hxxps://drive[.]google[.]com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view

Analysis

max time kernel
384s
max time network
385s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
31/07/2024, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
110	drive.google.com
111	drive.google.com
247	drive.google.com
248	drive.google.com
1	drive.google.com
2	drive.google.com
3	drive.google.com
109	drive.google.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 600afed65de3da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "543"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "3508"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 37143de65de3da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1046"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 48c195d75de3da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "604"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 54a49a035ee3da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "604"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000006519f11e952641fa1f7b5ed3ae09ce0fbdb958a899959cc5fa3dd507d6900e474db4e8bbdef537b9212d61936cfee0a86c09042c0dc759d69078	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "3609"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1786"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Downloads.zip:Zone.Identifier	firefox.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1716	MicrosoftEdgeCP.exe
1716	MicrosoftEdgeCP.exe
1716	MicrosoftEdgeCP.exe
1716	MicrosoftEdgeCP.exe
1716	MicrosoftEdgeCP.exe
1716	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1688	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2104	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2104	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1852	firefox.exe
Token: SeDebugPrivilege	1852	firefox.exe
Token: SeDebugPrivilege	5800	firefox.exe
Token: SeDebugPrivilege	5800	firefox.exe
Token: SeDebugPrivilege	5800	firefox.exe
Token: SeDebugPrivilege	5800	firefox.exe
Token: SeDebugPrivilege	5800	firefox.exe
Token: SeDebugPrivilege	5800	firefox.exe
Token: SeDebugPrivilege	5800	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
3276	MicrosoftEdge.exe
1716	MicrosoftEdgeCP.exe
1688	MicrosoftEdgeCP.exe
1716	MicrosoftEdgeCP.exe
1852	firefox.exe
6112	MicrosoftEdgeCP.exe
3276	MicrosoftEdge.exe
3276	MicrosoftEdge.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe
5800	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1876	1716	MicrosoftEdgeCP.exe	76
PID 1716 wrote to memory of 1876	1716	MicrosoftEdgeCP.exe	76
PID 1716 wrote to memory of 1876	1716	MicrosoftEdgeCP.exe	76
PID 1716 wrote to memory of 1876	1716	MicrosoftEdgeCP.exe	76
PID 1716 wrote to memory of 1876	1716	MicrosoftEdgeCP.exe	76
PID 1716 wrote to memory of 1876	1716	MicrosoftEdgeCP.exe	76
PID 1716 wrote to memory of 1876	1716	MicrosoftEdgeCP.exe	76
PID 1716 wrote to memory of 1876	1716	MicrosoftEdgeCP.exe	76
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 2720 wrote to memory of 1852	2720	firefox.exe	81
PID 1852 wrote to memory of 1244	1852	firefox.exe	82
PID 1852 wrote to memory of 1244	1852	firefox.exe	82
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83
PID 1852 wrote to memory of 2988	1852	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://drive.google.com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view"
1⤵
PID:4800

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3276

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:760

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1876

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.0.1162153209\605842213" -parentBuildID 20221007134813 -prefsHandle 1708 -prefMapHandle 1700 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d0366e4-b33d-4e93-9824-a6881f44d034} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 1800 1ac698ceb58 gpu
    3⤵
    PID:1244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.1.270554552\905584006" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0ee7cd1-e15a-4a2b-840d-0dbae14d1daf} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 2152 1ac69430e58 socket
    3⤵
    - Checks processor information in registry
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.2.1997194115\279497305" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 2968 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c214a3a-cd06-45f8-8879-cfd99571dd0e} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 2784 1ac6985a158 tab
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.3.1606545214\291013547" -childID 2 -isForBrowser -prefsHandle 3488 -prefMapHandle 3476 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3adb12c7-f96a-4bbd-acbd-79136849383b} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 3500 1ac5e862b58 tab
    3⤵
    PID:1996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.4.777316704\1158822836" -childID 3 -isForBrowser -prefsHandle 4208 -prefMapHandle 3716 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {486c13f2-755b-43be-a2c3-d2388835fbd4} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 4224 1ac6f857b58 tab
    3⤵
    PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.5.2120873323\385998759" -childID 4 -isForBrowser -prefsHandle 2660 -prefMapHandle 2584 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eada2df1-2b91-4bbb-87a8-5d412bc445bc} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 2588 1ac6c2c5e58 tab
    3⤵
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.6.1110158480\1007184755" -childID 5 -isForBrowser -prefsHandle 5076 -prefMapHandle 5080 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b623d71-4f9c-4279-905b-c9962e5b0380} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 5064 1ac6f854e58 tab
    3⤵
    PID:5764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.7.204847704\2060216467" -childID 6 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee504551-c5db-48a0-bbe7-e475b1718365} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 5340 1ac70242e58 tab
    3⤵
    PID:5772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5684

