hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqbmEyYTdic0psbDY5R2xCNVFGN0p5NS1pS3YtUXxBQ3Jtc0tualY0UUY3WkVyR29RdEY4dmhHRE5DS1MwTmM4SjhvN3gwMXpmVzlsb2xUaUtPQWtlVVRZZ2ljQ2V4akRpaWVMbElHVkVVSGhmSHdqbzJ0eGtLSURtOFFUdUtjWll0MGFFTVd4NzUzT3JFaHl4TGszQQ&q=http%3A%2F%2Flyksoomu[.]com%2FmO1x&v=YmBhPy4YQ3Q

Resubmissions

03/05/2023, 17:56

230503-wjh5fahf6w 1

03/05/2023, 17:54

230503-wg32tshf5w 4

Analysis

max time kernel
402s
max time network
1601s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
03/05/2023, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbmEyYTdic0psbDY5R2xCNVFGN0p5NS1pS3YtUXxBQ3Jtc0tualY0UUY3WkVyR29RdEY4dmhHRE5DS1MwTmM4SjhvN3gwMXpmVzlsb2xUaUtPQWtlVVRZZ2ljQ2V4akRpaWVMbElHVkVVSGhmSHdqbzJ0eGtLSURtOFFUdUtjWll0MGFFTVd4NzUzT3JFaHl4TGszQQ&q=http%3A%2F%2Flyksoomu.com%2FmO1x&v=YmBhPy4YQ3Q

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1112	2068	WerFault.exe	77
3724	4444	WerFault.exe	82

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "603"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000000ee4a50498aaf2ae7c436a68dbb599c936a938992feb033d3dd11915411b2110ed4910ec379a20acf31492fec6605d63094908a1512befdfb3b1784d1a9ad913296ccbaf0f526175c98b50dd6d1cebaf6fb65e41cc0337bcfdc615a51d7ad5e5e46bced1947388d911c75799d38885e74a1065e4e515344c14310477875b58162e6808bd399e473d18e8e4e47b46e91e527784f5cd00615d35103537c8dd81bbb78190e5ef710b379b0d26ba15f500d7690b5427f0643c349784d80093a05ac209d82dba248ec9bf9f5831c4ad348ca123ec998bdbe15e45c1ade571ce440f63f78bf363339370f132e8fb2d36a5e5d12b3a937e85171a7a34ac9ed6276ab1964ebcbf56d921595238dd79b26fe72f400215b45d57a6f608539f62a938b0c1a1f889a6b228d999b967579933a099731d179dde0e262ef1d9a5a7c55a14b7b3af6114c5739459f6b7bb752f720a5d9ad1e1f2165b694fff7d7ee57772ec1fac7dc07bb0715e438c96dd59b20e68d280f4ef34321740a9ceb5267728f7b588d6131de065330c359feb3b229bdec697534b9083aa1903dccf88ef490767aaebebc195085dafd2b4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "603"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "4080"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4162da1ef97dd901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "9t1tyxe"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsVisitCount\url2 = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 68d5b42af97dd901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 55e11732f97dd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "542"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "3058"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 903e2cb4a386d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000003a9561aa144753ac9c5d4def3796a1d71a78cd27682e008589f7b4082fd85fde4382f362ff9fab0cc2f299501795748a97b053589f83b35663d7	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsVisitCount\url1 = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3588	powershell.exe
3588	powershell.exe
3588	powershell.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	1948	MicrosoftEdge.exe
Token: SeDebugPrivilege	1948	MicrosoftEdge.exe
Token: SeDebugPrivilege	1948	MicrosoftEdge.exe
Token: SeDebugPrivilege	1948	MicrosoftEdge.exe
Token: SeDebugPrivilege	3400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3236	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3236	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2068	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2068	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2068	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1948	MicrosoftEdge.exe
Token: SeDebugPrivilege	4116	firefox.exe
Token: SeDebugPrivilege	4116	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1948	MicrosoftEdge.exe
4328	MicrosoftEdgeCP.exe
4328	MicrosoftEdgeCP.exe
5064	MicrosoftEdgeCP.exe
4116	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3400	4328	MicrosoftEdgeCP.exe	71
PID 4328 wrote to memory of 3400	4328	MicrosoftEdgeCP.exe	71
PID 4328 wrote to memory of 3400	4328	MicrosoftEdgeCP.exe	71
PID 4328 wrote to memory of 3400	4328	MicrosoftEdgeCP.exe	71
PID 4328 wrote to memory of 5064	4328	MicrosoftEdgeCP.exe	72
PID 4328 wrote to memory of 5064	4328	MicrosoftEdgeCP.exe	72
PID 4328 wrote to memory of 5064	4328	MicrosoftEdgeCP.exe	72
PID 4328 wrote to memory of 5064	4328	MicrosoftEdgeCP.exe	72
PID 4328 wrote to memory of 5064	4328	MicrosoftEdgeCP.exe	72
PID 4328 wrote to memory of 5064	4328	MicrosoftEdgeCP.exe	72
PID 4328 wrote to memory of 5064	4328	MicrosoftEdgeCP.exe	72
PID 4328 wrote to memory of 4444	4328	MicrosoftEdgeCP.exe	82
PID 4328 wrote to memory of 4444	4328	MicrosoftEdgeCP.exe	82
PID 4328 wrote to memory of 4444	4328	MicrosoftEdgeCP.exe	82
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 4328 wrote to memory of 4144	4328	MicrosoftEdgeCP.exe	84
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 1088 wrote to memory of 4116	1088	firefox.exe	87
PID 4116 wrote to memory of 3080	4116	firefox.exe	88
PID 4116 wrote to memory of 3080	4116	firefox.exe	88
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89
PID 4116 wrote to memory of 1256	4116	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbmEyYTdic0psbDY5R2xCNVFGN0p5NS1pS3YtUXxBQ3Jtc0tualY0UUY3WkVyR29RdEY4dmhHRE5DS1MwTmM4SjhvN3gwMXpmVzlsb2xUaUtPQWtlVVRZZ2ljQ2V4akRpaWVMbElHVkVVSGhmSHdqbzJ0eGtLSURtOFFUdUtjWll0MGFFTVd4NzUzT3JFaHl4TGszQQ&q=http%3A%2F%2Flyksoomu.com%2FmO1x&v=YmBhPy4YQ3Q
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4632

