Resubmissions
23/09/2026, 21:37
260923-1gvsnsdg391023/09/2026, 21:30
260923-1chybade971023/09/2026, 21:28
260923-1bl9cat13k1023/09/2026, 21:24
260923-z81bssdd641023/09/2026, 21:22
260923-z7x52swglh1023/09/2026, 21:21
260923-z7rm9stz4m1023/09/2026, 20:59
260923-zs574sch481023/09/2026, 20:58
260923-zsk7yach271026/08/2026, 02:32
260826-c1n78sx1gx1003/06/2026, 07:22
260603-h7hlxsax2x10Analysis
- user interaction
yes - max time kernel
411s - max time network
389s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/09/2026, 21:30
Behavioral task
behavioral1
Sample
MEMZ.exe
Resource
win11-20260911-en
windows11-21h2-x64
30 signatures
150 seconds
General
- Target MEMZ.exe
- Size 16KB
- Sample260923-1chybade97
- SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
- MD5 1d5ad9c8d3fee874d0feb8bfac220a11
- SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
- SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
- SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
- TLSH T10F725CCFFAA00457E4F0C93030656634EF7E9A7A0B968EDF6CF52E829AC0D472517295
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad regedit.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 28 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23A20C3C-2ADD-4A80-AFB4-C146F8847D79} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C028AF8-F614-47B3-82DA-BA94E41B1089} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6EADE66-0000-0000-484E-7E8A45000000} regedit.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25FFAAD0-F4A3-4164-95FF-4461E9F35D51} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A604D2C-E968-429B-8327-62B5CE52126D} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} regedit.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3853CC31-559E-32A7-B749-89E04145A139} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} regedit.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 54 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\0 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\1 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\2 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe regedit.exe - Manipulates Digital Signatures 1 TTPs 64 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{000C10F1-0000-0000-C000-000000000046} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{6078065b-8f22-4b13-bd9b-5b762776f386} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllProtectPrompt\DEFAULT regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{6078065b-8f22-4b13-bd9b-5b762776f386} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CTLs regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllProtectedRootMessageBox\DEFAULT regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.3 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2012 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AABA-8E78-11D0-8C47-00C04FC295EE} regedit.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce regedit.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\1 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\0 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\2 regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe regedit.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} regedit.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh regedit.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh regedit.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe - System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6268 msedge.exe 4480 msedge.exe 2952 msedge.exe 3236 msedge.exe 5664 msedge.exe 6456 msedge.exe - Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 35 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Enumerates system info in registry 2 TTPs 22 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6p.dll regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Security\NTLM regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4F3E50BD-A9D7-4721-B0E1-00CB42A0A747} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL\UTF8_URL regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{DC99E960-6594-45E3-9D5D-141D825B8096} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm5i.dll regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\UnattendBackup\FilterLevel regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{03cb9467-fd9d-42a8-82f9-8615b4223e6e} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{586FB486-5560-4FF3-96DF-1118C96AF456} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{86C2B477-5382-4A09-8CA3-E63B1158A377} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{96B9602E-BD20-11D2-AC89-00C04F7989D6} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{fd78d554-4c6e-11d0-970d-00a0c9191601} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\PROTECTEDMODESECURITY regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6i.dll regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6E2270FB-F799-11CF-9227-00AA00A1EB95} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DA56F851-D3C5-11D3-844C-00C04F7A06E5} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{619C4601-855D-4004-819D-62EF5AC5FE50} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\URL Compatibility\~/CWIZINTR.HTM regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\URL Compatibility regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{33d9a761-90c8-11d0-bd43-00a0c911ce86} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4918D1BD-B497-4F2F-A429-3C3CD74694FE} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D9998BD0-7957-11D2-8FED-00606730D3AA} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm76.dll regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{51B4ABF3-748F-4E3B-A276-C828330E926A} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{55963676-2F5E-4BAF-AC28-CF26AA587566} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{974E1D88-BADF-4C80-8594-A59039C992EA} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C531D9FD-9685-4028-8B68-6E1232079F1E} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FBAB033B-CDD0-4C5E-81AB-AEA575CD1338} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7F1232EE-44D7-4494-AB8B-CC61B10E21A5} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BCC-3C52-11D0-9200-848C1D000000} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\UnattendBackup\HKLMEmailName regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C5702CCF-9B79-11D3-B654-00C04F79498E} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D17506C3-6B26-11D0-8914-00C04FC2A0CA} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{009541A0-3B81-101C-92F3-040224009C02} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8136114D-FAF9-11D3-B0D3-00C04F612FF1} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm5m.dll regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\UnattendBackup\ActiveSetup\DisableFirstRunWizard regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{92B94828-1AF7-4E6E-9EBF-770657F77AF5} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AB237044-8A3B-42BB-9EE1-9BFA6721D9ED} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\CTRLTABMRU regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a1ad1bbb-3b33-4260-a74c-5fd8bc1479fc} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{aff735eb-cdf9-4894-aa69-3e3131128618} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{03405269-b4e2-11d0-8a77-00aa00a4fbc5} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AE6C4705-0F11-4ACB-BDD4-37F138BEF289} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F117831B-C052-11d1-B1C0-00C04FC2F3EF} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{238F6F83-B8B4-11CF-8771-00A024541EE3} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eee261cc-4b3e-46e7-affb-61f297155bf2} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm7e.dll regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{275E2FE0-7486-11D0-89D6-00A0C90C9B67} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8D04238E-9FD1-41C6-8DE3-9E1EE309E935} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{928626A3-6B98-11CF-90B4-00AA00A4011F} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BC4-3C52-11D0-9200-848C1D000000} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{95a4104c-1c49-4c2a-9830-1be0f47e926c} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FEEDS regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0D3983A9-4E29-4F33-8313-DA22B29D3F87} regedit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CB4276E6-7D5F-4CF1-9727-629C5E6DB6AE} regedit.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346726851919007" msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems." explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Mode = "6" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer." explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{EB7C3541-4DD7-4FE9-8C8D-D332F2082A39} msedge.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption." explorer.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{3E889A2D-E5F3-4C65-8C42-192434141A52} msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer." explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections." explorer.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings explorer.exe - Runs regedit.exe 2 IoCs
