd" /tr '"C:\Users\Admin\AppData\Roaming\asdwasd.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "asdwasd" /tr '"C:\Users\Admin\AppData\Roaming\asdwasd.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp22DB.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4496
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2016
- - C:\Users\Admin\AppData\Roaming\asdwasd.exe
    "C:\Users\Admin\AppData\Roaming\asdwasd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5732

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\MicrosoftEdge_X64_133.0.3065.59.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
1⤵
PID:4236
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:6004
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7d0a46a68,0x7ff7d0a46a74,0x7ff7d0a46a80
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:6024
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:3840
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7d0a46a68,0x7ff7d0a46a74,0x7ff7d0a46a80
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff797986a68,0x7ff797986a74,0x7ff797986a80
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff797986a68,0x7ff797986a74,0x7ff797986a80
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff797986a68,0x7ff797986a74,0x7ff797986a80
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F981415C-039C-41BC-AF3C-D10CB9A0738B}\EDGEMITMP_9688E.tmp\setup.exe

Filesize
6.8MB

MD5
1b3e9c59f9c7a134ec630ada1eb76a39

SHA1
a7e831d392e99f3d37847dcc561dd2e017065439

SHA256
ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

SHA512
c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\83vcsvae.default-release\activity-stream.discovery_stream.json

Filesize
25KB

MD5
b45a979ea2eee6299984bf020c697cc8

SHA1
7d5534ba12d5ef22479a0b647c5fad30816235d6

SHA256
1b4a8bf2715ecd2cd613f294400577954d9347dd10e7966006ae5c8985ce81d1

SHA512
0b70d8fa739e0892c313b7ef58f347ee6bebbf44acf5bcf7f628dc2a9de6524f6e02fe55c403a60c44885a836ef41a6936a4290ed3abb70f5f5f01db4dcbc250

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\83vcsvae.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
a5898e4d6d5bae7e771816e2700c9534

SHA1
8f93afe49b43fdb9490520383597ad67d450cb23

SHA256
0872d1ebf52bd5577a99a449443508a0e5896b4d2a2cb457b0033cafc3c85d6f

SHA512
e35039febf4cfa854e113cbcf21f1d7824fb563d5afa8a2aa283f27a445791cadbb8471089c9deb3777009497df1ee4b125c58f1464e6a16a4109ad7ab5b63d8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\83vcsvae.default-release\cache2\entries\3A8E73145A0F79B76AEBBC3E37176AF88740610F

Filesize
55KB

MD5
32992f5c5214e84ca5eb5b9d14fa3ffe

SHA1
1e8816abcd933db6ef4d0b8af74552c20236d688

SHA256
1ce41ab6982afd1cc86da603c6af94d4d59b833d0b694c388b218102136b3b2f

SHA512
06d0b2f7bc3883ca8abbcf0c0ff8b1e40fd9a90fa26fd8467df3535e5b9a06a67984193d38c5090155f7324c59cb95b9f911a2fe78543685ef9d8903204f63ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\83vcsvae.default-release\cache2\entries\655BF3A2A93E26139146DF1A34B70AAFD95900DF

Filesize
31KB

MD5
dee9ba1c0ccee83acb3bd23e599cbfe2

SHA1
8d52b9b06285aced23de45a60d3564b6cf09cb94

SHA256
8cfa5b37ffc2749c6a4119e81531ef8344e5572e0971c2d153450ac9eb17664c

SHA512
288329188364b77b441a61a26497ad0209fa8d6b0d2f3582d97a166ac7c5e0918282f0aa472eaf05dcf84f3c840cac84b7fee167e2d0e0780bdae12ca3ebc713

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\83vcsvae.default-release\cache2\entries\B8E79A61F1EC6E3B6A1FAC2AED215AAC7BEC2821

Filesize
16KB

MD5
5b3526b8c645f940cc0dd0943e3776f4

SHA1
cd10bbde746bd4ca7ede69b6a2e6b1d86df81b67

SHA256
2c281388c94f2325abf6cc0e67124f4c6a07c2e2f298587b20253e7bd22187cd

SHA512
d83cb9f5c3f850f9af252f32ddf11997c311629aa81780ea5bc54b8acf6f2cf795a2240a9f7f8f702582892d494b8ae33d7efb07b52ba270c1c18a5ea575ef71

