f9a60282724ecb92336187d3c5aa3d2f8c3c7e3fd235e351268eb509f24246df

Resubmissions

03-07-2024 14:40

240703-r1w1eatbka 7

03-07-2024 14:32

240703-rwlzmsshpd 7

Analysis

max time kernel
207s
max time network
204s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
03-07-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2068677510.exe
Size

7.5MB
MD5

cb394a6f354f693a9236583fa445395b
SHA1

2ed6ddc7ad28f50aee0ae7561e49fecf5d8c4f38
SHA256

f9a60282724ecb92336187d3c5aa3d2f8c3c7e3fd235e351268eb509f24246df
SHA512

4bf152e4418ed3492b0638fc22f64adbbe030ff9afe3a7aef4fd0e94e6949b4938d7f0b2b724eb7301facd5364dd2769130871f48c45c5b3d742a000e62311e9
SSDEEP

196608:0ds1VjAXZARCfxSqCeHUn4XCGXhpTD0NvKZGsKijlT:0sfsJffsje0n4yGXhm5KZpBT

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 29 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/4124-3-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-8-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-10-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-11-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-13-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-14-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-28-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-45-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-47-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-48-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-67-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-168-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-289-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-234-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-338-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-339-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-438-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-439-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-440-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-441-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-442-0x000000000089E000-0x0000000000FA1000-memory.dmp	agile_net
behavioral1/memory/4124-443-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-444-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-489-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-490-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-496-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-497-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-498-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net
behavioral1/memory/4124-600-0x0000000000400000-0x0000000000FD3000-memory.dmp	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
103	camo.githubusercontent.com
82	camo.githubusercontent.com
91	camo.githubusercontent.com
96	camo.githubusercontent.com
100	camo.githubusercontent.com
101	camo.githubusercontent.com
102	camo.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

2068677510.exe

pid process

4124 2068677510.exe
4124 2068677510.exe

Drops file in Windows directory 7 IoCs

Processes:

taskmgr.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644914197017921"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exetaskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{93A529D2-9376-40E3-A35F-D4DE79CD2F1F} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 811df95057cdda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e2bff55157cdda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a45a1f5157cdda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\AgileDotNetSlayer.zip:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\AgileDotNetSlayer.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2068677510.exe

pid	process
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe
4124	2068677510.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4144 MicrosoftEdgeCP.exe
4144 MicrosoftEdgeCP.exe
4144 MicrosoftEdgeCP.exe
4144 MicrosoftEdgeCP.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

5832 chrome.exe
5832 chrome.exe
5832 chrome.exe
5832 chrome.exe
5832 chrome.exe

pid	process
4144	MicrosoftEdgeCP.exe
4144	MicrosoftEdgeCP.exe
4144	MicrosoftEdgeCP.exe
4144	MicrosoftEdgeCP.exe

pid	process
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

Processes:

2068677510.exetaskmgr.exefirefox.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	4124	2068677510.exe
Token: SeDebugPrivilege	752	taskmgr.exe
Token: SeSystemProfilePrivilege	752	taskmgr.exe
Token: SeCreateGlobalPrivilege	752	taskmgr.exe
Token: 33	752	taskmgr.exe
Token: SeIncBasePriorityPrivilege	752	taskmgr.exe
Token: SeDebugPrivilege	2864	firefox.exe
Token: SeDebugPrivilege	2864	firefox.exe
Token: SeDebugPrivilege	2864	firefox.exe
Token: SeDebugPrivilege	4204	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4204	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4204	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4204	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2864	firefox.exe
Token: SeDebugPrivilege	2864	firefox.exe
Token: SeDebugPrivilege	2864	firefox.exe
Token: SeDebugPrivilege	5824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5824	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1840	MicrosoftEdge.exe
Token: SeDebugPrivilege	1840	MicrosoftEdge.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exefirefox.exe

pid	process
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exefirefox.exe

pid	process
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
752	taskmgr.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe
2864	firefox.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

