Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
402s -
max time network
1601s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03/05/2023, 17:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbmEyYTdic0psbDY5R2xCNVFGN0p5NS1pS3YtUXxBQ3Jtc0tualY0UUY3WkVyR29RdEY4dmhHRE5DS1MwTmM4SjhvN3gwMXpmVzlsb2xUaUtPQWtlVVRZZ2ljQ2V4akRpaWVMbElHVkVVSGhmSHdqbzJ0eGtLSURtOFFUdUtjWll0MGFFTVd4NzUzT3JFaHl4TGszQQ&q=http%3A%2F%2Flyksoomu.com%2FmO1x&v=YmBhPy4YQ3Q
Resource
win10-20230220-en
General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbmEyYTdic0psbDY5R2xCNVFGN0p5NS1pS3YtUXxBQ3Jtc0tualY0UUY3WkVyR29RdEY4dmhHRE5DS1MwTmM4SjhvN3gwMXpmVzlsb2xUaUtPQWtlVVRZZ2ljQ2V4akRpaWVMbElHVkVVSGhmSHdqbzJ0eGtLSURtOFFUdUtjWll0MGFFTVd4NzUzT3JFaHl4TGszQQ&q=http%3A%2F%2Flyksoomu.com%2FmO1x&v=YmBhPy4YQ3Q
Malware Config
Signatures
-
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1112 2068 WerFault.exe 77 3724 4444 WerFault.exe 82 -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "603" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000000ee4a50498aaf2ae7c436a68dbb599c936a938992feb033d3dd11915411b2110ed4910ec379a20acf31492fec6605d63094908a1512befdfb3b1784d1a9ad913296ccbaf0f526175c98b50dd6d1cebaf6fb65e41cc0337bcfdc615a51d7ad5e5e46bced1947388d911c75799d38885e74a1065e4e515344c14310477875b58162e6808bd399e473d18e8e4e47b46e91e527784f5cd00615d35103537c8dd81bbb78190e5ef710b379b0d26ba15f500d7690b5427f0643c349784d80093a05ac209d82dba248ec9bf9f5831c4ad348ca123ec998bdbe15e45c1ade571ce440f63f78bf363339370f132e8fb2d36a5e5d12b3a937e85171a7a34ac9ed6276ab1964ebcbf56d921595238dd79b26fe72f400215b45d57a6f608539f62a938b0c1a1f889a6b228d999b967579933a099731d179dde0e262ef1d9a5a7c55a14b7b3af6114c5739459f6b7bb752f720a5d9ad1e1f2165b694fff7d7ee57772ec1fac7dc07bb0715e438c96dd59b20e68d280f4ef34321740a9ceb5267728f7b588d6131de065330c359feb3b229bdec697534b9083aa1903dccf88ef490767aaebebc195085dafd2b4 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "603" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "4080" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4162da1ef97dd901 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "9t1tyxe" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsVisitCount\url2 = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 68d5b42af97dd901 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 55e11732f97dd901 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "542" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "3058" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 903e2cb4a386d901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000003a9561aa144753ac9c5d4def3796a1d71a78cd27682e008589f7b4082fd85fde4382f362ff9fab0cc2f299501795748a97b053589f83b35663d7 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsVisitCount\url1 = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3588 powershell.exe 3588 powershell.exe 3588 powershell.exe -
Suspicious behavior: MapViewOfSection 10 IoCs