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5064

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2068 -s 3504
  2⤵
  - Program crash
  PID:1112

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4444 -s 3400
  2⤵
  - Program crash
  PID:3724

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.0.691669075\180222336" -parentBuildID 20221007134813 -prefsHandle 1668 -prefMapHandle 1656 -prefsLen 20810 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e05ac4a8-968f-48bc-825e-1d9045644295} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 1748 11fb861b858 gpu
    3⤵
    PID:3080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.1.250888509\1242557327" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20891 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d410ba28-a9e1-4d48-92b5-1ebf528e9f3f} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 2104 11fabe71658 socket
    3⤵
    - Checks processor information in registry
    PID:1256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.2.639232333\850292036" -childID 1 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 20974 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4027caff-2433-4129-b0ac-5c739785b50d} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 2876 11fbb2e2258 tab
    3⤵
    PID:4024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.3.901079664\1486352596" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3496 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b271034c-a858-46d4-8109-67fc780b984b} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 3516 11fabe62858 tab
    3⤵
    PID:4376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.4.1774412347\1759027719" -childID 3 -isForBrowser -prefsHandle 4068 -prefMapHandle 4064 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8ffb4b9-6ba8-47f4-bfd2-0c5a8a663095} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 4084 11fbcde7358 tab
    3⤵
    PID:4680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.7.343227911\967409631" -childID 6 -isForBrowser -prefsHandle 5132 -prefMapHandle 5136 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c638259f-07dd-4699-a72a-b64e0751efbb} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 4932 11fbc20b858 tab
    3⤵
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.6.742662008\1078920938" -childID 5 -isForBrowser -prefsHandle 4916 -prefMapHandle 4912 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {00496c64-7749-4f9f-b572-8b8fc9914440} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 2944 11fbc20b258 tab
    3⤵
    PID:4976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.5.1971685488\1258118944" -childID 4 -isForBrowser -prefsHandle 4752 -prefMapHandle 4788 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27f3ce2c-8e36-4f63-844c-52a4dbd3966e} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 1560 11fabe2db58 tab
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.8.1126331432\1267368761" -childID 7 -isForBrowser -prefsHandle 2568 -prefMapHandle 3836 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d14eedc-e468-43e3-8751-8b0564505b74} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 2968 11fbd4ddb58 tab
    3⤵
    PID:3704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6FGHNCOX\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\activity-stream.discovery_stream.json.tmp