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5976
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.0.258339475\896578384" -parentBuildID 20221007134813 -prefsHandle 1672 -prefMapHandle 1660 -prefsLen 20747 -prefMapSize 233491 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84fa8fea-b497-4d10-88b2-dc68608e9d1e} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 1800 1ddec2ec758 gpu
    3⤵
    PID:5248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.1.1420455062\893687035" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233491 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ecc71ec-84dd-4e2d-b753-7e92818ff3a1} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 2120 1dde1072558 socket
    3⤵
    PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.2.105780641\1543795971" -childID 1 -isForBrowser -prefsHandle 2728 -prefMapHandle 3036 -prefsLen 20931 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be5b24da-7972-4610-9734-1c22b178df8f} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 3076 1ddf029ce58 tab
    3⤵
    PID:3200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.3.1072741756\332093735" -childID 2 -isForBrowser -prefsHandle 3364 -prefMapHandle 3360 -prefsLen 26109 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {748dc086-ee5b-4512-9569-c3685d4fc4bd} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 3408 1ddee8fa558 tab
    3⤵
    PID:3708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.4.1338543996\496878081" -childID 3 -isForBrowser -prefsHandle 3976 -prefMapHandle 1568 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {656e88e1-ced0-4e94-a7a4-3e7210f089be} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 4108 1ddf20a1558 tab
    3⤵
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.5.1001885266\1854124175" -childID 4 -isForBrowser -prefsHandle 4728 -prefMapHandle 4696 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfb90c51-68c6-4f7b-b98b-1ed2e9179c53} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 4736 1ddf16f0258 tab
    3⤵
    PID:1248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.6.351821189\821975230" -childID 5 -isForBrowser -prefsHandle 4828 -prefMapHandle 4832 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08590a2d-4aa8-4424-82fb-6645f990b12e} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 4820 1ddf25b8e58 tab
    3⤵
    PID:2692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.7.1637283339\790418441" -childID 6 -isForBrowser -prefsHandle 5020 -prefMapHandle 5024 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15133f6d-a767-47c7-a599-f9037c7bfc06} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 4984 1ddf2d06e58 tab
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.8.1863649510\467266326" -childID 7 -isForBrowser -prefsHandle 5744 -prefMapHandle 5740 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76d5c4c2-40ac-4924-9c06-de82bd7eafa3} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 5752 1ddf3f2e258 tab
    3⤵
    PID:4152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.9.573293288\1071457" -childID 8 -isForBrowser -prefsHandle 4364 -prefMapHandle 4380 -prefsLen 26343 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05b08f34-5179-4f2d-af0d-cc659765f2b3} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 4352 1ddf2d06b58 tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.10.1337071106\292490054" -childID 9 -isForBrowser -prefsHandle 5108 -prefMapHandle 5104 -prefsLen 27661 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4216e38a-1c28-4285-989d-2a00eedfeb47} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 4820 1ddf25b6158 tab
    3⤵
    PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.11.1933133296\514264876" -childID 10 -isForBrowser -prefsHandle 2644 -prefMapHandle 5856 -prefsLen 27661 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {101ae5fb-db4c-48bb-a1f2-9e4adbc2444d} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 4572 1ddf2d05358 tab
    3⤵
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.12.2100560344\799559441" -childID 11 -isForBrowser -prefsHandle 6572 -prefMapHandle 6568 -prefsLen 27661 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1582636e-47ef-4ff2-98bf-473a8d8adc1f} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 6580 1ddf3db3958 tab
    3⤵
    PID:5688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5800.13.155206969\1357193601" -childID 12 -isForBrowser -prefsHandle 5808 -prefMapHandle 5700 -prefsLen 27661 -prefMapSize 233491 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b975825-659a-45dd-ac86-6a75609dc7e7} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" 5796 1ddec56ae58 tab
    3⤵
    PID:2468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
326b386cb2ae5d23c4aa2003c5ccd326