pid Process 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 1948 MicrosoftEdge.exe Token: SeDebugPrivilege 1948 MicrosoftEdge.exe Token: SeDebugPrivilege 1948 MicrosoftEdge.exe Token: SeDebugPrivilege 1948 MicrosoftEdge.exe Token: SeDebugPrivilege 3400 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3400 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3400 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3400 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5064 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5064 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5064 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5064 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3236 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3236 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2068 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2068 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2068 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1948 MicrosoftEdge.exe Token: SeDebugPrivilege 4116 firefox.exe Token: SeDebugPrivilege 4116 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4116 firefox.exe 4116 firefox.exe 4116 firefox.exe 4116 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4116 firefox.exe 4116 firefox.exe 4116 firefox.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1948 MicrosoftEdge.exe 4328 MicrosoftEdgeCP.exe 4328 MicrosoftEdgeCP.exe 5064 MicrosoftEdgeCP.exe 4116 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 3400 4328 MicrosoftEdgeCP.exe 71 PID 4328 wrote to memory of 3400 4328 MicrosoftEdgeCP.exe 71 PID 4328 wrote to memory of 3400 4328 MicrosoftEdgeCP.exe 71 PID 4328 wrote to memory of 3400 4328 MicrosoftEdgeCP.exe 71 PID 4328 wrote to memory of 5064 4328 MicrosoftEdgeCP.exe 72 PID 4328 wrote to memory of 5064 4328 MicrosoftEdgeCP.exe 72 PID 4328 wrote to memory of 5064 4328 MicrosoftEdgeCP.exe 72 PID 4328 wrote to memory of 5064 4328 MicrosoftEdgeCP.exe 72 PID 4328 wrote to memory of 5064 4328 MicrosoftEdgeCP.exe 72 PID 4328 wrote to memory of 5064 4328 MicrosoftEdgeCP.exe 72 PID 4328 wrote to memory of 5064 4328 MicrosoftEdgeCP.exe 72 PID 4328 wrote to memory of 4444 4328 MicrosoftEdgeCP.exe 82 PID 4328 wrote to memory of 4444 4328 MicrosoftEdgeCP.exe 82 PID 4328 wrote to memory of 4444 4328 MicrosoftEdgeCP.exe 82 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 4328 wrote to memory of 4144 4328 MicrosoftEdgeCP.exe 84 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 1088 wrote to memory of 4116 1088 firefox.exe 87 PID 4116 wrote to memory of 3080 4116 firefox.exe 88 PID 4116 wrote to memory of 3080 4116 firefox.exe 88 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 PID 4116 wrote to memory of 1256 4116 firefox.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbmEyYTdic0psbDY5R2xCNVFGN0p5NS1pS3YtUXxBQ3Jtc0tualY0UUY3WkVyR29RdEY4dmhHRE5DS1MwTmM4SjhvN3gwMXpmVzlsb2xUaUtPQWtlVVRZZ2ljQ2V4akRpaWVMbElHVkVVSGhmSHdqbzJ0eGtLSURtOFFUdUtjWll0MGFFTVd4NzUzT3JFaHl4TGszQQ&q=http%3A%2F%2Flyksoomu.com%2FmO1x&v=YmBhPy4YQ3Q1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1948
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4632
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5064
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:644
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2068 -s 35042⤵
- Program crash
PID:1112
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4444 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4444 -s 34002⤵
- Program crash
PID:3724
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4144