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\83vcsvae.default-release\cache2\entries\C480DC2E887C2EC5556F7B69EB07B76AE5666CED

Filesize
36KB

MD5
e7616bead2f750e7c0e496b0a10fa758

SHA1
1297b8e7c472ce575e34067088ba7603761d20ca

SHA256
a4f719390251b9839947072f1820d53aa5b204ffffd0f42644bf4dc84f4182f0

SHA512
d571749fc2bf199bfb3390a4116817ed6b2bd66caea2d321d5323ad24a00bfd758a4f110ed8946b0b38d9535c1c2ed9efa8fe772a13f020da8fedad825894446

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\83vcsvae.default-release\thumbnails\f57216fa82fc651689a1d75ff154f342.png

Filesize
27KB

MD5
defe476bfc9c56c8c314fcaf29770d91

SHA1
dc89e0bbf83ad92dee45ba199324bdc8d16af2be

SHA256
5cd44dd1277374ae67e006344971ad22b74533b3e0c68322b1ba958247a09b2a

SHA512
d32dfb95876f414b50e33f4d143c5429d79b4134bda457c9488cf5cfdd4496b193f907a2349432337c2dc264e5460b2676a5ba7ea74238746ecaebadf7a11360

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp22DB.tmp.bat

Filesize
151B

MD5
800a24c83a16045a9706295d3fa6667d

SHA1
d171599806ad9b5feea25ed3b38843eb7b5259c5

SHA256
b0fbff110e4d011b318692cb5eea8b67990d0315df35fcd0df9a90da02175091

SHA512
f348e2088d2dce9a0c991e4639e13a1d413c664d6a48876a211d83338b3e644a58369037bb5e44b86190382d0f89591a04b65acf325a060c3d2832f4c4fce382

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GNBNO42ASJTQ7R55439E.temp

Filesize
19KB

MD5
510c66e59d065f82183199112a1433df

SHA1
2d4aeaf83e48d5d416daede4da47b00db113f6e6

SHA256
193e5c5278b5088af6afde9143017e89723879e6095092902e2772f2264c5a9a

SHA512
2b4546c2ef436cfef5886b6ff7f83450f11b8d997937c242526614a03eee2924336128db375764daff10db966118e05a2c3aa25a32022fa8b8845055da9dd971

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\AlternateServices.bin

Filesize
7KB

MD5
8561612d4fcc50c7adf46c025b5d12c8

SHA1
dec640d4c4b2d2525def8dbff5178630b0b50484

SHA256
b247d833e85cc82c3373ca44c76ee43988539fae16bb4581a242218f06b977e0

SHA512
824fa035ad7dbfcdb50902f62b3085591af52cb6f8f17f31d0b8c73c78440d4731b01d6b004f9ba30936cf64092b87fc75f2fed8339525cc2caedf8a1c1acc86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\AlternateServices.bin

Filesize
26KB

MD5
f7301f2445ddf288025315915214aaec

SHA1
9009f5963d4320bda498b2e4f95178fc6fcf0161

SHA256
b43de293f9bbd558802142973ce47eef99f4c5371d0c2640792a523b7f9da377

SHA512
92e87e7fa026726e5fcfc3ea16ddeda7f390347095014961603a4696e68416297965a64181a3797b05dfb63e5ef00c4af6f3497ddc7137f8288d76d49a0bf4ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\datareporting\glean\db\data.safe.tmp

Filesize
86KB

MD5
9b87d008612a8a9d3c2876fca168667f

SHA1
b9d80a04c890c5b6df844a3acc68580265ba634e

SHA256
7e506f25e11f759c0b4a4f7ae2453fc0b0c18e22688bccba8a05fd8143a1224c

SHA512
1c0125c9fa028a2abe55c4da478f6d318591a76c5999df3df15b56842820b53b0705074a9b448522070c0daad21aaaabb00861079bbb20875236f46932e2a028

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\datareporting\glean\db\data.safe.tmp

Filesize
84KB

MD5
79a92bac557f8246877359487a56dc32

SHA1
25a91a4ab7f02234f4687cee7f7b90259ce35765

SHA256
69183f6306bfe42f19b8c78618d4380af5659687f262ba527413585ee56fa899

SHA512
1d7c882f81d984999717e22541d9d8f3c445726ac626876ca4e3eea362ce6e4de5be6654995c998c9d1d85f1fb82e22fcb23050b3bfe6b7f1d7478203b40bd1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
116301d066dc023af15ba4ecfcc5e276