2068677510.exefirefox.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

4124 2068677510.exe
2864 firefox.exe
2864 firefox.exe
2864 firefox.exe
2864 firefox.exe
1840 MicrosoftEdge.exe
4144 MicrosoftEdgeCP.exe
4204 MicrosoftEdgeCP.exe
4144 MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 4060 wrote to memory of 2864	4060	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2848	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2848	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 2252	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 3964	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 3964	2864	firefox.exe	firefox.exe
PID 2864 wrote to memory of 3964	2864	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2068677510.exe
"C:\Users\Admin\AppData\Local\Temp\2068677510.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4124

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:520

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:752

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.0.170572112\2147380672" -parentBuildID 20221007134813 -prefsHandle 1712 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb3a5478-e8e6-4a80-a94e-cb38dfefc69c} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 1792 1d9e5de1858 gpu
3⤵
PID:2848

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.1.2141199425\1331457123" -parentBuildID 20221007134813 -prefsHandle 2136 -prefMapHandle 2132 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd797b8c-9ada-4d37-b5bd-4b0858a58f04} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 2148 1d9dad71f58 socket
3⤵
PID:2252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.2.768732132\1271190785" -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a91d6f9e-db50-45e7-8819-24205984cceb} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 2940 1d9e9fafb58 tab
3⤵
PID:3964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.3.1897412810\407398639" -childID 2 -isForBrowser -prefsHandle 3508 -prefMapHandle 3492 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4558a03e-cfa8-46b7-ae8a-b10ca38f58ed} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 3524 1d9dad71c58 tab
3⤵
PID:2816

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.4.805050121\1936097224" -childID 3 -isForBrowser -prefsHandle 4184 -prefMapHandle 4268 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53c53b6d-6af1-45f9-9742-63cdf8713cd9} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 4284 1d9ebcc3558 tab
3⤵
PID:8

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.5.1962091985\723697001" -childID 4 -isForBrowser -prefsHandle 4832 -prefMapHandle 4828 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dd324b4-5a07-41c6-bc7c-53afba9065a4} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 4796 1d9e8362558 tab
3⤵
PID:4252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.6.1318528116\1306590199" -childID 5 -isForBrowser -prefsHandle 4972 -prefMapHandle 4976 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9a8b3b5-d0f5-4544-8e48-3433efd27c15} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 4964 1d9ec433258 tab
3⤵
PID:3532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.7.98954583\1970327045" -childID 6 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e57d54bc-fc93-46d3-9abc-144cd737b68f} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 5164 1d9eccb9558 tab
3⤵
PID:4112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.8.1054302805\1561257692" -childID 7 -isForBrowser -prefsHandle 4344 -prefMapHandle 4348 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e1966b8-6aaa-4bc0-b844-c40985411fe0} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 4356 1d9e6050f58 tab
3⤵
PID:420

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2864.9.665867625\422484000" -childID 8 -isForBrowser -prefsHandle 5600 -prefMapHandle 5360 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7575f7d0-d84f-40dd-9cd0-84840c01b14a} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 5364 1d9ec1afe58 tab
3⤵
PID:764

C:\Users\Admin\Desktop\AgileDotNetSlayer.exe
"C:\Users\Admin\Desktop\AgileDotNetSlayer.exe"
1⤵
PID:2280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3044

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Users\Admin\Desktop\AgileDotNetSlayer.exe
"C:\Users\Admin\Desktop\AgileDotNetSlayer.exe"
1⤵
PID:6048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=AgileDotNetSlayer.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:5832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe1bf49758,0x7ffe1bf49768,0x7ffe1bf49778
3⤵
PID:5908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:2
3⤵
PID:5420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:8
3⤵
PID:5444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1880 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:8
3⤵
PID:6112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2616 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:1
3⤵
PID:1896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2624 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:1
3⤵
PID:8

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:1
3⤵
PID:5168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:8
3⤵
PID:3044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:8
3⤵
PID:5296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4820 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:8
3⤵
PID:6116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4688 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:1
3⤵
PID:6060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5028 --field-trial-handle=1864,i,11450758544879931852,2224925253405052045,131072 /prefetch:1
3⤵
PID:5924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=AgileDotNetSlayer.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:5276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe1bf49758,0x7ffe1bf49768,0x7ffe1bf49778
3⤵
PID:5984