pid Process 2796 regedit.exe 2312 regedit.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5272 explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4428 MEMZ.exe 4428 MEMZ.exe 4428 MEMZ.exe 4428 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 4428 MEMZ.exe 4428 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 2244 MEMZ.exe 2244 MEMZ.exe 2244 MEMZ.exe 2244 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 4428 MEMZ.exe 4428 MEMZ.exe 5952 MEMZ.exe 5952 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 5952 MEMZ.exe 5952 MEMZ.exe 4428 MEMZ.exe 4428 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 2244 MEMZ.exe 2244 MEMZ.exe 4428 MEMZ.exe 5952 MEMZ.exe 4428 MEMZ.exe 5952 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 5952 MEMZ.exe 5952 MEMZ.exe 4428 MEMZ.exe 4428 MEMZ.exe 2244 MEMZ.exe 2244 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 2244 MEMZ.exe 2244 MEMZ.exe 4428 MEMZ.exe 4428 MEMZ.exe 5952 MEMZ.exe 5952 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe 4584 MEMZ.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2796 regedit.exe 2100 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2964 msedge.exe 2964 msedge.exe 5716 msedge.exe 5716 msedge.exe 384 msedge.exe 384 msedge.exe 384 msedge.exe 384 msedge.exe - Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeShutdownPrivilege 5272 explorer.exe Token: SeCreatePagefilePrivilege 5272 explorer.exe Token: SeDebugPrivilege 3348 firefox.exe Token: SeDebugPrivilege 3348 firefox.exe Token: SeDebugPrivilege 752 taskmgr.exe Token: SeSystemProfilePrivilege 752 taskmgr.exe Token: SeCreateGlobalPrivilege 752 taskmgr.exe Token: 33 752 taskmgr.exe Token: SeIncBasePriorityPrivilege 752 taskmgr.exe Token: SeDebugPrivilege 2100 taskmgr.exe Token: SeSystemProfilePrivilege 2100 taskmgr.exe Token: SeCreateGlobalPrivilege 2100 taskmgr.exe Token: 33 2100 taskmgr.exe Token: SeIncBasePriorityPrivilege 2100 taskmgr.exe Token: SeDebugPrivilege 5632 taskmgr.exe Token: SeSystemProfilePrivilege 5632 taskmgr.exe Token: SeCreateGlobalPrivilege 5632 taskmgr.exe Token: SeShutdownPrivilege 5388 explorer.exe Token: SeCreatePagefilePrivilege 5388 explorer.exe Token: SeShutdownPrivilege 5388 explorer.exe Token: SeCreatePagefilePrivilege 5388 explorer.exe Token: SeShutdownPrivilege 5104 explorer.exe Token: SeCreatePagefilePrivilege 5104 explorer.exe Token: SeShutdownPrivilege 5104 explorer.exe Token: SeCreatePagefilePrivilege 5104 explorer.exe Token: 33 5632 taskmgr.exe Token: SeIncBasePriorityPrivilege 5632 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5272 explorer.exe 2964 msedge.exe 2964 msedge.exe 3348 firefox.exe 3348 firefox.exe 3348 firefox.exe 3348 firefox.exe 3348 firefox.exe 5716 msedge.exe 5716 msedge.exe 384 msedge.exe 384 msedge.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe - Suspicious use of SendNotifyMessage 60 IoCs
pid Process 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 5388 explorer.exe 5388 explorer.exe 5388 explorer.exe 5104 explorer.exe 5104 explorer.exe 5104 explorer.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3348 firefox.exe 4236 MEMZ.exe 4236 MEMZ.exe 4236 MEMZ.exe 4236 MEMZ.exe 4584 MEMZ.exe 5952 MEMZ.exe 2244 MEMZ.exe 4428 MEMZ.exe 4536 MEMZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5076 wrote to memory of 4428 5076 MEMZ.exe 80 PID 5076 wrote to memory of 4584 5076 MEMZ.exe 81 PID 5076 wrote to memory of 2244 5076 MEMZ.exe 82 PID 5076 wrote to memory of 4536 5076 MEMZ.exe 83 PID 5076 wrote to memory of 5952 5076 MEMZ.exe 84 PID 5076 wrote to memory of 4236 5076 MEMZ.exe 85 PID 4236 wrote to memory of 5704 4236 MEMZ.exe 86 PID 4236 wrote to memory of 5996 4236 MEMZ.exe 90 PID 4236 wrote to memory of 2964 4236 MEMZ.exe 93 PID 2964 wrote to memory of 3188 2964 msedge.exe 94 PID 2964 wrote to memory of 2952 2964 msedge.exe 95 PID 2964 wrote to memory of 5192 2964 msedge.exe 96 PID 2964 wrote to memory of 5192 2964 msedge.exe 96 PID 2964 wrote to memory of 5192 2964 msedge.exe 96 PID 2964 wrote to memory of 4788 2964 msedge.exe 97 PID 2964 wrote to memory of 4788 2964 msedge.exe 97 PID 2964 wrote to memory of 888 2964 msedge.exe 99 PID 2964 wrote to memory of 888 2964 msedge.exe 99 PID 2964 wrote to memory of 888 2964 msedge.exe 99 PID 2964 wrote to memory of 5300 2964 msedge.exe 100 PID 2964 wrote to memory of 5300 2964 msedge.exe 100 PID 2964 wrote to memory of 5300 2964 msedge.exe 100 PID 2964 wrote to memory of 1252 2964 msedge.exe 102 PID 2964 wrote to memory of 4684 2964 msedge.exe 103 PID 2964 wrote to memory of 1252 2964 msedge.exe 102 PID 2964 wrote to memory of 4684 2964 msedge.exe 103 PID 2964 wrote to memory of 4860 2964 msedge.exe 105 PID 2964 wrote to memory of 2240 2964 msedge.exe 106 PID 2240 wrote to memory of 5004 2240 msedge.exe 107 PID 2964 wrote to memory of 5716 2964 msedge.exe 111 PID 5716 wrote to memory of 4944 5716 msedge.exe 112 PID 5716 wrote to memory of 3236 5716 msedge.exe 113 PID 5716 wrote to memory of 4300 5716 msedge.exe 114 PID 5716 wrote to memory of 4300 5716 msedge.exe 114 PID 5716 wrote to memory of 4300 5716 msedge.exe 114 PID 5716 wrote to memory of 3592 5716 msedge.exe 115 PID 5716 wrote to memory of 3592 5716 msedge.exe 115 PID 5716 wrote to memory of 2340 5716 msedge.exe 118 PID 5128 wrote to memory of 3348 5128 firefox.exe 120 PID 5128 wrote to memory of 3348 5128 firefox.exe 120 PID 3348 wrote to memory of 1708 3348 firefox.exe 121 PID 3348 wrote to memory of 1708 3348 firefox.exe 121 PID 3348 wrote to memory of 1708 3348 firefox.exe 121 PID 3348 wrote to memory of 4684 3348 firefox.exe 122 PID 3348 wrote to memory of 4684 3348 firefox.exe 122 PID 3348 wrote to memory of 4684 3348 firefox.exe 122 PID 3348 wrote to memory of 4684 3348 firefox.exe 122 PID 3348 wrote to memory of 2916 3348 firefox.exe 123 PID 3348 wrote to memory of 2916 3348 firefox.exe 123 PID 3348 wrote to memory of 2916 3348 firefox.exe 123 PID 3348 wrote to memory of 2916 3348 firefox.exe 123 PID 3348 wrote to memory of 2808 3348 firefox.exe 124 PID 3348 wrote to memory of 2808 3348 firefox.exe 124 PID 3348 wrote to memory of 2808 3348 firefox.exe 124 PID 3348 wrote to memory of 5012 3348 firefox.exe 125 PID 3348 wrote to memory of 5012 3348 firefox.exe 125 PID 3348 wrote to memory of 5012 3348 firefox.exe 125 PID 3348 wrote to memory of 5012 3348 firefox.exe 125 PID 3348 wrote to memory of 6148 3348 firefox.exe 126 PID 3348 wrote to memory of 6148 3348 firefox.exe 126 PID 3348 wrote to memory of 6148 3348 firefox.exe 126 PID 3348 wrote to memory of 6148 3348 firefox.exe 126 PID 3348 wrote to memory of 6436 3348 firefox.exe 127 PID 3348 wrote to memory of 6436 3348 firefox.exe 127 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4428
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2244
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4536
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5952
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
- System Location Discovery: System Language Discovery
PID:5704
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ff91387c188,0x7ff91387c194,0x7ff91387c1a04⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,11056006701337141573,17804108096516059648,524288 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:114⤵
- System Time Discovery
PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,18087135948840079807,14507002904859639702,262144 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:24⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,10521517224181383809,14014275909151214658,524288 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:134⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,12176949126508700006,17307890486216504823,2097152 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,3647357135697910707,1719947699103442433,2097152 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14⤵PID:5300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,14955055095798616368,13675536759758335232,524288 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:144⤵PID:1252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,6864725144811852811,4667130446103879406,524288 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:144⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,13647293411880180350,15465039621142876367,524288 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:144⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,13647293411880180350,15465039621142876367,524288 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:144⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,16498521459779539698,9398367958798051184,524288 --field-trial-handle=2264,i,6006100543480810036,6733467826982771782,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11445⤵PID:5004
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x238,0x280,0x7ff91387c188,0x7ff91387c194,0x7ff91387c1a05⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,4477135593872873141,7951433356056494403,524288 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:115⤵
- System Time Discovery
PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,1096476508354159644,10721803231829747897,262144 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:25⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,16490117455247353611,7108683326209786371,524288 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:135⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,10508477336632181536,1833612696976148397,524288 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:145⤵PID:5568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,10508477336632181536,1833612696976148397,524288 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:145⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,13657710979395630466,2261007355648131411,2097152 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:15⤵PID:7084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4956,i,12707444672713366791,11993419634578369699,2097152 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:15⤵PID:7096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,8344701917984213263,5840839064259859882,524288 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:145⤵PID:7140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,11823783494471450704,2730293273755931788,524288 --field-trial-handle=2072,i,13276517633154109729,8052741510334809713,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:145⤵PID:7152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window5⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:384 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ff91387c188,0x7ff91387c194,0x7ff91387c1a06⤵PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,10844571722478351738,6231689574140801707,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:116⤵
- System Time Discovery
PID:5664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,13573601699082103532,15466773885127386920,262144 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:26⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,15687489192709042125,14800906130071233326,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:136⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,17015518892623044855,10710911145937713426,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:146⤵PID:6780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,17015518892623044855,10710911145937713426,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:146⤵PID:6944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,18318195936850993231,13766715317264722507,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:146⤵PID:7048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,12121670729194892230,16897492576796569908,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:146⤵PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,14675150116695604255,2524447310914506796,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:146⤵PID:7076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5052,i,16374127121204304167,1017781447850001390,2097152 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:16⤵PID:7008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,12287074011355943482,8066844096552199313,2097152 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:16⤵PID:7016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,6197355477440298182,1511118678095571566,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:146⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,6688847621904276213,1621227493814110084,524288 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:146⤵PID:6036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5972,i,7686032451214208535,1274374313764017774,2097152 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=1092 /prefetch:16⤵PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4944,i,12695862570434210326,3102089689602577897,2097152 --field-trial-handle=2196,i,12536526267810635494,6556468036689754756,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:16⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window6⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:6700 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff91387c188,0x7ff91387c194,0x7ff91387c1a07⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,15389623164014833341,5325377327693247667,262144 --field-trial-handle=2160,i,8880110058849118740,1102002376766652744,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:27⤵PID:6460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,8756754703361311034,15033683094432428602,524288 --field-trial-handle=2160,i,8880110058849118740,1102002376766652744,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:117⤵
- System Time Discovery
PID:6456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,41350673306243687,6447813456812856835,524288 --field-trial-handle=2160,i,8880110058849118740,1102002376766652744,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:137⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,9476981968553590548,2488741889251932510,524288 --field-trial-handle=2160,i,8880110058849118740,1102002376766652744,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:147⤵PID:5464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,6635449815797423254,9172353530956074163,524288 --field-trial-handle=2160,i,8880110058849118740,1102002376766652744,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:147⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,12008703721049506580,10855202549837685724,524288 --field-trial-handle=2160,i,8880110058849118740,1102002376766652744,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:147⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,5962000714113731532,14251735430902155944,524288 --field-trial-handle=2160,i,8880110058849118740,1102002376766652744,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:147⤵PID:2844
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download3⤵PID:7032
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Manipulates Digital Signatures
- Adds Run key to start application
- Indicator Removal: Clear Persistence
- Installs/modifies Browser Helper Object
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt3⤵PID:6784
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"3⤵
- System Location Discovery: System Language Discovery
- Runs regedit.exe
PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real3⤵PID:6504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt3⤵
- Enumerates system info in registry
PID:1160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x338,0x7ff91387c188,0x7ff91387c194,0x7ff91387c1a04⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,7045504478120790150,8665911632135832743,524288 --field-trial-handle=2392,i,13397871777376457637,6391053578542924754,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:114⤵
- System Time Discovery
