bumblebee | hxxps://bugzilla-software[.]info/

Analysis

max time kernel
272s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2023 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bugzilla-software.info/

Score

10^/10

bumblebee bz2106 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

bz2106

176.111.174.70:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Executes dropped EXE 1 IoCs

pid	Process
2324	InstallerBugzilla.exe

Loads dropped DLL 1 IoCs

pid	Process
1664	regsvr32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1664	regsvr32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4b6b1597-2aa6-4c1a-a62e-03a42a4e3867.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230627152218.pma	setup.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58170d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D960-4AF4-BB8A-BE91FA942756}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1807.tmp	msiexec.exe
File created	C:\Windows\Installer\e58170f.msi	msiexec.exe
File created	C:\Windows\Installer\e58170d.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c462aaff2c1743fe0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c462aaff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff000000000700010000680900c462aaff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff000000000700010000680919c462aaff000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c462aaff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	InstallerBugzilla.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	InstallerBugzilla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Bugzilla_506.msi:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4912	msiexec.exe
4912	msiexec.exe
2560	msedge.exe
2560	msedge.exe
3140	msedge.exe
3140	msedge.exe
2712	identity_helper.exe
2712	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2324	InstallerBugzilla.exe
4816	OpenWith.exe
5376	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	firefox.exe
Token: SeDebugPrivilege	4584	firefox.exe
Token: SeDebugPrivilege	4584	firefox.exe
Token: SeShutdownPrivilege	4648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4648	msiexec.exe
Token: SeSecurityPrivilege	4912	msiexec.exe
Token: SeCreateTokenPrivilege	4648	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4648	msiexec.exe
Token: SeLockMemoryPrivilege	4648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4648	msiexec.exe
Token: SeMachineAccountPrivilege	4648	msiexec.exe
Token: SeTcbPrivilege	4648	msiexec.exe
Token: SeSecurityPrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeLoadDriverPrivilege	4648	msiexec.exe
Token: SeSystemProfilePrivilege	4648	msiexec.exe
Token: SeSystemtimePrivilege	4648	msiexec.exe
Token: SeProfSingleProcessPrivilege	4648	msiexec.exe
Token: SeIncBasePriorityPrivilege	4648	msiexec.exe
Token: SeCreatePagefilePrivilege	4648	msiexec.exe
Token: SeCreatePermanentPrivilege	4648	msiexec.exe
Token: SeBackupPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeShutdownPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	4648	msiexec.exe
Token: SeAuditPrivilege	4648	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4648	msiexec.exe
Token: SeChangeNotifyPrivilege	4648	msiexec.exe
Token: SeRemoteShutdownPrivilege	4648	msiexec.exe
Token: SeUndockPrivilege	4648	msiexec.exe
Token: SeSyncAgentPrivilege	4648	msiexec.exe
Token: SeEnableDelegationPrivilege	4648	msiexec.exe
Token: SeManageVolumePrivilege	4648	msiexec.exe
Token: SeImpersonatePrivilege	4648	msiexec.exe
Token: SeCreateGlobalPrivilege	4648	msiexec.exe
Token: SeBackupPrivilege	4280	vssvc.exe
Token: SeRestorePrivilege	4280	vssvc.exe
Token: SeAuditPrivilege	4280	vssvc.exe
Token: SeBackupPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe
Token: SeRestorePrivilege	4912	msiexec.exe
Token: SeTakeOwnershipPrivilege	4912	msiexec.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4648	msiexec.exe
4648	msiexec.exe
4648	msiexec.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
5376	7zFM.exe
5376	7zFM.exe
5376	7zFM.exe
5376	7zFM.exe
5376	7zFM.exe
5376	7zFM.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe
4816	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4592 wrote to memory of 4584	4592	firefox.exe	83
PID 4584 wrote to memory of 2116	4584	firefox.exe	84
PID 4584 wrote to memory of 2116	4584	firefox.exe	84
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 1484	4584	firefox.exe	85
PID 4584 wrote to memory of 984	4584	firefox.exe	86
PID 4584 wrote to memory of 984	4584	firefox.exe	86
PID 4584 wrote to memory of 984	4584	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://bugzilla-software.info/
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://bugzilla-software.info/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4584.0.1099459786\748527771" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c57ee5fb-a429-41a6-8ea0-73d9fd3f15e5} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" 1932 1e4d790bb58 gpu
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4584.1.1132758664\277994310" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f765cc91-d116-4b66-af46-99eae512f2ab} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" 2440 1e4c9971058 socket
    3⤵
    PID:1484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4584.2.287985613\783841505" -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 3012 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb80305b-6865-4bc7-b889-b948b850f3da} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" 2972 1e4c996a558 tab
    3⤵
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4584.3.1056360311\1288023770" -childID 2 -isForBrowser -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4be29134-da6b-41b1-986e-a8e8b612b85c} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" 4020 1e4d8dca058 tab
    3⤵
    PID:752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4584.6.1617583086\1054749854" -childID 5 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6873dbf3-0abc-417e-93b6-0e50b0c90b5f} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" 5200 1e4dd307858 tab
    3⤵
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4584.5.1619825840\1504195355" -childID 4 -isForBrowser -prefsHandle 5012 -prefMapHandle 5016 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4beae355-69e3-430a-983a-323bbaccfda1} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" 5004 1e4dd30a258 tab
    3⤵
    PID:2132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4584.4.23858013\1474678197" -childID 3 -isForBrowser -prefsHandle 4844 -prefMapHandle 4836 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04144faa-d502-41b3-be0d-4523f134475a} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" 4864 1e4dd307558 tab
    3⤵
    PID:5008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4584.7.1545259138\1304602322" -childID 6 -isForBrowser -prefsHandle 2908 -prefMapHandle 3172 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb53d06f-004c-423e-90b9-928afb8619c0} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" 4736 1e4d9e18858 tab
    3⤵
    PID:2856