SHA1
a0afca6cef779e2cb2598a1f19059f64e6978642

SHA256
c4ccd24ed9557181ce1d1a4274fa602a84300ea443708ae762e3f4ebc4678249

SHA512
da199881ba329e0d4e1391b0989e20f6f5e65be8d153c7e06bbcde349ab48943ad2bc06ab072b39a2c09121b9336fa8deb42023d16a0f83e6e693bd7ab278102

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
14KB

MD5
3fead73cb6fb5792da228495c3b16ce3

SHA1
97bbf04ed5641e6d589e0b4b1c00cfabb30c3e7c

SHA256
8e4536aaf26713b9b4725ac49db24ef0026ed04a21836716b74d677aea3007fd

SHA512
ea8329265463891e6c1826b574f5713cf74019b62dbab75512be707ec39122ab00e89654b42fdefef125af721f349dfe5e8034039d1fad183cf5f922ee19e6e7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C

Filesize
13KB

MD5
79254a42f950e4fe36cb643aafab279d

SHA1
d6928e3509fa74d27240949fa95dde413aa46f96

SHA256
5d62ba7e77568d12f60c1f301cd1b000b4ed70fabda42e4e7370e4bb93d161ae

SHA512
b98f38a482390d0b222c1c81907fbdbca0f8d8638c22d9f3fb9afc28d1704df17ea3996146a532f55406c25ecf28f16359f3fe347bbd161d13ca4e1f52539d3b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\startupCache\scriptCache.bin

Filesize
7.7MB

MD5
06454596afb9edbf133a4a0f430f09a0

SHA1
e54b7f467d5d54bf74218300ff35f98cc9e00371

SHA256
1b98e229a18039202c943b75fc1dd7bf434a290ce78b7a4070fb2fed3a7d0d9a

SHA512
b7154e432ec2520f934aa9ad18d6bf4a863c305a9703bf25365c41e129f15075068fd1238bcfae8720bb6d740173d1a74cca8c4736f7e644cab08938b805b4df

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
fa7717c30226b22964a956170efd4ce4

SHA1
eccdc9c53757cb3b6fec814605250d59aef8174e

SHA256
1770f6f02d6382d8949c68bf6ed7ae2a6d772dc9fe590b65db5b05ba8e3bd5eb

SHA512
76010ce78a31ec0f534af5ab0d0d311517ec46d0cf27a89866813bc46a19d33cd29fcb7474e03882db05490719a63dd0c3602b3d4387a13ee869c7b3c12ebcdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IX4B2H8P\warmup[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\B0A56N45\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\MUDKVNDW\drive_2020q4_32dp[1].png

Filesize
831B

MD5
916c9bcccf19525ad9d3cd1514008746

SHA1
9ccce6978d2417927b5150ffaac22f907ff27b6e

SHA256
358e814139d3ed8469b36935a071be6696ccad7dd9bdbfdb80c052b068ae2a50

SHA512
b73c1a81997abe12dba4ae1fa38f070079448c3798e7161c9262ccba6ee6a91e8a243f0e4888c8aef33ce1cf83818fc44c85ae454a522a079d08121cd8628d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
920227e840159cc05a67e3a279a4f770

SHA1
444a3708c445d83571c05b31310f23833e184185

SHA256
182194ec70e506005be23d167ec899c51651f1bec1ee6a6d0c63b01a6ce34c15

SHA512
65463c6e8c089db1b00e6e0e9726f8c522a29978223362cb6a246203eafb6b5cf1195f48f694ade8259e077eb5af3ff190e2e6ebce6c6b367dd1d0d6034501d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\AlternateServices.txt