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.0.691669075\180222336" -parentBuildID 20221007134813 -prefsHandle 1668 -prefMapHandle 1656 -prefsLen 20810 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e05ac4a8-968f-48bc-825e-1d9045644295} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 1748 11fb861b858 gpu3⤵PID:3080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.1.250888509\1242557327" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20891 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d410ba28-a9e1-4d48-92b5-1ebf528e9f3f} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 2104 11fabe71658 socket3⤵
- Checks processor information in registry
PID:1256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.2.639232333\850292036" -childID 1 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 20974 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4027caff-2433-4129-b0ac-5c739785b50d} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 2876 11fbb2e2258 tab3⤵PID:4024
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.3.901079664\1486352596" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3496 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b271034c-a858-46d4-8109-67fc780b984b} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 3516 11fabe62858 tab3⤵PID:4376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.4.1774412347\1759027719" -childID 3 -isForBrowser -prefsHandle 4068 -prefMapHandle 4064 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8ffb4b9-6ba8-47f4-bfd2-0c5a8a663095} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 4084 11fbcde7358 tab3⤵PID:4680
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.7.343227911\967409631" -childID 6 -isForBrowser -prefsHandle 5132 -prefMapHandle 5136 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c638259f-07dd-4699-a72a-b64e0751efbb} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 4932 11fbc20b858 tab3⤵PID:4980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.6.742662008\1078920938" -childID 5 -isForBrowser -prefsHandle 4916 -prefMapHandle 4912 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {00496c64-7749-4f9f-b572-8b8fc9914440} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 2944 11fbc20b258 tab3⤵PID:4976
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.5.1971685488\1258118944" -childID 4 -isForBrowser -prefsHandle 4752 -prefMapHandle 4788 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27f3ce2c-8e36-4f63-844c-52a4dbd3966e} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 1560 11fabe2db58 tab3⤵PID:4944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4116.8.1126331432\1267368761" -childID 7 -isForBrowser -prefsHandle 2568 -prefMapHandle 3836 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d14eedc-e468-43e3-8751-8b0564505b74} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" 2968 11fbd4ddb58 tab3⤵PID:3704
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\activity-stream.discovery_stream.json.tmp
Filesize149KB
MD523f889d778457acd7f4e3573239317e1
SHA197706959081aa70865a6a81536a48d11a85e9430
SHA25676d9a7016945dca64f02050cfbfee02a76ee631db1f61b7c3b61932f3deb6b10
SHA51205b9144aba63db734f4ce34ad9a303af2c58f7a87a35b73afb1ee0b581af585267bca711ea75fea2e969cf16ef2d52fba7cb0cf0bed851317d200941dc0d8316
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\warmup[2].gif
Filesize43B
MD5325472601571f31e1bf00674c368d335
SHA12daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
SHA256b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
