hxxps://arras[.]io/#wf2493

Analysis

max time kernel
273s
max time network
279s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/07/2024, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://arras.io/#wf2493

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "3597"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4e27029279dada01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = f7e58d8379dada01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "428226805"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 60c1f39179dada01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "428243399"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "704"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "603"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "1865"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = b09f5d0659eeda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2168	MicrosoftEdgeCP.exe
2168	MicrosoftEdgeCP.exe
2168	MicrosoftEdgeCP.exe
2168	MicrosoftEdgeCP.exe
2168	MicrosoftEdgeCP.exe
2168	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	368	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5048	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5048	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1108	MicrosoftEdge.exe
Token: SeDebugPrivilege	1108	MicrosoftEdge.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe
Token: SeDebugPrivilege	4180	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1108	MicrosoftEdge.exe
2168	MicrosoftEdgeCP.exe
368	MicrosoftEdgeCP.exe
2168	MicrosoftEdgeCP.exe
1064	MicrosoftEdgeCP.exe
1108	MicrosoftEdge.exe
1108	MicrosoftEdge.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe
4180	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4580	2168	MicrosoftEdgeCP.exe	77
PID 2168 wrote to memory of 4580	2168	MicrosoftEdgeCP.exe	77
PID 2168 wrote to memory of 4580	2168	MicrosoftEdgeCP.exe	77
PID 2168 wrote to memory of 4580	2168	MicrosoftEdgeCP.exe	77
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 3936 wrote to memory of 4180	3936	firefox.exe	86
PID 4180 wrote to memory of 4568	4180	firefox.exe	87
PID 4180 wrote to memory of 4568	4180	firefox.exe	87
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88
PID 4180 wrote to memory of 4000	4180	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://arras.io/#wf2493"
1⤵
PID:4776

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1108

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.0.1258320523\924887404" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceb94794-a2c9-4441-b7e9-35acb8ae3023} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 1780 24fccafc958 gpu
    3⤵
    PID:4568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.1.1265065754\1523512116" -parentBuildID 20221007134813 -prefsHandle 2116 -prefMapHandle 2112 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f163780-9271-48d6-94e6-f3a4788e0c48} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 2136 24fcc9fce58 socket
    3⤵
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.2.1934776208\619348926" -childID 1 -isForBrowser -prefsHandle 2772 -prefMapHandle 2944 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2a3f305-c837-4619-9c60-5c76aa5c3e92} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 2920 24fd0c9c958 tab
    3⤵
    PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.3.1777086575\1531003160" -childID 2 -isForBrowser -prefsHandle 3436 -prefMapHandle 3428 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c966f19-9b65-492e-8826-aff98190ab88} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 3484 24fcf3ba158 tab
    3⤵
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.4.2103676788\562024533" -childID 3 -isForBrowser -prefsHandle 4036 -prefMapHandle 4032 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17d49876-09ab-4832-8da6-2520e5073532} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 4040 24fd2274658 tab
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.5.307998924\1726267197" -childID 4 -isForBrowser -prefsHandle 4860 -prefMapHandle 4856 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0d6f332-7a87-428c-9542-3ab53814ee74} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 2620 24fd2f25758 tab
    3⤵
    PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.6.1687887270\1051034433" -childID 5 -isForBrowser -prefsHandle 5012 -prefMapHandle 5016 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31512e50-0479-40a2-aa1b-87a20052df58} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 4796 24fd327b858 tab
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.7.1221964323\588257190" -childID 6 -isForBrowser -prefsHandle 5192 -prefMapHandle 5196 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbbcdde2-e24e-452e-aa03-2daabf9669db} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 5184 24fd382c558 tab
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.8.1554256665\80116607" -childID 7 -isForBrowser -prefsHandle 5684 -prefMapHandle 5692 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3374575b-9fcf-4b60-9718-80cfdbfd6728} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 5704 24fd465cd58 tab
    3⤵
    PID:2612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.9.177092305\396075585" -childID 8 -isForBrowser -prefsHandle 9808 -prefMapHandle 9812 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8326014-5229-4f58-b5fe-5c754f40d796} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 9832 24fd5b7ed58 tab
    3⤵
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.10.1987378142\1072106591" -parentBuildID 20221007134813 -prefsHandle 9588 -prefMapHandle 9592 -prefsLen 26503 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36a793f4-d7f1-4898-928a-7f62f1c3e263} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 9576 24fd5cfb258 rdd
    3⤵
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.11.1388460020\1424794120" -childID 9 -isForBrowser -prefsHandle 4148 -prefMapHandle 4088 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d1ec88f-2e6c-4d3f-8826-07da1e7cb29c} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 5724 24fd5cfdf58 tab
    3⤵
    PID:5804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4180.12.614973330\22835127" -childID 10 -isForBrowser -prefsHandle 9248 -prefMapHandle 9240 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c73e1cd9-d222-4218-a914-61882302b476} 4180 "\\.\pipe\gecko-crash-server-pipe.4180" 9224 24fd4e3e258 tab
    3⤵
    PID:5260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCFODRP5\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\10653

