hxxp://youtube

Analysis

max time kernel
1574s
max time network
1697s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01/10/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youtube

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5262ff091814db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 99a19d091814db01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6717b3091814db01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = af50bf0e1814db01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{8266255B-FA63-463F-BA08-389E5C7726FD} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3712	MicrosoftEdgeCP.exe
3712	MicrosoftEdgeCP.exe
3712	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5036	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5036	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5036	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	932	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	932	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	932	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	932	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	196	MicrosoftEdge.exe
Token: SeDebugPrivilege	196	MicrosoftEdge.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
196	MicrosoftEdge.exe
3712	MicrosoftEdgeCP.exe
5036	MicrosoftEdgeCP.exe
3712	MicrosoftEdgeCP.exe
3456	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3044 wrote to memory of 3456	3044	firefox.exe	82
PID 3456 wrote to memory of 3188	3456	firefox.exe	83
PID 3456 wrote to memory of 3188	3456	firefox.exe	83
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 4472	3456	firefox.exe	84
PID 3456 wrote to memory of 704	3456	firefox.exe	85
PID 3456 wrote to memory of 704	3456	firefox.exe	85
PID 3456 wrote to memory of 704	3456	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "http://youtube"
1⤵
PID:1368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:196

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3112

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5036

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:508

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.0.1854494748\313156576" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dea4e6a0-6911-4fee-9416-5e40eceabe75} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 1796 243475d5e58 gpu
    3⤵
    PID:3188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.1.1620809836\1622651764" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbf39edf-9601-415d-bbeb-88d7863229e5} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 2152 24335070d58 socket
    3⤵
    PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.2.1007875580\1005549782" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 2852 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {883e0229-d07b-47ff-b7d3-fcd1b8c10368} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 2684 2434755b458 tab
    3⤵
    PID:704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.3.195584415\1217028380" -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 3528 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90859de8-f926-4e24-9595-22c680ed1875} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 3544 24335061658 tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.4.1013325363\929810871" -childID 3 -isForBrowser -prefsHandle 4276 -prefMapHandle 4228 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62e76611-fa90-4b79-be7f-a9f64844ee74} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 4288 2434d3e8158 tab
    3⤵
    PID:2984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.5.2142356474\1503297894" -childID 4 -isForBrowser -prefsHandle 4876 -prefMapHandle 4884 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b478526e-4333-429f-a3d4-5fa711849ed3} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 4856 2434bc87b58 tab
    3⤵
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.6.165538362\2021199469" -childID 5 -isForBrowser -prefsHandle 5024 -prefMapHandle 5028 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {253ae420-7a3d-4d6f-b768-ed916bcac735} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 5016 2434d97c758 tab
    3⤵
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.7.1330049035\1745282196" -childID 6 -isForBrowser -prefsHandle 5224 -prefMapHandle 5228 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d59b381-deaa-4f16-bd47-da94c72f9d90} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 5216 2434db7c558 tab
    3⤵
    PID:3024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.8.1479250987\1359279606" -childID 7 -isForBrowser -prefsHandle 2792 -prefMapHandle 3188 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a624540-284c-499a-8f0b-0a6b3b51e9f6} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 2820 24349a11058 tab
    3⤵
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.9.1131187550\950689702" -childID 8 -isForBrowser -prefsHandle 5932 -prefMapHandle 5916 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fceda0b-3fce-4315-9d4f-04cd4199c957} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 4196 2434f28ea58 tab
    3⤵
    PID:2928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.10.34429415\1585923630" -childID 9 -isForBrowser -prefsHandle 9900 -prefMapHandle 9984 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {644f288c-c190-41d1-b026-1cfec7ee09e8} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 9892 2434f6cce58 tab
    3⤵
    PID:3084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.11.2040485863\605453419" -childID 10 -isForBrowser -prefsHandle 9776 -prefMapHandle 9772 -prefsLen 26698 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3eb4411-4641-4b89-b9f4-51f10fb0f2d4} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 9864 2434f6def58 tab
    3⤵
    PID:3708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.12.498472698\972341465" -childID 11 -isForBrowser -prefsHandle 5308 -prefMapHandle 5312 -prefsLen 27790 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1b63acb-943c-44f6-bab3-8fa4c07d219d} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 5376 2434eb9f258 tab
    3⤵
    PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.13.739300056\119468284" -childID 12 -isForBrowser -prefsHandle 5676 -prefMapHandle 5092 -prefsLen 27790 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92c47ad6-814d-4fd9-85a3-236f1889a3e8} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 5524 2435088fa58 tab
    3⤵
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.14.1185084883\1085308348" -parentBuildID 20221007134813 -prefsHandle 5088 -prefMapHandle 5060 -prefsLen 27799 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bea8b94f-c2e5-4324-a82a-d750034158e0} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 5220 2435235b558 rdd
    3⤵
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.15.872943316\1371891784" -childID 13 -isForBrowser -prefsHandle 9468 -prefMapHandle 9452 -prefsLen 27799 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55f23b59-d185-48e6-826e-4c6f8a7d5863} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 9464 243526a6e58 tab
    3⤵
    PID:196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.16.1554945800\2002791775" -childID 14 -isForBrowser -prefsHandle 9312 -prefMapHandle 9304 -prefsLen 27799 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f385b0ce-fe78-4f6f-9987-17e7aa670aa5} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 9336 2435389c558 tab
    3⤵
    PID:4240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.17.1620103967\155700787" -childID 15 -isForBrowser -prefsHandle 9184 -prefMapHandle 9180 -prefsLen 27799 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93ffcd69-fb44-4731-9e22-b345afaa0d20} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 9192 24353899258 tab
    3⤵
    PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.18.1632739779\993811196" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4984 -prefMapHandle 4960 -prefsLen 27799 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bee4d09-4ec4-4144-a9af-82f4dbdd6e0d} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 5624 24349a55258 utility
    3⤵
    PID:4288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.19.1933682347\2123565192" -childID 16 -isForBrowser -prefsHandle 5360 -prefMapHandle 5192 -prefsLen 27799 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4823c594-2d8b-4201-a22e-1fe32bf60f24} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 4048 2434f6f5158 tab
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3456.20.735714091\1182753875" -childID 17 -isForBrowser -prefsHandle 5504 -prefMapHandle 5496 -prefsLen 27799 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cfaf098-9312-4d27-94d7-fd36939875e3} 3456 "\\.\pipe\gecko-crash-server-pipe.3456" 5488 2434f6f4858 tab
    3⤵
    PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\15404