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:916

C:\Users\Admin\Desktop\AgileDotNetSlayer.exe
"C:\Users\Admin\Desktop\AgileDotNetSlayer.exe"
1⤵
PID:5876

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
acdad9483d3f27ed7e86c7f0116d8ad9

SHA1
dd2cfd176ad33d12ba7e6d260e1069b1dd4490c4

SHA256
bff5b4fff4b34ed3ea2754985b5ba1a8d6921517b0fa370f71f37ee0845552ba

SHA512
6e3ab4b6cfa73a7ad3c36fa621b1d2817b26e8e3613b78a40df6691d65e1486e6c2281efa0f8d3f30d2c6647b7ba3430a8be77df770f1cc575e8db76be6836a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
873B

MD5
3c50015b0d80ae1901597b95b3e0cf7f

SHA1
bb19366ccec8d5171c18d8a0d78c89255dc0c151

SHA256
3b39a3c8c99965c76749506453ae6e5cec00b2cc13ea3c8e89a2b895a972ec9e

SHA512
96edaa51d2df8f2e4b3973b0938f70a5c479b4ae3e4ebc0f0750d6397e69c39088e4d79716210a6946be0635e2d1c765c47c287753d0833acf2999178cca5e32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
536B

MD5
aeaaf38b360443096e6dde16618a0264

SHA1
ba8d11fc7da661176f8578afcbaedaf0b064dea4

SHA256
604af7e8fcd75350c652098e90032bed2c3858de7a72554010d71e5b7155915e

SHA512
3703df575e77b431f7cf07d5530018ab71a16b27689b8bd430a1439269e8c4705f28f3648e49dbb7818c708b395dee5c1ff7d06f4d6ef23da03d8fa660a4523c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
870df732f396bd5101c4110ead271e81

SHA1
bd23e098030acc36ecf8c10c51198fd8bc3462d5

SHA256
ff36709c769bd51a101479a758696e5fc47bde72dfa3bd0d40390859bb08affc

SHA512
c6cdc9629c6865d4b834e9b79f0ff58743b7673f4595f18b6d39376c0e20b29efee33a538191fc570acf527840f47748ca372b956cc3b8b91e0e5ba448c2ec47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
2f8152798e44042f84dd1ae696e773f5

SHA1
e2f29f246f837ad36ebd411f7ae1e746baeedc64

SHA256
33e04733f5d9e4d4d7982681ea08bad62381534f5087077ab4e361acbc560cf5

SHA512
0fa1cea357d9711ede70e9c67fc1099087ef37cc050805e0e49fda2370b45596209a317b678b727c332f8aac11c8aa9c1419c546162c59e3e8f3c2a595b3c5cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
289KB

MD5
0cc19cc465ee3faa8f668196aec28b1a

SHA1
5e542557ce2b6a88de293963fe8e781db5c63804

SHA256
7d50d9aa5ac7a66eec2e26232e8bc3422461a67fcf17893e5f62a9561ae1bce6

SHA512
5296c097c068479c093eef935bf7351ded6a6abfd9af21a64bb8b0da59461e2a8e9fd7458bbfa21bee16fdf3c06c7e67e2d0696e59d0ec9fcab6fc3b7527663b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ccf6b5d0-d7a9-417a-a87c-164da9b05f86.tmp
Filesize
137KB

MD5
3e779f49c10b92879d02d6d3cfd65854

SHA1
ecd6d432d0ad735c6cac85f99472a726db103e1c

SHA256
f3bc61f4d1100e66c62696bd71023645f7a46698a5c069748111623487c06c31

SHA512
4904d2233b12a2b2c26a1ce02238240ec0055a5a7d1ff7fe4bcbc84570d92bc4953d8750fafb936be4eccc5320743cca9a886180fa5801ff736c48371e74edb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\14775
Filesize
9KB

