c28a377d9093de3473e14a1a0ce0cb51d3d46b357872ca84a0625697f7f06a72

Analysis

max time kernel
64s
max time network
68s
platform
windows10_x64
resource
win10-en-20211208
submitted
15-12-2021 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe
Size

2.3MB
MD5

e6bd3c80fbe81bbddd0ce095c4efa2ed
SHA1

5701bf12ad277b42bd951adfc3e57c5d6c4f8b64
SHA256

c28a377d9093de3473e14a1a0ce0cb51d3d46b357872ca84a0625697f7f06a72
SHA512

6a2d615af205c828992f76f27e0f7bf8a743bbfe1f91853b3fe9d034470c2c00d43591ad44112f41e599704e85c98fc2f11bc35d4dbec668b1d1d63dca1548a8

Score

8^/10

adware evasion persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

IP.exeIDMan.exe

pid process

2556 IP.exe
4092 IDMan.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2556	IP.exe
4092	IDMan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IDMan.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Program Files (x86)\\Internet Download Manager\\IDMan.exe /onboot"	IDMan.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

IDMan.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IDMan.exe
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IDMan.exe

Drops file in Program Files directory 6 IoCs

Processes:

e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exeIP.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\IP.exe	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe
File opened for modification	C:\Program Files (x86)\Common Files\IP.exe	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager	IP.exe
File created	C:\Program Files (x86)\Internet Download Manager\__tmp_rar_sfx_access_check_259405609	IP.exe
File created	C:\Program Files (x86)\Internet Download Manager\IDMan.exe	IP.exe
File opened for modification	C:\Program Files (x86)\Internet Download Manager\IDMan.exe	IP.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

Processes:

IDMan.exebrowser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Program Files (x86)\\Internet Download Manager\\IEExt.htm"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	IDMan.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeIDMan.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000039c0c08a19829ed36378212652e133dbc9c25ada5dca3bd5aeaf47c1b20b07d6a0d34f80e2e7502e31676baa7f87d0d5cf546d6dc616ec3fe0d0fb5d0dc6	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 653f76ddbdedd701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{099B0C26-5BF7-427F-B4B8-C24FFB04FFF1} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = bca03f4542ecd701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000005f87071fa744223955e9ed3c5068a735d7a5d50f48b92a82e41abcfe5a22c64bfc882d2418e195050a33c9e65d29f12348832d3b16c0b5fcfa259c0671a1ad8f982a7804d09a8626e0266ef1a6ee77a20e52e1296bf4471f84a9f64be6b52f47950d39987b9104514863b382a8d92673cbb184fd62753e4c9d46bf56ec7e84d3ffd101cfc6e4e184718862cd700917187342b36a6a63b8bcec9cb375531db0512617742a00b5659ca236384f0e9e19e628a4107a37de343d5e4b449338b00d20787dfd47fb22cead760ec9cf66b8ec6a8276f15c3c06f1b178f3629cf55864a246a4237b1c4dc23bebaeecb08d76d91f2a5a314c82fb82723d34e2750c360a619f2c8779e654d73511b819f9e4fa9c7063efda7fb0ddcd710aae838523688e76e9b58e13075990c51eca184a3b63da0ed6d45e2ce1cce6356c01dac7ff0ff54cd0df3901cb7aeff7928591fa41d1099400abf799cee8939e87ccb572974b91a4314b70b931d9e821048a08c993636e7c6e137542c7516f84afb106325e3debf94c97195e7395de2ad277ad16cd3bab62b1ab0f07a427ac17a601c8a90154e9413e0a189cbda9	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe

pid process

2448 e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe
2448 e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

1228 MicrosoftEdgeCP.exe
1228 MicrosoftEdgeCP.exe

pid	process
2448	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe
2448	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe

pid	process
1228	MicrosoftEdgeCP.exe
1228	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

