hxxps://drive[.]google[.]com/file/d/1fwJdsnnK8CE52uB6ttf5BOyA6_zlBL57/view?usp=drive_link

Analysis

max time kernel
395s
max time network
401s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
30/07/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1fwJdsnnK8CE52uB6ttf5BOyA6_zlBL57/view?usp=drive_link

Score

8^/10

defense_evasion

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2864	winrar-x64-701.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
181	drive.google.com
247	drive.google.com
260	drive.google.com
1	drive.google.com
2	drive.google.com
3	drive.google.com
179	drive.google.com
180	drive.google.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = f079716007efda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "605"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1046"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 33930a713ae2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = aeb91b6d3ae2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 268bdc5b3ae2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a582f76c3ae2da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 427e7a5e3ae2da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "605"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "544"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4712	MicrosoftEdgeCP.exe
4712	MicrosoftEdgeCP.exe
4712	MicrosoftEdgeCP.exe
4712	MicrosoftEdgeCP.exe
4712	MicrosoftEdgeCP.exe
4712	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1716	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1716	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1716	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	192	firefox.exe
Token: SeDebugPrivilege	192	firefox.exe
Token: SeDebugPrivilege	192	firefox.exe
Token: SeDebugPrivilege	192	firefox.exe
Token: SeDebugPrivilege	192	firefox.exe
Token: SeDebugPrivilege	192	firefox.exe
Token: SeDebugPrivilege	192	firefox.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4900	MicrosoftEdge.exe
4712	MicrosoftEdgeCP.exe
1716	MicrosoftEdgeCP.exe
4712	MicrosoftEdgeCP.exe
1688	MicrosoftEdgeCP.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
192	firefox.exe
2864	winrar-x64-701.exe
2864	winrar-x64-701.exe
2864	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4464	4712	MicrosoftEdgeCP.exe	74
PID 4712 wrote to memory of 4464	4712	MicrosoftEdgeCP.exe	74
PID 4712 wrote to memory of 4464	4712	MicrosoftEdgeCP.exe	74
PID 4712 wrote to memory of 4464	4712	MicrosoftEdgeCP.exe	74
PID 4712 wrote to memory of 4464	4712	MicrosoftEdgeCP.exe	74
PID 4712 wrote to memory of 4464	4712	MicrosoftEdgeCP.exe	74
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 4836 wrote to memory of 192	4836	firefox.exe	82
PID 192 wrote to memory of 688	192	firefox.exe	83
PID 192 wrote to memory of 688	192	firefox.exe	83
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84
PID 192 wrote to memory of 3484	192	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://drive.google.com/file/d/1fwJdsnnK8CE52uB6ttf5BOyA6_zlBL57/view?usp=drive_link"
1⤵
PID:4132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4464