Filesize
163B

MD5
aa3db8846eee31d86e55ba32e8bbdb99

SHA1
4af5908c4d58bb1f8b56e2a99ef44ffc9920cb47

SHA256
8a908315374e03fc6f1cf756b91df5dc5a894d7985a62a8e1f637cba60af1dd7

SHA512
0bf6e6f05ba2bbeb07610e33cfc2f971a62be087fef8bbc545b3246f3e82283cae05ac65429af9218a17045f254185d4a3920374110500b4440f57d25fe20b12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\SiteSecurityServiceState.txt

Filesize
324B

MD5
3586fe261a54866e58095c791c6bf899

SHA1
802a4da05c72f1a2a4272dcf329d843450dcdc5b

SHA256
415279262e99da611e7348f7e56c5d6515aa39cd30a814af3e39b80f09548ac7

SHA512
4970434eb65cf20202c475f500a5aff3491ac0477bbe5fe5cc65fb375563d135eeec6c6c29d6f29992340d804affd62f05385fe0837dd128d5412eb5c2d03154

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\bookmarkbackups\bookmarks-2024-07-31_11_+ftwiIQfjYtrlniJNZ3V4g==.jsonlz4

Filesize
945B

MD5
5454384ec38638981ce5e67157b8f07d

SHA1
20da940d1b48d7c555b5f7d050fcc26b9fcaa217

SHA256
faa28431b2b70bce1f1552ef63266622ee731b9a30a3b314c9b6d6e0bdc07e11

SHA512
5526c70002b23f106dbb494742fce905cba27979f8bf8f2a92832232fb34b6bf873043f0b54f88567250f358e5fdd93438f5211318ee303ad71615ea85d1f2f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cert9.db

Filesize
224KB

MD5
809fc9d89864cf118516417c073ca361

SHA1
1ddddee081d00dd89d3547b8640440c97fe6a26a

SHA256
d2ac29570ed5d1004d0fffdd21500d5d1ba40b43eeaec31426dfa587f1aed218

SHA512
384575fc0efce844c4f729dc25527d3d3d438b88343802e58bdacdfc8d24eb55d42bc9aa2fe8ec70e52857acbd3a93c826290d9f6bfc7debee70bba08a141ac4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
6a8e323b6c5dfa50babe37982b679a76

SHA1
fe13fe5f3cc182e991613ad8c3007e65eb8839f5

SHA256
3b4cbb87b58d6f240244fad488e6f9dc27e9be4c17e4f0989a9a0e9bbd1475be

SHA512
32b16224c20e69fd5107d3301dd18fd8c6c3b74ddd42e8dafbd3a2c4f451f70d269fef9bf5ad4bfaf8a4f045926bf916c3fe75e1d64f1607c8973bd7338c205b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
4KB

MD5
72aecac6ba5577f3e4270db41e755ba5

SHA1
749dc51d6b84bdeab657a6b864fd6028d5595aec

SHA256
6244407c7939f7f3cac617758c147d5afad482b1d16afc10b3bdf044989ba2ad

SHA512
ad9dd384831fd9fb5caeee931510c6ed1f225d8b909d9123b943b86a759912c1237c935f7419e536d315d23ecc185d59ff7b40092b3ac39b32a3816c7c71878e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\2f8be815-037e-495d-8fd1-cc07f5271204

Filesize
657B

MD5
78e45fd37a8d2fcfc21917f98af21fd7

SHA1
b882c1ab9a13e194024c28c2a0002c3ea74be299

SHA256
6278e918b2a39e72b730ff0bdc39238765e42e2176fb48f805fdf7b833504460

SHA512
b16ce9a70a650ec9e06a8585bbc3efe268152d486cf8c9d35e4dadaf375c0abd797ab54d4fd1ff4cf0094b856dd22745e67aa1a2ff3b430cb08653f981024bea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\325268d1-4a2f-4221-8ccc-6aa86d4d5390