IDMan.exeMicrosoftEdge.exeMicrosoftEdgeCP.exefirefox.exefirefox.exe

description	pid	process
Token: SeRestorePrivilege	4092	IDMan.exe
Token: SeDebugPrivilege	2944	MicrosoftEdge.exe
Token: SeDebugPrivilege	2944	MicrosoftEdge.exe
Token: SeDebugPrivilege	2944	MicrosoftEdge.exe
Token: SeDebugPrivilege	2944	MicrosoftEdge.exe
Token: SeDebugPrivilege	4160	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4160	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4160	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4160	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2944	MicrosoftEdge.exe
Token: SeDebugPrivilege	2672	firefox.exe
Token: SeDebugPrivilege	2672	firefox.exe
Token: SeDebugPrivilege	5008	firefox.exe
Token: SeDebugPrivilege	5008	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

firefox.exeIDMan.exefirefox.exe

pid	process
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
4092	IDMan.exe
5008	firefox.exe
5008	firefox.exe
5008	firefox.exe
5008	firefox.exe
5008	firefox.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

firefox.exeIDMan.exefirefox.exe

pid process

2672 firefox.exe
2672 firefox.exe
2672 firefox.exe
4092 IDMan.exe
5008 firefox.exe
5008 firefox.exe
5008 firefox.exe
5008 firefox.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

IDMan.exefirefox.exeMicrosoftEdge.exeMicrosoftEdgeCP.exefirefox.exe

pid	process
4092	IDMan.exe
4092	IDMan.exe
4092	IDMan.exe
2672	firefox.exe
4092	IDMan.exe
4092	IDMan.exe
4092	IDMan.exe
4092	IDMan.exe
2944	MicrosoftEdge.exe
1228	MicrosoftEdgeCP.exe
1228	MicrosoftEdgeCP.exe
5008	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exeIDMan.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2448 wrote to memory of 2556	2448	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe	IP.exe
PID 2448 wrote to memory of 2556	2448	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe	IP.exe
PID 2448 wrote to memory of 2556	2448	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe	IP.exe
PID 2448 wrote to memory of 4092	2448	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe	IDMan.exe
PID 2448 wrote to memory of 4092	2448	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe	IDMan.exe
PID 2448 wrote to memory of 4092	2448	e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe	IDMan.exe
PID 4092 wrote to memory of 1572	4092	IDMan.exe	regsvr32.exe
PID 4092 wrote to memory of 1572	4092	IDMan.exe	regsvr32.exe
PID 4092 wrote to memory of 1572	4092	IDMan.exe	regsvr32.exe
PID 4092 wrote to memory of 2948	4092	IDMan.exe	firefox.exe
PID 4092 wrote to memory of 2948	4092	IDMan.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2948 wrote to memory of 2672	2948	firefox.exe	firefox.exe
PID 2672 wrote to memory of 2456	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 2456	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe
PID 2672 wrote to memory of 728	2672	firefox.exe	firefox.exe

C:\Users\Admin\AppData\Local\Temp\e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe
"C:\Users\Admin\AppData\Local\Temp\e6bd3c80fbe81bbddd0ce095c4efa2ed.exe.vir.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448

C:\Program Files (x86)\Common Files\IP.exe
"C:\Program Files (x86)\Common Files\IP.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2556

C:\Program Files (x86)\Internet Download Manager\IDMan.exe
"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
3⤵
PID:1572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
3⤵
- Suspicious use of WriteProcessMemory
PID:2948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
4⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.0.2060859418\590545790" -parentBuildID 20200403170909 -prefsHandle 1524 -prefMapHandle 1092 -prefsLen 1 -prefMapSize 219808 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 1608 gpu
5⤵
PID:2456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.3.1800943798\1677846621" -childID 1 -isForBrowser -prefsHandle 1432 -prefMapHandle 2064 -prefsLen 122 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 2264 tab
5⤵
PID:728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.13.797679849\1210525318" -childID 2 -isForBrowser -prefsHandle 3324 -prefMapHandle 3320 -prefsLen 6979 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 3336 tab
5⤵
PID:1736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.20.115979711\2142144623" -childID 3 -isForBrowser -prefsHandle 3952 -prefMapHandle 3948 -prefsLen 7684 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 3960 tab
5⤵
PID:2364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2672.27.1583778453\704048606" -childID 4 -isForBrowser -prefsHandle 4576 -prefMapHandle 4692 -prefsLen 8137 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2672 "\\.\pipe\gecko-crash-server-pipe.2672" 4184 tab
5⤵
PID:4780