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Bugzilla_506.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4648

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3276
- C:\Windows\system32\regsvr32.exe
  regsvr32 "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\bz.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\InstallerBugzilla.exe
  "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\InstallerBugzilla.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bugzilla.org/download/
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff99e6e46f8,0x7ff99e6e4708,0x7ff99e6e4718
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12336446080386519933,7982100535228370116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12336446080386519933,7982100535228370116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12336446080386519933,7982100535228370116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12336446080386519933,7982100535228370116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12336446080386519933,7982100535228370116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12336446080386519933,7982100535228370116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:5940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7d91e5460,0x7ff7d91e5470,0x7ff7d91e5480
        5⤵
        
        PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12336446080386519933,7982100535228370116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2712

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4816

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\bugzilla-STABLE.tar.gz"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5220

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\bugzilla-5.0.6\robots.txt
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58170e.rbs

Filesize
7KB

MD5
876222bd93befa40afc7c9316150472a

SHA1
5c7f38b6e78386e15099ca3ca4f2e269b2a975c1

SHA256
94bf045670e3e9b7d1a13acd961f0fdb823ef093dfaaf31e436603de56f49b4f

SHA512
68dc22f4f66e375d0df10818de5bbecd70ef0a3e1a6151b9130c4432a465387eebdd1d5107ad60f08941725c17546fb8f428860d8becb3d8d3853661220ff3b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a9f76dde5876d055fc0a4a821de6d02

SHA1
3cb30f2ff875cff6a4e4be0c7506254e076ad4df

SHA256
323204c96cf3ed35bb893c2f20a444cd0c7aa0b44749174b7b22ab351b2edf1a

SHA512
b805309fbbc622f2e47c9d4397662713b37879d0ea0602675c0894e655b9dcd34d483a02c6bdb73b5c6ce084ca7523e038104bce428a5bc7be3569c0d18b9091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6abe43658387f0826ca6d505ba2a9b0c

SHA1
ba777e01296195063af3aef86ad61289215991b6

SHA256
2683def01b6ee96268c1ee356bee3d8540683e6c830f6860a903cffc07f345e7

SHA512
2ca9e4ef89bc9d518a08ead9420610b2c24574f474f03545a65d589a8ee01a926b7da3d344e227a7f056a004766344bbb57d37f2d0cc3dd0078ddd9eedc87b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
546c8fb969898572bef5dbc9c84b347e

