hxxps://www[.]dropbox[.]com/scl/fi/7vlpt0tika14yg5fhtg3e/Bulmor[.]pdf?dl=0&oref=e&r=ACGDrw0lHiGgxaxU3KMfuK3SpkWO6TPeff5N_E1xxyukDXfxjPHWZ5IwBehBHyCfTdtQBabZPuuS56MLUB8VTxOSricSxfa0ZiYAVDFvXghodDksdIPdKUTwbmxnXoHbXSIASQiAkaFp5ngZcBopN2OXLIU5L4acucau-PiP8PH6oFI2rLCAiuwoasn2iGsE2lybHzK43a-D_4xziP-m584N&sm=1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
25-01-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/7vlpt0tika14yg5fhtg3e/Bulmor.pdf?dl=0&oref=e&r=ACGDrw0lHiGgxaxU3KMfuK3SpkWO6TPeff5N_E1xxyukDXfxjPHWZ5IwBehBHyCfTdtQBabZPuuS56MLUB8VTxOSricSxfa0ZiYAVDFvXghodDksdIPdKUTwbmxnXoHbXSIASQiAkaFp5ngZcBopN2OXLIU5L4acucau-PiP8PH6oFI2rLCAiuwoasn2iGsE2lybHzK43a-D_4xziP-m584N&sm=1

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
118	dropbox.com
119	dropbox.com
120	dropbox.com
121	dropbox.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 33aa484fcf4fda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "1392"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "412986524"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ab46654fcf4fda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 83ff0254cf4fda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 404d7e62cf4fda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "1063"	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1232	MicrosoftEdgeCP.exe
1232	MicrosoftEdgeCP.exe
1232	MicrosoftEdgeCP.exe
1232	MicrosoftEdgeCP.exe
1232	MicrosoftEdgeCP.exe
1232	MicrosoftEdgeCP.exe
1232	MicrosoftEdgeCP.exe
1232	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4608	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4608	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4608	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3816	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3816	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4864	firefox.exe
Token: SeDebugPrivilege	4864	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4864	firefox.exe
4864	firefox.exe
4864	firefox.exe
4864	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4864	firefox.exe
4864	firefox.exe
4864	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3968	MicrosoftEdge.exe
1232	MicrosoftEdgeCP.exe
4608	MicrosoftEdgeCP.exe
1232	MicrosoftEdgeCP.exe
1336	MicrosoftEdgeCP.exe
4864	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1896	1232	MicrosoftEdgeCP.exe	77
PID 1232 wrote to memory of 1896	1232	MicrosoftEdgeCP.exe	77
PID 1232 wrote to memory of 1896	1232	MicrosoftEdgeCP.exe	77
PID 1232 wrote to memory of 1896	1232	MicrosoftEdgeCP.exe	77
PID 1232 wrote to memory of 1896	1232	MicrosoftEdgeCP.exe	77
PID 1232 wrote to memory of 1896	1232	MicrosoftEdgeCP.exe	77
PID 1232 wrote to memory of 516	1232	MicrosoftEdgeCP.exe	80
PID 1232 wrote to memory of 516	1232	MicrosoftEdgeCP.exe	80
PID 1232 wrote to memory of 516	1232	MicrosoftEdgeCP.exe	80
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4672 wrote to memory of 4864	4672	firefox.exe	86
PID 4864 wrote to memory of 4000	4864	firefox.exe	87
PID 4864 wrote to memory of 4000	4864	firefox.exe	87
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88
PID 4864 wrote to memory of 4236	4864	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.dropbox.com/scl/fi/7vlpt0tika14yg5fhtg3e/Bulmor.pdf?dl=0&oref=e&r=ACGDrw0lHiGgxaxU3KMfuK3SpkWO6TPeff5N_E1xxyukDXfxjPHWZ5IwBehBHyCfTdtQBabZPuuS56MLUB8VTxOSricSxfa0ZiYAVDFvXghodDksdIPdKUTwbmxnXoHbXSIASQiAkaFp5ngZcBopN2OXLIU5L4acucau-PiP8PH6oFI2rLCAiuwoasn2iGsE2lybHzK43a-D_4xziP-m584N&sm=1"
1⤵
PID:2888