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.0.448047007\1263163800" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 20767 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93768238-e4b9-468a-a110-f81e3e0137c7} 192 "\\.\pipe\gecko-crash-server-pipe.192" 1764 126996bd158 gpu
    3⤵
    PID:688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.1.490871064\1244687891" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20848 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b05c1733-552b-4261-abb9-be1c11961548} 192 "\\.\pipe\gecko-crash-server-pipe.192" 2120 1268e471c58 socket
    3⤵
    PID:3484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.2.501389999\1974069467" -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 2808 -prefsLen 20886 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db33f9a5-5daa-4413-8955-ec3881f6f542} 192 "\\.\pipe\gecko-crash-server-pipe.192" 2940 1269d6d0d58 tab
    3⤵
    PID:4220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.3.61363716\634904917" -childID 2 -isForBrowser -prefsHandle 3392 -prefMapHandle 3388 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2042d99-03e4-41f7-875f-663ed4c68b1c} 192 "\\.\pipe\gecko-crash-server-pipe.192" 2848 1269e430e58 tab
    3⤵
    PID:5156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.4.1791234876\1904701299" -childID 3 -isForBrowser -prefsHandle 4296 -prefMapHandle 4292 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac813c72-66d5-4925-a28f-d939195cbf88} 192 "\\.\pipe\gecko-crash-server-pipe.192" 4308 1269f11ac58 tab
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.5.1403399997\755618567" -childID 4 -isForBrowser -prefsHandle 4912 -prefMapHandle 4908 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5198c9d-86e9-4141-866e-11b505330bb1} 192 "\\.\pipe\gecko-crash-server-pipe.192" 4920 1269f8ae058 tab
    3⤵
    PID:6040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.6.724801112\463363263" -childID 5 -isForBrowser -prefsHandle 5052 -prefMapHandle 5056 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c38fcbb-82c9-47a2-bd8d-bf3e0e4629de} 192 "\\.\pipe\gecko-crash-server-pipe.192" 5040 1269f8aef58 tab
    3⤵
    PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.7.250326189\274524840" -childID 6 -isForBrowser -prefsHandle 5248 -prefMapHandle 5252 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33abc5cd-5978-4be0-986e-a533c34bb155} 192 "\\.\pipe\gecko-crash-server-pipe.192" 5240 1269f8af858 tab
    3⤵
    PID:6056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.8.1006938073\856153442" -childID 7 -isForBrowser -prefsHandle 5676 -prefMapHandle 5580 -prefsLen 29989 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22a37593-f906-4a01-861b-d027251ac173} 192 "\\.\pipe\gecko-crash-server-pipe.192" 5544 1269ea08658 tab
    3⤵
    PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.9.2116972110\1798736573" -childID 8 -isForBrowser -prefsHandle 5104 -prefMapHandle 5932 -prefsLen 29989 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ba84b3e-91c8-48f5-b717-718e0b0e3ede} 192 "\\.\pipe\gecko-crash-server-pipe.192" 5656 126a6ecae58 tab
    3⤵
    PID:6196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.10.793911245\1692771597" -childID 9 -isForBrowser -prefsHandle 5956 -prefMapHandle 5932 -prefsLen 29989 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee1b1e50-f78c-4bda-85d8-1eb64895a51d} 192 "\\.\pipe\gecko-crash-server-pipe.192" 6052 126a288bc58 tab
    3⤵
    PID:6392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.11.419666055\1457228671" -childID 10 -isForBrowser -prefsHandle 6548 -prefMapHandle 6516 -prefsLen 30164 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e627d45e-206a-4374-b5b8-559e800ffc9d} 192 "\\.\pipe\gecko-crash-server-pipe.192" 6484 1269ececc58 tab
    3⤵
    PID:6612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.12.1794799933\197918738" -childID 11 -isForBrowser -prefsHandle 10640 -prefMapHandle 10644 -prefsLen 30164 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0277d01e-d89e-4657-a91b-5f88f13332a8} 192 "\\.\pipe\gecko-crash-server-pipe.192" 10632 126a2e40158 tab
    3⤵
    PID:6712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.13.287366667\1001016313" -childID 12 -isForBrowser -prefsHandle 5320 -prefMapHandle 5308 -prefsLen 30164 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {531a7828-9a5a-4546-81d9-f2f9eb84a294} 192 "\\.\pipe\gecko-crash-server-pipe.192" 5312 126a054c358 tab
    3⤵
    PID:7040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="192.14.1145611352\404029608" -childID 13 -isForBrowser -prefsHandle 10360 -prefMapHandle 3336 -prefsLen 30164 -prefMapSize 233414 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a330a2cf-83d4-4152-822b-a20b02db24d0} 192 "\\.\pipe\gecko-crash-server-pipe.192" 10380 1269d60eb58 tab
    3⤵
    PID:4428
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2864

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5908

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQ9VIUB\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
27KB