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
3⤵
PID:3976

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
3⤵
PID:3112

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
3⤵
PID:1324

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
3⤵
PID:2560

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" https://www.internetdownloadmanager.com/welcome.html?v=640b02
3⤵
PID:4016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2944

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3740

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1228

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5008.0.1886955953\457283281" -parentBuildID 20200403170909 -prefsHandle 1448 -prefMapHandle 1440 -prefsLen 1 -prefMapSize 220282 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5008 "\\.\pipe\gecko-crash-server-pipe.5008" 1540 gpu
3⤵
PID:3116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5008.3.570578832\1831828420" -childID 1 -isForBrowser -prefsHandle 2292 -prefMapHandle 2196 -prefsLen 448 -prefMapSize 220282 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5008 "\\.\pipe\gecko-crash-server-pipe.5008" 2328 tab
3⤵
PID:4312

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5008.13.1240246348\907377379" -childID 2 -isForBrowser -prefsHandle 3476 -prefMapHandle 3472 -prefsLen 6679 -prefMapSize 220282 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5008 "\\.\pipe\gecko-crash-server-pipe.5008" 3488 tab
3⤵
PID:912

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5008.20.1495817726\124825662" -childID 3 -isForBrowser -prefsHandle 3968 -prefMapHandle 3964 -prefsLen 7384 -prefMapSize 220282 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5008 "\\.\pipe\gecko-crash-server-pipe.5008" 4296 tab
3⤵
PID:4140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\IP.exe
MD5
35b696cadad0831f4158ac7c206197fd

SHA1
0696679f06c7ab3b55310767233a1eac734a2c33

SHA256
56e187d38f8f4ff89269f002c9b014d8ac74cc9371929e3df053fb31ea04e0d9

SHA512
f11bf8a3b5f21e9e4024f806288bafb2444f97cf2b18a4d1fe707f7ab7c3512d47f6982d92a9985955553e312bab9042eb9972dd439d3fdd1a2a3ccaa9da4a1c

Download Submit
C:\Program Files (x86)\Common Files\IP.exe
MD5
35b696cadad0831f4158ac7c206197fd

SHA1
0696679f06c7ab3b55310767233a1eac734a2c33

SHA256
56e187d38f8f4ff89269f002c9b014d8ac74cc9371929e3df053fb31ea04e0d9

SHA512
f11bf8a3b5f21e9e4024f806288bafb2444f97cf2b18a4d1fe707f7ab7c3512d47f6982d92a9985955553e312bab9042eb9972dd439d3fdd1a2a3ccaa9da4a1c

Download Submit
C:\Program Files (x86)\Internet Download Manager\IDMan.exe
MD5
0f1a0720e91b565b223431eafaa803f0

SHA1
b9fe54600b29bdbbacfa1fbf648978a32c304d25

SHA256
555b0f98172946709bfe170cf68a2af773a2866702d95d58fe161913a406015c

SHA512
2d12e8a6b789350a00f57d1656a3c7930e127aa98fa594e8dce92d1b327a708176e0cf90431789730a377037e2af8482707f581f8836ccb5cfae6e27f2d12549

Download Submit
C:\Program Files (x86)\Internet Download Manager\IDMan.exe
MD5
0f1a0720e91b565b223431eafaa803f0

SHA1
b9fe54600b29bdbbacfa1fbf648978a32c304d25

SHA256
555b0f98172946709bfe170cf68a2af773a2866702d95d58fe161913a406015c

SHA512
2d12e8a6b789350a00f57d1656a3c7930e127aa98fa594e8dce92d1b327a708176e0cf90431789730a377037e2af8482707f581f8836ccb5cfae6e27f2d12549

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\cache2\entries\1BBC7759CBC162CA4A6DD44B4D4454193297867E
MD5
122483af254d6d309aa3bd85d576de13

SHA1
888919863f39cccb842781f13256837a4939e5b7

SHA256
88480ddb23c5578fbbd5900a45d9bbde5c5ed1fdba43026a105f894bf70691eb

SHA512
e54dd3309f76139b881ffebe32fd6142481d2a0de8c50cb4f7e494d46c4224ec6e0069587361dca9e333e53509593363adcfa8625b5c088f214140c13098ba37