SHA512717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\LG1P8J4U\www.bing[1].xml
Filesize1KB
MD514bec772cfb786dd04f824d6ddbf8c1b
SHA187ac33b00198e3d45bab043ed2264dbd20d65954
SHA256ffd6162f520cfee449c06132bb8624c1b0c84e9e4e872c04ffcf07310859f509
SHA51280863826cbb489de511ede5b2d96f5b365bb12a785d73b65e599c60cda86669e19c1e27d2821033056812f29166b81c0fe5ad47079c7ddddf56daf22d27d1ec9
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\LG1P8J4U\www.bing[1].xml
Filesize6KB
MD5355fcd7db85cb488f4b0359728e2bcb7
SHA15d4659d73d5452b64ede2bbae1afdd4f917575e3
SHA2569ba32073393dc971872f8dfbf1aad2428da97ebde62860161e432f64988bfdd1
SHA512269ed6a9312ecf8299adcfd32976c9405f874781eb508403cd4adabf0610cd95bc52ed1039c0104630c492807ba8dc87603b3bc33d7ec332b36296999446a16f
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFFDB0E0A7D593560F.TMP
Filesize32KB
MD55bd442e3f7c2c74f736fcd938bc24faf
SHA113a13a6e29db651780de03a3862043d8a6053885
SHA256845fff790419b6563a9c52cc2c99c021fe19c1464a30ee7d7744e5f2c59ce180
SHA5128182584c27663379c329923a18ae9413ca566623702f500dea2c42b76bcbb36dd8028c707f6d5e0dff5f71c170a201235fc976ffdc41dbfc6701a696f238ec64
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\KFOlCnqEu92Fr1MmEU9vBg[1].woff2
Filesize49KB
MD508c655068d5dd3674b4f2eaacb470c03
SHA19430880adc2841ca12c163de1c1b3bf9f18c4375
SHA2564fc8591cc545b7b4f70d80b085bf6577fad41d5d30ddd4f0d0c8ab792084c35e
SHA512b2fce4bc018fa18de66095cc33d95455a4d544e93d512b02bcb8af06aadb550cd0f4aecbceaa013857196c91b6e3c4565a199835cfb37c682cb7bddb69420198
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\KFOlCnqEu92Fr1MmSU5vBg[1].woff2
Filesize49KB
MD58a62a215526d45866385d53ed7509ae8
SHA15f22bfd8ff7dab62ac11b76dee4ef04b419d59b5
SHA25634ccd21cf8cc2a2bdcd7dbe6bef05246067ff849bf71308e207bf525f581763d
SHA512845f721e564e03955c34607c9c9cf4000db46788313ebf27c1d12473c7948cf2609b08b24093c5d01f6c97acc79456e7aa838c291462bfb19700bbfd07ee243f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\KFOmCnqEu92Fr1Me4A[1].woff2
Filesize49KB
MD5ee26c64c3b9b936cc1636071584d1181
SHA18efbc8a10d568444120cc0adf001b2d74c3a2910
SHA256d4d175f498b00516c629ce8af152cbe745d73932fa58cc9fdfc8e4b49c0da368
SHA512981a0d065c999eea3c61a2ba522cb64a0c11f0d0f0fe7529c917f956bce71e1622654d50d7d9f03f37774d8eee0370cfb8a86a0606723923b0e0061e1049cbc6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\www-i18n-constants[1].js
Filesize5KB
MD55eae7233ffd6b404a912fedc9cd5f033
SHA19ab8ee6f71d53087105b8b277a774c18279d9b02
SHA256b4809d3495c2e0feed0ae9501cc7fae69f0cbe5c251d51d4cf6d59631f20328f
SHA512ffe893c89a660937d025db636001e0eb6a2c84a893f28dc1a28fe3750f3cc8ae763dc3110e7232a8adf7af0df600968817257f3217815640114833077e7fdd88
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4NAM5IKF\www-tampering[1].js
Filesize10KB
MD5bfbb0ba84fe3bfce2aaa23f4a07bf5ee
SHA111a30e7fc7e8bac9c604c6070f649ed7b49a10e7
SHA2560b075b596d2930687c7ebdb98f265b4ecff2a97e566047cc0f9c364a353772a2
SHA5122710b57965359f72fc6de227e3f3fbd80440579b296b9db336ad2600d557d1614309b2e4ce0c52da60e9ab8d4d0fac0a4ed3c300f23b4b46bbe89db639b6fc67
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCNX17U\KFOlCnqEu92Fr1MmWUlvBg[1].woff2
Filesize49KB
MD590f0b37f809b546f34189807169e9a76
SHA1ee8c931951df57cd7b7c8758053c72ebebf22297
SHA2569dcacf1d025168ee2f84aaf40bad826f08b43c94db12eb59dbe2a06a3e98bfb2
SHA512bd5ff2334a74edb6a68a394096d9ae01bd744d799a49b33e1fd95176cbec8b40d8e19f24b9f424f43b5053f11b8dd50b488bffedd5b04edbaa160756dd1c7628