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.0.912150803\1482488698" -parentBuildID 20221007134813 -prefsHandle 1724 -prefMapHandle 1716 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc61f664-6f4b-4773-b078-83aa6d5d3d59} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 1804 167f12ba158 gpu
    3⤵
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.1.1504183738\324989385" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c57314ce-8780-4e2d-b182-f2d6c4bde68a} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 2152 167e636fb58 socket
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.2.1144690269\1446636478" -childID 1 -isForBrowser -prefsHandle 2876 -prefMapHandle 2852 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d41465ea-9951-4636-9c2d-b971ec58c227} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 2936 167f5495858 tab
    3⤵
    PID:5368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.3.822673274\842011160" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3420 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3330137-da4e-495b-b1ec-0ce08f810d1e} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 3432 167f620dd58 tab
    3⤵
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.4.723362053\1095793475" -childID 3 -isForBrowser -prefsHandle 3884 -prefMapHandle 3888 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fde41f7d-b70f-4513-a333-06f73f30b319} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 3904 167f5abc858 tab
    3⤵
    PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.7.861838489\377368007" -childID 6 -isForBrowser -prefsHandle 5164 -prefMapHandle 5168 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ff56256-7dce-453a-ad15-43a58eba4f62} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 5156 167f6b85e58 tab
    3⤵
    PID:5404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.6.578581124\1489750588" -childID 5 -isForBrowser -prefsHandle 4964 -prefMapHandle 4968 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fc7bcb2-85c6-452b-9fb1-55b4a357d2d3} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 4860 167f655a458 tab
    3⤵
    PID:5400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.5.2100817908\1255569957" -childID 4 -isForBrowser -prefsHandle 4836 -prefMapHandle 4832 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87804eae-dab0-44bc-9976-77b5647652ab} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 4844 167e6369958 tab
    3⤵
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.8.399822827\1707086614" -childID 7 -isForBrowser -prefsHandle 5652 -prefMapHandle 5656 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7870622a-05c6-4330-b363-a274da465c10} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 5624 167f71c5358 tab
    3⤵
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.9.1198324067\1929168150" -parentBuildID 20221007134813 -prefsHandle 6040 -prefMapHandle 6036 -prefsLen 26424 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fac31ed0-e9a8-4c48-9837-dccdae10b76d} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 6060 167f9069e58 rdd
    3⤵
    PID:6204
- - C:\Program Files\Mozilla Firefox\plugin-container.exe
    "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel="4864.10.519373447\1436869077" "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1" -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6f2b323-233c-4cf4-8c3c-68f361f66a66} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 6248 167f9be0958 gmplugin
    3⤵
    PID:6316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.11.190013755\1153898233" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6388 -prefMapHandle 6384 -prefsLen 26424 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7327356c-17f7-4cbd-8621-df3f173217e5} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 6352 167fc1e7158 utility
    3⤵
    PID:6424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.13.1344312643\1993831322" -childID 9 -isForBrowser -prefsHandle 6796 -prefMapHandle 6792 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17f75552-ac0b-4bc3-8efd-0f2cb35c33db} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 6708 167fa7b3a58 tab
    3⤵
    PID:6488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.12.423580183\2138366423" -childID 8 -isForBrowser -prefsHandle 6520 -prefMapHandle 6560 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c202fbfc-3b2b-4f97-acdc-0ec293383dbc} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 6576 167fa7b2e58 tab
    3⤵
    PID:6480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4864.14.729064790\724745615" -childID 10 -isForBrowser -prefsHandle 7032 -prefMapHandle 7064 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13457d9a-0c9e-4714-b440-b6b22b3d2916} 4864 "\\.\pipe\gecko-crash-server-pipe.4864" 7028 167f620ec58 tab
    3⤵
    PID:6852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVCMQBFA\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\cache2\doomed\26078