PID:6268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1488,i,5112740657162644296,1715694357741189130,262144 --field-trial-handle=2392,i,13397871777376457637,6391053578542924754,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:24⤵PID:6204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,15901395114975572499,9960386205408784216,524288 --field-trial-handle=2392,i,13397871777376457637,6391053578542924754,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:134⤵PID:2436
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b453⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download3⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date3⤵
- Enumerates system info in registry
PID:7044 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x348,0x7ff91387c188,0x7ff91387c194,0x7ff91387c1a04⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:7060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14828773215607227681,16040662287710642934,524288 --field-trial-handle=2184,i,2684443291950370000,13509060008424091637,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:114⤵
- System Time Discovery
PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,11610733050787151890,6050001646566908083,262144 --field-trial-handle=2184,i,2684443291950370000,13509060008424091637,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:24⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,10073980606552983621,8039220255645815917,524288 --field-trial-handle=2184,i,2684443291950370000,13509060008424091637,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:134⤵PID:6276
-
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"3⤵
- System Location Discovery: System Language Discovery
PID:7012
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:5340
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5272
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:2628
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4436
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:4576
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3644
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {71eb1035-6a05-46e3-9031-0927bf541022} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:1708
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27133 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2408 -initialChannelId {2062982e-1aeb-4e2a-925f-aac15bf27529} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:4684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3716 -prefsLen 27274 -prefMapHandle 3720 -prefMapSize 270279 -jsInitHandle 3724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3732 -initialChannelId {a570d667-9546-4a41-98c7-f37bea99ec47} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:2916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3912 -prefsLen 27274 -prefMapHandle 3916 -prefMapSize 270279 -ipcHandle 3724 -initialChannelId {bf99aa8d-1714-44e3-9a66-74b140679933} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:2808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2804 -prefsLen 34773 -prefMapHandle 2808 -prefMapSize 270279 -jsInitHandle 2536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3148 -initialChannelId {13a0e3dd-f6a8-4451-9394-1f7f6c1c383c} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:5012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4752 -prefsLen 34822 -prefMapHandle 4756 -prefMapSize 270279 -ipcHandle 4764 -initialChannelId {4289bfc7-5ade-4311-869a-963e80e8bd3e} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:6148
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4984 -prefsLen 32845 -prefMapHandle 4988 -prefMapSize 270279 -jsInitHandle 4992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5000 -initialChannelId {fe30a53f-d811-4385-a977-1a8565617d55} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:6436
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32845 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1672 -initialChannelId {16d65620-6b1b-472f-9b3d-23af20ae7210} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:6448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32845 -prefMapHandle 5188 -prefMapSize 270279 -jsInitHandle 1664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {f313034f-1005-434f-9708-38abafb32f3c} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:6528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6124 -prefsLen 32964 -prefMapHandle 4524 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6084 -initialChannelId {880ca2e6-9f8a-4250-b2f3-461a623353f1} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:7140
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:6220
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:752
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2100 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5632 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5388
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5104
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Browser Extensions
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Indicator Removal
1Clear Persistence
1Modify Registry
5Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
- Size 1024KB
- SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
- MD5 38623c06e100113cf825efa6a44b2386
- SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
- SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
- SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
- TLSH T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
- Size 114B
- SHA256 81e0c234bbee0b4f7319d34b467d6d747ef5fba9476d1873c4bdd4136a4e1141
- MD5 14e9408a7b2194f494381570587c63b8
- SHA1 cda4ad215907a73a0d11d9dfe239f1ca341f8d26
- SHA512 37a7649d4f35260a30eef38bca5d6d1984bd93add861acc810a56d4ad551c02d4771f352ea16b64beb6317b34fa9cbc4581f15185a3a063079b7d9dfe1d85171
- TLSH T18CB012396FA4E4EDDE2347B8C08227109926C3C0773B330250025C041A810863830240
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\2937d632-3478-4885-9ac7-267f857d8482.dmp
- Size 15.1MB
- SHA256 373dc8b6ce3da385f9ac9c62b156597ced019e615a643e18cc6f60106d871730
- MD5 e5ee80cf962cb7ac0bef9ccd9a05ddb0
- SHA1 6d9c0efe2b8e55922c0d0ccb31c86b290e48db9a
- SHA512 55331a51f28113c72c61637c308533bd951eab937f3b4967b642eeb69896ab8a6f23d9129f8201506b9771989a97e745483cc1bf77bbc16c71a4773f8ae8806f
- SSDEEP 49152:PsxYVRg6LQm4U4pz4tnZOv7C98r37UnD/s+Spx:P/Rg+Qm4Ua4tnZSr37V3px
- TLSH T1E8F6EB7876C5851BFC6128B098FA82AEE372FC969650332BF6A1336D2D7B1550FC4E05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\72a82197-e3fd-4fc9-afb0-b20d59c410d4.dmp
- Size 16.4MB
- SHA256 c4b2428b072717d7825a918afb23ed8c7156ca506514a0ca4c19494ac282d651
- MD5 88bc5c1d186c63990050d7ad55461d15
- SHA1 bd98ce6f9b591268a72f0f18e7030401bd760603
- SHA512 f7ddda5ca2ad9f5f8586af4014ebbb01b2cff972db102bd580c30cd4bd8c2f2616b7660e7c37d0a93824ed729c1d99c6b58ae59b58b7766f022fb8b51c92ce6d
- SSDEEP 49152:xpSk6Iqv+UeZY0odj8NcqPPdI2KDml3iHwX88r37UnGkr/yn:x6JQZXodmFDr37a+n
- TLSH T11A072ED8BBC18106F07194B1AAF9A724D7F2FF958955431B3291331ABE772206FC9A1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ea51bf2c-ea1b-4d0f-998b-f24a44526b4d.dmp
- Size 9.3MB
- SHA256 613b52218b03c93c3ea01430255fddc71a6d3acda39812e3af5d048a5a7bc006
- MD5 4450a37f876b404579970add80a0d792
- SHA1 9d603b4c2f18b27920b740a40f4c15307532afdb
- SHA512 f7653d31eba8afb0cfd6813a2e1d583ce4f15bed9d2a9f83b809b23a13fab5ab5feb0e8b668f2128e6aff59450ca0c237467a5ce3c8f175df0be404b3a98424a
- SSDEEP 768:pyhbzSlDfI5LQOK5TA7hZTMguYK0t+d+cl30DT34tUfpbBSgAOASREp9RScy7:pyd+4e+cl307AOASQrjA
- TLSH T1AFA6FF13D34C117BE198037096DB6726BBF7E4619BA3075E66148A3ABC67740BD30F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 e5836884fe9bc3099c188977dd54c75e232f58cc81fcaf9be79c3d66a3334ad7
- MD5 acb5c3a60df80beb13feffa9fdfc2ed2
- SHA1 7df20087ec566e81f7dfe7652555116cfdde42c2
- SHA512 58aa18d093cc4e58464a5d4f9655af4811c6e6aea42c98d8534d271ffd91a5b0f48926c7b8f41f1ebbd1793120e0dcedeb7df62bbba41b7f550bb0709f3539d4
- TLSH T143D02B58EFD58290D832343A4035429531CFA548D5035200E090010319C01410061869
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
- MD5 e720824e80db33ac2843bf1ebb30faec
- SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
- SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
- TLSH T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
- MD5 7611be076e62556d26aa1ad65d6c21ee
- SHA1 3b62033283275e165c1cdb998b2b174841695892
- SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
- TLSH T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 2c102066815506e2623e871db6672fbb9bf37c8be9a5ce507b3505cb4fa52831