MD5
7f7877d8e16b3ece44f6c6c884f40c73

SHA1
d9c8e786684cca46ff5c4196d690f345d1b7dba0

SHA256
d0032cf20792f3668f855198125ce5d28035d561a99745092fee7571ccecdcfa

SHA512
111533ac9482fd52beed2c97d050297b4169c26e7d5b3ab60ed37b97d8f918d2aef43db3f1f36531b3bd04cd554d0cc81e5d8118bd12a0b3af89cfd38cc11767

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\BAEB8384F8F4496365E05B7853D63CA2D2772D66
Filesize
60KB

MD5
6b8e3f99baebfdc703d6f48f6be183fd

SHA1
e3c190fd131ca7a029e264024c30bcb39b102bf5

SHA256
482efca4346077ae4030199f13138745e848f468b1da72c636beed7ae4290148

SHA512
624e48ac3d464fdb33d714394cd3ed0d193cbdbac4c1f5ee4c0751ddf46df19fe27ca620d7184dab456cf978eb0e6d08998b9b6077797d9681a86e3c6a568538

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF13940F092FB6D2AF.TMP
Filesize
20KB

MD5
5e8cd987f308b36edb14b0f5ae8b54b8

SHA1
ac12b70dd529bfdd8fdda73c0f0ab941ffca539d

SHA256
584f0ae2ff49ff9518b3fde4d910a9be5a790e0948f664ce92967dd3e0f231bb

SHA512
2e700af168cc115052e51b6c42a23be67d566b5f85f1e02281491c571ab4fbf0ac75ce198e8ea12061671a6dfba2f2a51e2bc7627ec7ce8c1f35cfc9925e2dbf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Filesize
471B

MD5
f8359000fb59b8c5ecb6ca0c6ae668fa

SHA1
208b9dd6d8f4e0abc7a2016bd0a0f07d846912cc

SHA256
79827933e6aa5c729c9d535c338d6e8bd20c51fa42c23d17b21e79162df00e22

SHA512
22eb9f88c75893f9d9aa5a33dcb91acc96d4e75950cc7ed293b4ef8efbc73e68ee9d9a22c51ae200326d0f6a4f33d553dec3238180b0d15f9a019082d2df441a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize
471B

MD5
d49c8dc232d63b42b4dce9a85d0a3ea1

SHA1
884fb8aef25df4ca35dcc4c6613f034d38fb7b24

SHA256
d8e973f6b10c7755321564191e60f17bb99c4059fe6b26016308d3c196ba0380

SHA512
6863e77eca6c00286c87e4a0f1bc6f9094d5c808533b4d565466b6b96f5ce124bc3ff9ecddc4c4b832fe54ec1bf9d20f2c00c3403f88ed44175a57ee3465c704

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Filesize
412B

MD5
111575e06ff5cd9038904f19904f0009

SHA1
b8bb2a599f1da66186a34728e93489dc17eea013

SHA256
c4e2d1998c26c105aa4d90a1b16ae0c8e0090d6240514a0621667a723cac0af8

SHA512
d3d996d20f9958afed4894e637db392811e1ed4e5efe669f8ae780518374684e3adbcf78e44bd36ce245ee7a2f4ecb2a90ff4197c161a13969e1afe2ee633174

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize
412B

MD5
f27088c3c361d1d79e81d20c20227f6e

SHA1
e41aae3cec2ffc6c3b8afc3c3f44998f6137377a

SHA256
78006437a365f1ddccaf16f2602e771a13cb41b3032a0c1020c1b04835fefc91

SHA512
e25a53e6e1c7ebf6d1332f4966db8cb176d3afdd0e4e63fcf318bcb9051d0e8ff5876a0aec8ac624d3e5a38094a1f4a34e02da9d0e10ce0f906596176259b94a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
b5325cd2d72dae1d2d1225e052e622b6

SHA1
8be02e31f7011861ec2ed215c572966bd3d1e1c6

SHA256
16942d3df82f27113544b732dcbf2708bf2b0bd449836623af8f6a7586122919

SHA512
9d7d573627bf825e22fd34599b4ca113028ab17b8722928e6114ed8e3588bc0cbb6c96808866b4f7b9d523f3795991ff20f0c6553703c9bd3e3e06a675756e81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\4fe13d81-4cae-4cc5-bbc4-4386f3675e12
Filesize
746B