Filesize
51KB

MD5
196cc5284acdb2fefda4a56655fe7312

SHA1
f4d310521aed6abb89464686e9bb19c8ff71a591

SHA256
52ff3f6fe3630b430d7d109ae02818e7b8f088aa63fb6832306cc674d5a344aa

SHA512
8887ed0f37af734f3b0bca2f7a2e4c69911b27fc99cef9e63aecad4550cdb6f57cf09bd9cbfe89adcbc1e2c8de6b98553fa23389ec4cb50135032e060d84916b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\cache2\doomed\29456

Filesize
54KB

MD5
e06585239d6c738b5b9139be11dc5cb7

SHA1
f6ef4bfd29a63a55acdada3c4d35dd0b89ea0658

SHA256
c4917bf1d243f7ae0305e829d06c237faf0b802ab856ed6019220d77d4315d7e

SHA512
095b828e9ef19f6225559df98b2246705f5384d9d3ffabc31c9cb18d670d4c22d8e9c75d23c149e411c558a8cd8ef6eb935579385255000bc7fcd7a8cb5584de

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\cache2\doomed\4441

Filesize
36KB

MD5
8fedd5945294bdb1d88fb3379caa6408

SHA1
e6f88eabc147a40c773a49d66bc658d190bd68e0

SHA256
19d9663cca8380241d962653baf92ea76a4ecaa48a0026105139d4ba09271c8a

SHA512
f761ec9d7994cd10a49566677260e5ac3264e4eca1a69aa7e9174618e1714d823c74790571176ee7a0c042963e37ce27fb926a6a8bd46b2c662bb5a352b4bd4d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BTVBNTUJ\alameda_bundle_ie_en-vflPvcDrY[1].js

Filesize
498KB

MD5
3ef703ad89034a739c147c9262f9d11b

SHA1
97a7ddb763b8d7e5c28e98909d1ef99211a2a852

SHA256
f0933e9e3fa483777600718367edf5f7aa3efa559eaf6da1d2a99f6838544b57

SHA512
f7b42e1d6f33dc97e5dccd42046a15aeeec0eac83f33a26e852abc65d4a7b990c94ffe18026e96867871b01c46c9705ef09df73f9ce15fe9f32abb7be07cc7dd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BTVBNTUJ\c_tslib-vflfSMMlA[1].js

Filesize
738B

MD5
7d230c9400febf45cbca39b0a249cdd0

SHA1
82e9b58b9153ab1e5a0a781ee809422b166492a5

SHA256
d3dc43d5fe529216585c8bf36c91cf8412b457207f40f1a14cbb773efefb352d

SHA512
79c7961851e96abad64d5602f9268d921527ef4cb939a407368fb89eefe20079981f4cd0da5ed0cb5a3b9a695070d9d6089b46ce4cb16e920beb256684772f5f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\BTVBNTUJ\react-dom-vflI7_n6Z[1].js

Filesize
117KB

MD5
23bfe7e99565ee8f34afd63c06f4c24b

SHA1
bf08b8ad1ad73c12a7c9cb211926ce23a861db07

SHA256
9db33292007ab6c38527b39d5663e976a305564e19b2a5a8713ea2b2c00f505d

SHA512
f6318daf93e2c1ef27ccb2d84e4f10ac430f7e3194d29c7cd066332995318bb96609fac18edc827355799244b9bf1570c0807b429cdced4c4b890c5f00ddf477

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HOIRRQFZ\Bulmor[1].htm

Filesize
78KB

MD5
bff2f0965e0541bd4c17cec4542a79ba

SHA1
af1ce4575c4933f33783f5d052649fba65b0e432

SHA256
f4ba062d2a12361c3bc13b27ca0c457ee62be6ad97ab612d0ca3997c231b01c1

SHA512
acf53802d788fa193caacbf746c726ee4230be582f13717984e19c81d0dfc6adc925f0449bd74553693621052edd6246ab773db8d62a34b918005f59702795ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HOIRRQFZ\e_edison-vflzSqcWo[1].js

Filesize
59KB

MD5
cd2a9c5a8fc28a92208d6b7e9c1fe1da

SHA1
c0c860a21623cdef5dae02247e0561c9deee7732

SHA256
f5b2c8e249b1b0968065a6ca385c2fee21c3d7083385b23970cb182c874108d2

SHA512
f4c23f36aad274c0c5217e73db733d00604d13e832974ff5337fba481da0d1ef585b1e9577b089aa5795019d5e52128da9e15592329fd480593c232ceda0627d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HOIRRQFZ\e_edison_edison_react_page-vflvsdYyM[1].js