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCNX17U\network[1].js
Filesize16KB
MD5d954c2a0b6bd533031dab62df4424de3
SHA1605df5c6bdc3b27964695b403b51bccf24654b10
SHA256075b233f5b75cfa6308eacc965e83f4d11c6c1061c56d225d2322d3937a5a46b
SHA5124cbe104db33830405bb629bf0ddceee03e263baeb49afbfb188b941b3431e3f66391f7a4f5008674de718b5f8af60d4c5ee80cfe0671c345908f247b0cfaa127
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCNX17U\rs=AGKMywGynMpZadDd_Lu7ZDZYCebJBJrCGQ[1].css
Filesize138KB
MD5a14587236b683c97e43c6ebed5570325
SHA1cda7bd8b47d0e3e855ac98b0be11168af14b489d
SHA256b2aa2097951d09528a06dc1a3057c5880d6e38d08f7dfb991d8d011edf2d7dd4
SHA51280a1f30c75b75cc75e216724dcf05d8560990fbdd760030139ca14136cf467dc690a3bbac034030f009a8f97b0b7318a315fb1b59b090725fff958102b3105a5
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5DCNX17U\scheduler[1].js
Filesize7KB
MD52c741d303e5ad03fc5c50b8ec6f3be09
SHA11b48c16f18bc4a293ef0cd4777d37b3b039536be
SHA2562520f559f7bc4e171a9826769bef6566fcca1b70061c610832778c2c366e0778
SHA512c3585d8a34b5b71440ff4b5706a92c26654455fa1a778441c18f18dc344c3681f6d71d5a169b15452ea64e504a18ceee3f60111033cdd5abbb90e809b559a18c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QD5CJ8N6\css2[1].css
Filesize2KB
MD5f7aab2e4f194ab8d1f396c0c40318299
SHA1969ef8e2bdd4cc8670a281270f6cfa6850d04b2c
SHA256f57cac4f1bfe3bda19f853a4c497b0186481fbb5f7b786825da4cb0edff79d7d
SHA512042ce410c42c494399547aafcd8df73275175ea076cff2ca2504a01ed49dbabc594c21157fc3a64d6fd081b2e30e4fb1237a0b836d57cce81546d68242e2a98a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QD5CJ8N6\spf[1].js
Filesize40KB
MD54e6788978c91a0e928d96c5d9ea83d62
SHA1365baa57a87d564172a48a9530e9b597445f7fe0
SHA2567e65e377c853d7333a4c889236bf471d114a3a48bf2f6d1263e1888cb6aca244
SHA5125882023af51a5254ca70c0c541ecf0b3ce54b58bf3d3e886a999cd4ba92393d1047744688350ee2a858c485314af3a1e6cfc5c07701d08e7ff003da446f06271
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QD5CJ8N6\webcomponents-ce-sd[1].js
Filesize95KB
MD558b49536b02d705342669f683877a1c7
SHA11dab2e925ab42232c343c2cd193125b5f9c142fa
SHA256dea31a0a884a91f8f34710a646d832bc0edc9fc151ffd9811f89c47a3f4a6d7c
SHA512c7a70bdefd02b89732e12605ad6322d651ffa554e959dc2c731d817f7bf3e6722b2c5d479eb84bd61b6ee174669440a5fa6ac4083a173b6cf5b30d14388483d4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QD5CJ8N6\www-onepick[1].css
Filesize1011B
MD55306f13dfcf04955ed3e79ff5a92581e
SHA14a8927d91617923f9c9f6bcc1976bf43665cb553
SHA2566305c2a6825af37f17057fd4dcb3a70790cc90d0d8f51128430883829385f7cc
SHA512e91ecd1f7e14ff13035dd6e76dfa4fa58af69d98e007e2a0d52bff80d669d33beb5fafefe06254cbc6dd6713b4c7f79c824f641cb704142e031c68eccb3efed3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\desktop_polymer[1].js
Filesize9.2MB
MD5d8724d4a3b922564237ea8bd77ae3908
SHA1e2c48b20789f649db2a672097281f6e3f0977070
SHA25661e079f4325d9e9b7a75672f1b663dbb76ceb3447571c38293d2f35f69abaa9a
SHA5124b83ccc14bada9de3ea837736cd05144df424d558e650cbc0120a26964511b43de93c1dffba7d381a558db3be386a11f9aa47dd0975b101ce81afc237861c6c4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\intersection-observer.min[1].js
Filesize5KB
MD5936a7c8159737df8dce532f9ea4d38b4
SHA18834ea22eff1bdfd35d2ef3f76d0e552e75e83c5
SHA2563ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9
SHA51254471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\web-animations-next-lite.min[1].js