- MD5 4c0bdf80ef1710bc244116e582094129
- SHA1 f268cbe3c41a0ded58f4090e8546702813116b80
- SHA512 d7c5436764b7957e8be4891486dd4c88b8d861d3f03f37531930aa4bfc9a258b7f51dd43358791ccd3cd21e96d695e4e4a126eb2b9f80fd6f3d70fa7d0b483c7
- TLSH T1D2D02B58EFD58390D432343A4075428531CFA505D1035200E090010339801610061865
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 68fdc3ed9a1f149bead2457c5053a7696442156c849744f6c9dba894e28f442c
- MD5 ddfd266206d9f8418c6587d9d7ff96c5
- SHA1 04e0e175707700ef71aec02bfcc5707f162fd261
- SHA512 2dfd392bccf4f2819f0d1d713ac7ddb4b3872cab36e307fd10c0216fbaf07a625b389920c9db811d1f7d4241277c103021239f4eef6135a800e8beaf7adf3fed
- TLSH T1C1F0F9A9CC21AC3F18FD1B2D20545B4AEB5113672A90985B3B3C820C4FB163B8585C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
- Size 44KB
- SHA256 86df22227d15808820d784cd8d022832c1298c0ec99b8164389567cb1a3b65ce
- MD5 8289a5fe40b236e7cd934364c69d3d57
- SHA1 40eca427b8454030b9c0a73885b732f6cbbf2af7
- SHA512 9915d6675c9fbfb7b4f34909980173528a9cf4cc30367a714fa407bbaa95620f8814ba99eeac6d222cc8a73d021aef029b336bbc1b03c124dde20b1e36556a98
- SSDEEP 192:AcFObWB3rK5YgovEYaiQHJnugGOPo3jaROolQfWZ6X5PAEET8/GbgKBBv16L69Yf:zOEOFiQm3jwOMQfWZ+5IpgqXL6L69Yr
- TLSH T179133BBE33111EA6EBC3623C010F2B357771E8A5F1E9A24B4737F5D507627821A8E466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
- Size 264KB
- SHA256 40aba09109be4851dcbc0f25bb671fcde49fe5bcea3bc955227c079f48c39891
- MD5 529953f544dbf973cb724bdb9a168d10
- SHA1 1ecc0f48cb511f41477bd4a58d9d0e32f91fab19
- SHA512 424f57d786a4ce5dafff87c983d05d50475eaf6e4ca8d890c7651660c31e3136826d8d311ab88a931b4be834b7f32bc97e78c12b78b17b8d558d39ad66eaf955
- SSDEEP 1536:OahL/a+L/5zXE8SQKGL/LDg9cYrL/6L/Uryu/yv8F9eT2ome6y:OIL/VL/gGL/eL/6L/UOMomeh
- TLSH T1FA4470F71951A01BCBA802F5D2133E3ED177015E3DE1E8EAE5788CD52825B31B6BDA48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
- Size 264KB
- SHA256 52a9c62b055998e6d126bd04d07faf0b94e116e94058891beb3504f193c82548
- MD5 33d0e628db9195200494acb9800d4c0e
- SHA1 bf6ea6238ce6403ed78952674f71b97e8f765034
- SHA512 2fe8d36eff5da89be7affed923ffa2e82ebc1932bb38c7ffa3e86e7d47f8da4bc5e1e7303fed5fc14144157d212ff26110b7d01f02b9dced334544c3d5775ca0
- SSDEEP 1536:pahL/a+L/5zXE8SQKHL/LDg9cYrL/6L/Uryu/yv8F9eT2ome6y:pIL/VL/gHL/eL/6L/UOMomeh
- TLSH T1214470F71951A01BCBA802F5D2133E3ED177015E3DE1E8EAE5788CD52825B31B6BDA48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
- Size 4.0MB
- SHA256 0ed4dde1f4ca6044e47d24cea8e37cdb11daba435553022441f935f8d95fef3c
- MD5 a565b955c2d9f765406d784e0bb96929
- SHA1 e5f97d8ed90a7366b6165096341b633347fa08b8
- SHA512 94d965456976b73db3ded9d889a96e856d50237aa01980f73a3621351e05abb0b9d5f6dbfc5dac11090a5b131c1cfcb7654519a13850092decf96b55626a3340
- SSDEEP 24576:2ZWNAw5Dt2TjIUKsASkNcv70GJDmIn+Nz:qWCqJnUfArNcvQsm7N
- TLSH T1D7165BEDCA6858C3CD639A30B4F0E9477C7413C3F995D1D68C98C184026BBC5BBAA769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 320967352b2861ab9c6446703e8f4ce46b1c31f81c15ecedc9446d2770d44ab9
- MD5 221157cd5abfecb764a684da55afb099
- SHA1 c27cb45d6bbcb443751cb8d5d6c6b661d55280bc
- SHA512 6c6079945afcc7e9f1d2e40f53c588f5b5922ed3b03595a5b76755b06eee0ece9fae4c23c1f109130f63f8e0721ddac482b303a408552f41eb81dc0a952d4628
- TLSH T190613DDCF99A84A4E7A4247FB1F92D97363C5690BC839E83D1F6DBF898463579108040
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
- Size 346B
- SHA256 e10c7a27564252d4031ac91462b2369111d7b1228843ba20540d1c5957643a56
- MD5 cded228d8eb5d084dd99e7ff8bd8ed74
- SHA1 ab76bf965674ed2593898782116b75b64868f5a6
- SHA512 593f6b5b228d6ca00a743753a85e20b962daffd71274e55ccea7f4105e782073eae5a93f0a33a3d7284fc785021fbc7ed4bfec253bc1e0b80a0af4e87a50016f
- TLSH T14CE020D868C6C21D95A536C783245F4891C9354EDA8EAF031704CCC47F03081F3F6567
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
- Size 319B
- SHA256 06c31c260261be6646fd2dcbd30890af8e2e51fcfa629ea4d2dabcb49ab3c819
- MD5 4900ec32c6d32feaa059965e41a542ef
- SHA1 b54b020f9838d3d7fcc2ca9fb68775af36e6ad79
- SHA512 d152d86ffeb94a7fc73c2340f7f29a814af593b9d7dc3c2f725b29497c327287f649df39b52af3df6c20b37e6692314f85ad3fe91abb60d6e9680961f9d0d5a1
- TLSH T155E0200805C8C369E05465D343749B498AD1390FA28C3F171708BC816201581F2F9365
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
- Size 204KB
- SHA256 da2bb28d68cb519ea674e1f32e898a91852b308bef7ec9bd1809090c82683179
- MD5 27310438ecedef13bea13af45508d483
- SHA1 bcadd339bd08f92c27388959e93db7bebda5d815
- SHA512 c74d5e42d100e846480af11023361d067ab8abea77a07ec56217ed1f339cb48e8c5b846c0a772d3bbdf899e323490dac96c240afd89539112e6b9ce99d01ec7c
- SSDEEP 192:xUKcA0+G83uxXBBK31GkSJr7EJH7DNspU8:xJla83uFBBQ1GkSlC7DNspU8
- TLSH T16614430F5F743211CDBC813629EB44A35DADF03F8B5266DA78611471CEE3A52A02C8BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- Size 334B
- SHA256 77b64cb3dd36a28cce9e96d4bac782c0d3376748c8a0f4500e416f4d98c3bab8
- MD5 212fce22e5e85194e642cf4e2baec7dc
- SHA1 affe5bf45fa99d91390c57fc05d309451c059673
- SHA512 8ea64f4a52f5eb665948fce4fcd17ef0bd33e88144e4e60e4d3636c2ba9fc9311f81daaad250e7435f97d3d32b84c3ebc6516a29ddb74534c5de5f6e1faa6ef2
- TLSH T194E0D86945CEC269B14C649B8224AF4DDBE2354ED78D6F125B04BC40B249044F6E52E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
- Size 20KB
- SHA256 cdc2fbedb2341e340700afc78403047066a8065ed82b643c429c0ab465a020e5
- MD5 c4f4ad992396817a8ae9f616229a95ae
- SHA1 97f4ffb35d071afda51684c99b4e67b15b71c287
- SHA512 9970f9d5d34dcd8ae9ad861a85205b29bfa80b480bf606c00fc5b45aa1c99752946f83ff8edfc8c1276ace407dd5cee42aa9ff6e25ee7c425bd3358ce1fdf536
- SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
- TLSH T1A8928C4E5F346220C0F04B76EDD185672F7C211CD3A72A99DE5410F3DE925ABF1055AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 5b2f66a4d81edcd260e6248fddafe79edf9b8454e218f5ca02bd10c27f9019ff
- MD5 a044af2bc62a2ac2df4242484b0f00b1
- SHA1 ba6962beba5ad31733fc888c39b0ba29cbdd2303
- SHA512 09e974f7fda47cdd0ef2e0d7a93bcbdb53637bb8e4c5377aa38612e4c5cfaf29da5490f51cde8784502794eb740033c27b08dfb0972b9619623513eaa189f7a3
- TLSH T1E1319EF783F4866E8A0196F0AA18AE2FDE2D0511432C7D99C5E4AE2B93E3471D141A5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 3fef4c1ae15f36a9ac088a923d2cb4864a8ebf683095d30001967e784772fb84
- MD5 9cf4a1050ef25eb62d4ebeafa4f2e91a
- SHA1 faea71c7189b66ce9534a8a0b58787c97ce3db8c
- SHA512 73a4b1f6adc39b936cf6eb6beda6f9805473cf365021c962c22937f148bd840e252e124e4e7ec830f985f1429c7ab11241e854634862c9ba62fb5d00213f111f
- SSDEEP 384:sxZCPOZ/f9s2WvR7q++/oRW/HG58t4YZY:saPA/f/YRefh/HG5M4h
- TLSH T19552B6156D28A93B8CC7E619FB557F52E7F91032A0911E48A6FCCA2C11EB6DD220781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 581c25fd920d08e415159dc1eff87bc5bd4f48a96e36a12b78052013b7c02127
- MD5 a5a6848a2092317133fd765c23c46a81
- SHA1 b3cfad8d2223d8861b97b3351cb1dcf67158b7cc
- SHA512 8bf46367a4d7ef12d019b97976730ca93fa3b93f54f1b1f61488afd6f2f008dc888aa03f1f49fcee85654335293d8573c3d04ecf53bc13934ebc9de9cec39bed
- SSDEEP 384:sxZC8OZ/f9sI+WvW7q++/XR5/PQD/5Q44FRZY:sa8A/fB+YWefb/PC5L4i
- TLSH T14352B6196D28A93F8CC7D619FB557F62D7FD103250915E48AAFC8A2C11EB6DD220380F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 2bef9b8ebb48c64d9cd2b66087d48d592b11200e2d851aedccb4712951b3f1a5
- MD5 e5ed9fc4cfef7c1e662f2811d70778d4
- SHA1 7bb50127028f3e2ea60a74174e1a9de61603119e
- SHA512 7025ba03bc2ee3e2603dcb42424685a11835106f412c48a286f6bb0ee45b3a71941d97b089f679115875fe5f87be67f0a0ef242629b152039e25650f8d028df0
- SSDEEP 384:sxZC8OZ/f9svWvW7q++/XR5/PQD/5Q44FMZY:sa8A/fiYWefb/PC5L4H
- TLSH T15552B5196D24A93F8CC7E619FB557F62D7FD103290915E48AAFC8A2C11EB6DD220380B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 3453728521d5214015eea2fe69c9552be5091ff3669393014b2faaeb0bfa174a
- MD5 ba5a1e711013e82f076adbb7dca8bb9b
- SHA1 697f280dea88e469bc3a492f98cebf52af170cd0
- SHA512 6f3824bc231b15dff1b3d96ffa46356a36c9c67f88c08284248b5a6fcb3830777bbce87c393a5f4d3f1ae387938e9957a7116486e7fe1123aca5c21c6c0d72fd
- SSDEEP 384:sxZCPOZ/f9s1WvR7q++/oRW/HG58t4FnZY:saPA/fYYRefh/HG5M4s
- TLSH T13C52B6156D28A93F8CC7E619FB557F52E7FD1032A0915E48A6FC8A2C11EB6DD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 8833c4348ee3b8eecc74b35aeaed996039090cf58c98d9d7002ecca97213afad
- MD5 f2cfbb13240289effadfe4cab496b786
- SHA1 769f5b98eb69f977748db3be0c5fc5328b0f87f3
- SHA512 a81027448921e2a68258d68bd23633394e1a68612e330c5632330c9c2f2d52aba58451889289c6d52764ca344986295489ddd97538a10b71c801406f5c34fadf