Filesize
880B

MD5
bec758c8cb70c2cee32e2d1dc95f4dbb

SHA1
0f2544c566b9f2c8f4432663a3f9be9e619466cc

SHA256
3be63d01dd07884d569b5976b287ffa2294fdccdef762d9da4bb9c444a2ae585

SHA512
b6ab96e203e4288febdf0655fd55e78149effff29054886486994bbab70dabdd4ec077cbc013b3dd03b2b778b39b320ba157a9e4a0fe6751a13ef79275f1a758

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ODR7JVOY\e_edison_scl_invitation_signup-vflvhi2vy[1].js

Filesize
1.6MB

MD5
be18b6bf2e58b543eec82b2faaddecac

SHA1
3ffd6ea6a25ea055ab30639269d0619210b4a09d

SHA256
094cce52c7ecd28b2aebabede50d2835dba31b795cf3a965089570266d3a1c5b

SHA512
93ab458d586501c018efeab0136b75ad86cfa580d8f7357c7988e9d6c7dcaf05baa76ddda85e8ba4b9389acf938fb8f232115c3678af358d9de18d24fe58a45b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ODR7JVOY\react-vflYWmbcM[1].js

Filesize
11KB

MD5
61699b70cf57abe63fdf5f4007d36ec1

SHA1
6c05189cc2d08bb2a7609c002f0675c9c670d362

SHA256
229bbf4d0e7488209564152c6723497f1ac3934136ca1684233d2fa88fa4146f

SHA512
aa5cc8794b5383b781a6611a4b5d8d660c73e766186551799b28fcf668c911eb0177fa04f543ec60e5f64005f3bce019604bd0a2129d718f33284d3689f5c398

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z86CG2SL\c_apex-metrics_src_types-vflKvib5e[1].js

Filesize
32KB

MD5
2af89be5e401b5f8a362cd856e5bc602

SHA1
f9b569ba10f58b8453e0da4031532aaafd9053b8

SHA256
51abd0d6108d6f6dd635d51a3eb0d71b5a770af595043c1a07484b3c778ea45b

SHA512
bbc6bb5dbb57d0015ac0b76882c7d3f9f551ab015d216007f6a7d20631082bcedf449d1786b001226c1ba0c21a78b66ee22947cc080166f85662650e55281850

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z86CG2SL\e_core_exception_reporter-vfliVLeVu[1].js

Filesize
67KB

MD5
8952de56ee2576ef898f332b90fbe275

SHA1
bcb0fabdd8e5362de5f4bb55625f3da15d026786

SHA256
0b17ecf5f4ff5bec8069599fb26726f1a621b21080b380305995106f78a2c203

SHA512
36548744c6f707c1fddce3336448cdeb637b382032942dbce014de57451290146f471d41233b4ce202eef4e978e583207db5044608c2286b45cb791ab9adcab6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Z86CG2SL\e_edison_init_edison_page-vfleV6hDA[1].js

Filesize
229B

MD5
795ea10c006d184b47d48c5074fe4e25

SHA1
15c00edd56338266f7f3dcc0e3cb7fcfccfc3e11

SHA256
6744c1c0a06e629a335412bdbf215c0569ca5196263c94124d2aa9bb3d8fc9df

SHA512
4219053d2eca746dbb549a3f89a1587f3a0b7cdba24ed80265546d58f245a24d1491c5243d6120ffafe6b48991009324615760bc382d3bbc9cdffee0616e04c6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\9RE8KYEF\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\PRC1RKL2\favicon[1].ico

Filesize
4KB

MD5
f25511f4158c2dfab6aa11a07d026e4a

SHA1
99f63cf1694fa5e52f43eb967462ea0d9eef7513

SHA256
c0906d540d89dbe1f09b24f17b7f35b81350e8d381c1558b075c28ea913c450d

SHA512
0bfb19aec453a1c4d4b8f39602bf8bbf0a98182a98e29e1e1708eabfd99e3168855994a56061ed462c29b099137c226e25ddd274b46ed2f443c2c515a530b731