MD5
d3070f3e95c267d1dac894a878470a32

SHA1
f6d8cb76245722ee9e5ad379d0205b7274d73dca

SHA256
7e58d879f94772719f5700b56f53b8826cff1dd6218e6547755942c2f5fce75a

SHA512
02565de4055c82522f4015f6e0633b3aef82d471cac47ef50fb0f8626661a2bd0bc8d13043a2cc53d4ab5fbbf09e07eb98d34907b8ac42e04bcafa555920758c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\d8564326-28a9-4031-b1cf-9cdd0be9fbc9
Filesize
9KB

MD5
5b9b02ba3888c5b93f3eeea48a947fc1

SHA1
5c9b866d70711877f8d3a3ec4021522544632929

SHA256
2084620414b5356b84551439f0b520159bfd7f65102df2ef0ab9934df36996f9

SHA512
191dcd88d96c6690a53d7480e6386a6e9af808e32a8a2ff414d3da048cc67679aad469f85afe6a3c4bacb29a4d6e9254b29ba605dc196f17b8648e882dc2dcd3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
Filesize
6KB

MD5
55d343bf2e4e659515f59934cfbd3811

SHA1
2c8bf96bb7719915ca18c01cab9082eea095536d

SHA256
f24d80103309a1e0635be4cf803de1b402ba0a1fdc838f5cabacc33e1c94e8e5

SHA512
4aa3252f745dcf7d0c46416ab9abebf2e766eb0545f96f3f3f819517df283dc3fe97d1a426ab6bd272cf28a10c9f896351da02aa75ea6b3c96c52fb5783ec4f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
9c62af1ac7b255781cc9c7a86d88244a

SHA1
cee9807b322111376b64c2e2edee98011d493d2a

SHA256
fc74bdb0e44adc688477ed58cfbef75e9047e13151f4af97135a35a9242d1783

SHA512
cdd3d588d8f7c2609be8aa7d94ac8e9f9732a7369e83489a05a838d4f738fc307bac992b296af00be15ffd6ba601ff06d1de5d0b2508459eb17f60e205bd83f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
7e26d65db736cf755c1db5b2b329e7fc

SHA1
e2cb66629fc149ba98e086a8b5cec324cb7bc488

SHA256
398a97cbde0f595217e626d9c55fe7f92abe2430a192d71ed6f7f6bc07887257

SHA512
a3b5efed324e4f18be28b8e63f07e23a3b985215a2a6b7e9dadfc4b6a626f2dc4d20cd2c2cbcedf433819fca002ec8f9459286576c9e0435c89a30a5ce59917c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
dfe10bd5d2ff3ea99afe8367d9a9400e

SHA1
77488d37ba8844e2813004fabbc22089724f7206

SHA256
2750fef19f1810a80b45496953a46e01c25f754aacd16963a5e178a167a35a61

SHA512
2944ff24a63b2e2eb10c6e0e454b639c90f570dafba30aa928ff414bf304a5aaab5df0ce2b4871c9b95440fc54ced889783c77c98fa7dc775e9f4bcb2f596d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
214200fac8b55d8962ca74b9040b62d5

SHA1
a70157c77f1e30ea361f1b470b52bd1b08859099

SHA256
6936ae2bfbeb71d56e14a6c9f5f56b833e9a32bfa0d4f102e94337155cc40ab3

SHA512
40394d99627016943934f9e26b037d56ccca9f7cd1e1a4765fb0eec3300886d2523462e858714f40382e44cf16609e3798b91d9ea2dfb40b0fbefe1dc9f1a6f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
c196ff00b3407b172e3b5b0df72a6fa5

SHA1
be7390275af8915653a73123a3cbc96975e4c264

SHA256
742d612517acd7104ae002db1e6d870261cd8ceecbd427595657ea3ac12f364f

SHA512
ccf17d56aa4fae430ff0d879f60fd09abd88d3c59124df873bfa582bc417f20dced6998190b51d39a632bc8db876349bfd0a25164163af33e63fd6def6899e38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
dbddfad5d4e6332f7e35be307bf08dad