Filesize
746B

MD5
400604a75fe53e01f86c956bc10fce3a

SHA1
bd479fc88e9274edf8e2cad1f9274df48249998f

SHA256
0b3b7d28b588b3d5c047338be2d415e6ce827f8c3a99be9533ee14fd9641a5d2

SHA512
46a181795c1d7733e485d935d583b46d50d4225dd552320d918891b3a563689917ef21352503d8278a65187185eb4c5937e9e9f426af930781c2426342a32413

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\fedf9a18-df71-4f65-a3ea-4025e4c96671

Filesize
10KB

MD5
527d9f5bd74b02f95bec3ee35dee160f

SHA1
81120a1d7123b9cc42347f9702a5736200016200

SHA256
7ac1af893d4a883158c336aaba6da15f6811104ee1a2ee425213545245e5fc4c

SHA512
38e6feb0706578bea8f4c2851fba72c6aab60889222f42b177d14b3ab161ed3d3ad99723e43b28e3ef8edd965b9d2f997797f3050dc3480c2cb55a054439f2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
7KB

MD5
937018be08a2e6a9efdc5776155f3ebc

SHA1
7d300056e16aea633c8684d92f190696d15d75a5

SHA256
e7816d90cb1edd5057ed5df308ed62b21ac558b66cd838712d95bd9eaa05e7ea

SHA512
dc64ef867644cdbc4297cf61151228947bb2ffa49e3874f81d0a63e1c1e41545174221913484a32a1aa471585adad64758a081a559e5b94ad9bea3a995cb552d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
7KB

MD5
c94c98d13afaacdf61f27572bfe630aa

SHA1
a32927f6a0d5dd1be9775a374283d9835c2efdf8

SHA256
b375cb5501ca54da1e49d10fd9783ace10c8a5ae7266f25e511aabdfee67dccf

SHA512
81964b4cbeffffed83e49413d557635c5f1d17a4fd0c5b33846a975530fb818bc04d9f98dad97233aea2b166f8f5ef318f3d93cce382dbe4cc1867b35514ea7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
c2d9557b7a7e2a9b0773db49b61f9578

SHA1
3598f09c6ea621deeee27c1e33f5055910c3f282

SHA256
d7c1bce7c077333db0c45fa5c8f165b8ac28a1ed6945148aaeb2717a9a32e1fb

SHA512
22115fc9d5446acee7638ef675a699ba4ffee638a321d41e34d6179c032daeb58fe498765ee5b9df1e3ef1ba8d1de25f252e67e19bd4da16e51c748a4efb9b46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
b2e3e16bc830b234105257f1777b94de

SHA1
390f52475e23700a6d250ffcb138d3639daf0cae

SHA256
28c2b07b02bb711172298d92b6dd8cb51e178f4501e98326e77609f15ede7f1c

SHA512
e9596d1483aea4b0c8549664204a473b973363485f320acdbe6dce7065bf22eaafb7acaf69f9b3cbff031fd8bfcc5e95c4ecb66a52ec982692337d988301073a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
49f058f101419e71a51996d77b73a2e9

SHA1
1116c90d71f55c2de3a2744d8b0e7f0927f1792b

SHA256
01ce8f48f2dbf32d337b39098c153659b66215d92f13f92f1bd4b48bb9468dbe

SHA512
d3b03b0694a90bfc5b95d15fa918cb505f9f7bb181ee7bb4851fe798cab6ec2a12d451157be1ad7b58d26c54b760dca8cb0b5a0c8fc2f22215b2c040db8bad46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
e1640abe7d6c7eb0abe5ace8ba032424

SHA1
eea9fb0fa6b6a815b6964d9e3aab87ef90f9347d

SHA256
152a61a5c30a3b9ec00014b6c908e204119b7d7f48f091a8c8a86ce8494afd84

SHA512
dea1d74337acd5d6c71075579def2a2eacc7fcc5cf3fad90445fc665a413e70888f5221e68aea66497f53da7028bf75de7ee4366600081c6f4ddc13d41ac7275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
97dd8506dbb4b38cd60c7bff1f83c9d2