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\cache2\entries\4903E7ABE348ED39D98D1C844FB81A906D5ECA16
MD5
abd080b55d229ae84fd2fb6d238f0393

SHA1
69dd24432b84131fbd1f3e2b4f3db1c1d4de82f7

SHA256
82b73349ddcf01ba00b4f8583285c7323025aa1b889db66a03f657e760ce15d7

SHA512
bd7b538b7729683ec23b814b39d5901e6e9b923b20e522d6f3b6c0065bc7a26d80192946aa832811c66340bbe83eee3408a306bcfd0c4540cafe8eea7cb5662b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\cache2\entries\97E8D217D59733C5DAC8BF6D74564B40D930A09A
MD5
6d4a1c28f363155d3f4a54451252eff2

SHA1
ceae5c3f4e1d3352b4119bb846bad2a7c6c1cf50

SHA256
cdf02ee7fa6e48661ce3659c765bf126b487dcf3b3ad92d80b49dd91234e93be

SHA512
fe4439e378a0f014704a469d6917f355d9a140f760b159e40b14e4e76d789d0c777d60294c792abfca1ef0637f86f3c89a7b8b6e08d86e5cf78db2cc77c481b5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\ads-track-digest256.vlpset
MD5
6c3605de4e50f585c2dad2819d138112

SHA1
4c647f39e09f9a3f16c982febbcca061ffa42652

SHA256
1983aa1c36d96d197aa522d6347f0ab6a62234294964f1d5889600c2ca6605d0

SHA512
b619f4fa7138b90ea92064fa9e614e978b014257a59a71738d2fd2382988d395c1d9d7aa362e90abe5acf82dbe786f860bdeff65684db16ab5b42ebd5f47fc44

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\allow-flashallow-digest256.vlpset
MD5
de0d88480c24350c59e1e9a3583de0d1

SHA1
4e3c279344cb37deb5e893ab24770982de135789

SHA256
01ba9f0b913e04ed10bd7166796483dd4f72005f249d6ee68b12117be4b5d3c7

SHA512
f627c69598baa9bc60b036cea03fdadc8b4cc424ef8cdf93614275a336de05a60961f5e77553226c99c29ec2932272ae994327a4da77d75d2464f6722cb700aa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\analytics-track-digest256.vlpset
MD5
2b077f437067b52d00d4280df1b248a5

SHA1
19c10d8bdf159b9e53db9855d1d97a658d92c994

SHA256
a8cb2ff713acaba0b4612c5bfece51a5e5d436a739c0455a3731d1ef8e0eae12

SHA512
ba03b93b68e5cc0de34f890d7d112a1df0a17dcb451bd9c0761e087260fe9b3cb2afda9efb0b9d075cb722b77a859ca0b27c570a6db62a08b2fa9d30a04d00d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\base-cryptomining-track-digest256.vlpset
MD5
f45cb33dfea35013b6d5951f464a7841

SHA1
21c9d73636871aafe063797059078fe2373d1233

SHA256
498ab828f2dff25b45deed474bebdbcfadac63a1cbba2e393162ab54bbc9f2e1

SHA512
88ff2955d709d53fe248b88beb3f6bc31a485c17c80c5ddb8ea91abf46b0a43bcaf7f357ea4ac09dfb1d7988f8b7b1034ded15c2861d9de01719c131cf72a27c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\base-fingerprinting-track-digest256.vlpset
MD5
cb73b8baffcd07ff5d1df58f8477370b

SHA1
3bdda94d12aea19a659c3b4035d0e613e18ca202

SHA256
1e063a0cbc2d947925265cabbbb0da6721b7e05361b1171316fca37e906226fa

SHA512
f5004c43ba0b5b48fae0c45c5f61c2a608a4ca3c61362cf27c51da7335597f9862f6c5a04e137bba16e92f3523e1009b5ca2542f52d478f56b946cebf2140712

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\block-flash-digest256.vlpset
MD5
130b9ac2beec5ada274561105d81ae36