MD5
c1d3648111c4f4f0327be23d800f809c

SHA1
3837d2bf05cd38efb93af22131da905a3e08e9be

SHA256
af08dd6f5c02366f6fb308838925b2412856ccd9628d0baf964b3758fb321f77

SHA512
aa6bb7c88c93745fe3b56fdedfafa5d4de1fd83e58df8fde2fb5f9514615afdce3cbeed8a217b9fc686897deccf91c8e42b29012adaced159e75c2d4f5a1fd8c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Filesize
13KB

MD5
8d43bd435f10dc06700f38a4cb63e7bc

SHA1
b1388df09e2a9e475aea97ea989ee1333f2e4703

SHA256
a101c8f814ba3d1a9d2a159bcae82403218cfa173dff0f3a3d9c672257a0eb1c

SHA512
22e2cd05df96a23247d22806b2e859cbe66a3aa6eb009817f60e46b70500c90f0ab8c29fe3223898f77ffeb4c904263185c6a6c7ce1f265b864bf26f129f9121

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\9FC8C85689D31525EACE26158B83B464F43A027B

Filesize
23KB

MD5
16845c7180f7e40393bdb1047acff3ab

SHA1
810de32f98ac8e3ffb54546f7f3c8caa14a8611a

SHA256
a3a06e671c785bb02b68ba6f22437d75aa0d24280cf5da91e9a8dc0ccab4e190

SHA512
7148e9ff1a7b0aded04da0ae719b532b9584998a9e839bc677b4b7854d06881a8408f3fbb9f105ffd71888c24d18fbcafc82372806dbd63939aaf532ad789864

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\thumbnails\75b1f7e4f3e621c7bd2912b6a371fb84.png

Filesize
1KB

MD5
b5b456e64f1c4cbb7fe01d9031f50817

SHA1
2810a84577f38b3be35904248f09989049bab339

SHA256
8ee38a0b1177137adcf58489beb798f4f0caf6065457568ca68b0c1e2227e501

SHA512
4257a8e157a45ff66e87d7a6a208261021d01906b9f927088cb4f711f2696b066d3108e85398f62c32a98f0706d746808cb2f860c0798d08ae6489024ab296cf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\9N6RE061\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\R5EUWRSV\drive_2020q4_32dp[1].png

Filesize
831B

MD5
916c9bcccf19525ad9d3cd1514008746

SHA1
9ccce6978d2417927b5150ffaac22f907ff27b6e

SHA256
358e814139d3ed8469b36935a071be6696ccad7dd9bdbfdb80c052b068ae2a50

SHA512
b73c1a81997abe12dba4ae1fa38f070079448c3798e7161c9262ccba6ee6a91e8a243f0e4888c8aef33ce1cf83818fc44c85ae454a522a079d08121cd8628d00

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
5056708f70b45c2ea44aaac7e6141adf

SHA1
29da833dad61570dbf1535584996c0341363583a

SHA256
7745050c45dab44f8d8a9163fbfbe77eac6de5e04ada6ced1bc9f9bf6e7121af

SHA512
4b600ac5ec55119b6f01a989ac04e92bd5a10c8e21ed141f2c0d8c3e52c711a878c4aead1423d92a6e876e3fa9b253f865c3d771d3640e064c334983145d487c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
ba82a1825db2c72c08ff4376f80e435d

SHA1
b8e8dd056d3a3e8754d037d7c98980f17cea155d

SHA256
8bf8620de9599c0a9257c58841ef0f7f8dfda6b5b51fc3fdaee3276365681118

SHA512
a522b34eab793effb45606266e69449c331b52b17bc472163f52524eaba48b691ebbaa13bcd88645f7dcfeb85e98419dcac23b29d75936128403a8f8557178f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\broadcast-listeners.json

Filesize
216B

MD5
445dfd04bb4d91c625977b3881f41c2a

SHA1
d063b9e0c27ac9e1738e0d41fa9b85e4383283cf

SHA256
764ed7be1eaca760931bce9537eadecc7b1900c687c9ed22f1662b82b54efbcb

SHA512
4ac21b59b99766d1df978e4eae980bf04474410b90a8575f44eadc7f30e4f97ecfb648971f3954161064a96c980a0891fce86d62fe5e3a260245179d9907f6cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4767aeb9ab02509cc61e1684e19c0d81