SHA1
d4ca42436e4a5833b1a46f84418182afef950f1f

SHA256
1dccf74872c8dfa9a36572bbf61bc270881e5f2a5cb28acd01d04d55aef675ef

SHA512
2f0a614252c116d46355d4f679d369e6fda05528656ecdc42f9ec4bf9ebdfe1742b973c34ac64e1aec58d37ecc4f40577179bc731fbf9a13cdea3c7d64eedf71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\protections.sqlite

Filesize
64KB

MD5
49397db0486dc59d607907a086f40c9b

SHA1
08742ce9db9569062def08e99eea8470702feb7d

SHA256
890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

SHA512
fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
e30e8a684e32ae04ec51a2e201224b20

SHA1
b08d9387566140918cf8de642f80ba4775b4c9c9

SHA256
aa001363ec80c141ad132a7c8e9638012750980050667f03e356787c3b2ff84f

SHA512
b16ac689e577bda7691c4ed1038b0f4d68e93fe73f3153aee2a9dcf866668f1eea980adab7341c7d643e2be9b851d006c380d95a4018f10f02b44890d2133566

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
34df4f896744c3e30a740c10f5856568

SHA1
2428380bf426a777d9eccd25c2c200f40036c34c

SHA256
08050885bf65a09f0d9f435d43f0083dcd66ed0c10aaed09e35aa3c45d4b781a

SHA512
911255d6c3c3284981e0a2a2d9e4d05dac88aaf462fae9de178f725a101bcbc7fb8490bc972884878b7d9d06c1a640cfff370dbc60f06d1193281c720214063e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
94784273786a2e4d930471f0a66d41e2

SHA1
73d9bcb7c93f4c14213e23d3ceba6d71696c1e23

SHA256
752c2fc0bc38fdc3a9e0b67fc7c5c829c881fdc53085f473897a721b16bb6c15

SHA512
4c4155f0b4a9c3c14a6ae538ef03e40ddf54a9f0faea92bb2742aab6385bd4a28dac3eb355464a7935868b1900de5908736d09412d6775342fe611d710c165c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

Filesize
881B

MD5
f0a16aa6e119d448885e91c4786526b8

SHA1
78c63693ccc0f3c75859f4a54a5c33edea97812e

SHA256
92d3b947619da3e5d577d082f819a87e56d18e8200a9c52e6937f78451f47d23

SHA512
769563305381cdff3ee2c896f635db8f047855895b9a656bfa49704bfa60dd44568bf3bd1417e93af8ea25e4445aa3bf14e502a47db9cf2c080f13d717a8ec1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
7bcfb105686a806dbdc3787cda36edfc

SHA1
c57476e4f3734843351a86e15411c6589fa90fd1

SHA256
baa8d3cc063803ec72cba96c46c214900de133c63d77146fd48a4677a1c510d9

SHA512
a27cf58b2ba97ab3a707ff760a11064462b22878c60a620361cb6c70cfc14a020384837127d540893e8ad363d35b888001b8784d0a3ff64a7dc8e0d0391a408f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
799b3a5140049d59255a5cb54668e234

SHA1
e215322c219c5ac4f6d6f7226d3fdc51b37253d8

SHA256
9fcbc282fc6ccaca19277039122e780e617200527d2c5bcdb799cddaa2f762e7

SHA512
030b44ba9e1dfc27009e85358eb77cbe24d60de5f5e7742a427e4896dac9eb2b5d6710bb7ce4f76a972a7a4f7587f8b3af08eb35a5dab0129b179a740f9e689b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
e7d901ad03d22078f4c42ecc83c3bd45

SHA1
13ffe2ced2026e6b99c39a96d006c7832a72ba17

SHA256
fddee54013f830a84e74dce5679f6e4c3c71b4c5c51ecdf58bcef7e27eba4f17

SHA512
8e7373116183db845f03c74e28effbe85b53c6c109f0a1a867fc4daa2944c099846644c5b6ecfa6408091d097a08b3f1b8cedcbeffbdcfaa14147f6b76663ec9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\targeting.snapshot.json