SHA1
85a4785b34bb151da41bc0dfed380cceb7a29983

SHA256
7d99fec08182a5b95d18d1569edaa2c60c2aafbd15a56d8882f22f3b395e6460

SHA512
cbf32630bfe48fe6dd0e815f2e9752ca75c066bdfb5f12941f3278883b0530f1736b2d179801afc7ab4680be6ca9976c6e2e3705147d95503ef32cf730194631

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\block-flashsubdoc-digest256.vlpset
MD5
40165280ff1345b5241ec2a9d1da2af0

SHA1
c49f9172a6bba2dc4e91fa97defd161d9e87773e

SHA256
f80bdd5341d8b1ee946e344e258ef2d35c3c0bb6b13eb7b3e6a77467dfa8b97f

SHA512
b5ec96e5f786de54976de804491aaf01bd79dd48d81ec81e1a9d32157881b0e7690d3608ee18e60e4381291a1c179999f40e0b98f9483519084da268b4904c8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\content-track-digest256.vlpset
MD5
9f355ca06a2c5eed2b13ab75dd4ca3d3

SHA1
16a014268d85c8b1cd476da2cfcf7aef79d5218c

SHA256
039695d5ea6e79797e1b2acb4aa95bcbbe3f4c53970abf28c68aef2b13f1a95e

SHA512
ace6b46c28c25ce5d87162566a882cf99b4a2512ac5fd9f0168ff9936d316af8652e775ebce8b1fc8b95d33844425da3a4832348115ead078d7b78a0b369b78f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\except-flash-digest256.vlpset
MD5
c2994d388f8780c87d35c352d9582985

SHA1
b4e9ecdf3ecce53f072b7ce9e695ffcc17ea9f76

SHA256
7ed09f7d2bd632f70077a4ae4f2bd2f3fb654b03cd72652f51678b0c7d027f25

SHA512
60edd83f6e0ff782ab251579e0f3c113d3d5fff7ba7f3a8900cd4fd6bc7271921445e94b53073129db9529f0210750615318348307db650fd11ffaedaeb7bd15

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\except-flashallow-digest256.vlpset
MD5
7194b6bff691a056852a51e2e06ce8fe

SHA1
0adb901d9e202ee31ce6a8131ff15e5ecca834f7

SHA256
cbe2dc6abfe25bead60f4dfaf419fc0f441ff8a8dd4a2febf5553be1cbd90c49

SHA512
b0d8240050a25b2ab754e8f260361298d0017e3a938e965a34b6db072380cb6167c4fa5e0c2293b46b1135207ce9242ce1441b77af8b07a3212a49000e8bbd36

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\except-flashsubdoc-digest256.vlpset
MD5
0c0d67875bd75a0227c02dd8529ba01a

SHA1
2b12efb5e31bdac680b6283e2585eeea096fe73c

SHA256
614be0169ec36e67223eb9645a98da66dbfde5dfbb89bb064f428aaeabdd9d97

SHA512
8fb01246c4b7b4a2cf0379f931e0cd3ea5a32781078efdc4c4a5ac3bc496697957f6d15a0b6daaf562e48bd1b1ffbafe0583c59962689b030c4c5543cf8e2ce5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\google-trackwhite-digest256.vlpset
MD5
e54e5b84194eee15e64d2a03f1136bb7

SHA1
308413c74a49af1a575bc6f64fea33f9ad2f220d

SHA256
07707b589be3dba3bb0bdac67760a2b180ea3531e9d7976b73e4c1d8df9dbb1e

SHA512
f3bae1816db808c69871bd1a059236bf57982e90da5706adcc3359a200f1ec2c529be516be629fbdb5e7da8c3ea80000815d99c8c2c347440cacd9237bddd3b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\google4\goog-badbinurl-proto.vlpset
MD5
919e1a32f27d3f9ac68c40eda6b4adab

SHA1
20217a579d2171a1c17fd9f3ab843adca7388806

SHA256
e0c4bcdfcb224bca886d3c6b0c742fa00ed92e8854eeed19f78fb9c2132bdf04

SHA512
f50f0243a02d1c60f63e3f782e71420f06c4cf1d20cef5aec4e640f487db2e4cdcd887838f2db6306e771e3186a32848270312ff5406bf426cf7945e87d92568