SHA1
3d43de6858bb6b54dc9fc2e268f1f0a5e6c6bf4a

SHA256
513953d89337740cbbb2ed0dbabb3aed256d97c371d2fb012b8574e111e41f0f

SHA512
841aa86da7ba2410990f6ef137fc86c5dae6883c04ce4f46c359b8aade7b4e9e4ec01e9681b16d824ad6f96430b191ee9e70dd1816e57aafdec5dcf0926a856f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
e4015d8fac1cb3d0be77cca46b652e26

SHA1
834204c7416f6c20ad7c792d1673817e4599b1c1

SHA256
03b13a9539a48cd214829109dab168188c57f0b390001370e7d6af825ec98a35

SHA512
665acf358fb5c4a4fdf3c8b294d1cdaf758e4f6e1837d144434e74627893f9c4f931f8ead75c4208144c7eb13367ec6eb2cfe2136150113ed400c1297ca5bda2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9cbb318f58270a61ea47260a1f20b9b

SHA1
e81bab56ffa84de5c156ff86565c2b31a6b2fd2c

SHA256
a646793b86ab928db651de85fae034c48181d4daa3efb5346fc001480c5e20ba

SHA512
30f8065ae41ef3cccb7434e401cfaae5a9fe390d0c0cb3df4c3341e1fd96be7f17971c89a89cedaf8fdd19275cc0652d1dab8478e69d3998e46f97faf07152b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55e038a0de5bd73acdee82d6903725ef

SHA1
69adf493ed76b3d0414b81bd710f965feaa7ab9d

SHA256
4db8dc98ad9dae1872771668da9ad63d85f79076d72e0ad3607292a22761e8c0

SHA512
ef42f2f821e5dc6b2a75d3f45be811f52676ca6eff2a245809906b1a7b6d13d31ed1cc678014d45a4aa1e13b39711c1f264c55ff8907731e802326d452f2f737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3922931a21a66290ecb769f2d79cc417

SHA1
d72bc5af3b2da078125ce71512249f67765624c3

SHA256
0eb33cdbc3b30f2dd68d3e4de912b61c6f29f3ddbf17b8e83948e9243763b8d4

SHA512
e4b1c22b64afa2120c2ae1385374747b04ea4b509fef1a27384755d57cfd4a86008cbf9af7095a1955c9934148b38cf7aa32b036d08702cbaa0ec9f5f59c3987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
43d12bfa84d3afecafeed66dcfca71ee

SHA1
86718fbfcb00825330f74bb9a2a024d0b0436ceb

SHA256
26783e1364d30948db8cdf34467d206bdbbb2c3f2b972ac512a1feae1ed57d12

SHA512
62adefa5cb5beb889572b071047a60707c72f7c63ef4b76805c3dc070d434d732e549aeca0761d38f30ee57db12a0f964d6909666c73b88830105b95d697152e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
0b1c45ee3e6d8240d5f888f459ffe848

SHA1
cb870c216074cbba4fcd6ba83f41d8a4c8a6ab86

SHA256
b5bac463963828f5c7d63dfdb1f82275229b0259b98ae7a9f2355f8315f48bd0

SHA512
303aeb0019f3f10fceae52bcd74c1d6cf11d1ed1451d2ad739b1c4b948173c99179e275de1ee2c7d9f025f37ae5391a0be3400af85f11e907501678e14278208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
2372f7314af073c13745f25345c6ee64

SHA1
4c03802c0ccf173e64dc66fcee28c47825d038bc

SHA256
d26a64a6ae8a32be46810fb9711f73315d80fa2dbdbbae9f63bdbfa2fc3daf57

SHA512
409a52d2453a3f239976d54f732ca83a2244c7a2d910bde82faf0ddd7159b05387449104cee49426d4e91ecd818ad6db67df423b1c380c1e514ccbec09c60700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
ef7a077c6fa7e202bd381bae34698f14

SHA1
8255802b4a2cf8555922aa4146d55b7badbcc11b

SHA256
d071ad04072e48ba01fceaad0760ef611f00c8fe50be63b6ad9c170ff965849f

SHA512
d498837467a31120e2ae5c1961d365d39bac010025514cc69ed4a8e1e2120828a2afd57070cdca72f17b0586ceeb6a162dc4b7200baf31836c9d0fcb29ecf84b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
35a1146c694f1d518ec4b3320b014a38