Filesize
3KB

MD5
7072a167e5027dd9818dc8ab2c5b7a38

SHA1
365e6ab0993f97edc2d75d35294f92c810a5105a

SHA256
69b5762d59ad56db96f82fb2e3f1d32ee1ad5796ba6a30ece7f95d0d9462411a

SHA512
d29e76fa696b06600c0e0d28bd361fd56ee90fd94a04b56612e7f36c0b1c0877c96a591a2a0fc1ade0c31b3f52db5c22559f0917797da857d1a5840e3935841a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\xulstore.json

Filesize
217B

MD5
6d87256a2b21b9603b7d731eb033b9e0

SHA1
8e2603f254af21d5dcf310fdb5a688e9097aefd9

SHA256
5b3e57bf27b98cae50a753101df9a00a1f6d96886c1a92c4106a6f7eaf6d09a2

SHA512
67bfabf0b5d3fc75b5223a5da836e6909b2af8d98172120fc5efc0b0f6ece72b6cafbdd97ac170bc5357d85a39b15fda7e2df861981d193f84cfca82f360e156

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\xulstore.json

Filesize
120B

MD5
05e1ddb4298be4c948c3ae839859c3e9

SHA1
ea9195602eeed8d06644026809e07b3ad29335e5

SHA256
1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be

SHA512
3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e

Download Submit
C:\Users\Admin\Downloads\Downloads.tFYyuagX.zip.part

Filesize
26KB

MD5
00e9de19d3720dfc01d1e16d2bf27fbc

SHA1
7abfc3f92dcaec50c1cd2d4ddc4b5b10c3def474

SHA256
5942f9c96258485633bd87f3d3830a1018c02c8d78dbbd9b2282ec8756340629

SHA512
a1eac299758bbe1298d492094305b8bdc1b3341fcae17938cef2b8badc1c69f9baa4b290e8c62e9e4a2ae847095c416bc5633f9b86c2fa0e7cf7029d82c859b2

Download Submit
memory/1876-121-0x0000017EC1800000-0x0000017EC1820000-memory.dmp

Filesize
128KB

Download
memory/1876-323-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-327-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-325-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-313-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-331-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-324-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-282-0x0000017EC4D00000-0x0000017EC4E00000-memory.dmp

Filesize
1024KB

Download
memory/1876-314-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-111-0x0000017ECCA80000-0x0000017ECCAA0000-memory.dmp

Filesize
128KB

Download
memory/1876-173-0x0000017EC42F0000-0x0000017EC43F0000-memory.dmp

Filesize
1024KB

Download
memory/1876-160-0x0000017EC42F0000-0x0000017EC43F0000-memory.dmp

Filesize
1024KB

Download
memory/1876-330-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-87-0x0000017EC3260000-0x0000017EC3262000-memory.dmp

Filesize
8KB

Download
memory/1876-329-0x0000017EB0930000-0x0000017EB0940000-memory.dmp

Filesize
64KB

Download
memory/1876-89-0x0000017EC3280000-0x0000017EC3282000-memory.dmp

Filesize
8KB

Download
memory/1876-91-0x0000017EC32A0000-0x0000017EC32A2000-memory.dmp

Filesize
8KB

Download
memory/1876-85-0x0000017EC1560000-0x0000017EC1580000-memory.dmp

Filesize
128KB

Download
memory/1876-62-0x0000017EB1100000-0x0000017EB1200000-memory.dmp

Filesize
1024KB

Download
memory/1876-63-0x0000017EB1100000-0x0000017EB1200000-memory.dmp

Filesize
1024KB

Download
memory/3276-35-0x0000017CDFC20000-0x0000017CDFC22000-memory.dmp

Filesize
8KB

Download
memory/3276-238-0x0000017CE7240000-0x0000017CE7241000-memory.dmp

Filesize
4KB

Download
memory/3276-237-0x0000017CE7230000-0x0000017CE7231000-memory.dmp

Filesize
4KB

Download
memory/3276-16-0x0000017CE0C20000-0x0000017CE0C30000-memory.dmp

Filesize
64KB

Download
memory/3276-0-0x0000017CE0B20000-0x0000017CE0B30000-memory.dmp

Filesize
64KB

Download