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\google4\goog-downloadwhite-proto.vlpset
MD5
b0272f5cf9f56f11c856155dc5f40be1

SHA1
e824cd22b162fce2892fcf2b9e9215d8e94ad4da

SHA256
74ab81a1929a8806d559a13140947f076caba52bf882364c416ef4d8e9b155f4

SHA512
3c50fbad8e60e35661826efa9f111364656bff4d4d9a7df3cdaca565ba7d899337064cf1d3c7eaac759e8178180dde402d6305c56fe3d0efa9cc171611592da2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\google4\goog-malware-proto.vlpset
MD5
3440bb2c89291acc8aeef6f5905daf81

SHA1
2081c8971a15443af2bc8d7f286416d0becd64f3

SHA256
a58f52f482b00001532212c14b2c62f5b7a0d03d605fc11f6576d4d4a174bfeb

SHA512
ebec7ac41b97ed01760185031969d5234b9d5d89951ed92ae1afc83d2bbc7b2301bcb25f97109855c0d7cf2902fa5a548e8373855f14eb817ff2b8d7ebcd677e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\google4\goog-phish-proto.vlpset
MD5
3a739c0915ebf3d884741dec9398da62

SHA1
506b2e2f51b1f83afd3fd5eee2b5c81505709aeb

SHA256
56cfdb8880dfa601621579eb16e415ec31cbe88c387afdf4e081db13e57faf2e

SHA512
7dee506b77bb32b2200249202dfc4f110b711e97cc15e55599403dcd563e5fcd5f2faba3d8f9c5e3636fbcfdab6c8d0554fa031e9325bc4cd779805337c60107

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\google4\goog-unwanted-proto.vlpset
MD5
95aeb217404e71c603e99e69d85a7063

SHA1
d698aa929376caeaeabf3907cf920bd107693b8b

SHA256
18baf7a92fa8ec24818c2539507a40ffb26aa9d0486260639b7d1705bb896e7e

SHA512
3560f25ba51b413b8b2e1209760425109c9bb7ad56edba9d5c00f2123e0c5d2ec6977f878fbbb8eac99048dbfa4aa416a3a690fbae01e45b286b2284261343b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\mozplugin-block-digest256.vlpset
MD5
fcc9c2c9b611a3264b68ebe180eb4248

SHA1
50d1a83ce69bb20d0d98f0ce80fc8dca44e054c7

SHA256
6ecd378a537eefe350b45cfa353741383f407d99d776bf23155a7825dc5dd2bc

SHA512
5a5be2ca3dfb29cab5e9bfbafaf173105e4cc1a79da6cf663ca0f8f7bf109a5b42a4ce5665150a97cadc22865860e0e6f8c708d83e5aa01d6211a7664e10d249

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\mozstd-trackwhite-digest256.vlpset
MD5
dbd7544bf04db52719348298521f4ed4

SHA1
ab838a83ae023aadba87bcae62093e874393a0e6

SHA256
f87c0e78f812bf39363b1974ed20175e907cd6114173db31e1c7243f4d515dfd

SHA512
0ef0ba0a594bb019133a133b9edb73901e804c845a66d427686f32a48c9d1ba665623d3fcd10018c2415202fd3f722aa23420598ce892444b4574c108ce4d6e4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\social-track-digest256.vlpset
MD5
399e146c7c24fb3a69525f748f6742ab

SHA1
5a19c6f96244a65ec44af582956a9085407768a0

SHA256
11bddd57f215cf440ef5e41385a618123658be38b03097b547a9ac5220db425e

SHA512
3d280f40d78b0ef1b76fb8210f1d59edc5412208058d7f9448e14ff11c4e717505735c161979e2f84c4ccbcf4c4fa13ff3e8200b27ee2bb96e8d1180fca62e5e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\social-tracking-protection-facebook-digest256.vlpset
MD5
c6e5d0e5cc6cabbb446b625d9a14f3ef

SHA1
2d46657ed7ddb6f4c295b90aea7c477f2560d4f4

SHA256
de974099351ab8e3b4945d3fae34a2d8bf43407921800719256cf29139f516e7

SHA512
6e30e2adc27654d3052fbdaa8c4bf6d2ea41687bea67cc80c412c0d07a6174211e633a1aace5629444ba9ab0289af9f56651b5ab9061bcbb820b04debe175098