Filesize
149KB

MD5
23f889d778457acd7f4e3573239317e1

SHA1
97706959081aa70865a6a81536a48d11a85e9430

SHA256
76d9a7016945dca64f02050cfbfee02a76ee631db1f61b7c3b61932f3deb6b10

SHA512
05b9144aba63db734f4ce34ad9a303af2c58f7a87a35b73afb1ee0b581af585267bca711ea75fea2e969cf16ef2d52fba7cb0cf0bed851317d200941dc0d8316

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\warmup[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\LG1P8J4U\www.bing[1].xml

Filesize
1KB

MD5
14bec772cfb786dd04f824d6ddbf8c1b

SHA1
87ac33b00198e3d45bab043ed2264dbd20d65954

SHA256
ffd6162f520cfee449c06132bb8624c1b0c84e9e4e872c04ffcf07310859f509

SHA512
80863826cbb489de511ede5b2d96f5b365bb12a785d73b65e599c60cda86669e19c1e27d2821033056812f29166b81c0fe5ad47079c7ddddf56daf22d27d1ec9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\LG1P8J4U\www.bing[1].xml

Filesize
6KB

MD5
355fcd7db85cb488f4b0359728e2bcb7

SHA1
5d4659d73d5452b64ede2bbae1afdd4f917575e3

SHA256
9ba32073393dc971872f8dfbf1aad2428da97ebde62860161e432f64988bfdd1

SHA512
269ed6a9312ecf8299adcfd32976c9405f874781eb508403cd4adabf0610cd95bc52ed1039c0104630c492807ba8dc87603b3bc33d7ec332b36296999446a16f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFFDB0E0A7D593560F.TMP

Filesize
32KB

MD5
5bd442e3f7c2c74f736fcd938bc24faf

SHA1
13a13a6e29db651780de03a3862043d8a6053885

SHA256
845fff790419b6563a9c52cc2c99c021fe19c1464a30ee7d7744e5f2c59ce180

SHA512
8182584c27663379c329923a18ae9413ca566623702f500dea2c42b76bcbb36dd8028c707f6d5e0dff5f71c170a201235fc976ffdc41dbfc6701a696f238ec64

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\KFOlCnqEu92Fr1MmEU9vBg[1].woff2

Filesize
49KB

MD5
08c655068d5dd3674b4f2eaacb470c03

SHA1
9430880adc2841ca12c163de1c1b3bf9f18c4375

SHA256
4fc8591cc545b7b4f70d80b085bf6577fad41d5d30ddd4f0d0c8ab792084c35e

SHA512
b2fce4bc018fa18de66095cc33d95455a4d544e93d512b02bcb8af06aadb550cd0f4aecbceaa013857196c91b6e3c4565a199835cfb37c682cb7bddb69420198

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\KFOlCnqEu92Fr1MmSU5vBg[1].woff2

Filesize
49KB

MD5
8a62a215526d45866385d53ed7509ae8

SHA1
5f22bfd8ff7dab62ac11b76dee4ef04b419d59b5

SHA256
34ccd21cf8cc2a2bdcd7dbe6bef05246067ff849bf71308e207bf525f581763d

SHA512
845f721e564e03955c34607c9c9cf4000db46788313ebf27c1d12473c7948cf2609b08b24093c5d01f6c97acc79456e7aa838c291462bfb19700bbfd07ee243f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\KFOmCnqEu92Fr1Me4A[1].woff2