Filesize
15KB

MD5
233a3de4a31d6546d40610c10a0e1065

SHA1
087517dfeecae0944a88016d99c82854e4fc2e3c

SHA256
14bdfc6cad36d6a1a317e65e85d217822b360a568dba7570528fd6a1e49b4bab

SHA512
ec1393e66737e9dc38db9c277cc15fceb509ae8ea896b775d6709ca2f0b51163ca4c5b5bceb5f7b8513658b022ce9b5f360cd03d60e0d9a6f439862606c2afa5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\1543

Filesize
28KB

MD5
1c0bd3dfb2085c206b6d533b5d589c98

SHA1
0cd9e3a5b2217dded426d50e29358a758fc3129e

SHA256
656d85707e8e6f07863fddc3312e330b2cb44c6eeb73d9971af787164c0487f5

SHA512
4b625ff80f6b3592052963ffe8f16eb67f2db8c12dcf435b20a492a176f96d2543a9521aec7b323af5a5d8ef14b665354b7c8fe84128a572c0fbe2c0560d30a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\2225

Filesize
8KB

MD5
128c4f35c4f4cd4f9a2c5b5e07aa2034

SHA1
f57edfbae5eb754826344f7c11f1698381dcc163

SHA256
317d203a5738921b487d7ff17483d6859eb81faf7608ab2da421056e47f8a56b

SHA512
d74549f98acb7cf0e0128639b5f6355cd2c85704bde761eab8e0d4fac6908b032f5b91659663fe9cc75c7d6c39dfae6ebe2469cd7f91ae1a002d3daa847932b6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\30260