- SSDEEP 192:sxZCRxcOZ/f9s9I1ZqMqO+/IrqzodpW/7u6+WNGY0ghDzuRUoIgjUJ:sxZCkOZ/f9si7q++/oRW/HG58v4PjY
- TLSH T10142C6556E28A83B8CC7E619BB557F52E7F9103290911E48A6FCCA2C10EB6DD220781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 08aec2cc7f8ffb421135b4849c332ac44a3b7d275608b053bfbdf416ec82db15
- MD5 c4bad1d812b9824ecd3f8ca39318bdb0
- SHA1 cb14ebac77527746c4ed352d3ef7177b54d6e6bb
- SHA512 fa99b6a220d2d28ba0d609e52d78a9f10808bbad98c535bec15c688e1388f9bb6e28718f56d3cc194a3003d5cf5559a48cffd03df54638c58a77683b040b5eff
- SSDEEP 384:sxZCOOZ/f9s1WvR7q++/oRW/TG58t4FJZY:saOA/fYYRefh/TG5M4W
- TLSH T14B52B619AD28A83F8CC7E619FB557F52D7FD103290915E48A6FC8A2C11EB6DD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 4eaa40fd237a7f8c61db343fe6b359451031d33de94c8e344799a71edd7ece96
- MD5 c8a0ba29cd15f3169fcdbd24380d0abd
- SHA1 144dd0a69c8f8ebeaf47358d218bb70a67a8ab80
- SHA512 b0d7ced928508cbd3b45790ad313d6db51c8d196ef97cf4b4dd2d4ebc969068bc3d4cb65a92e1a421d8841b7597a0e2903c70aac9f12c19132953c26eeafa8dd
- SSDEEP 384:sxZCOOZ/f9svWvW7q++/oRW/TG58W4FcZY:saOA/fiYWefh/TG5P43
- TLSH T14552C6196D28A83F9CC7E619FB557F52D7FD1032A0915E48A6FC8A2C11EB6DD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 20077b4ba73e701b9177b86d6fed41b3869b3a27bf234fea3e26b97773b94d22
- MD5 f703edd3559612e20960ed2fc237c0f5
- SHA1 f0928a55c997ce9d71a5d41c4e40a19d4343ffc8
- SHA512 dcc84efd7dae083a4d2fd79fddc013f30696e06fb43a263ed1b0a4315017c605b694edc698f482fa7b3d1c9acdedb6f60b04c596c01debd1f1c3d8f2378bfbc1
- SSDEEP 384:sxZCOOZ/f9svWvR7q++/oRW/TG58t4FcZY:saOA/fiYRefh/TG5M43
- TLSH T14352B519AD28A83F9CC7E619FB557F52D7FD103290915E48A6FC8A2C11EB6DD220780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 33KB
- SHA256 628f366f97314a1d7b5915af5c7662847496b4309e79dcb73e2d9e899a02b31a
- MD5 e95fc4df03bd88329c298a2b8d54b50b
- SHA1 1ab4f918bc10920a6d09075812b3d8978950eb3c
- SHA512 4970e0766f68dd2847faf59cdd6c176302caea7cdcb64e5eaf5fb515ca51db01dc1b8edf97f8546997ed6ff34d928a8470c60dcc44e2fd1c320c041f9ebbf6f8
- SSDEEP 768:AvmgC8Ba2P67pLuLbdtWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mHRgLlB:AvmgC8Ba2PSEbdtWRmpbQPLu1jaKmHRe
- TLSH T183F20A7B680CCA7E4FC04E9DDD267F9A6DA802CBAA98CD4447F9845C02C77EE51160DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
- Size 335B
- SHA256 3720ea07219b6d0afe15192edb50592252330e1d04bbe6ca7b83e14993fed89a
- MD5 14f3ae9e850fb71a0471cc0b06cc1894
- SHA1 e8d5f69fd237a52760dc5ed22732d3a0f06e3a8c
- SHA512 29f51d38044bb6b698dfdcb2cfe5a5079282cb2e0522c628c5707bee2dc50dd2e7e1fc23ac1e0fdd8b8b514015778be14b60c891539f14989a65a61584f0b291
- TLSH T19FE0DF2816C8C27AB059304B0224CB48CAE5B54FD2CC3B636F08BC8063C2D84B1BA1A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
- Size 716B
- SHA256 7206b53d1b0e1d8bb30d79055cc183c3e45fa237bc32743d142d5c5b433c48fe
- MD5 eed927c42ec27fd7e07e6c0bab6f0341
- SHA1 bd1d6e5810a241dd23b700db4f8ad1bf4523d22a
- SHA512 e7bf29026131dae85d95f860a6c21c057e4d4bfea6e874fb3f89be2dd201cc56bac4464560e5b0b96cf878b342ed20ec85b84e8590ee60ed2117544e3d341b11
- TLSH T15B0149F79A0C6426CE2D51F008666BE4E736C1CD028859DA975D41C724252B27C064D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
- Size 319B
- SHA256 1e2861662394892a572f46ad6a27e753fda1e94e344eb91bca4f04e8ca87eb16
- MD5 12fe14c0b51ea03d86673503f7575bda
- SHA1 3555c8772c14f927be861add2c7d1e6a9503a59c
- SHA512 5e41a32dcb9c2178caaf890435009592d2c6b86750952a09a02e6e2b2df20f7cdf90343d4c5f8f89c2ced850b86edd876cbeec7ecb74905566bb069713ee8af8
- TLSH T1E3E026A816C8C23AA15065D70234AB4E8AE2350EE39C6F231B09FC807303181F3FE1B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
- Size 347B
- SHA256 9deee9123acfdc3e171c8e44c90cf21b72a02263d22f3691ebb5a0571db98219
- MD5 d4b5d23426cb7fd9a1932ec318167cb9
- SHA1 a60f970ccf2023190ace6296feb2a8870395e503
- SHA512 83fd26dfb05ed115fddb5ed6962f386f96baa48082d01d654f56c5e347b3d1b100082bbb1fa2aa5810dd04ee82bf1e2b9c50dd134d7a3feefa1b621e0154886a
- TLSH T198E0923816C9C72BA18930865324DF48C6E2B51AD6CD6B237B09B88063465C0F2BA161
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
- Size 323B
- SHA256 73083ccbe1070522148179b29796bcad53c43329a73fbb04d4ac2748051c7d29
- MD5 a5bbd3194afd933830ea22beb0baad2a
- SHA1 4fc2f535957b11e52b30f00682a44e8a668d8e02
- SHA512 277d875a9682cb9596678f285ca04cc529744d528eb5d8e0b9ff5c6ae3d003aaaf3e56473c832fa6141f941cf1fc6c1be517d88e2a4ee7a83611338dc0a9cbaa
- TLSH T18EE0867446C9C77AA04870CB4275DF4E8AF1BD0E97CD7B6B970C7850A241584F2FE6A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 26KB
- SHA256 1ac8832abbc30e5ddf4c8bd60cb95de621967d12b82499b58332cc64cc33ae0a
- MD5 21dbb2c665390c1cc4ac86099af5e8a2
- SHA1 9f9aa2b1579ac4fd48395d37c86cfae7ae54f033
- SHA512 6fd49ef869afe12366e07c54f22608ffe293caf6e7510c19cd23a8cd533092399a4df42d9f7465732a15b094c085ad45f20e28624677fb99a649484ecf467b0b
- SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAg8:ohdNdBzXXFPXgRbKvtp0JlznMl5bP7vs
- TLSH T144C2551031BA12543CBE394890B5AB2F52823577711CE62B7FFD10A68E6BE481DFD9C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 23KB
- SHA256 a87269de28612b991a12fe3daa5a9a0f440098c3402a06b151ed47202611c6c2
- MD5 e74e0e7e3d73b78aeafbae7b45a8d628
- SHA1 392426a5444feb2ed017f22f1942ee432d01de3d
- SHA512 68ef49294fdac3bb5717a36f18967c72c2ab433ee11c95c0826ba3b86f13f451a708b1479a10b2f9d661e13420f4914605ee8ecfafcc7cfdc0e41dd7b5ad8580
- SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgC:ohdNdBzXXFPXgRbKvtp0JlznMl5y
- TLSH T191B2231131BA12583CBE290890B59B2F52823573711CE62B7FFD50A68E6BE481DFD9C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
- Size 224KB
- SHA256 92023f5059248e6af5e124a6987cb9ce301270415f1dbcb1d08624010d566710
- MD5 7308ae87ee0c67e18688fbd1b7b1538b
- SHA1 7c3b8a20b88168cecd7143cf4f97f9daa2c08979
- SHA512 dda311fd116d86c94e1004e602708fb43eec5a26c31b18f6d06365c06ab956feea040f5a76e98d39a56c21f31dc65bdc19afef8a2d1c3390edd37638587980dc
- SSDEEP 192:FvoWbsDofT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aafQ0JQn6lLfzAivuvBN+wtP2s
- TLSH T15124540A6B747001DDE7D9725CB080771A3CB16ECF22A6915DB254698EB3853A23D8FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ade07c3c-3e51-4ab5-a648-021229c5f4bc.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
- Size 13KB
- SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
- MD5 256c40bace492c4e28451ce149d2f9ac
- SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
- SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
- SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
- TLSH T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
- Size 2KB
- SHA256 0ddbc2b54cd3b29e3d22132306e172f46bb7479c22480bdfb96dded07db1fd41
- MD5 5645eb041adb09737cb678486caaadbe
- SHA1 a92ba7550e591d0fbbd2daabc4be0205d2e25107
- SHA512 7ed6df1ad109eeec820f70a41a28b0e62aaf9ffe960a6b5ed452e92e1fc03600929c3c011d7397a45770d6918906775d5f7d770fc329ddbdfbd0163e8d8de72e
- TLSH T17E5167C0B3E964987F89A981D11A6907A8E13F6E260ED972733E54F84F448191F7FE31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
- Size 88KB
- SHA256 999445b94ebe1fea58e131b4e4c2210b041aa729545be82089779e19524747a8
- MD5 7f4de760af0fb8fda28d65349fb0338e
- SHA1 e7c58773b05134ee7c654b742144fd920c638138
- SHA512 64d3abcd190250bef0b364860c721cf4f24ea0430887a02d29ecde43f0f8583d4fb5e13c4c3afb828978acfe3c7653d445cb1a69f02ecdd689f83fd94174110b
- SSDEEP 768:Avo0J5F0OCEEvkix1g5XCvfbfqgcB9ltSzbLfnvO827wzO7W+SRBgyY0RzoBVz/P:nG1blhFPp5
- TLSH T1B593EDF7BC09E1A6CDCDA5B8D407FF44557306268628D8E4AA7C08C33B79A027DB56C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
- Size 13KB
- SHA256 ec16ec209fe69c4f264cf32a1a9492fdf158824221b627b9086455fe1abce63f
- MD5 5795509d17f66c5d76fe4f9a8e9df202
- SHA1 5849705dff596825202e3cc67ef1779433f2953c
- SHA512 a4c9bc18cca30725fd16e02e567be93e964db6b535a77188274f719f4e2d2433ffcf3a770fe1a3a7f2738953d38a23686988f240df5c12265f1efe01d250213b
- SSDEEP 192:EibOfxAsolrNwQ2sRe/OYB4QQIIIXbHMIMxgYcYI:EbfysKl2so8QQIIIXbHMIMeBd
- TLSH T1DF52613927151F33C05E1BB6132A4B9657D8898181BB226D3562180FADF2E57C6E93F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
- Size 319B
- SHA256 f0e08130e3ff0486486ab6a85dd05dd8b757caa57f651aa1d457469cc9450bab
- MD5 b4d4846c76dcb5aa490b8086b11d2a4d
- SHA1 dcd43fbd3d29595cd480a1d86b93c85505623b62
- SHA512 311fd4b01ac28100fa95919c5319855f9f0efbc5bd1f9064f9a1fd36c7e2b798a1c303f95231da75338e40ecce612935cb4b6569d2c66fbfa10d87f0666730f5
- TLSH T1D2E0201899C5C26FE05424C741348B8987C9350FEA9C6B571F00D8446141144F6F9162
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
- Size 1KB