Filesize
49KB

MD5
ee26c64c3b9b936cc1636071584d1181

SHA1
8efbc8a10d568444120cc0adf001b2d74c3a2910

SHA256
d4d175f498b00516c629ce8af152cbe745d73932fa58cc9fdfc8e4b49c0da368

SHA512
981a0d065c999eea3c61a2ba522cb64a0c11f0d0f0fe7529c917f956bce71e1622654d50d7d9f03f37774d8eee0370cfb8a86a0606723923b0e0061e1049cbc6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\www-i18n-constants[1].js

Filesize
5KB

MD5
5eae7233ffd6b404a912fedc9cd5f033

SHA1
9ab8ee6f71d53087105b8b277a774c18279d9b02

SHA256
b4809d3495c2e0feed0ae9501cc7fae69f0cbe5c251d51d4cf6d59631f20328f

SHA512
ffe893c89a660937d025db636001e0eb6a2c84a893f28dc1a28fe3750f3cc8ae763dc3110e7232a8adf7af0df600968817257f3217815640114833077e7fdd88

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\www-tampering[1].js

Filesize
10KB

MD5
bfbb0ba84fe3bfce2aaa23f4a07bf5ee

SHA1
11a30e7fc7e8bac9c604c6070f649ed7b49a10e7

SHA256
0b075b596d2930687c7ebdb98f265b4ecff2a97e566047cc0f9c364a353772a2

SHA512
2710b57965359f72fc6de227e3f3fbd80440579b296b9db336ad2600d557d1614309b2e4ce0c52da60e9ab8d4d0fac0a4ed3c300f23b4b46bbe89db639b6fc67

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCNX17U\KFOlCnqEu92Fr1MmWUlvBg[1].woff2

Filesize
49KB

MD5
90f0b37f809b546f34189807169e9a76

SHA1
ee8c931951df57cd7b7c8758053c72ebebf22297

SHA256
9dcacf1d025168ee2f84aaf40bad826f08b43c94db12eb59dbe2a06a3e98bfb2

SHA512
bd5ff2334a74edb6a68a394096d9ae01bd744d799a49b33e1fd95176cbec8b40d8e19f24b9f424f43b5053f11b8dd50b488bffedd5b04edbaa160756dd1c7628

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCNX17U\network[1].js

Filesize
16KB

MD5
d954c2a0b6bd533031dab62df4424de3

SHA1
605df5c6bdc3b27964695b403b51bccf24654b10

SHA256
075b233f5b75cfa6308eacc965e83f4d11c6c1061c56d225d2322d3937a5a46b

SHA512
4cbe104db33830405bb629bf0ddceee03e263baeb49afbfb188b941b3431e3f66391f7a4f5008674de718b5f8af60d4c5ee80cfe0671c345908f247b0cfaa127

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCNX17U\rs=AGKMywGynMpZadDd_Lu7ZDZYCebJBJrCGQ[1].css

Filesize
138KB

MD5
a14587236b683c97e43c6ebed5570325

SHA1
cda7bd8b47d0e3e855ac98b0be11168af14b489d

SHA256
b2aa2097951d09528a06dc1a3057c5880d6e38d08f7dfb991d8d011edf2d7dd4

SHA512
80a1f30c75b75cc75e216724dcf05d8560990fbdd760030139ca14136cf467dc690a3bbac034030f009a8f97b0b7318a315fb1b59b090725fff958102b3105a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCNX17U\scheduler[1].js

Filesize
7KB

MD5
2c741d303e5ad03fc5c50b8ec6f3be09

SHA1
1b48c16f18bc4a293ef0cd4777d37b3b039536be

SHA256
2520f559f7bc4e171a9826769bef6566fcca1b70061c610832778c2c366e0778

SHA512
c3585d8a34b5b71440ff4b5706a92c26654455fa1a778441c18f18dc344c3681f6d71d5a169b15452ea64e504a18ceee3f60111033cdd5abbb90e809b559a18c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QD5CJ8N6\css2[1].css