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
d7ed2375603b9d9d755c9b9cdaa10d04

SHA1
d6b213ac0d614b95b4b95e118fae2fd7cd3d49f0

SHA256
3e02bbbe110c81de6e341560176b6e7c5063cf0b90d3e4dddb3e6bfebbd9a8f5

SHA512
82a48a6cf85ff8d49f017303a9d9379105f824d324c7cda3efdb7b42e795e66dd80c0e6810759aa17670e59ec356b809f8457dc359a09f7f03bef87d6b3c2665

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751

Filesize
471B

MD5
93dbbd99f822fdcefe7cf2f607f67afc

SHA1
5016b7cbaa68db57d91301fde723e33f6a310c9f

SHA256
298e0376f3bc88553d4482427dfee95a399a82c35403201ab27f8e92994bf90b

SHA512
a985f40a54dc79182834ec13ceb48853df60e8bb5cb4ed3f66ddeeff132dd48b49af65e6efe16e2011970fd0a48a37f7cf6a11687664e4271ccb0e2a20698b73

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
b8ae1eecfaae6d0d3739fdec8a76bc7d

SHA1
6d01a7a7bfcd62ee81b5313a6ee28086771b96cd

SHA256
152ec73b21edd39cf5651c0cf50d752c9c8e616bb37bf92f8426789906bc5893

SHA512
3dadcf0463e6f6935a1f06555f671c2ba1492e65e03dfa320288fa3298b5f2c63e46c0556333e4b5f0e72a4aeb33fdc2bbb25a65c03a65ea9a39d32ece03300e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751

Filesize
396B

MD5
d9dae7fd1e5dc410a390c6276585f09b

SHA1
fc7c203450cb51804b80549a2011fcb23bae8a4c

SHA256
900643996061e97ab68060583e2f37bc77f1aef0163d03eae0d0662b42537f2f

SHA512
c2c3bfec13d281a2bbd893dd1cef48666af5c9e8e5f3c672104f73fb624244d3b43d782a33187aa2e464ccd275ccda742e171a81eb350e5a98bb3d3396b47bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
369KB

MD5
98d107865b6c0c663978f4b0b9ba9c78

SHA1
0fee3045bdadb2ac26269c733a42a27042efb7a7

SHA256
e5586f51db0f61d3936b8dbf0efcfc9c7776d3fe67427ebd06e807c7385d8063

SHA512
48e69e175d8ccb2e06e7b73730f5ccd3c0036b4b6cae34190b7baacca5514478a7d9f8366bebe72c5c4868199554a3cc58c0ae2b8bb2fb70ce43e701854b4854

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
5f3bfa40810ab2db8c62bfad4910f06f

SHA1
5764e5bc9ad7d214f5fd53798c7b610b189b739b

SHA256
6250760033f54989d6f030c446345d516211c433e32e34daa0cc9a3c05cf5023

SHA512
981fa50b8e1903661e13a24341194ab9962739bcbdfefefcc4d8e0f5933499d7a83e7965840e0c0b9f493d87903b700288d72e672963cc7d83637eaadb049c83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\datareporting\glean\pending_pings\97433ec7-41bb-4040-869c-97bb13c6da7a

Filesize
10KB

MD5
e4643eb321d751fb0a517410829f26ab

SHA1
8a907f1f5798c2b2d95f755b2c31c01f2d9d3695

SHA256
34325e7b8f09d1cebbc60b8b93106de0d76d980cf6a95699a60d8e42f5213fd9

SHA512
f63797d9a63f8fde5d916264093e4a60aaf6bf0a382ecf1dd6e1a06ca74366d20792660ac6786094b202949c4e12a0cd664ebe137dd1f2180f9e4315910d69c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\datareporting\glean\pending_pings\ff3788c7-0951-482f-a855-2cdbd9eaaf88