Filesize49KB
MD5cb9360b813c598bdde51e35d8e5081ea
SHA1d2949a20b3e1bc3e113bd31ccac99a81d5fa353d
SHA256e0cbfda7bfd7be1dcb66bbb507a74111fc4b2becbc742cd879751c3b4cbfa2f0
SHA512a51e7374994b6c4adc116bc9dea60e174032f7759c0a4ff8eef0ce1a053054660d205c9bb05224ae67a64e2b232719ef82339a9cad44138b612006975578783c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Y6AEOWX3\www-main-desktop-home-page-skeleton[1].css
Filesize4KB
MD518bfa8a22a8a99dc038ca51556f2d84c
SHA13fba15bd6e149a8c49be165607fe4544389ed8c2
SHA2563b42a68d19aef6537fbda6bb22f980f18a06ab08aa30943a827601ce3cc62049
SHA5122581e6605d73018d0674fdca201fbec726e003ec52bf1876962ae7ddf195e6cdde748d74a3bc9b87a939661df41af7a7307067566bc695fbe700895d58f7101b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\A2AZZGR1.cookie
Filesize101B
MD572b7be4b9c2f62b2a6731cb3c044507e
SHA188f675ebc2f4cf05046da3d429b6dfa639706ad2
SHA25667c5a9b2abbcc098d23a80fa9bb860ccee660f2213bd811d4b9a8790845bfaa7
SHA5121e75fa27d4529146e5ed4a3c4ff058dda232fb0a6deabc40703eb10524673050fcb2b1b7a87f63c8eb30fce7baf5edf2ac84b89c092f9c35be8c68f6328aa13f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\H01HNI3A.cookie
Filesize344B
MD5762f2bc1d1a2dcad2c3df29ccec1611e
SHA10baf9f8aece25e4c9a627b4725c12521cbbf62cc
SHA2560f0c80832c03661662d66c98487287de7d17780f322d68c43a9d4a38b804def7
SHA51206379a4b86ce58ae4f04ef8b9e6cee1ca145c2662a6b9d58fdd727e8316d0debbf95d341e6fe207197ab45508eace82a17239b89a3d96269faa11eee99e70f92
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5e9602f9bc2818ee192ddc227170e8e6b
SHA1828d2eccaa5802f5a506191f80a1603af84ecf8f
SHA2563368956172461b5ba32cf3dde9731c8938981d02e7b7a63b22a1b7a857cce7a3
SHA512db74186ba70c71a1fb90ab390bc2d215dd95feb75c5f004a97d11b5a336a63a3f59ba647e69ee49e952c044f55b7f3d9e48b7b5a6df1686da459f4334403be0a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_167048499A9877CCEFD35EE3C1FEAAB2
Filesize472B
MD53a72067351b347eb5c7a7deaca3594ad
SHA1b6ed79f64b05083485f0840e97535c1afb2b472b
SHA25684f7bf729eef3c67bc9595c52bc7ff4c86e45dea8b4cee26abc7a10418be2a0d
SHA5126d6840b7ecffed8454980546c4b68b3dc0f9f7f74fffea88570d87738f42a5d0f2be1a0fd3bb04d8409748eafdf3586d5bd120e24dd5f682b52b3dd89a2b4bdb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_309B303B90F655EEEC702C35A278AA80
Filesize472B
MD596e446cc22921691e5a30eaf19f082e6
SHA1a4e298d39c0bf62e5ac88ed8e261e12d83cfd2ae
SHA2564f90dbfe5ead44e4b1d78dae8f725e684c4f882b6d8ea643dda3eb4b68b025c5
SHA5124582c14d740bee8bc3422cbcacb7238cb27b3ae961871e75cd2ee0013f65d34d26f29e5ce20ff77b5d1b89c1ebe9377a2680c24f2cb0a91c49b08d165d393fb2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5aa62f8ce77e072c8160c71b5df3099b0
SHA106b8c07db93694a3fe73a4276283fabb0e20ac38
SHA2563eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176
SHA51271724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_83714946F9F5F0DC078BE568126375A5
Filesize472B
MD510b49cca166b52d304b0465208afd90e
SHA1b3ad183db5ca4e63f1c309fad49a85cf34f75052
SHA2569ba884b68893feaa6fe66fc795ab11022b4228bd1f845a1c251857394bfd072c
SHA512482f35a18eec2a958852e60d4b44fb74d6e05999775466fd838023e8331b87e2ebabcd2ea49651fae105468f7f0000d01399bf400f94a78fd88a3b0a36501743
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD53f3e08afdc88aa6b5dcf58a0a3c9646c
SHA1895c0bc0ca1bd80589db7e00c6504cef67d7a881
SHA256a9dd95b985f151b2707a0bbbeac0504d98ff6a004f140476ec85ea1f5ba1a79b