SHA1
72b7d988f9cb95b1ad17ca601244bc4e44d7652a

SHA256
96e827ad381cf5ed7589edca601f4c1a8f04b87ae219682a95e704f4da5bab4b

SHA512
f3e8bb1ca130be922a11cf26ef2f6cbbc044b67fcf86e87d05f23b36997917a651b3bc8b0d351d2846c2964020b8f1cb752bff7de3e97d4ae0eec21ffd96f487

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\datareporting\glean\pending_pings\2477f37a-06d4-46d2-9276-1fddfeb29230

Filesize
671B

MD5
823ad0473c1377fac3b5f379ed8256cf

SHA1
ac2c31390a4cc2525ad94406fcc5032d79605a8e

SHA256
3c8d1b6902e63ca989b4e922be98a5ccb858c0efba69a66b9f3c9a5033e568e1

SHA512
707fa30061574e5cd24e9e57f0a1d90473c6d3d65187425aac5aca52f7d86d075a141c3f4b7fd93e6e38f23aa7c87977ead55622581dcae18b7053d51ff60a69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\datareporting\glean\pending_pings\b03517ff-193a-4a4d-962f-40d53e22404b

Filesize
982B

MD5
6716d3b4ffbeb46c084f9c8abd7b1b7d

SHA1
cfcb37e63119d1dde0bc7e0c48d67487f98dfb0d

SHA256
5cea3b64d8edcd6ccf78c9912a339c64023fa4718718070a7e485e30a77acfaf

SHA512
4e116f937f74c5ce423047c5bd12bb0cf25a0e5a11d142559d381beb5e288a9e751eb3f2ef90d541a5bba98275d2068add94595a65ec1ecd861e523362c19d99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\datareporting\glean\pending_pings\cf6cf084-2845-494a-a6a7-a0281286c943

Filesize
26KB

MD5
8d5d58ea5304e4229e02c435a3830f2b

SHA1
ffb90daab16076453d5ee120304f13b0767c229c

SHA256
71d944404be55076d9c27183d7fedfdeaece2470740dd7f1512a3b94394015fe

SHA512
dac2f2ee6d3d28c5bc38e0c28e028303b28bae5bf010fad96410ed96b7e77fd8a80c2fe5504d20b5c53dcc53c74a8d9455942c9a8640f74212378cc1c4976421

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\prefs-1.js

Filesize
10KB

MD5
33ee0b85b3df5e2729ab36dc603acfa6

SHA1
c0acd8becc2e66846115ef2491898c12279dc510

SHA256
1110466fe76ba5249acc6a8d1b0ea20d21412f91cb76c2bebb17bafce22d537d

SHA512
1b978e1aa778ffa7dbdbd1c28031d3643cdb3fc1e0f4a9dfabc859a83e371c1a48e0c2b19cbf1656d38a30d3ced4b6a7240d6e594637c8a466b7b844f85662a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\prefs-1.js

Filesize
11KB

MD5
05aeed593a6181662718ab90c9304188

SHA1
dc8f20efd94318c1632097aad2002eb4a3725612

SHA256
b8aa76d512e01fef559713ca63d09577dd0e277ab7bdf2b674b5af05ab310a9c

SHA512
74562fe99264e838659689d31a6dbcf6c5ab87e320a8259d952a62d6eba69da51d5150d79b173f3da503632189d478b569dcf2680776fdd005b3a31fddd9feda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\prefs-1.js

Filesize
9KB

MD5
493a2ad96041d369dff61a2bc048e95c

SHA1
f80893a924ca0ce9ef6a9bd18840c910b5fd8515

SHA256
2472ee74508ed330fafb7bc05c6df78279806df78b39d61580adff28c32d7a59

SHA512
ef75aecc1fed1b7aa4289fa89363eeb8c2fe956d867c6445966b6b6c0ed4b45121f28b79c1f96be37a090744c0a523d4f6c0e784b148a03fa91203a6f76234d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\prefs.js