Filesize
2KB

MD5
f7aab2e4f194ab8d1f396c0c40318299

SHA1
969ef8e2bdd4cc8670a281270f6cfa6850d04b2c

SHA256
f57cac4f1bfe3bda19f853a4c497b0186481fbb5f7b786825da4cb0edff79d7d

SHA512
042ce410c42c494399547aafcd8df73275175ea076cff2ca2504a01ed49dbabc594c21157fc3a64d6fd081b2e30e4fb1237a0b836d57cce81546d68242e2a98a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QD5CJ8N6\spf[1].js

Filesize
40KB

MD5
4e6788978c91a0e928d96c5d9ea83d62

SHA1
365baa57a87d564172a48a9530e9b597445f7fe0

SHA256
7e65e377c853d7333a4c889236bf471d114a3a48bf2f6d1263e1888cb6aca244

SHA512
5882023af51a5254ca70c0c541ecf0b3ce54b58bf3d3e886a999cd4ba92393d1047744688350ee2a858c485314af3a1e6cfc5c07701d08e7ff003da446f06271

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QD5CJ8N6\webcomponents-ce-sd[1].js

Filesize
95KB

MD5
58b49536b02d705342669f683877a1c7

SHA1
1dab2e925ab42232c343c2cd193125b5f9c142fa

SHA256
dea31a0a884a91f8f34710a646d832bc0edc9fc151ffd9811f89c47a3f4a6d7c

SHA512
c7a70bdefd02b89732e12605ad6322d651ffa554e959dc2c731d817f7bf3e6722b2c5d479eb84bd61b6ee174669440a5fa6ac4083a173b6cf5b30d14388483d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QD5CJ8N6\www-onepick[1].css

Filesize
1011B

MD5
5306f13dfcf04955ed3e79ff5a92581e

SHA1
4a8927d91617923f9c9f6bcc1976bf43665cb553

SHA256
6305c2a6825af37f17057fd4dcb3a70790cc90d0d8f51128430883829385f7cc

SHA512
e91ecd1f7e14ff13035dd6e76dfa4fa58af69d98e007e2a0d52bff80d669d33beb5fafefe06254cbc6dd6713b4c7f79c824f641cb704142e031c68eccb3efed3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\desktop_polymer[1].js

Filesize
9.2MB

MD5
d8724d4a3b922564237ea8bd77ae3908

SHA1
e2c48b20789f649db2a672097281f6e3f0977070

SHA256
61e079f4325d9e9b7a75672f1b663dbb76ceb3447571c38293d2f35f69abaa9a

SHA512
4b83ccc14bada9de3ea837736cd05144df424d558e650cbc0120a26964511b43de93c1dffba7d381a558db3be386a11f9aa47dd0975b101ce81afc237861c6c4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\intersection-observer.min[1].js

Filesize
5KB

MD5
936a7c8159737df8dce532f9ea4d38b4

SHA1
8834ea22eff1bdfd35d2ef3f76d0e552e75e83c5

SHA256
3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9

SHA512
54471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\web-animations-next-lite.min[1].js

Filesize
49KB

MD5
cb9360b813c598bdde51e35d8e5081ea

SHA1
d2949a20b3e1bc3e113bd31ccac99a81d5fa353d

SHA256
e0cbfda7bfd7be1dcb66bbb507a74111fc4b2becbc742cd879751c3b4cbfa2f0

SHA512
a51e7374994b6c4adc116bc9dea60e174032f7759c0a4ff8eef0ce1a053054660d205c9bb05224ae67a64e2b232719ef82339a9cad44138b612006975578783c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\www-main-desktop-home-page-skeleton[1].css

Filesize
4KB

MD5
18bfa8a22a8a99dc038ca51556f2d84c

SHA1
3fba15bd6e149a8c49be165607fe4544389ed8c2

SHA256
3b42a68d19aef6537fbda6bb22f980f18a06ab08aa30943a827601ce3cc62049

SHA512
2581e6605d73018d0674fdca201fbec726e003ec52bf1876962ae7ddf195e6cdde748d74a3bc9b87a939661df41af7a7307067566bc695fbe700895d58f7101b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\A2AZZGR1.cookie