Filesize
9KB

MD5
ce09ebe5a2a2e661c86925ef04170c60

SHA1
1aa60105831ac47484b888bf310b335164be708d

SHA256
47f3205a7fc0f3b46607d8c1addbdf96402d0ba568e3ac55d10c3d8173b9d29f

SHA512
e35c309ebad3e0d056d302667419228e262182eb56e81434510245528d8af9563b8e9195bf8f3afea791df27d7b006cdf29771016b76d75de03e4cda573a629c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\11170

Filesize
9KB

MD5
c7a1881f6098a13b4e0b66a54765d2c3

SHA1
76412d06b532c2689da56b0abe065cacc143e4d2

SHA256
182839a3858dfb5fae4c4ac8a47cc597ed89bc4853b444e6018b87ffbc1cd47e

SHA512
3900b8223bfc1c34e2feada13bc3c633a10d411724b597f2135c6808f56ac876747814b21c504890f91cddcae5c0ddcfdc3aa3667e3e05196e896fa1d6d7471d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\15460

Filesize
8KB

MD5
7d3cfde8af6a78f85d31e9e42a046b43

SHA1
17ee165fbe86bdfc21fb5b5e4fc8549f3950380a

SHA256
c4b99a7c0fdd5a8bb733d7911e768edfdcd5e2017a6a93f9341026f63a0cde00

SHA512
0f547a77fb8128a3c56e27984efb5e0eb8fe919ec7e9948d43b0adb86c79655c777b48d41eb6443db0748d362a6549e2d152003881ce4e8970f9296a6b225198

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\17356

Filesize
115B

MD5
679a475b337485637338e1d330b4864c

SHA1
20518e969a98c6ba41d2e90b65dada8c26425607

SHA256
2a73fd31c42e2167d6fb1648645eec1b3d3487f699dcd8151bbe6a77f958bad5

SHA512
ed5ffe056c1bf9bc9b019a2f48ff77ae9c041a68ce55abfdc6aea4f0063f22bf9ee4f7f924f2da54c87c8749fed6150aa7872dd6633f74dc2760c6d8f13ce3db

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\24320

Filesize
9KB

MD5
5e1482bf6b04f0b42024e1fcddb7c654

SHA1
5a96497f8318d055b95a9267aeeb9fcdafd038e0

SHA256
5705ee6bb45f4b4bf17123749d3d80a8a269fe2a0dbb7969e6ca91a969d1f3a5

SHA512
6b8004eb150e15585841a98bfff1a6dc90d4567a812b726cbabc4588eadf555f97f249caa3bdc08d4086c5c9ac139e0ebedfae6972ae5aaada6e6c863f41d4b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\26464

Filesize
9KB

MD5
22c391d9effbb95e5a98ac6637bf7f9c

SHA1
df80ba7343bb6343ea07c34c43544bd34be98e60

SHA256
26db916f673b8f5d9aebf6b2ca83a1f4f80bd2f9487357d5efc5b471fb5a369d

SHA512
7e1d76ceffb27b40bf1ea78024c5c9bd0797cce857be21e7ad14aa1a296fa9d1a666d4d6a38a9ca33f3fd31d66a3d8388896e5caaa957b36ccf2235b128f512b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\28764

Filesize
9KB

MD5
9a541dd295ac4f0d9860c0477fd682cf

SHA1
ec513f40699b7f9a1b91846227e7538b3c7d4673

SHA256
3a257c6e7106fb92fd897c06d2137c0c0fb56f4b3942dd89c5a9ea4f9f8205bd

SHA512
1b660fb4e98ec4e526a4de6de768a017c0be973a82044697c4111a8b6875f2a4a47d62abef481bf51239080c2db8c8e8adbcfdb3e268eb3d9e539ebed9725c59

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\31842

Filesize
9KB

MD5
d8d72dbef2834bf0806d01e14b09c9e0

SHA1
67c9899c1e89be1b335f61b8598014804796914f

SHA256
b9e754a4636990824d1959e0c425bd85e0938012aa89d5a43c0f3de746d47695

SHA512
758abd3adf62bca0c15494cd0328b61d477223b88b12a7828559fc91c17c76959c64edfd6fd0e0568df106e5fdc0849f41a6105c752213d986cb62445daf83b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\019E6E81C87648C62CE6729B1517DFE1B56B9EF2