Filesize
9KB

MD5
fc33a99b0aad9df3f2f768121c4ce9dd

SHA1
ee204501da2364c33d15b431be6df5ade42ff209

SHA256
b6898fc69122172cb6b57fd7372aa8b31ac5e6a7649881d9216f4faa7d2415b5

SHA512
549505f53455f48e73085fb4d7624336a6628fd014e5fe22bfb7628f6dbab3c0cbee42a876282bcce7765ff1b83813e412c25d51b8b7c879738d7820bf2c5839

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\prefs.js

Filesize
9KB

MD5
5f62b404f7cf4587ebeffb2592c8272c

SHA1
c47403015aeb0a69cf0896ec575d07daadd9591a

SHA256
4b7c57928201b0502fd3e0a2924f7fd81b2c22959a89ccbdc7bdda36127b4d5f

SHA512
22af70592a5ced01899312bcad92daf8b0cc463e2cb57e2fce81ad1b44b867adebdfc50e7a58360d74ce4202092eea00d16e8b07e7594b0c23efb637f634e2c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\sessionstore-backups\recovery.baklz4

Filesize
20KB

MD5
b9524ff7147f90f5fab89e775310a006

SHA1
2a56959d3f19da987d03c791f4694f29483ba7b5

SHA256
ce8f2e1524028e72adb9cc614bb810cec003fcc46c36281341c9a7d41eef0bb2

SHA512
a68f655b16a19a3955abe9fb004f0b45912721e2b3a7dc6b152c092dca01ccec67ede0095a4fc61be2c46d8a7923935ae34013488675dde1245d9a0fcbabcdce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\sessionstore-backups\recovery.baklz4

Filesize
21KB

MD5
191ae12b717b6e31e49f599c46681c21

SHA1
1c03a3df45e19df453151e08fb9aa791190848e3

SHA256
42495965cc14d636b452bc9bf571b4caca3cc0df430154fc9fac1e98c464a613

SHA512
fb3d1798207362a1afd61fd1d85baa2d81c912b65ba36131e05bbd798a758f2ba68d82b52cb511e27452a7cb12a984cadcf70f5ea329423a0e1f19dda30b2d7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
d95669bda58db359c6d93490775c2807

SHA1
9169d6085ccf1061073e224281ad80732fe3c898

SHA256
24cb1a0891262a3e243fc6c21fcc45471f03ee60c308f393c3e1b67fb93b4faa

SHA512
72fda62eab91b21e8fc11c6ba95cf8b76a4b0ede2344ae65d5fb26a50fba8909ae37853cdff2117e937cad00ae9e82207b40d405c4c3fdeea87292a6acbe59ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\sessionstore-backups\recovery.baklz4

Filesize
20KB

MD5
d60739b10c8c452e0caba4bbfd45c56a

SHA1
9275c3ee1eda34a7420a311db27a17c36a7aca7d

SHA256
678aff01497eb00f7d49ab79da5b4c70148982a93a183c80c1ff9478ecb03b31

SHA512
8b31dc4f36bfe30e6ed2a9ef64c0058fdffca3f57559c10be405c9d7e37c60abb5e1e9c5b71e725489975a768c3e8c64ab8097f469203696276640309bdc06d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
997b24a3de1f8d4d9f86e57f01b325dd

SHA1
5e462e2d373f41455e3777c13cae79ef0c39209a

SHA256
6abf36eb76e53e25da4dd011742c8689848abd2433a4e4dc45649072bf3b974b

SHA512
42a66f3b7046f9c7024412bfb86f0e475457c0bafb73b09ab84418670d97cd5b218c11beae2373be60f708aa52423e10384458acdba3dcd272473a13b407b26c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\sessionstore-backups\recovery.baklz4

Filesize
20KB

MD5
bf1b89be7479811504316cb52fe36ed2

SHA1
9434e596305299cd41699b623a20a9eb33d88090

SHA256
29bd3c71edb7c88673370f0269d3079020767d07067fb95bd260efcf4c293953

SHA512
607f8e23d2fdd5317401db0ce950c1ab89f3022e61b67cb5ce976306b41588ddd398aba4ebc9351f0f51a057e7fe4121d117e23f12203e7754a7fc8bf43856df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\sessionstore-backups\recovery.baklz4