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\social-tracking-protection-linkedin-digest256.vlpset
MD5
e28d310df430e7b6d95d9c912fa94e2f

SHA1
6c54ae3b421f47b73260751c44584d4b1effbb16

SHA256
0f6bd075711185f73238b0cd030f84a6fa9ddc17d341a669aadd07b806a86626

SHA512
1dc3c42fd79042eb9d17746a6f5c3e46d3bcbf36bda2143b380a02519771c39870cef4e8031e29191505c125c52a73e20c8167e1c26c3458fd9b7c89f231f0ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\safebrowsing\social-tracking-protection-twitter-digest256.vlpset
MD5
dafe2c58eba7740af1a2bad64cef0f54

SHA1
f10d56c4c9d035744f46ed60690d7eab35952c27

SHA256
16093715575f4b5990d69d92459156f5843134a22135ff93185fbf109d64423d

SHA512
5e6e65b2e357e6dabb163496135b0269f4e6f19f230e2f5f51f17c18b3462280f83e48d621747aeb88eca016906acc9d6c05664b3f5d20ac6d90ba0aca41ba4c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\startupCache\scriptCache-child.bin
MD5
f68af26bb091ce823006bb3975f5aa13

SHA1
146058120d5e8eed11b0aac9c02e1601e1dbea5a

SHA256
728fac9a374ec132d32d9e3fef6f29c63d25832fda3e9d9da262f0b893eb6ccb

SHA512
9f567d9313d76e6b38b54f46fc8067569feeea139c98f3077b7a73903ea949b3fec4becb506d21c98e71b017f5e7f387bff593a8f1e18007443cbd7ff1b722c4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\startupCache\startupCache.8.little
MD5
ea215a0e52d90222c0881cc22f46013c

SHA1
797bd3b5ac9b227a511c40005b09d2270a94c61d

SHA256
2ead09d55e9e59b9640cf1eef58da679f5cefe6a5df45f384426b5f8e5c41ab8

SHA512
6867aee45f99a13fae6a007665d93c6b804b754a950ce733ed0083c923c90c73526ae200d93ee135b2feada00ca8f58e60bb9cfe5d4e3f0ae8f93832d95e0c88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0elpq90o.default-release\startupCache\urlCache.bin
MD5
1d618725fa20fae3007d1ac6db3de506

SHA1
e345d67524f537b800a8d793c653c709b6b93980

SHA256
c8a029f7e132f4d9b66cbc4f8afe3b50d2488cb21d6adf5aa37c8407847d39a9

SHA512
da4ca86390acf93dc3e6c92dc77e9f0ecbd5725c92aeb832c6dd3c1332a447d7befd1dd073e5a2de33284e7e20535eb54278f70611c1171bd533f19ccf2c6793

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ELPQ9~1.DEF\cert9.db
MD5
82519c2fa6d86c8edee600122e438398

SHA1
4ccd286b467785e2e9cc950e21151da16f839535

SHA256
2f47129d653ebd2ed9f2ba0c5ce3d978b82ed118dd242ea5ffd8e4c249f9056f

SHA512
375443ed4f7a587f51e7eb0823982002a314be101f24f974055c87075b1be5ba1a9f3a80e4a7ba91973955890df6e2b21662a6473f3db8488d3ee06335879f83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\SiteSecurityServiceState.txt
MD5
f0da10166172aabf892f53ecc15db210

SHA1
37e41a65d06b31682f2cec6cf6cef41c88508af6

SHA256
f65df74a2ff0953675a0a05341bcbee45e7a04357637df3db0b617e371267365

SHA512
a65e507ef95e711693c5ade468d9b24db5733d31f17dfecc6b74a1ca59ea6750a29c15d05397f5498dc8cccf552a28c8d660f514ce221bad7a2c43d43546fce0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\addonStartup.json.lz4
MD5
bc4bd0071af0574fe57b6756f0b26071