Filesize
101B

MD5
72b7be4b9c2f62b2a6731cb3c044507e

SHA1
88f675ebc2f4cf05046da3d429b6dfa639706ad2

SHA256
67c5a9b2abbcc098d23a80fa9bb860ccee660f2213bd811d4b9a8790845bfaa7

SHA512
1e75fa27d4529146e5ed4a3c4ff058dda232fb0a6deabc40703eb10524673050fcb2b1b7a87f63c8eb30fce7baf5edf2ac84b89c092f9c35be8c68f6328aa13f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\H01HNI3A.cookie

Filesize
344B

MD5
762f2bc1d1a2dcad2c3df29ccec1611e

SHA1
0baf9f8aece25e4c9a627b4725c12521cbbf62cc

SHA256
0f0c80832c03661662d66c98487287de7d17780f322d68c43a9d4a38b804def7

SHA512
06379a4b86ce58ae4f04ef8b9e6cee1ca145c2662a6b9d58fdd727e8316d0debbf95d341e6fe207197ab45508eace82a17239b89a3d96269faa11eee99e70f92

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e9602f9bc2818ee192ddc227170e8e6b

SHA1
828d2eccaa5802f5a506191f80a1603af84ecf8f

SHA256
3368956172461b5ba32cf3dde9731c8938981d02e7b7a63b22a1b7a857cce7a3

SHA512
db74186ba70c71a1fb90ab390bc2d215dd95feb75c5f004a97d11b5a336a63a3f59ba647e69ee49e952c044f55b7f3d9e48b7b5a6df1686da459f4334403be0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_167048499A9877CCEFD35EE3C1FEAAB2

Filesize
472B

MD5
3a72067351b347eb5c7a7deaca3594ad

SHA1
b6ed79f64b05083485f0840e97535c1afb2b472b

SHA256
84f7bf729eef3c67bc9595c52bc7ff4c86e45dea8b4cee26abc7a10418be2a0d

SHA512
6d6840b7ecffed8454980546c4b68b3dc0f9f7f74fffea88570d87738f42a5d0f2be1a0fd3bb04d8409748eafdf3586d5bd120e24dd5f682b52b3dd89a2b4bdb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_309B303B90F655EEEC702C35A278AA80

Filesize
472B

MD5
96e446cc22921691e5a30eaf19f082e6

SHA1
a4e298d39c0bf62e5ac88ed8e261e12d83cfd2ae

SHA256
4f90dbfe5ead44e4b1d78dae8f725e684c4f882b6d8ea643dda3eb4b68b025c5

SHA512
4582c14d740bee8bc3422cbcacb7238cb27b3ae961871e75cd2ee0013f65d34d26f29e5ce20ff77b5d1b89c1ebe9377a2680c24f2cb0a91c49b08d165d393fb2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
aa62f8ce77e072c8160c71b5df3099b0

SHA1
06b8c07db93694a3fe73a4276283fabb0e20ac38

SHA256
3eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176

SHA512
71724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_83714946F9F5F0DC078BE568126375A5

Filesize
472B

MD5
10b49cca166b52d304b0465208afd90e

SHA1
b3ad183db5ca4e63f1c309fad49a85cf34f75052

SHA256
9ba884b68893feaa6fe66fc795ab11022b4228bd1f845a1c251857394bfd072c

SHA512
482f35a18eec2a958852e60d4b44fb74d6e05999775466fd838023e8331b87e2ebabcd2ea49651fae105468f7f0000d01399bf400f94a78fd88a3b0a36501743

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
3f3e08afdc88aa6b5dcf58a0a3c9646c

SHA1
895c0bc0ca1bd80589db7e00c6504cef67d7a881

SHA256
a9dd95b985f151b2707a0bbbeac0504d98ff6a004f140476ec85ea1f5ba1a79b

SHA512
fea372f94609581387dd9fd6a605688f55221f339cee2e1bf15270c61b6db16bf0b44fbe80ecfbbc3aa81fe5553b58b35e820e2d3dc910ee1673c6bdfd27489e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_167048499A9877CCEFD35EE3C1FEAAB2