Filesize
20KB

MD5
80503653199fda72f6deba6e22224c44

SHA1
34f392eb44fe85a9241254c45e3b07c5eac96a39

SHA256
8077efaf222191514214dca3d2406897360db7641e18ba34195005e174f07e25

SHA512
bde37fd4648bd5a66280cb12ea792d19e98e58522ac83fb5de7505f9fc80e7c6b067cb8f8846d440b1dfd810412c9f8c224123dc3370be02a9164ca43461a94d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
45fa5abcb5c8c76f1c5688c30e203605

SHA1
e306a33e4fb5a8c9be7f5337bece37e6d7b0b354

SHA256
76912dca5b6cb5ec76b1e565696b40d0d304265eba4a0223ab4401fd0d25fec9

SHA512
38a4cd2a6405c4dc3438bc06eb1ce2a54b5c777fe0a75b4a563afd581b67579c0d8e83a6a28ac2ec6989c08e608243103c4a9307d1a871c498b0f167f3195d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\83vcsvae.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
664KB

MD5
6dfb9e6299b9dc94bb6fbafe7f9fc757

SHA1
dfb6449613c2664c451fcf8719bdfe672830f7f5

SHA256
55f6f389fd3db7fd1d3b01d96889f4408cac8617517e53cb2e4647479a9da8a0

SHA512
d804e9758611a8931aae1d71ce59fed07284f449b08d9a118ca2fc9932cbae75e87825fba0e16e18cbd03e33701ffb3d56739f630ca006c614a7ac5e96177f7f

Download Submit
C:\Users\Admin\Downloads\AsyncClient.8AdR5xC0.exe.part

Filesize
47KB

MD5
ce93f36337563d976eae9bd272f7cdcd

SHA1
84ff6a8a4ec811ac334752644d16df40389bbd97

SHA256
c33c5dc638cd0606a9de2fa9d2de15e6106bab527624e28e69612f6fe33d136e

SHA512
96abba7a56082d48fcba1291d2f9c88fb93852df820f4b58353e6c0faf67c6ce451c4cee3ffcc30147ed171a8ae164d19a97fe65848ff3441586e07e16d2f357

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
72KB

MD5
02a117bdb8053e28b6d4f37f786b9d27

SHA1
68a5d0b29913a8fba8d058cedaaa31c86f08da6d

SHA256
1ff0a745e807dddb239e8b3b7345a20e71fab4b26ce0bda8185052cddd62a485

SHA512
3d2066f7c0f2a902d9034e332e2dc4879fe07165346050eb9f5773c209b626a9c199f8524adb46f70fe6cd3a6b5cb784958b75308ef42f87126e2df59f764aa1

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
98KB

MD5
d7f2e24f7f3f32648cea642934fc0d8c

SHA1
7757de1f30e607d003c4e57e1a010677da85349e

SHA256
919378c010ebee3f0671578473001406322d846cbc30f6641a1eeb96193f89b4

SHA512
307a08f2b2611e3172a8423d09ae9be742280684608d718773869c08f1a42fc7c23235ad824a57b07272c9d04fee0766028488e81e74757ce365e59c2e118007

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
99KB

MD5
9bec4f6827d77b66a51ca30315dc7bbf

SHA1
f984d2345b03924ac93b9604c98f2727b14ab62e

SHA256
f66903408c15ea392a43cae73e458a6ecba9344fdb5b2622f7943288bd57ddd7

SHA512
7fc1abd592e684a268c0ec7d117952448f4c470f84f798ca8ac0fd8cba9bd71562a935133b9441740703e995fc140ed680c692582facb43ed78df058adcabc2d

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
104KB

MD5
d979a86e0b541c39464f50c53b91fb44

SHA1
ce89b150b795f6892d9073a2b833757718dce061

SHA256
a23c9ab9b4f6ec2df37b11c3af43c504872a1eba7a64dc1da291753273457450

SHA512
e56a723514ac742d121405f20659d64e5bc52de37d4047b037d1bf129e6c2bc02cc460afa1b0cdf8995fab784bfa495c51b2e9fbac8779c0bf619faa76ffb0d3

Download Submit
memory/1416-1243-0x0000000005520000-0x00000000055BC000-memory.dmp

Filesize
624KB

Download
memory/1416-1241-0x0000000000C60000-0x0000000000C72000-memory.dmp

Filesize
72KB

Download
memory/5732-1302-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Filesize
408KB

Download
memory/5732-1301-0x0000000006290000-0x0000000006836000-memory.dmp

Filesize
5.6MB

Download