- SHA256 681f4ab4b7f4d39a231d5b2ca5f739cec7e31cab954306cf9157eac986451987
- MD5 eea40b1709764075ee24f8db02a4dba6
- SHA1 f1574fe10c72ec659a64455b47deee355db28a88
- SHA512 f20c562cce8faf428b001d83302d82c8dd091cb89cb9c0c60f73e7f639a28d6e73658a55b8ef6283c054f1bed4d060c10694a5970104c86e1c27f844b58ca5ea
- TLSH T10421EF56F334C059D14E867DA02F97261338E8069FFCED0F847924392EB2A041E8BAE5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
- Size 337B
- SHA256 dc41745ed0246cdb07e48b5fb66b1370dc7642dc2b76a2670c927e8a51a799f8
- MD5 ba677b35ade93fc7940e99715568dc05
- SHA1 4c4579149a305ce5d2317d7abfe4b7225f9181cd
- SHA512 a42d25918b134e61c4ca9a8f5861f64d3a4e85b0e23da77a0a1d4b6eb3f051a31c608160fbe587ab44d5cfa2612e3040a651ae66cb5294cc3a210570fbb6b604
- TLSH T1A1E0D854AAC4C25FE15520870164CFC9C6E2394BEA982F521F009D8C5305181F2AA1B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
- Size 264KB
- SHA256 9538ed057a7c1df5836fbf34209188a63dec2b21c5d7bf663a103bc1fbb06153
- MD5 db098ca85404eeaf04ad252b70ef555b
- SHA1 e3f3110ce821e8cf6bfe524b0ccd330fbeef8adf
- SHA512 2de2335208a8d38598590c8de37feb6f4e087aa2be421d74f969e513fdca93d66cad10ad9be61454c9b4ff958597254d13357566040504a8552fb49ed1f2e5e6
- SSDEEP 3:MsEllllkEthXllkl2zEfl6r:/M/xT02zRr
- TLSH T11C4404047FD43507C70010304051C3501370DD501D11D747F4D14433FDC75450C00000
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 b9ae3b46b30e1f8ce563ec503faa8dd4299b9b7f9253cb56b86ee31adb8dbdd3
- MD5 59cf102f5821924c3991a327e2b015cb
- SHA1 1f15daca326b92bd2794720acfcb158192397573
- SHA512 2ef452679c1f3de907b1f3969c19245c754344b9ec161b5480497516158570b57ba4b3af9e583454a621e0568624a268b0de943bd757fa65047181aceb2615bf
- SSDEEP 3:MsEllllkEthXllkl2zEfl7CcKX:/M/xT02zcC
- TLSH T1A74404447FC00405C70010314153D3541370D4101511D74374D144335DC75C04C40004
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
- Size 120B
- SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
- MD5 a397e5983d4a1619e36143b4d804b870
- SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
- SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
- TLSH T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
- Size 14B
- SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
- MD5 8297da058a737611abcc3a0ede9ffc24
- SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
- SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 31KB
- SHA256 d94800aa9bd43179a9c34da87ce1a5463604032d0c01801bcdbeee5826c1c74f
- MD5 77818eb7935beb4c5a06bd3f17508b3a
- SHA1 b84d321a2fbd842be7fd28e0a081ea6e8b5cd72a
- SHA512 424c162eacb5aa7f4f72107cc3ecde6a86693fef2a78a44cdf9ea9f8d8fc4bdca164592faacc317a78763af13aeff2649f85a0fc974ce1460f0ce27dc14f26b5
- SSDEEP 384:nniFKZcI68Nd8TUNTUlIRMCC7AZqxzyfoBjWz0Ra1TU+j9vrA8HLAL9hpsa+VYIv:iFo66wgdCKAdBS7TUM1M8sL9hphgzYY
- TLSH T134E21871D890DDEB98EACED6A74AF502ADE40173848C998CD5F97D3D209F5BD030782A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 f614141c4b3f54622f617fa192123d4150e9b33688da4a18b1e3251b901f7996
- MD5 7a1042588be885ff21cc39a12d028941
- SHA1 34093e7078911e6ba2f809246d3e4ef0c3febb48
- SHA512 5eb60f60311c4b2221567cfd1b55171beaf62615f2de7b1e3451c50a47d839ecfbbfac7b57b822a805a20e9af2502af453b272e17bedf08048d5b55bdda93901
- SSDEEP 384:nbiFiZcI638N98TUNTUlIxBCC7JzccxzyfoBjWz0Ra1TEQAsa+VYId7ULgL/7Izd:2FQ636wgCCJcWdBS7TVAhgzPY
- TLSH T1B3C23A35EC94D9BBECEB8FEAAB4A7603EDF01153949C5AC4DAC85D1D009719D0307C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 26KB
- SHA256 58d5ec73419680ea01b03bb8ffa6600ee900f527be452af82a029bb9647d569e
- MD5 0a4b2b234227f4eee687e00fe2be7ce2
- SHA1 5401cd7ee2b785849eaaddf44ff7460b4c200410
- SHA512 37a2745ece5909cd8e513727daa59e3ef36037e1c1d6607108aee5b09411ee9e3bca374a3e2dc73c3c48cd379942024c49debcc99fed9d50de6f74e04aa287c2
- SSDEEP 384:nniFiZcIJ38Nd8TUNTUlIRMCC7NgqxzyfoBjWz0Ra1TU+j9vQsa+VYId7ULgL/7x:iFQJ36wgdC6AdBS7TUM1QhgzYY
- TLSH T139C24935ECA4C9BBD8EB8FDAB78A7603EEF41163948C5AC4DAC95D1D009719D1307C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 31KB
- SHA256 737b336eec9b67f9ceb0a45cf342b21ecc809019e58598dec6916abf2829f579
- MD5 646ec167935520aa5470d46c6b9a0443
- SHA1 742ed6aa8ff88a6e2e63fe809688fddaac9e0c56
- SHA512 0a5bbab9ddc5980a8cf6e6ca0870730796e6aa89487423d793bddae9eab228b1c998cbc68d28a9a714b5616a5289b8384fb9308d4a5238e4ce395f455785d2dc
- SSDEEP 384:nniFKZcI68Nd8TUNTUlIRMCC7AaqxzyfoBjWz0Ra1TU+j9vrA8HLAL9hpsa+VYIv:iFo66wgdCpAdBS7TUM1M8sL9hphgzYY
- TLSH T1A3E21871D890DDEB98EACED6A64AF502ADE40173848C598CD5F97D3D205F5BD030782A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 ee4348e03c8f9c071fc13cbc8292bd15db961e49fbad4a98e5f9193c92a325f9
- MD5 182d54e4a0d462c08a7fec487f5af162
- SHA1 5d5b580660d7508d72c80dd9ee8a7d6798080f3a
- SHA512 d4339f1cf68414934348d7d3303991a66cd4d101d43453a79410f8b60c67c4c6b6cbf14ecd7e7a2f8d583392c6d933f6230803ba851c8c22fbcb97adede8b4c8
- SSDEEP 384:nSiFPZcIM8NJ8TUNTUlIRxCC7u+qxzyfoBjWz0Ra1TU+j2rAsa+VYId7ULgL/7Ih:ZFHM+wgSC9AdBS7TUMsAhgz3Y
- TLSH T140C23936EC94C9BBECEB8FDAA74A3603EDF44153958C9AD4D6C95D1D009B19D030BC2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 31KB
- SHA256 8cc6a55d6b4107eea7cbd91e66d17c4f7325721fb348e1c054a4f4883e1a671b
- MD5 2260cd48cd726ddc78d78a4a817ff76a
- SHA1 b25ef7001820256977b4d2e8a66388fb53680152
- SHA512 870f8fbb9c50738ca61c0cf810702a4c26df4f3e6b0b9bbe52f216839d311c6be737d664f96144a6bd73052deb318902a93fd2451c3c96f14fcc38f142ab4911
- SSDEEP 384:nSiFRZcID8NJ8TUNTUlIRxCC7utqxzyfoBjWz0Ra1TU+j2rqW6Ln9h3sa+VYId7o:ZF5D+wgSCkAdBS7TUMs0L9h3hgz3Y
- TLSH T17CE2273DDC50C87F98EEBB99A74E2652ADE40173D8A89998D3C84F0C807659DF70781A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 994bd3fac491a5d8fcd3be918f549980be36060f66f1ad350d9472c6ee274785
- MD5 54a7869dc517375d7850eb58834346ee
- SHA1 5ec56bd39de8105f95261190862284a862e7a752
- SHA512 41ee84ed386bec882ad2e78d10eae631c0c56530c6f744619b1f686c1cb6cba228b4e45127999085aa5e77b3bdd28b263e5f86cf2586158b5ba799d7116c62a8
- SSDEEP 384:nSiFKZcIy8NJ8TUNTUlIRMCC7I0qxzyfoBjWz0Ra1TU+j9rAsa+VYId7ULgL/7IW:ZFoy+wgdCTAdBS7TUMpAhgzGY
- TLSH T10AC23936EC94C9BBECEB8FDAA74A3603EDF44153958C9AD4D6C95D1D009B19D030BC2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 5b13c84acce90a55fd633d397fb4ee1cba9aa54f5073d2a6eb58f5372f944e85
- MD5 074d3fff207534e1fe70cfc9c1975ada
- SHA1 d025214d722887f1c4d26017b295e2e34f9c6cfc
- SHA512 d3585bf020b9493d4321cebd97f426bbb1a610952e1ea6d323ac6b46a16c735243b8e5675f5351f9718754eed0ac7b73fc6d805eadbb1844e6eb5e51aa08b3dd
- SSDEEP 3:MsEllllkEthXllkl2zEfl++t:/M/xT02zGt
- TLSH T1184404047FC40C05C50010304051C3F01370F4103511F74375D145375CC75404D00010
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
- Size 87B
- SHA256 c7209c3eb51763e3139fa0a5e5a1d18b610932294b507ba5d043658e45953727
- MD5 8e0265073c65dc7491c8b6eda0b62e0d
- SHA1 b75642618bae1886d9c426b5183a13da6c21acd3
- SHA512 45b190ca41357baa1dbdeff2b123d27428be4c2dd69cb88cb6070f5d6abe9a7728f47fa2844592b192c17961580225348aeb1ec270e161a7422c1a8b71a239d8
- TLSH T168B02447C473C00FF41440D1C45C03C114F4C047411DD0015070D31314D40CF03F5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
- Size 68KB
- SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
- MD5 88bf35a77b25e16c2037a71dfa6c2ddb
- SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
- SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
- SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
- TLSH T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
- Size 12KB
- SHA256 85f48f48696f8e8c511576083ca457b262ccc739a56e30920b1bc189cb4e2fd9
- MD5 54bb90e7c5b50e7e760a47e407ddf802
- SHA1 dabe8dc7f2298430a382aa12044e7e6ca86aedeb
- SHA512 0857659c081abab7666dc72155e094c08305f2e1e4996b30120b524acbff3f1932069c4e8770361dfe6807d7a0632452aa3ea2374ffdfe95b809911ff0679f9e
- SSDEEP 24:Q40C5fsqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwj:tpsqp/IHRH34kWqB1kQnjhHmr6ITmUQ
- TLSH T13342786EDA2CADA2FEE00B3ED7D1D0127B36AA0EC2E4D9F1495B505746C440405DB63E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\activity-stream.discovery_stream.json.tmp
- Size 75KB
- SHA256 e7e9960b8e1da3348ef21ff1d522ec06272a31b4b8e9353b131132fd1e8f7f1f
- MD5 959f0ee2e3d3f68a4fdc49113cc0dee7
- SHA1 c5464082d710764fdef83db04056a80303260421
- SHA512 1cb1ef7ffd76a866f9016489391b614850460b247eaad3984837a081584568e46ad3e185df17b7fdb0df494ac3598f1310d000132bbf3593e0e9309179637550
- SSDEEP 768:Byz8cS84kHmv6RBJ3h1Oj515BiYQZLs4iOOrHO1+GFJ5g+t:wz/Av6RBRh1ONTByZQOsGFdt
- TLSH T1F173E8A3E6A8B1FB1BD137CB2C0F795B66E10186E34505CCFCE9C91C81DD694123A6AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\compatibility.ini