Filesize
406B

MD5
72792dc85c38ba75e062096572585e31

SHA1
ad81b7da3b788a3d9cf0bb15d411b96ff8e33ca4

SHA256
1412347097280e09216c4338d6c6576a06a5207889ebdccd24bf4af602fa65a7

SHA512
c7e43a8736134e3a9fb3187e2462d2f48d5d8f8b18aa3f2965beebaa0596ac2b566f5233b4440773d02bd769aade4a2eb3e7bf068d2693450e7397da75b1bd8b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_309B303B90F655EEEC702C35A278AA80

Filesize
410B

MD5
c677bc823b8b0c00bac6f7cf44f3d366

SHA1
c3c918a98b78db40abfaf0bca2251baab9052022

SHA256
1adb2daae50506af0c83b7f63cbf94f9c4868632f23f00f61bc649617c0e1789

SHA512
508d8d71d6396236c13eade1264fbc6d4022716ee3adae0d387e13226a1eb935d260371f90eff35fecda0e7ad8a4143222b90ee72cada448cc41f9092f35c3a3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
fee61be68b8e0827ad74df95439843aa

SHA1
530f93752b4d1a942ba94a11711ebcea12682e8d

SHA256
88d813fbcd38c42e052f018abd8f5d1a54a086fdce6f40247e90241e8cb1b353

SHA512
e225b05e2b042efaaa586e5050d692520c3feabb1010b0c5fe060ebe2a7f48391dbd972fb5b1f41f0bd593c2db14c4d2ab77d7816232dca13745a55609af9b0d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_83714946F9F5F0DC078BE568126375A5

Filesize
402B

MD5
8989de2a92db6f2fa4fd14f6901880ac

SHA1
f7c394b0644223d73b88e5269e9fe6fff2d27006

SHA256
e94ae687c5ecadbaecb063aa339e3f707f1592c817150c2b09a723464727f590

SHA512
d78cef2e8264ceb3389fb8a7b39bd7b485ca2b5b2564f29249a71e5081ca394ecf3883334e81c919104f7091e760830c33240fe5055d14e5fe0e4998ee8636f2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0y50lg05.yfx.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs.js

Filesize
6KB

MD5
cdb5a91b7898f75f98e448e80b41dba6

SHA1
c749651f98e32a2320d2e52fd467fd6217660535

SHA256
ed56bd19352777293cf7195af0fe1412d52e25af6a9a8e2bb04e3e32056556dc

SHA512
b99bca03a398f7e068691852106fe03a90489d1e8230720749c25703e59874765ef706e9e27c9215251372efee84d9c9d0eb636a54e45035d5d2095304fee97b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
ee45f4348f289d888121b56c3f07555a

SHA1
43b8c55024637f5f39c5562258bc74d817fe0e2e

SHA256
89ac0e6863d60731dcbb15505774f4c95ec04a468732f3054fd9770edea15bcd

SHA512
7f53f04a0d0655e7f8104acce6c6d9948ac8e22eb76a9abbfc07188a7be56db080210bb33422790f51e486a6f7e794235ba86206f50eb6a3c2fff0a309bb00a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
7560dc4bb76a37cd763256b3db6e9550

SHA1
bd05356d9af7cbbab80a9a99c31e5bc37ff1d615

SHA256
15897add9c65869df241039e15425456899cb83018064ee63a180292ff735416

SHA512
83d5df9cedbc394bccfafa49e03367b0b7970759dc7cc4b29d8d0e87d6ffdd1556b396858563b0cf680598870429d17cb4718e6e66a90538eb6c676dae0f0725