SHA1
44750e48512255879d611c15b303b31efcae6814

SHA256
65028cda4e753287ac12fab62cfa887461e0b8c91bd6a9975c5befcc5b3c8350

SHA512
bbc5e7c907c3ce77d114e4a5a5e753a596b1a76339657e359980b9e9a50f85ea4d3823a44bade3e9473018194effd02e595cc3f2c510f4d20cc9eb96bc994771

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\535fc4ad-b3ed-4406-a0dc-849239553edb

Filesize
746B

MD5
66d120fb466946bfcf32e7c4049701af

SHA1
a08dd61559503beda0b86654bb073f0a7002671e

SHA256
bd4b9e7394c49e79c536733bc3c1cc243a8d1a625eaa6fb4b18a1dd83b32a8b8

SHA512
f60a74bcf22ecf872e37e1dd433977061f265bd322e6fd72e26d992e6318c5fd2711527fdc558ff8795468bce7009d4a2a6b27615558a3ad2b63349f1dfd9b15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\cc3337d6-128f-4476-b9ab-40777d056d06

Filesize
10KB

MD5
6bc3ccc771c240be47dbd33e08813f61

SHA1
62063a1a38fc13180c1f4f70c983f926035e566a

SHA256
c51b3c750750861eb5dcf95a35875ad78b2a918185df62201b69be008b687ec8

SHA512
5de7105d0a8a305ad08274b5b2aa7910e5c5dd55538eb5e76d9eaf1897c1f5975a2902b1187e64413a0ebda22bb953efcefc7507d481d16a71a99dc6f5e67f43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
10KB

MD5
f7ab9c71e4297a192350dfa1e60819c7

SHA1
e91be99655792f98e502b248297580e1c8c78595

SHA256
66e9ad2535536c781ae432d68da73a402acf53ffba273f01036d6e541913dff3

SHA512
5f03abb58ea6a5a56c365410925fc4c556da13d783711afb59af097906bfc05b3a86cc22c737722f1cb7aeb3243ceccd6b28534c109ddc26cb4921ae627cbca2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
10KB

MD5
e023eca02a013b1699e1444d0a35f266

SHA1
0954eed242081e1bce988786371b0c8c99d994d0

SHA256
1bf37c511b60b2b6d0ad3ef482a211ac72585b89d2a58109eac94b7c00ff6fdd

SHA512
efee322fc1ca18aea099d6a1905bb6cbd17ea1010eb1e99570de13302130bc5bbcf52bfdcae99f14d242ee1909941c430c41e5c947650dd300670447099d2e16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
c869cb453f6baaffdefdadca2f57a4e4

SHA1
63150c6ccb042d6a8c86071e0c5df2ac6d7f42ec

SHA256
1e15104955271ef46467adae88ba0709575b9d1623951696acd416dd045d554d

SHA512
da70c08fde389092c67eaeb3d4ef28df35fa9dad46bed29720b5355c7efe5b437588b09e084de728a5f4a95bdec75e500a83bba997cecd944c8f18b15d1cc81b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
997471d6886b1cffd8f9bc2605666aba

SHA1
bf57aff3c7b55d1447d9d284e8c2fc75511bbb9c

SHA256
5ddacd41708391310058278489b3e0297d9d198952579263601542082ffa4bf3

SHA512
d1b1b03f7958559ac2a38cf7b3fce85f0cd1e180cd6c7e1207ad5f75ea0f64948a0ea8b3359046dae7155780182d17ef69fb2ed2f9da98ceb7c32b648e3f74ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
7KB

MD5
6f62753f003ccbf889f74951a9da3e30

SHA1
64d23e5e92e37f46b6fab0ffaa459829659c6b0e

SHA256
eeeb783d478bf652a8977eff5b9fe9c1da9edcdab4d66085adbbd10167c60649

SHA512
5c0a95c9b2420c2a0890313d116476eba0e5e006d2b39da34d77c5a7937de679b0558eef0916ffd82abe52287dfbe7d5c3597e468c4e509153eb52fd760b0500