SHA1
cb1541a0c2a9f41f4b255ccee37b81a0e2cad985

SHA256
00e340415d45e96a0119edd0a203411905c38c1ce3aca900b1709bc254a1b0c7

SHA512
3856d346e256d6d668e1df2fbb8e6bd07479c6a40a604ed01ad1dc9c9fb0d8c29088e859bf08ef1de402633438d3a1152629318e461efaf680d05360e8f0d8ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
0ed2663971e8051b2bcb574926400fa8

SHA1
467756bf41c377bdb07c8be10d5391f1df1d80a7

SHA256
0c44c9887ebd30506041e4f483422673660df0b74c7468b0cab2c69bee1f4e8c

SHA512
e521f02d0a4dc70e3bb33747c5113c76f18f15b4370826ef13700c4f559c8b158ed1d8ef79d7d88794bfea61496a75d653237391f2f8b5e53d8574a21f113898

Download Submit
C:\Users\Admin\Downloads\AgileDotNetSlayer.w54ya2x4.zip.part
Filesize
12KB

MD5
f5bc8a42ea194687afbb6c5ec4b39b65

SHA1
bab707c65b527c3216684c19d431abb0a10981a4

SHA256
af2646ae35995ba51389618411955dd9de20a64cab86ca0e54a976c2cba0e284

SHA512
886aeb6b8ef1d39172cab29e3aace53363c82d7778ee231e58cbd73ce516a5b149590d1d329d56a1312cad55efac2614c7e4cd5581fa157163b347c8308760d2

Download Submit
\??\pipe\crashpad_5832_FSXWDWZJQTTAQNZF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4124-47-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-416-0x0000000009010000-0x000000000901A000-memory.dmp

Filesize
40KB

Download
memory/4124-49-0x000000000F780000-0x000000000F812000-memory.dmp

Filesize
584KB

Download
memory/4124-65-0x00000000104C0000-0x0000000010504000-memory.dmp

Filesize
272KB

Download
memory/4124-55-0x0000000010420000-0x0000000010464000-memory.dmp

Filesize
272KB

Download
memory/4124-52-0x0000000010420000-0x0000000010464000-memory.dmp

Filesize
272KB

Download
memory/4124-50-0x0000000010420000-0x0000000010464000-memory.dmp

Filesize
272KB

Download
memory/4124-66-0x0000000010420000-0x0000000010442000-memory.dmp

Filesize
136KB

Download
memory/4124-68-0x0000000010510000-0x0000000010A0E000-memory.dmp

Filesize
5.0MB

Download
memory/4124-67-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-86-0x0000000010AD0000-0x0000000010AEA000-memory.dmp

Filesize
104KB

Download
memory/4124-85-0x0000000010AA0000-0x0000000010AAA000-memory.dmp

Filesize
40KB

Download
memory/4124-75-0x0000000010A90000-0x0000000010A9A000-memory.dmp

Filesize
40KB

Download
memory/4124-72-0x0000000010A90000-0x0000000010A9A000-memory.dmp

Filesize
40KB

Download
memory/4124-70-0x0000000010A90000-0x0000000010A9A000-memory.dmp

Filesize
40KB

Download
memory/4124-69-0x0000000010A20000-0x0000000010A86000-memory.dmp

Filesize
408KB

Download
memory/4124-87-0x0000000010E40000-0x0000000010E62000-memory.dmp

Filesize
136KB

Download
memory/4124-101-0x0000000011300000-0x000000001130C000-memory.dmp

Filesize
48KB

Download
memory/4124-115-0x00000000113E0000-0x00000000113FE000-memory.dmp

Filesize
120KB

Download
memory/4124-167-0x00000000113C0000-0x00000000113CA000-memory.dmp

Filesize
40KB

Download
memory/4124-181-0x0000000011800000-0x000000001180A000-memory.dmp

Filesize
40KB

Download
memory/4124-182-0x0000000011830000-0x0000000011838000-memory.dmp

Filesize
32KB

Download
memory/4124-168-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-154-0x0000000011600000-0x000000001161C000-memory.dmp