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore.jsonlz4

Filesize
1KB

MD5
84500ca7e9b722af30057b80edcd1160

SHA1
9160e0c8999ac2f16d94f03f0b2e89201e5c115c

SHA256
799df7a07724baafc5f7f9cd3959056f4cb4767df49db24de71b9087821baf2a

SHA512
852e6f504d54cb1917fff45f83c9b44abdbf062a7f5df2cda8397c13660ff183dc3b9e7a8fa1ec31d16cc641dd4fd5123cf32e78deaa3c51e023df690d636326

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
fa2cb26398a675b1648b15264672ed4e

SHA1
6f0dce025b4e317366c4b00da7134cf12aa082b1

SHA256
4afecd2e7f92ef105633806ab512ce28106893b953f46150a77fb82f5b3c3b59

SHA512
b95435aed8515c28ada9f1ed8970d7643ac44b74da014b4d60097c26d03693bcaf181872310f77e372808eae19ce83a6bdffc5f8acba3a00d0e8e523e168377a

Download Submit
memory/1948-190-0x000001E9DCA50000-0x000001E9DCA51000-memory.dmp

Filesize
4KB

Download
memory/1948-192-0x000001E9DCA90000-0x000001E9DCA92000-memory.dmp

Filesize
8KB

Download
memory/1948-195-0x000001E9E11B0000-0x000001E9E11B2000-memory.dmp

Filesize
8KB

Download
memory/1948-171-0x000001E9DCC00000-0x000001E9DCC10000-memory.dmp

Filesize
64KB

Download
memory/1948-194-0x000001E9E1180000-0x000001E9E1182000-memory.dmp

Filesize
8KB

Download
memory/2068-548-0x00000221FE7C0000-0x00000221FE7E0000-memory.dmp

Filesize
128KB

Download
memory/3400-211-0x0000023712C10000-0x0000023712C12000-memory.dmp

Filesize
8KB

Download
memory/3400-213-0x0000023712C30000-0x0000023712C32000-memory.dmp

Filesize
8KB

Download
memory/3400-206-0x0000023712A20000-0x0000023712A22000-memory.dmp

Filesize
8KB

Download
memory/3400-209-0x0000023712A50000-0x0000023712A52000-memory.dmp

Filesize
8KB

Download
memory/3588-125-0x000001D0EA4F0000-0x000001D0EA500000-memory.dmp

Filesize
64KB

Download
memory/3588-129-0x000001D0EAFA0000-0x000001D0EB016000-memory.dmp

Filesize
472KB

Download
memory/3588-126-0x000001D0EA4F0000-0x000001D0EA500000-memory.dmp

Filesize
64KB

Download
memory/3588-124-0x000001D0EAE70000-0x000001D0EAE92000-memory.dmp

Filesize
136KB

Download
memory/4444-643-0x000001A4B7600000-0x000001A4B7700000-memory.dmp

Filesize
1024KB

Download
memory/4444-659-0x000001A4C9520000-0x000001A4C9540000-memory.dmp

Filesize
128KB

Download
memory/5064-304-0x00000210DA120000-0x00000210DA140000-memory.dmp

Filesize
128KB

Download
memory/5064-483-0x00000210DB800000-0x00000210DB900000-memory.dmp

Filesize
1024KB

Download
memory/5064-366-0x00000210DACA0000-0x00000210DACA2000-memory.dmp

Filesize
8KB

Download
memory/5064-369-0x00000210DACC0000-0x00000210DACC2000-memory.dmp

Filesize
8KB

Download
memory/5064-362-0x00000210DAC80000-0x00000210DAC82000-memory.dmp

Filesize
8KB

Download
memory/5064-478-0x00000210DB400000-0x00000210DB500000-memory.dmp

Filesize
1024KB

Download
memory/5064-477-0x00000210DAEE0000-0x00000210DAF00000-memory.dmp

Filesize
128KB

Download
memory/5064-414-0x00000210DA520000-0x00000210DA540000-memory.dmp

Filesize
128KB

Download
memory/5064-410-0x00000210DA520000-0x00000210DA540000-memory.dmp

Filesize
128KB

Download
memory/5064-407-0x00000210DA520000-0x00000210DA540000-memory.dmp

Filesize
128KB

Download