- Size 198B
- SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
- MD5 ce9ef13caa8a74c25157b184aa038475
- SHA1 db03a9935d8bb3ce6b120aca98feade536805160
- SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
- TLSH T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 4541c8134382784d0457c3b08441a36442680f5791212cc6f9e07c12b587c9ec
- MD5 826375b3796ead45485b9942330c286c
- SHA1 e1ae1be4579634559054067a1596cdb75b579425
- SHA512 25b1fffb116121c0b74ac8aa9bf8a06447d94eebd01b90f7788b9fa46c8e9632912365ebe5867242fe08f5c05229a738d9b7b5c8d3161bd26fbf1f571ec784fb
- SSDEEP 192:KkY1d66Joz0dzgCl6mc0doOv5zboHZyFyjEx:ed66JozQzgC1jtboHZyFyj
- TLSH T12ED1FC68F639463FD408423BDCA61B400F35398A989E7F1931AC741C2D5B2DE769E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 7cdbd80b8edb02716463f872cfded4f692174f0146969f486f30854a474daa36
- MD5 0e97ca5a52c747471bce3c4fbf37e140
- SHA1 a10571ab754a487c3a650e204ca09ad574b0db82
- SHA512 003f4d84e7411baaeeb02e9fdb0c49ecf25176f8214126e2ca7881769ba61fff85ea6faa3534060cb52e536bb6d5966dfe2e8934b3c350362e75986c2d82f5fd
- SSDEEP 192:8km1d66Joz0dzgCl6mc0d1Ov5zboHlyFyjExI:6d66JozQzgC1jkboFyFyjD
- TLSH T1AFE1FC68E638463FD408423BDCA61B400F35398A989E7F1931AC745C2D5B3DE769E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 19d6fff1fe22da10d5fc921259a483d9d50265f2bd74dfeca737221062c23797
- MD5 08f476b8601a0086f2ee5aa534dabc5f
- SHA1 ef30c24f29ac0959931bd9b946a11193a1f721b5
- SHA512 3ab1f6e35419a4c994eb71151db0a926c1bd56fc1d1e755cfc0be1dffbaf337ba87bf147185656e73b9e61a90312993ab816c48e85cfc4b741b1237249caec3f
- TLSH T11D217F9C3EB84D2A5CC7FA5C784101CE57E58D0615871C431E43DE8EDD85AD532AE53C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\01911ff1-7011-4214-b492-73a5a967c9a3
- Size 2KB
- SHA256 39ee9fa73459e2cd758bae6c951224fc87f6338130ea968eb3d856294794af3e
- MD5 bccfa512d94bacf531c3c209af1dfc70
- SHA1 0edb0c54a0c969df07ee661a0aa992b87ce555d9
- SHA512 c6627003f9482430dab88b57dffb9072d7ef4943526a7e0856cc17361f4c81df8cd6293174f3eca3e7af7325ee92edaf60858175217f624e7e3e11717247ec47
- TLSH T11941115CB5B84CB69CCAF59D9482334E53704A5300C62C836E51EF0C9DA66AE737F517
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\050194f0-350d-4c24-899c-53e5f5667b12
- Size 235B
- SHA256 beb96b0bc05f6eead3ad09c0feb66c28deb366446dab2202450995cd02201fc1
- MD5 13e765e1459e090f90c94feb897a9602
- SHA1 8438f8584dbfe0df8293f57d98b67cabc2fcfc3a
- SHA512 3c08427e10799031261d7682acd58ce72a9aa560380d2fd54f9c553d6feb551a595860d54275afff4c8ba96ccdd724e83ba64e63c13b7aa1a7f3853a389d64ed
- TLSH T1B6D0A78525D86F6D98144F07F0F0ADC631554C3314A858509A95457899F9DC4416595B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\1ca1e5ed-8f92-4d78-b31a-0d8c2b0a3511
- Size 235B
- SHA256 67018d8ce981694ceeaee4e49f8f34c4b66fd94fd8ffe3b57d79f57d16c5cafd
- MD5 c406a1b56038904576c37345a4ef4b3c
- SHA1 10037ea1f7fcb945ae7e5f27017ed8eebc88e0be
- SHA512 ee797cafbd493e1be2c89d305e15d3ab2a426badba4959f4a6ac1031d1a86b19dbef448903174212fadfc96e4a0542708812afb84b3af1afbc1a68f420921199
- TLSH T1BDD097C41CA83BAC48201F0AB0E069E370884C3320E0A8209A9245B48AFCEC40222806
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\1d6d0773-7fb9-4800-8e43-cc49cefa4605
- Size 826B
- SHA256 2d33e49f8902f170c563cb09c7ed9050019772e36c9045ca436a771153979510
- MD5 b56a1ad89a450d0c540f44172dc1dd3a
- SHA1 dda506a23130f2221d62be13f22bd3d15cf25968
- SHA512 0458f6c41200c49983aa37cd1414506e6b8f845cd101a953b04fb319ac082a23f8dc1e87737bc3b548921d758cfa8a0af371c2ccfa4c0cd309f17c929ab768ea
- TLSH T12701AFD197256423BC28D24FD551770B62A6B532C0CA85053EFC49250EFB43F52B630A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\1ec2f376-c2d4-460d-be86-309cfbb4ff78
- Size 886B
- SHA256 87aec5038b2925e21972973c186cb5bf8d48d6cb5534ab7d16c94f5c2f242077
- MD5 1dcc8d35e1c03cea6916df00b835bb9b
- SHA1 fdc602963946b0af5afc78519627824ac0f31aef
- SHA512 324a521fc099339451625607e28651b1134a1575ff0b7284467218f1e1ec6cb9fa80c2fab4d670a2c6a55ce0d907c3dca3576a4776553c28508335a9d94e9771
- TLSH T14F114080D778B5B19C28E28B9AE173424BF47563C0CE4D083D609A184CFE56FA3BB607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\3da5e605-55f9-4705-95a1-05029801ad98
- Size 16KB
- SHA256 7fa8c0990dfc70693795ba8b15138ee9ff085690c9387dc8ad950c0937eec0b0
- MD5 a53428be904339f80aeb0b3fb12852e3
- SHA1 5cb31d0131fb254ca0ffcf8177210a77ad6000d4
- SHA512 1bb4dd3734f28623d2b613295d7ee33367eaaec88d46c9c89fce3e0869f8eb52625e411ceb9d11d02f2de878d7c34dcbefd2cce91ccac10902d27c58746e868f
- SSDEEP 192:g8SQ0sSzx1M26B/IKcZaOC9LguxV219B6NqZbEhS4V091Qr0osDQ8OQOFeaSSPLj:wQ0sSl1v6SKcZaOCNge+cQ48dTW+EfPP
- TLSH T11072D956282045BA8691E36994F87FC3E6F53CCF4C019FCE9BE4BD0869DE06E512784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\ca4ebba4-3299-4e5b-810d-f6ca2b7bec87
- Size 883B
- SHA256 647ff4f7f59eff213f1c4d2c9196a6bb5e4abcd917654e4a9f1fbecc48a2adba
- MD5 217488600209e5b0c9c04e9cb2c74559
- SHA1 5881579ba37f460baec6a3830bf89bfaa0f05ba6
- SHA512 e88d473c07eac08d1a3fcee60d9c628d97977e30ccf2b0d9e43e53e046824a9294b3626518622c735344872cab09140115747716c4cdd911288d942ac7f3052d
- TLSH T11F1100C0963575B1DC2CE24BC995374267B4352380CA98083EA499140CBE62F93BB307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs-1.js
- Size 6KB
- SHA256 46e08b607180d63389c6ac4272b7024f15538f3ecee2b0aa7efbac62b29a6b56
- MD5 adc799d743017c0529242d4c4d195407
- SHA1 e1f6b5444037c4d0bc4a02efcfee3a7b36ebd076
- SHA512 ae39ac97aa3422c6bd798f2845e7ce630d10e2e930ec6863c0c552102ac9ba375ee0787d01474c6a959528db98788e0f7c45cc58c1cf70274a5c1763e24a16ac
- SSDEEP 96:xHsUTUSqGqnfSHD1zSpUGSSlcdv9jnJnuH6tZBw88H8L4cnGLEcGS:WFRnfSHDUUGSSA+yZBw88bj
- TLSH T100E13E7895088F7F74B677ACAC6888315AB2013BBBBF68C750B55485054CF3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs-1.js
- Size 7KB
- SHA256 027c7a62935bc6b5148c2c835d38cc6ecba2d501c345db289ab2fdef7b6d43d2
- MD5 78c3eaf8af21d306a917ba35a873b44e
- SHA1 0f83ffcf3b5c8efb1c320c680a6f4060330b8834
- SHA512 77b358a1a3b9cd97e8571042fa8bad924c81b683b468c8fb909eaca244b9cb87fe3edbc981880994153e15d3cd0290e9ef4558ec03ab8010ef656c478752405d
- SSDEEP 96:xHsUTUSqGqnfSHDNbzSpUGSSlcdv9jnJnuH6tZBw88H8L4cnGLEcGS:WFRnfSHDgUGSSA+yZBw88bj
- TLSH T12CE11E7895088F7F64B677AC6C6888315AB2013BBBBF68C750B554C5054CF3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
- Size 6KB
- SHA256 ec0be7539336b00cd5b080c41c6b4a26ce33ab15e65c9d0376ec1072d68ac49a
- MD5 f5f9905f1fc9e526a53c1111dc2400c8
- SHA1 4e22cc70f56c9aa8b197fd6be0b6aadfdc93a0a5
- SHA512 0998b628dabf8f62baddbea6aa7853a58e4ad14dbf52de8d2f558582db33187afc59c4fa89ca35c71898843e7ead3cfbd1b975ee268a4caeee0441bb17292d66
- SSDEEP 96:xHsUTUSqGqnfS+q1zSoUGSSlcdv9jnJnuH6tZBw88H8L4cnGLEB:WFRnfS+qBUGSSA+yZBw88bs
- TLSH T1B2E12E7895488FBF74B677AC6C6888315AB2013BB7BF28C750B55885054CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
- Size 7KB
- SHA256 fae8bd646b6a57655f702994bd49c733facddbf2c0a68976a26c584b7ecc2e18
- MD5 758fc82d5b87ab0582aed87c98403c27
- SHA1 382e552027d28d990f6385b07467d288e9291d46
- SHA512 32573e397656783176d946e5fc7b8aa6713907329c2ce5e03d79fce1a8e3cc20337ae7e7bf215ffa8eb8d5f1de4c1a0cb8ed4c40ad7e6315f141bc071070a139
- SSDEEP 96:xHsUTUSqGqnfSHDObzSpUGSSlcdv9jnJnuH6tZBw88H8L4cnGLEcGS:WFRnfSHD7UGSSA+yZBw88bj
- TLSH T196E12E7895088F7F64B677ACAC6888315AB2013BBBBF68C750B554C5054CF3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json.tmp
- Size 288B
- SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
- MD5 362985746d24dbb2b166089f30cd1bb7
- SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
- SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
- TLSH T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.1MB
- SHA256 afc1ae07dde0f35c8b166f815b370c8cd73ad250cfd0af60fb91fe32920b760e
- MD5 61c88130f526e94b050e9ddc3f4ec603
- SHA1 5b587871f334629eac45ec1ddaff16221944fb89
- SHA512 1d8b62acd3bb52cb9eb8da2695bd73672a70f0d0b37f17917703c57d92c1f3084676553b28a9ebee95ef91d9863245f60eec5b3377cee2c487b096009779f222
- SSDEEP 24576:u6gKq7imi+fOPjPt5YoEAhbzbDQWsb6QXhTSxK9Z15P7UNqsuAhe3QNt+:u60akkD/YQhXMSxmT5P7xihsqt
- TLSH T1B3462AF820D1A257F3414033764593EF21EFD00C6027DA085BA95AE9A5B8CEF9E16B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\note.txt
- Size 218B
- SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
- MD5 afa6955439b8d516721231029fb9ca1b
- SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
- SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
- TLSH T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
- MD5 SHA1 SHA512 TLSH