Filesize
12KB

MD5
fc0f164b08811a98ff60c7ddbe39b26d

SHA1
f6a5e06cf9d2488fc86000443352e3d1b04ec5e3

SHA256
f921e0628ac8d8394ea0ef9e922341b515025b60266d54f5bfdc2c99b3cb4d93

SHA512
332599849c1968a4966c9eb21bc6272b006c3299a74e05744251c85d3465d04fa1d824723e1c83c1b1f595997e00bb8a84fc536ca02c3c5d6dda9a4b706456e3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VB6NM2YV\warmup[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\GKH8NJVT\www.bing[1].xml

Filesize
1KB

MD5
cc735de7090c4377d79249818ef18f1f

SHA1
7323f81758358e9b2fc5d3b28be7e395e665883d

SHA256
9db85fd56f09cf1323609749cdc585314f94d375bc9376d2949870b3dd923eec

SHA512
00092e02baa44105ff8f339cb59c07b776c2283388a10174f310b1758693f6ba8ccaf6acc3f79e5cd098f96f651ebed7e9f8fc4411330a167b2c97b3477671cb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\8635Z59S\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ZE6UHZIL\16x16[1].png

Filesize
1KB

MD5
f69c15b17dc09acfa4636c74e72e214a

SHA1
525cfbbef8cd36c2d14f1520d9c64011a8d906a9

SHA256
7c6a318cf4932c4e930fa6bc4374ba81bf3ebfae1e4a491a7d551ea3119a20e0

SHA512
ae62ca39f21e02e3335707c5f3a8c587b701d58bb540aab479fa7695ed5b292467719c295e9361b90c3808f53b38fc5944ccafa9eab90ceea4b186a390931d79

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF3743B2D899F9DFA4.TMP

Filesize
16KB

MD5
7112148377ac3b133bf5ccc925b00b23

SHA1
066dc37896dc789a1baba00c225f8d06d7cd3c5b

SHA256
010070056173414d472e59aff2cf72ee5bf9e6664501ba435a30daac5b907cf7

SHA512
66d5d7ab4d1bca3da121828a41a506e3bb99536a8245f9a32bec499d21fe220085bc5c7cf74a85b8b3e8b6c2738221b76a93cd3debc6d80cc52fdc33b88458a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
db62c737ad9c96ca17c98e882c4ffef3

SHA1
23ddc4679ac845c0c9f7c07857434cfebea55dd3

SHA256
8e0b85c6d08684271abcf30d4618ebd799db1f4313a9321462094b5b30cfd551

SHA512
47e115fbfd898678596f28463a7a32fbcd818007f886bc2c3017667f6979eeccf5e172cf11cad7a6d34e0d2353031946262a8da5e8f542bd5fbb09386078f019

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\0a5ed3a8-af15-4333-9ddb-8c063865410f

Filesize
10KB

MD5
e4dd909e29c04d5e574e14030f850036

SHA1
5447f6eecf13f4594b579c470f870b7dd3559a74

SHA256
5288066710e61e2ac6a4903115331dad55f36a22d9d29b8c958b10531b016bd6

SHA512
2fb9f65e45b2ec57cd58814964a348446099bfd816379126b3787fd7e13bc1f63b1dd26d2806409ed5931fbd11ac89e6d31e118e55ccfe0c58df59598231ec93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\f8cc22e2-c06d-49e2-927c-2c7cc6914aac

Filesize
746B

MD5
cd6ba5a0384c2b4551c3851e39e24eac

SHA1
0bc832211e113bc2e89381151c0fdd372a6f6a18

SHA256
5f0dcdd1b88d31af702523d20eb2b4628071b448b52819694c5ac4e519abe858

SHA512
799e62d7bc120687b44ba20d6ff1076fe75d169d427bcfedca7f110fbc2ce2d967b08a091ab702b8db00aef76d3a157e498177a7538885dc6466fb79d95ec7c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
41dadb401ea1ddc223496af35641ddbc

SHA1
16ac22bd7b8195e26751c02bdb14aadf27a2792b

SHA256
07851e3e52a26a4a9d9b4eac9b2ea0bad05becf1fd19e1c6b84ddcb9bae5b142

SHA512
31a95704f2ae87cb454fe7adae4ae4b65319ec8f8c3034313fc4232f98f8ce65a3b7145fb0ef750cea9324681957228892551f63d2adc25dce2be1980ec36e70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
adc6d9bca2b99e4d2ad0ad7bf53fe69f