SHA1
9eab1d32e500d0583b9b2905b50e076a052781b3

SHA256
14b9a9f7ead0488ad92d68b86ff17ac9d7770c00d566ca99e891a038c2f983b8

SHA512
69c9299527a9aea8aaef11fe84db6d4dbbcd7fc34ad259bd9425a683964da6c56e3cc437c035d5f5dbaa071d530b9feedbfc5071866a5a3b4c21c42ff4b16bea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\activity-stream.discovery_stream.json.tmp

Filesize
154KB

MD5
114674d922f2baac37319022affdc7ba

SHA1
3deb31530723c5f1681a36b085c2cd76a0a59f2c

SHA256
b331e96205d4c17645238d8c49b700d07383fd2487c5d3c0a0e14492dc86a6f1

SHA512
cdfe1dba3d4eed4d14951eb0d1407e6579d27bc9fa4b1ff12498937cf6ba34bdb3c90cff3b63093a128957f9a199203c1069970e6887b263ea4192be5b475be2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\13D4196C3EEE6D166E2A3DD430CCB10CCF7E99D1

Filesize
15KB

MD5
14e0b573abd807eaac0c21463bd2288e

SHA1
b6dd4d7304c90ea0e915a33a8a6c18e49a072a01

SHA256
2effa0bf80bef97bdf9ce8c7cd61eef365ebbe3584092508c96b9771dbf38f35

SHA512
c239a1780c69c3385ea182a25ceda6846aa0fe62050e691d16a90d575c84c46482b71491eec1da5a49ae5d1a7d93d4130bdab5a4274dc9a3b850c532b1c7e373

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\155786A18992DB2A80D7CBD4854A334B4EA43E4E

Filesize
21KB

MD5
12c9b2634aaf86eb904e3c0dfef18869

SHA1
33a079477581b59818ad2695e1cee13e5434b35f

SHA256
21ffcfe6b091d10525b80bd6bc9ffcd4646885144a14425c1941fb93ea6314bb

SHA512
5d3b6cdb3753332541bda17bc0f22772cadb3ce348400489b4214aa864267265844c7ba58e4c5676092cb22329e66287e2d703667385f448ec4a91473b99ba8c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\1ADA1E731458507B2771CE086DC77E5EBE579505

Filesize
17KB

MD5
28722e0051e8206ab0e4f58c48a64181

SHA1
7113b9200a202fc4454df003097c4bef63e46f2b

SHA256
e5f46312f12a21fbfd523f5051eb3210fd5c0fcd8d3d50e5fec6ccd45088733d

SHA512
1f759f4872d4ae39b8b3cb7fc8a49456dc2beb914268c662f760bbbfb2ad91fa6ab31ced0e42adb723e085e27f1c0e3be443f0c7c0fb09d17dfd7c5edc295e5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\5776C471368586F7B1D1D8D62F59F6B4F8BFC13C

Filesize
92KB

MD5
7cb4672e132df363a55e886dc9a7abf2

SHA1
fa2ff37bb19b532d5e137ee33751dcd5c2827965

SHA256
f3e6114d9769a9a2fea67fdad500dcf8229f7b81d2f666aaeaa22dd6965f46ab

SHA512
29cbc5e1e49d446890889f21cdf28c4088353e2fcf5922903396fc57c2e2aebecf969740ee28f1594a99236aa347ce5ef0e6803e26cae2c7a9a8c93fe80dab95

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\58622E771062E11854CA601CBD9392441E2C483F

Filesize
24KB

MD5
f9f98d75c5ac0d96ce97cab56533afab

SHA1
d655eac10d0021aa03f23b89946d9239fb8152dc

SHA256
ff88d5831274907c43fdc570db329543323d7e0c6657a405e7c5e64d7924d120

SHA512
fbfc29496af71ea452ce393bc8e6f8b682e18a9f33de1a50da53c76333087bda82c627cccce5226b22383d8ea244c06bf46889f513fb2dfff28772166041e296

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\8630615E19721C87EA6F553E856D41BF240C170D