SHA512fea372f94609581387dd9fd6a605688f55221f339cee2e1bf15270c61b6db16bf0b44fbe80ecfbbc3aa81fe5553b58b35e820e2d3dc910ee1673c6bdfd27489e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_167048499A9877CCEFD35EE3C1FEAAB2
Filesize406B
MD572792dc85c38ba75e062096572585e31
SHA1ad81b7da3b788a3d9cf0bb15d411b96ff8e33ca4
SHA2561412347097280e09216c4338d6c6576a06a5207889ebdccd24bf4af602fa65a7
SHA512c7e43a8736134e3a9fb3187e2462d2f48d5d8f8b18aa3f2965beebaa0596ac2b566f5233b4440773d02bd769aade4a2eb3e7bf068d2693450e7397da75b1bd8b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_309B303B90F655EEEC702C35A278AA80
Filesize410B
MD5c677bc823b8b0c00bac6f7cf44f3d366
SHA1c3c918a98b78db40abfaf0bca2251baab9052022
SHA2561adb2daae50506af0c83b7f63cbf94f9c4868632f23f00f61bc649617c0e1789
SHA512508d8d71d6396236c13eade1264fbc6d4022716ee3adae0d387e13226a1eb935d260371f90eff35fecda0e7ad8a4143222b90ee72cada448cc41f9092f35c3a3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5fee61be68b8e0827ad74df95439843aa
SHA1530f93752b4d1a942ba94a11711ebcea12682e8d
SHA25688d813fbcd38c42e052f018abd8f5d1a54a086fdce6f40247e90241e8cb1b353
SHA512e225b05e2b042efaaa586e5050d692520c3feabb1010b0c5fe060ebe2a7f48391dbd972fb5b1f41f0bd593c2db14c4d2ab77d7816232dca13745a55609af9b0d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_83714946F9F5F0DC078BE568126375A5
Filesize402B
MD58989de2a92db6f2fa4fd14f6901880ac
SHA1f7c394b0644223d73b88e5269e9fe6fff2d27006
SHA256e94ae687c5ecadbaecb063aa339e3f707f1592c817150c2b09a723464727f590
SHA512d78cef2e8264ceb3389fb8a7b39bd7b485ca2b5b2564f29249a71e5081ca394ecf3883334e81c919104f7091e760830c33240fe5055d14e5fe0e4998ee8636f2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
6KB
MD5cdb5a91b7898f75f98e448e80b41dba6
SHA1c749651f98e32a2320d2e52fd467fd6217660535
SHA256ed56bd19352777293cf7195af0fe1412d52e25af6a9a8e2bb04e3e32056556dc
SHA512b99bca03a398f7e068691852106fe03a90489d1e8230720749c25703e59874765ef706e9e27c9215251372efee84d9c9d0eb636a54e45035d5d2095304fee97b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5ee45f4348f289d888121b56c3f07555a
SHA143b8c55024637f5f39c5562258bc74d817fe0e2e
SHA25689ac0e6863d60731dcbb15505774f4c95ec04a468732f3054fd9770edea15bcd
SHA5127f53f04a0d0655e7f8104acce6c6d9948ac8e22eb76a9abbfc07188a7be56db080210bb33422790f51e486a6f7e794235ba86206f50eb6a3c2fff0a309bb00a1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD57560dc4bb76a37cd763256b3db6e9550
SHA1bd05356d9af7cbbab80a9a99c31e5bc37ff1d615
SHA25615897add9c65869df241039e15425456899cb83018064ee63a180292ff735416
SHA51283d5df9cedbc394bccfafa49e03367b0b7970759dc7cc4b29d8d0e87d6ffdd1556b396858563b0cf680598870429d17cb4718e6e66a90538eb6c676dae0f0725
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore.jsonlz4
Filesize1KB
MD584500ca7e9b722af30057b80edcd1160
SHA19160e0c8999ac2f16d94f03f0b2e89201e5c115c
SHA256799df7a07724baafc5f7f9cd3959056f4cb4767df49db24de71b9087821baf2a
SHA512852e6f504d54cb1917fff45f83c9b44abdbf062a7f5df2cda8397c13660ff183dc3b9e7a8fa1ec31d16cc641dd4fd5123cf32e78deaa3c51e023df690d636326
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5fa2cb26398a675b1648b15264672ed4e
SHA16f0dce025b4e317366c4b00da7134cf12aa082b1
SHA2564afecd2e7f92ef105633806ab512ce28106893b953f46150a77fb82f5b3c3b59
SHA512b95435aed8515c28ada9f1ed8970d7643ac44b74da014b4d60097c26d03693bcaf181872310f77e372808eae19ce83a6bdffc5f8acba3a00d0e8e523e168377a