SHA1
dfc6af6b87b58391f67679a24c28495503f9e75d

SHA256
2f0cb964330decccb1375985d126d6cd2fec171e344cdd6e21026fa9459d8ad3

SHA512
9cd3f9140a3beca18114253556281c48e0a2401d8e7bb01b518a0615caf6a1f4a8cece627c00caaf9cb3f7cf3a57a224ec5233682b5b3f8e933619b85488551d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\datareporting\session-state.json
MD5
afafea3399b1bb601546a894fedd0667

SHA1
04949493ace1e1f11afd836abb61738bbfcf5c9e

SHA256
e88a5645fe7c79ebd119bf05b3254785bd8b7f1cbeda05958d0897b73a80ba23

SHA512
02510e5116bf78168fc07a6bf69da5574dba2b8e612927744c75fccab3f5ddbd421ed083c081aea995947e5a317f93d124f22f35dae196253fa10d2b843136da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\places.sqlite
MD5
6fff1ef176819d7c99399b426b900625

SHA1
2aba02a9a3824f1ba3c69cef34ccac492973771e

SHA256
26b9921f3ebda1d33db77c04903fb543d1614c889343f142c7692a2288b4d2ff

SHA512
d464319526e67c8a2ddfe0b6b07408609caa8a2ed71bbb2ab9197d609e2aac006ecf77c5dc9d69189a705c9fa1388923bb6cefebed8ed72870d5711fe81cb349

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\prefs.js
MD5
e320902e773ae28af2626c52ea250d4d

SHA1
84c45653a091b9449c8ddfadd8f7c90f8fae2b81

SHA256
1f790660953989d1d9e372542fd6324438abaee5c2d3ef88db435f9b8986277e

SHA512
4b4b4b0f779b3932b6bf255279b60d769fb84d275b5f646b5898981e01b4de29c26270779cfac50d94a729c4f292672aab4bb4ac760527f4de32f64d741f1314

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\search.json.mozlz4
MD5
3ee92a4956523e555fad8f0636da6f1a

SHA1
4415695dbb0a47584d9d1f865b9376dbfbb258ae

SHA256
741ad3715335892bcabc00647d6f90e23e6e1ebfd5f3fc3c21aea3470f40f2d0

SHA512
c02153bde65eb1ca21b93c2adbc2f6f28397fa007454e1457c251dbbe213610d55e2fc15d1e5e88e3308c6fb08b0b3c1e626a8333cf0ff9df3f4a765b584056e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\sessionCheckpoints.json
MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\sessionstore.jsonlz4
MD5
182f67123c80b0a89607578df1f421f4

SHA1
1035810f515d202dae998a9ece08b22f101be7c4

SHA256
502207b3258c6b7844b1cf1da0f079c4c0a3b71c185e17895d782f91953ce90d

SHA512
57802be6b546f060f5c178a3d2e8c797f232c17d5f055c7f645eed7b99cfbf64fe470191878dbcbfaaa9d0df929ac41aaf9fa47e2d92fccef2691aa66f948ab0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
MD5
adb0ad577d5ef24774af25affa0b4278

SHA1
96236826881aeca33eb06f6219f260cacaf32105

SHA256
27542c394df2f236bdd7076fdec74f0d83648ca8cdac68e75034d91518b02856

SHA512
092239dae365598b61b5d32092b08fe2d4768eb799fcc0ca5df27bd7de8082ad658154cd29704e842b4238f750cdde1bd6df211b65d15b411d15855087aaf3b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0elpq90o.default-release\xulstore.json
MD5
1995825c748914809df775643764920f

SHA1
55c55d77bb712d2d831996344f0a1b3e0b7ff98a

SHA256
87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776

SHA512
c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

Download Submit
memory/1324-124-0x0000000000000000-mapping.dmp

Download
memory/1572-121-0x0000000000000000-mapping.dmp

Download
memory/2556-115-0x0000000000000000-mapping.dmp

Download
memory/2560-123-0x0000000000000000-mapping.dmp

Download
memory/3112-125-0x0000000000000000-mapping.dmp

Download
memory/3976-122-0x0000000000000000-mapping.dmp

Download
memory/4016-126-0x0000000000000000-mapping.dmp

Download
memory/4092-118-0x0000000000000000-mapping.dmp

Download