Filesize
19KB

MD5
d9a4778c1cf3b17c344286b2e143a811

SHA1
a94e067bbed1d60d5b085415c2435ac92d8d07b1

SHA256
3b3ffb8c6a90a84ac0ff8e7956d0fd98f6a2e9ce8353148e6165cfca6587868b

SHA512
d25cffc38c04e91a559ecbb18f6901497fbba0b2045b7327b31c2b83911d453ef633026b51b00a1e081fef103920911c368274d168660711fdcf09c2420d5c47

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\8B0B3692D9883BBF5FC17ABBE15EAAAF1045CB88

Filesize
45KB

MD5
6f2ccdf32921182f779e6088ed72dd0b

SHA1
647a5ea98b57c868e061db825d185d17df2e023a

SHA256
c855a2a7453ac77c923000997bbd7c001f967a48816542d3f89a82b44d2d144c

SHA512
f67e08b2c699301c9209c4825fad432a1977996a0743f8d6f89bc481a2a78d6650a42f60d8a5f1b2dbcdf605c183666ec4995270543db24e90667547f8a83c77

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\8D1DE31C4B7B1C6D77ED077BBE874824578A9CB7

Filesize
24KB

MD5
69e71b285e8304032e77ea9adc236b78

SHA1
97f10b1454f29834ebef101a86aad75a493096af

SHA256
ca8f588788df20f44e9944ec52d56922a39062b59719d0ccb235a2d3987a0017

SHA512
ba3380e450309cdb99ed2f31796246ab969f3a146659eb3192e79ff011eb6b124555ef48339811fe5d39c9a4851d6811959af7639298cfe875eff3341b9e75a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\97E1D9DC5903A44D28FFD392C7063F4700B4DD27

Filesize
24KB

MD5
cb73877a6290b22ea2131173066e98d4

SHA1
49befeaf90fab13e1f5696b892e22368b48bee43

SHA256
3f0694abc098169f8c5a34e7e9022e98331535c9454b49ff148806cec1009fe5

SHA512
daf4f1420767c04be24757ae76f780743f621d826210d953fd8b16ec9bb7f3925194424ac92dd3fe12c4868a736efbaf25e3ef4a711d0f49d82b528f87fba712

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\AC9C4FECD791A0278AD7C69C9996AD2E6006C4A4

Filesize
15KB

MD5
a69ae0bb9aa899489800ab4bd0768ccd

SHA1
3d5df3b6d99c7577282f70a80b99eb88ce25b601

SHA256
9297cafc5d7ec5ee7ad0d8f8f69dfa31e4ebd821b54ec156db9a5f9ce9c32118

SHA512
f59dedaef255dc32795fe82d91a013f9e0762a7019a6094aadb0b7cd35914c97ea555dfb02901c59b7c5360458f17e2f5e035e863da794822892ce65f458aa50

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\B8CBF5D7057ABB1E48F1D483A41C013A9BBFEA2B

Filesize
20KB

MD5
42f311348e0c91f1db031735c660ae24

SHA1
ebcfa7a44646559f9ff49a0636da07fc8c83d8bf

SHA256
1ce08ed140899e6dfd6a9e6a5a9ab40070c19ae3678e9e0528a690ecb9964f32

SHA512
972fbac1e3491a148799f8fa28993604d20920c9060013fe7816603ce2901572df2b5f0aa38ca91801a46e25af62b6c6c1c53076ce2cda9cf25e0b616179eb4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\InstallerBugzilla.exe

Filesize
290KB

MD5
c582e466993bfd6f8b5cb7761e6f9a10

SHA1
142e6278733940eb85074db43fee3de7a3fd441e

SHA256
6597b6ecd9d1744a460a8aefdd246e5c606ee955323443d1fdcf8dcd9405780f

SHA512
f6d91df511c81034d25dce5ce012a7366aabc86ab578c23bc4d9d53cbb02b1e53f84535804baceafa98010508245127eb1399310c0463adb02929f489c0be9e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\InstallerBugzilla.exe

Filesize
290KB

MD5
c582e466993bfd6f8b5cb7761e6f9a10

SHA1
142e6278733940eb85074db43fee3de7a3fd441e

SHA256
6597b6ecd9d1744a460a8aefdd246e5c606ee955323443d1fdcf8dcd9405780f

SHA512
f6d91df511c81034d25dce5ce012a7366aabc86ab578c23bc4d9d53cbb02b1e53f84535804baceafa98010508245127eb1399310c0463adb02929f489c0be9e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\bz.dll