Filesize
112KB

Download
memory/4124-141-0x0000000011670000-0x00000000116DE000-memory.dmp

Filesize
440KB

Download
memory/4124-88-0x0000000011310000-0x0000000011318000-memory.dmp

Filesize
32KB

Download
memory/4124-287-0x0000000011ED0000-0x0000000011F02000-memory.dmp

Filesize
200KB

Download
memory/4124-274-0x0000000011E60000-0x0000000011E90000-memory.dmp

Filesize
192KB

Download
memory/4124-261-0x0000000011DA0000-0x0000000011DAE000-memory.dmp

Filesize
56KB

Download
memory/4124-248-0x0000000011D80000-0x0000000011D8E000-memory.dmp

Filesize
56KB

Download
memory/4124-235-0x0000000011DD0000-0x0000000011E24000-memory.dmp

Filesize
336KB

Download
memory/4124-221-0x0000000011D60000-0x0000000011D6A000-memory.dmp

Filesize
40KB

Download
memory/4124-289-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-220-0x0000000011D50000-0x0000000011D58000-memory.dmp

Filesize
32KB

Download
memory/4124-302-0x0000000008B00000-0x0000000008B18000-memory.dmp

Filesize
96KB

Download
memory/4124-234-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-338-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-339-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-375-0x0000000009100000-0x0000000009214000-memory.dmp

Filesize
1.1MB

Download
memory/4124-389-0x0000000009030000-0x0000000009056000-memory.dmp

Filesize
152KB

Download
memory/4124-353-0x0000000008FD0000-0x0000000008FDA000-memory.dmp

Filesize
40KB

Download
memory/4124-48-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-438-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-439-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-440-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-441-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-442-0x000000000089E000-0x0000000000FA1000-memory.dmp

Filesize
7.0MB

Download
memory/4124-443-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-444-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-489-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-490-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-496-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-497-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-498-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-600-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-46-0x0000000075310000-0x0000000076658000-memory.dmp

Filesize
19.3MB

Download
memory/4124-0-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-44-0x0000000074610000-0x0000000074B94000-memory.dmp

Filesize
5.5MB

Download
memory/4124-45-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-28-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-29-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4124-31-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4124-34-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4124-37-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4124-40-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4124-18-0x000000000B9D0000-0x000000000BAE9000-memory.dmp

Filesize
1.1MB

Download
memory/4124-19-0x000000000B9D0000-0x000000000BAE9000-memory.dmp

Filesize
1.1MB

Download
memory/4124-17-0x000000000B9D0000-0x000000000BAE9000-memory.dmp

Filesize
1.1MB

Download
memory/4124-16-0x000000000B700000-0x000000000B9C4000-memory.dmp

Filesize
2.8MB

Download
memory/4124-15-0x0000000009D10000-0x000000000A702000-memory.dmp

Filesize
9.9MB

Download
memory/4124-14-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-13-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-12-0x0000000071C40000-0x0000000071CC0000-memory.dmp

Filesize
512KB

Download
memory/4124-11-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-10-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-9-0x0000000074060000-0x0000000074151000-memory.dmp

Filesize
964KB

Download
memory/4124-8-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-7-0x0000000073CC0000-0x0000000073EF8000-memory.dmp

Filesize
2.2MB

Download
memory/4124-6-0x0000000074380000-0x0000000074542000-memory.dmp

Filesize
1.8MB

Download
memory/4124-4-0x0000000002D40000-0x0000000002D41000-memory.dmp

Filesize
4KB

Download
memory/4124-3-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-5-0x0000000003460000-0x00000000034A0000-memory.dmp

Filesize
256KB

Download
memory/4124-2-0x0000000000400000-0x0000000000FD3000-memory.dmp

Filesize
11.8MB

Download
memory/4124-1-0x000000000089E000-0x0000000000FA1000-memory.dmp

Filesize
7.0MB

Download