SHA1
a9e138f60edd739a69160e1b0fbe46905589eeee

SHA256
90e60b71f385bd9a19767b5b4be5c77f784f55936de273af69ef19b00d12c6f8

SHA512
817e0387a5c7c8797fc7b5f55b002854513b6476c15b126263b43582ae4a360b6fe567a962cdd80700a484a2bc4e926de4668d55b58c67f474dd99bb9b58c438

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
30cd47aecaab9a39d7f9d5b00ab8fd7e

SHA1
0241f508624d36d868bd4459935306f936ed4436

SHA256
9680aea79fff4686f685f2fc72f04c4aef1f942ed965a4832a36e14a0fd43c2d

SHA512
57bb42e4d66ad2fa0693162aeec7cb4f4e833a9fa58517180ca748681eb88f470543d040cff2c716231fbbb81c2d551325d9da8132c301065dbaaffde38e6db0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
194KB

MD5
b63d54c8b7a1c00edd4819f1e33c065a

SHA1
da0fec069324ac4523be6b4179376431ac188e9b

SHA256
40056d4040d3fc012c0e5e11be632c0a9ea483d377fdef824664e5f39b704105

SHA512
3a7b47f9e562c33b85fd673ae8bb369c4bbca310721421907d54543ecb392bf29624ec76af8101db634362a6a8d323858d2e9d2aac15e3523bfbedb0f19090bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
194KB

MD5
38e7e699dc0dd1e71efe16fc89b3b627

SHA1
98c37d5ad3e5a2fdcc561d1b471ae12fce11e516

SHA256
78e42dc4d6cef3cb57dc00a5dfd2b7679cc024e94abb17cc77f6b3c21f34a460

SHA512
f02126b7da17db5d9df73ec8f154baf1bc9ef6392a3f400ec986ffaf11628a6f216128c4f463f031384d642714471d07241f5e7666389749c2f97cd02d913c9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
193KB

MD5
15ff0a56052a25bdad0a65c3e59ab4ad

SHA1
bf1670952ad90e3a913864ee1a2c7085c524bc2e

SHA256
2abfb288c5946a443d279f32f7435b5ecc4f765bcaa4a6891301b728e62c3175

SHA512
c79bcf37aa8dec6d4bdb37ced68decf86a5c39a80fdc62d8af7e3a2f4b8cc4a9aa2729746a767378682d1c702aa7ff256550bc795182feb820678f575cb62223

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit
memory/368-44-0x0000014FBB440000-0x0000014FBB540000-memory.dmp

Filesize
1024KB

Download
memory/1064-213-0x0000012F357D0000-0x0000012F357F0000-memory.dmp

Filesize
128KB

Download
memory/1064-205-0x0000012F35540000-0x0000012F35560000-memory.dmp

Filesize
128KB

Download
memory/1108-121-0x0000020BF4360000-0x0000020BF4361000-memory.dmp

Filesize
4KB

Download
memory/1108-35-0x0000020BEC5E0000-0x0000020BEC5E2000-memory.dmp

Filesize
8KB

Download
memory/1108-312-0x0000020BEC630000-0x0000020BEC631000-memory.dmp

Filesize
4KB

Download
memory/1108-309-0x0000020BEC670000-0x0000020BEC672000-memory.dmp

Filesize
8KB

Download
memory/1108-142-0x0000020BF4500000-0x0000020BF53C2000-memory.dmp

Filesize
14.8MB

Download
memory/1108-17-0x0000020BED630000-0x0000020BED640000-memory.dmp

Filesize
64KB

Download
memory/1108-122-0x0000020BF4370000-0x0000020BF4371000-memory.dmp

Filesize
4KB

Download
memory/1108-316-0x0000020BEAAF0000-0x0000020BEAAF1000-memory.dmp

Filesize
4KB

Download
memory/1108-0-0x0000020BED520000-0x0000020BED530000-memory.dmp

Filesize
64KB

Download
memory/4580-82-0x000001DA1BFF0000-0x000001DA1BFF2000-memory.dmp

Filesize
8KB

Download
memory/4580-80-0x000001DA1BFD0000-0x000001DA1BFD2000-memory.dmp

Filesize
8KB

Download
memory/4580-77-0x000001DA1B920000-0x000001DA1B940000-memory.dmp

Filesize
128KB

Download
memory/4580-60-0x000001DA0B440000-0x000001DA0B540000-memory.dmp

Filesize
1024KB

Download
memory/4580-86-0x000001DA1C1D0000-0x000001DA1C1D2000-memory.dmp

Filesize
8KB

Download
memory/4580-84-0x000001DA1C1B0000-0x000001DA1C1B2000-memory.dmp

Filesize
8KB

Download