Filesize
1.3MB

MD5
b2a58d30b4127c8ddc6f1e6ce5cd2821

SHA1
e07292fa3dc3b23bff6c4de6df79449acad23f88

SHA256
0f6215613e34ea753587ee98d7098bd713874fcba395df052ec970d19ecac7f9

SHA512
7d6c0d3071a4c8f98a618d8726d15a2b8cde4cf9abcdbb3b36be2f1bfccb4d80a9da48197516d42720d399dabbaf37747ea1d93446ddf7e1387e46fa84349c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\bz.dll

Filesize
1.3MB

MD5
b2a58d30b4127c8ddc6f1e6ce5cd2821

SHA1
e07292fa3dc3b23bff6c4de6df79449acad23f88

SHA256
0f6215613e34ea753587ee98d7098bd713874fcba395df052ec970d19ecac7f9

SHA512
7d6c0d3071a4c8f98a618d8726d15a2b8cde4cf9abcdbb3b36be2f1bfccb4d80a9da48197516d42720d399dabbaf37747ea1d93446ddf7e1387e46fa84349c63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
14KB

MD5
7b6924cc07243ecb1676bc13e87aca26

SHA1
5f4724c062a11389205f547d3f1dbc89c9badcbc

SHA256
7179f1273ef0d9718091e93735c8ea3e28ed8e6cb9ac41cfc509bcb23ece8980

SHA512
97e0037e071cd1a98cc0849e52a46c5fa4927621e65f73ab6d6806abe8ee93002f40d0cdbb18004c36da13dbd4b811be8ee12d06aca80a987df7d397159aece1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
14KB

MD5
c5c75f37d367a9916120c54a8bf1fda8

SHA1
a455e260b92cf6814457558559f4cce24de557d2

SHA256
2e42097c274007354d581ec445993a6b7050a8b576aebb40ba527ed07bcc8b05

SHA512
b4a248a28c4b68ebfc6f1282eb87300a6a9189dd799b0e7dac09f735a67cdd963035675cd385cb71b28efc7a5662446d0375fd9cba7044e278ed6e65c64d49b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
05cf2d8d17962b8ef1ec100e1f70b751

SHA1
aab26b2cdb42ad9091b745cb6fa831dcaa69586d

SHA256
9332a8c6414717f569a70d2d2d283da5a3cf98b044457cc550bd3099324bf4d4

SHA512
ad067d9ee349a6e915fcc8ffec7a8e1345a6f66a31565ce172d460b9c923ab8fdf962d849a8ae2992299a3ec83df16fed9f6f3a0e99dbffef7ed6c3eb69ab88c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\prefs-1.js

Filesize
6KB

MD5
416330ea6a14b7e03e8cb293a1fab89d

SHA1
0d81ac73f34c1c0f02741621f36d54bcb6ee9efb

SHA256
209dffc628fb60d1a521570d62816d57c532a17a202462d17757081853486a2e

SHA512
e903e766ca981ffc8a25c46cfc7efbbfb899f8cc74b660cc125a6ef7b9caf987d7a9b5ad3376481429ffbdaa4e1e435db8dadd55c7c1fbf827ae120337836bf4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\prefs-1.js

Filesize
7KB

MD5
c79c5f06c639bda1dcd9221a257e8160

SHA1
7437b63193f789bcb724dbacc4f87cb0834837e0

SHA256
a45944577ab1d4c5ca7c7fbbaa3eebd3758cff69fb84a0e714dfce7077048b96

SHA512
6c7999d6f34c193596b806187b414bc3a1b997e4a83e2a3d175668c8037b7217222590eb0c56608dc9faefb84a8b8a522782bcc0e04b6ce276cd3390b0ef7203

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\prefs.js

Filesize
7KB

MD5
a14a82b35b278c4e76d4ef0fd4429712

SHA1
c101dd207ef8f44b75346bcae1abea0b3bc2219b

SHA256
e4af22861308b6bbd73de6b6df24ba1364ec0fd855893f520e3731495d96404f

SHA512
fa2970a153152ba03ac243f5c7fac149b29ce731444197ee055f1d93edc60664301ab34e892ee55a1d9cdbd2233c287551b37d554b9d747940f5e4eb1283e348