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3479c696b712a6b98222ef0917e91309

SHA1
a341f676a2f5a643f9d66bff59fbe649ed634c72

SHA256
f96835cadbc2f6be2915c70a6d4f53ae610b43b8692519aa63c7cf0de7242c38

SHA512
805449e73db04fa6a3f1f80574b679b12ff7098845f307ef2f67c5f1af15dc85e3ace013ad4160fa346f5eceaf6a85e50c09dfcccc743fc8ddb70e504c33c370

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
71ab19b712318d4bf0097b9a21ab7f52

SHA1
5d992f5594b075b70a246da5d309681fea95804f

SHA256
9676b6035ea54e2a017f2f57563a77c4546982c31106dcf28eef9d17a1936fa7

SHA512
7b95ab168d5b7bc209123f33c01e052460b6d1cc9923ce05b02b5d1078720a9da30082b507768bf7fa898ab6e1db538552a39061fcdf3cf25677dd71617f324a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
d6d251e8eb6348c04700d39bcb6568c5

SHA1
a7dc08d086387f2c455abdcc65c8fa9beceb07b2

SHA256
7bc089b463691cd68416f379e8bd5414b73945642ac1b656ae41a52619132163

SHA512
f86806b423e833247041dc4ea29ebfb8381e217f47b9561c6f9b522bb2358b79dc925242944756213a9148236af46f55e2d76b0c5e754b3c24a096d583ca10b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
9f5b71ab4b8b87ef0b60a7651f916053

SHA1
3253beb575a3056d2c7da56ed897de63eadb6fdd

SHA256
f672a3eb2fbe83e9182929c7d03c97e58bf67509b123404bfa30a9f5b867d9a2

SHA512
ab6bfc4db5113cc23d81c6c39af36b6035f42d5d6dd736330d891dbe91265b82d6e5bc5e6b8d4444366ddd99ffc107765a93a6f7932fd919f026ae1ec06947f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
7c68e0757311ad67ad7bbfbecf3f415a

SHA1
a9128bb814ea8341c98867a7f8a0474d472ee0df

SHA256
ae4a0e1d4dae3b422b02f936d58a5402b5e3e0f2f4dca243c6297fff1e91cc27

SHA512
d0e48b03adb9948f8c80505d5bbc5d04243970bc5241f055dcf9c80c8229282f46fb9fe1304369afae22cdbba62dbe4850e194f3fc0c5104b89fd55dd60579f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
dd458834edebd962eeb3f43d038ed296

SHA1
2086735d46441d952951fdabf065c1bae41db477

SHA256
ec1418cd451d9d8fcd63c1ee568f53bbe64a4299673e5f5a83ccf7c9561f1d36

SHA512
6cffb6d4bef64ce4a66409f74780b2603fb17872e3349b44ab7afe732bda5bb3c1c88aa4c900cf15e0bce023f6451a31a5ba6ac493430a6b834c8e6e5a064ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
dcac875f236f79f7cb67689f598d1177

SHA1
200298df63dfb69a52d48b8e500075a27896210b

SHA256
0cd879de6f96ee588504ffaa13625b63c064d557e8757219d54b38af57eb29f2

SHA512
a1bef791f85ec112876a507fb27c9d31b73f90faeea50dfa77cb665133d603c7c80838c1d1ea43c68d307d62c7a67bcf230a0ff50144bd074c3aa0e76bf366cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
f2cde5b5d1d4b1c367bde335290d90d7

SHA1
0440d18a8e0335417565d2a6d542e6f9078f7264

SHA256
c10b4fa375407e5f9ebfacb29f48d99986ac2381231e73d4a1eac2a9b401ee07

SHA512
6bc2892d6c744709140a5569f5e362c12b25c4d2ad32b5cdf2089933144f69d459b22c2a13bf0e6ac88cb00a4603aa9e22a8e791849299012531a934db854e8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
8.0MB