Filesize
746B

MD5
8f3273b74a06dbcd493a3e47a35db4f8

SHA1
e4be4abae4bf93ad23f53fb065303cae0aa96043

SHA256
8410d4f2091daf9af29fc23afcc3010ac6cafa1cfc1fed2d95f154a79a67595d

SHA512
f0b728972c10182658c0ac71801941e8718ef0599a4b5a48070fa9653993a528baaea3491f7907772cc42969bc8763b47ff1975ce8ad4348a14c2c3933da5191

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
523KB

MD5
00e2c165994318410bfccbfbb3d1bda6

SHA1
cfbe08dd9e1efd6f283f76090366f4f15f8b8e31

SHA256
2847d5d554dc1993e8bd653c45040af5d29182d3b03baee36b4243a73aad0235

SHA512
360241a4eb5b18066a1695c09bdfb614c98f322a8ab40b4e614f1146c663c766e9bac4ed014fa6fa41b3ada5986c5588b3daff445c2fefdeaabbb71a4bbe3372

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\prefs-1.js

Filesize
7KB

MD5
a40d1ce83642695760bd5dc0f34343d0

SHA1
9a45ecdec663b0493dac49f55b4ba3f5b86f283b

SHA256
e92b5b46de1451e308ef96c8c7f0019500a08e7a1e74d942f22e2c1e5601378f

SHA512
8909c9dc985a777a6c49e0f426c7c02d795e593f6b7f74fb12b8c2fc0d745d46ad3132eea93dde7f87b07aee35ef453d7775b772c613e864adf3c91ae57a554f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\prefs-1.js

Filesize
6KB

MD5
ebc04d1f06d74216e2b1a244f927607e

SHA1
9100f6d8489c98b9cd363d79b1d74a2057174e5c

SHA256
90195d3994a78d09d578a1bc513c1a71ad06668437d601b7e89be8f2c0871fe7

SHA512
3ea751ddb7770e51b74a559c35027b04a74f110aa83df29b4b63fe0e75582bdb9a40b0cb1bd467ae0aaed0ca9a9ed014a8f078145aef28a53d69ff842d9344f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\prefs-1.js

Filesize
6KB

MD5
a92d450f9f4c7ff32ece410007e1e9e7

SHA1
c1d35fb74e2799427d95ecd495650165922681da

SHA256
dfb6ca8009835f3aca0c24a98810787dc5d2bb71f689869d2b926ee5be33b8ba

SHA512
c6c4097148fe23c4315ddbaf1421fddb7ef9a750854f7f4af533172f8a607b5baa33aa4c002cbb66867b0a456380204c0980e3b8ed9fcd4e7bdaf89114d9f438

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\prefs.js

Filesize
6KB

MD5
e515a1a24b1ad3bef6a8445bcceb501f

SHA1
2cf2748b2afc0bc4ddd6de5fc0536107bdb74c0b

SHA256
bc72ec91fc4281a1e36f4115099283d474515f801248381c942cbc6872a85147

SHA512
493370268d5af7ec342053a2c161d0eb11605621d52328d975b5c7915babad82312843553dbe94c56c6fda1397a361e28ff5348b82a49a1695393a7f1800a611

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
3d19d91b3eb2ec8b64e811b97b2f19bc

SHA1
8ed39338eed14989cab2c01fd875c5deb6007790

SHA256
abd08c528867abdb3e2a7c5ccb81f09ddec7134aa5bea86e4d5447e264a8cb00

SHA512
5b8c56197cee9da63b39f04703dd2c31f32b76f74614d0aba8092cd8402812a7263cf3cc6695f85717bfafa0a19d511492f6e084aa3513f121ee7c1bba1c56e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
6d3aa55ba7aada1c339dbb5959caa824

SHA1
4de9e670f70dba38d4f4f92734bb304247bdd0e2

SHA256
52a8570ee9c82fd8f44235eec5e6619d4cf80ecb4c2cdf9d446288f1e9691e83

SHA512
54ed55efec8ac4506cc1814a825ffe807b7c81ada36eb10d6d767d3ba0fa42a6316cbd68ec9740b14e1ccfb2f899e9b260a6f41ca199e785410a3b3f97064982

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
21f64221a4db951c7848df6c749c3594