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\prefs.js

Filesize
7KB

MD5
764a9c48bccf8a00af8fbbb84c4c9f17

SHA1
968c1aa169e8b73e6f29ada3b06d65a0181c2b6d

SHA256
6018d14397dfe9ce98c5b76d26d715a45c19036fb73a81dea889cde2fa76abaf

SHA512
e92a45a65459c64aab0d8eed63beaf9a853f0a35e384447bc94d36f9f9a3cc60425540b460ca3db3c7b91ccdc71b3d29b6a624c126b1af480fb45ca958a65d2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
27KB

MD5
a4d2b221f4e05269cb25e0805cec330b

SHA1
dd4c444fdd175dd0f85947cfff49158698daedce

SHA256
89ff81bc38bb4940427c0d4676a47b3d820f83243f3783d81451d9df38497f87

SHA512
5e727c1523ccb039a1a93fd161ac7c3c224e0a65b63b6c8f5e1a86dddb7c0c94d5c2711c6e8ce3f2a1a6bc09dff63f2a275d87b06a88d6cc3ea4fbb598707779

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
226e9a0b28e44df00ac4b28854c0376d

SHA1
4217877d9a8d7b38d5a262d7638d6abb13890888

SHA256
b98f96292476664a85cb1c4e7d589079b53afbfa7612619a29d6d59cd37569aa

SHA512
2f0a6d09394465942779c02e46f34da083c622512ba25c9cbcc96de4a35dc5c0b61129ee23e9f39d67642b1dc56ee51a9533af1a29240837ded9c1a2f3af996d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
19deeacc25530fec2d3f0b983ca08f7c

SHA1
122bed11c373f838ca94dc4b65c54897f3ff3508

SHA256
4133c06b9512cadf65d135c409a71bae0a6b93f21fee636a9308c81d1ff2e5a0

SHA512
a2f0080c6f4a1f63c4ac6a616642c15e868ce8790372912a9409693ec95d7dc9eacf7f1859182909a285647e44486bd5343ee738fb9928d33b297b4e1b290bee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
28KB

MD5
f4b43979fb36371814c4af03b16babb6

SHA1
dbfe2dbb9ef7d686abc969eb4e610bd9e8524677

SHA256
4ce54f87195ccc6d7063dcead2617175b897d2f1ead259f4946774ce66c1a1fb

SHA512
901cfc4850778dafef9c1ac2a3d2d6606fc47e5683d1688ab60a14774a51535c631e526c431841319c7e233a7b49aab51dc41e204ab4abf0947e4442166b3496

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
27KB

MD5
a876bcbd12abd89659cee6bc6e98bf36

SHA1
6b6afbe63cc70a8ba957219aa2ebe190f616685e

SHA256
958da278633f6eee749cb47d33a755c1ac1a63d49013f5ff65f49ae5929ae21d

SHA512
e916455ce85f15106a299882bda1bb4e2b579692c4e86a91112b2f06c3a422d73e18f25dfa4c70b331872d61041bb5a1d1f40739a1cef3e6e26d123500156b0c

Download Submit
C:\Users\Admin\Desktop\bugzilla-5.0.6\robots.txt

Filesize
44B

MD5
d899f8b5adc02d6323e898890cdc87ff

SHA1
ddaac05ed3bddfc61e76c9842018844ba1cdc99e

SHA256
1c588a712340c039f1cbdacc832dd988da07ededd7439055aeb6d3ec78bc56c7

SHA512
526712f20c78d7481c145c299436efb157f621b406c64fcbbd117cebb1ef04bae02d230251723bdd7020a3724544e7ca4918224e12f1f4a851bf300f49f587b4

Download Submit
C:\Users\Admin\Desktop\bugzilla-STABLE.tar.gz

Filesize
3.8MB

MD5
f291254bc7971c95bd7b1fc04b28081a

SHA1
bef85c8e7e031ca21d7c59f3c2dc083f52b3d7b1

SHA256
dd41a4b0a3a1df0d193bc056f2e3711d7b5605718a00bf6e5d4177bf1be86f77

SHA512
8ca47ea1be2b433a6ce68e1a595d72f3d0f0fede44d1194dc6bc9a116dbde3ab7285212c71995e200d31544876e4c3c57b63da1f877a0cb22747ab87a5d598de