MD5
29cc9a8d51082751a012efb58cd1502a

SHA1
88479fe331336753770bfa4c1c9d95ed811d2c70

SHA256
19d0e12d9b708e0a2a99e9b60159c0c1e61650d7ddfe342c5638d6e9d4be62ce

SHA512
84b3a834c0a889914f9ad115d4f22d47ac7e718f8a1c41bef019b6587f5275ad200d2742d692fee8cac267be37ba52d27d32059cc3ca41175605a9701ae74454

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\targeting.snapshot.json

Filesize
4KB

MD5
9810009d9ea3ead10bca74acf08f01e2

SHA1
dfa2cd31fa499a3056b581638e1b9c78ceb3545f

SHA256
e4eec6788940ff9a6a7915e0541b9c803d643c93dab29b4a7c7438582880ca6a

SHA512
5109e1dfc597b12af21ebc8282b1e4c8001ea50603d52e9ce791cfd4fb6df21c57db33f55b3eab747efa718da42d7eb1ce259ac0880a93ee634c4255a2298c22

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.wyVLImv8.exe.part

Filesize
15KB

MD5
0768b4e647494f8879e68a78aceec69a

SHA1
ee903db50a63f52087d5cbdf10964e63d9ebd4b1

SHA256
b6c766647c4117e535b85d668da78bfd39e05350ae8582321090684b3ef00be3

SHA512
7f6e0fa7c95f9010566476495c46d6f814c4ec4e9c068ce27ba9244fe833ee001ad507f0ae34a67f6347779033d5ca85698d370d0dc6b7b06f0c74f5c4e380cf

Download Submit
memory/1688-262-0x000002605DA40000-0x000002605DA60000-memory.dmp

Filesize
128KB

Download
memory/1688-267-0x000002605E040000-0x000002605E060000-memory.dmp

Filesize
128KB

Download
memory/1688-176-0x000002604D700000-0x000002604D800000-memory.dmp

Filesize
1024KB

Download
memory/4464-447-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-102-0x00000284CC580000-0x00000284CC5A0000-memory.dmp

Filesize
128KB

Download
memory/4464-460-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-455-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-458-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-454-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-453-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-459-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-166-0x00000284D5AC0000-0x00000284D5AE0000-memory.dmp

Filesize
128KB

Download
memory/4464-96-0x00000284CCCF0000-0x00000284CCCF2000-memory.dmp

Filesize
8KB

Download
memory/4464-457-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-452-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-98-0x00000284CCD10000-0x00000284CCD12000-memory.dmp

Filesize
8KB

Download
memory/4464-456-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-358-0x00000284CDCE0000-0x00000284CDDE0000-memory.dmp

Filesize
1024KB

Download
memory/4464-100-0x00000284CCD30000-0x00000284CCD32000-memory.dmp

Filesize
8KB

Download
memory/4464-443-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-446-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-442-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-444-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-445-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-87-0x00000284C9C80000-0x00000284C9CA0000-memory.dmp

Filesize
128KB

Download
memory/4464-450-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-451-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-448-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4464-449-0x00000284C9820000-0x00000284C9830000-memory.dmp

Filesize
64KB

Download
memory/4900-35-0x00000196CDEF0000-0x00000196CDEF2000-memory.dmp

Filesize
8KB

Download
memory/4900-16-0x00000196D0A20000-0x00000196D0A30000-memory.dmp

Filesize
64KB

Download
memory/4900-220-0x00000196D6FC0000-0x00000196D6FC1000-memory.dmp

Filesize
4KB

Download
memory/4900-219-0x00000196D6FB0000-0x00000196D6FB1000-memory.dmp

Filesize
4KB

Download
memory/4900-0-0x00000196D0920000-0x00000196D0930000-memory.dmp

Filesize
64KB

Download