SHA1
97c7f92f0e28733743a5411ccc332fd25ec3d0ba

SHA256
c495b0f1968646dd8b969d2b8ebcbc83f5617dc795bb667e13e272f15753b53d

SHA512
f8e069720d9acfc15c670152296f95ef3bde60bfe8094774ddcf99f086850de1801e810b65bdd8652ca5dc69344f3cafef48961c72ec59611bb41375973246ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
b78ff90df8956f9715b55e24cb189a1b

SHA1
8fc95ea31f358b663c4294d3ff7bc8fc2e4acc30

SHA256
823053463422cdbe1ac335f3fa394ca173fb8dff40a13ee420b11b3dc3a14554

SHA512
23e633504f4e0903caaae2051d04273a2771cc51c2a6065bd581da87821e98777672606fb2092071442dc6474a0688365ffb27db4748ed2d7b9c88b1228ef8cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\storage\default\https+++www.dropbox.com\idb\2146889975aspceixrMte.sqlite

Filesize
64KB

MD5
259ad772b8c6d0922aed14bc35d14ecc

SHA1
982eb98f174fc61091abb927f72ea643647ffb5f

SHA256
28e679c96e445684c43682a5ec14f084a2310b22f58944cbe557d71af5f3b06f

SHA512
4dca378472f759a11dcf83d89e6f5567f9ab096717d709d20d9f0c3c1f6d225a42fac13ea31c3308023e5267c6bad2673a8bd053fbd9aa96d3c967396ae30b65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\storage\default\https+++www.dropbox.com\idb\301792106ttes.sqlite

Filesize
48KB

MD5
1af6dccd68d9e28fcc0263223d041002

SHA1
b7b8aece54dac023c8ec151379c2e9d3cfa4ec44

SHA256
f9b3aa377dd950b533e86a8079df61a8ba4a386f17808b50db34e227bcd9f820

SHA512
a242e9f3ca68a037d5f1a55837015d04e3267e0c3077cc12163ec16da5244321dabc2fceb1b322fc63bdd83fde6ac72b12cb9144b655e83488410a61af9b627b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fxdqvyvj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
4886dc7b3764ae9d033ff05a296cc346

SHA1
e7b4b938c8db408c0be4c3469546b0b63e1a5e9d

SHA256
8a41ffe10b741de55355ada5a501348f062463bf2b50058e26b70f0486818adf

SHA512
85e40690ab4d2a340509506a8acafa5765fa1239bd1520703d0d40ea8a7e005b3e2596ff5f3e4cbe3e4dc8b40dfe565da2e5ec82d33d7b42d03ac614cd8eee27

Download Submit
memory/516-390-0x0000022913300000-0x0000022913400000-memory.dmp

Filesize
1024KB

Download
memory/1336-495-0x00000227D7810000-0x00000227D7830000-memory.dmp

Filesize
128KB

Download
memory/1336-631-0x00000227D7F70000-0x00000227D7FE6000-memory.dmp

Filesize
472KB

Download
memory/1896-67-0x000001CCDF890000-0x000001CCDF892000-memory.dmp

Filesize
8KB

Download
memory/1896-69-0x000001CCDF8B0000-0x000001CCDF8B2000-memory.dmp

Filesize
8KB

Download
memory/1896-71-0x000001CCDF8D0000-0x000001CCDF8D2000-memory.dmp

Filesize
8KB

Download
memory/3968-35-0x0000019C3B1B0000-0x0000019C3B1B2000-memory.dmp

Filesize
8KB

Download
memory/3968-139-0x0000019C41770000-0x0000019C41771000-memory.dmp

Filesize
4KB

Download
memory/3968-16-0x0000019C3B880000-0x0000019C3B890000-memory.dmp

Filesize
64KB

Download
memory/3968-140-0x0000019C41780000-0x0000019C41781000-memory.dmp

Filesize
4KB

Download
memory/3968-0-0x0000019C3B020000-0x0000019C3B030000-memory.dmp

Filesize
64KB

Download
memory/6316-771-0x00007FFF90B20000-0x00007FFF91B20000-memory.dmp

Filesize
16.0MB

Download