Download Submit
C:\Users\Admin\Downloads\Bugzilla_506.E6wncZCf.msi.part

Filesize
31KB

MD5
3f98782dddc00002825ce22ac496b762

SHA1
78a77d6fc454bc8d1bbdaf723635b6a868b59aab

SHA256
3c4d76698127f718552f461112d4790650cf721d2168bdef123ee56a9b073b89

SHA512
f71c69fec32ed6d0fe9c0cb6d5e6562e461c6b11c82c76de8d71f24eb3347abaa9b706c6d2249deb83f726319d982cb8917b40fba9bb2a1e1b1369b168d40802

Download Submit
C:\Users\Admin\Downloads\Bugzilla_506.msi

Filesize
920KB

MD5
c0f4b1036b8580f84418356dbcb4f7f0

SHA1
81ecafb47459a430b7210a076179029d27675148

SHA256
b778aa7ab828dd28dacf29d33b595bff3dd29718ad5706548d53797ead57d3c8

SHA512
ce4222b4cb9785ed207703067e9a2e9cd30973585cabcc674be8139d2d38e3799e004ae8ce9258dbf16249f92cf1c247de8ca9cd8cd60f8713d4b5fd8d34ca4b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
b49f1df011923cfa43f736c16f88ec2a

SHA1
7bb5e70a02cdc27d290493e08b9220a0e13f6ba8

SHA256
9df1bb7128dfbff3222b0e876fad8a64cfec805fe22f717a8983ca870497efbd

SHA512
46b9ddc23e3eacbff604691a6c48919d9a3c213708cd1f30a5384f2868df2f6574d8d6c35d229a563e4b59224c3747b52f3b7d829cbff1569d5082ba74067208

Download Submit
\??\Volume{ffaa62c4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{10977c42-f964-4d38-a836-b8591c9f9716}_OnDiskSnapshotProp

Filesize
5KB

MD5
146c5061da26334e1a30c57283401fed

SHA1
cb39fb29ce96f862acc5a8dda9d05ba2a00ac09b

SHA256
3623b4d20bff0c9a4ed865462b29d6f59de3aa71376d7ab500ceda12cf949253

SHA512
2114ea498b91dce66b76b78d01a9b36721db41abfed7ac5189eb3129115f2339d9d30ee9162b95b0a5fceef0013f9120c990221ecf7814010c20cc4dcbd86ae4

Download Submit
memory/1664-530-0x00000000023F0000-0x000000000247C000-memory.dmp

Filesize
560KB

Download
memory/1664-529-0x0000000002630000-0x0000000002791000-memory.dmp

Filesize
1.4MB

Download
memory/1664-528-0x0000000002630000-0x0000000002791000-memory.dmp

Filesize
1.4MB

Download
memory/1664-521-0x0000000002630000-0x0000000002791000-memory.dmp

Filesize
1.4MB

Download
memory/1664-523-0x0000000002630000-0x0000000002791000-memory.dmp

Filesize
1.4MB

Download
memory/1664-522-0x0000000002630000-0x0000000002791000-memory.dmp

Filesize
1.4MB

Download
memory/2324-531-0x0000000009F20000-0x000000000A4C4000-memory.dmp

Filesize
5.6MB

Download
memory/2324-518-0x0000000008D90000-0x0000000008DC8000-memory.dmp

Filesize
224KB

Download
memory/2324-517-0x0000000008250000-0x0000000008258000-memory.dmp

Filesize
32KB

Download
memory/2324-516-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/2324-515-0x0000000000DD0000-0x0000000000E1E000-memory.dmp

Filesize
312KB

Download
memory/2324-519-0x0000000008D70000-0x0000000008D7E000-memory.dmp

Filesize
56KB

Download
memory/2324-520-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/2324-542-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/2324-532-0x0000000009970000-0x0000000009A02000-memory.dmp

Filesize
584KB

Download
memory/2324-541-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download