Filesize
73KB

MD5
97fcfce35fdf81dcdc48c0ab5c27e77e

SHA1
9db8b22fa25eacdc3604dec45578f357a3facef0

SHA256
81f89656f7f79657cb57f1c8fd95162b90834bf089514c8d0925040551c85b82

SHA512
6eba50b609e386ead58ceeb443c1822f921970c24eacaa9ea1072fd541dce3fca02de615d668c38cc79b7c3095c5aa0b8e1403a671aa54fe4b9def45a5660a13

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\509

Filesize
105KB

MD5
1c3b6456a0a3c703ef264fc44635e4c5

SHA1
ecc7bd7c800c660d3a84d0b8afb38fa7ad0dfd63

SHA256
955df82c0e09fe9b4b04abb3d3925cd5a12633bd4bd234955aa8653dc1597186

SHA512
dc034e6b8228ee00b9dc5bca359820934ffd3ad325f214c1bca3da411c9edf818a20caa5a7a92f3fdedefcd6690f27d793be8bcd60d6e79dce1d20e3eae6bd9f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\219CE1DEBFFF76F771E6D379FA85FC9FE30C566F

Filesize
61KB

MD5
1d5998fc7a92bdba409fbd960738eb50

SHA1
16d538eccf511ff9a84c23959fa7c36f01579832

SHA256
d4849cbabaef6a4e861ffc2c2e5a300192788a9462b4528f227db40dab724f64

SHA512
3dd8a78ec474320890c1ba651bad18280538df5718b28910a9db2711759499a918860b39baea45ef4f3c6ee02bcfa523d5a91dc026200dfa26101fa96f7ba89d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\jumpListCache\DxLqKB6Zx322N07Zv_8dCQ==.ico

Filesize
817B

MD5
77d1832e7069f03400ae72579b65e50e

SHA1
b578eb7faa9d840c9f0825f39ff89bbe26ab43e5

SHA256
fc914927bd73fc72c91eccf65e19b993a3768da29dac14e82372185838c2ffaa

SHA512
740d25f3db003708393293b93b6873699e2baf0c73df9a22e8441a473a335cf38d60d75afde90f07ae95e8488550bd9c2bfd108c4a3db004293118b25ba2c5cf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF933DB8F366B6EC2D.TMP

Filesize
24KB

MD5
ae54027f8d8e9511fb0b873f776c5d20

SHA1
107bf513c5a5a9b064fdc20aefc925319c49759c

SHA256
28c3f748445f719a34b44a9229080fa7cf0b10cb7e8f1017f5ee5669ead0f3a5

SHA512
43f6ce3d5593d456b2c75dc6fad6dc215667d94e12e101115dc12239d592faaf026c103cedb6e9a9ec8cf1f69b6dcf34fdfc3fc10a96b109e45c58f176dd9f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
5197441ca32f99d344a596de04ab88d1

SHA1
b5314aba9a0b86318142fecdfc0690531bf0e276

SHA256
a73c934df83d5c160d885506d3dfbf24dc401e3fa3b83aacefcc3429da613562

SHA512
de70af3e30d5f2f19fd067bf8336981b29eacb3d465354d29df9af5d5263de4b0976af8984e123d49f87e64dd80f79b911aaa979431a0107f015e6f952053806

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\SiteSecurityServiceState.txt

Filesize
455B

MD5
65a5d0188a47a2f2750e4a151b5266cd

SHA1
e695ad79ff9406ca129a0c91ec070bd49fac7c8b

SHA256
1b40754054108f246a3a741f02029a6612366ba23efdcf7101b0b23051daf401

SHA512
9176f476814b3305f1ea1b8a5713c0218462ae9d504748e3a0320fa145c466b0ee287a6628210a1d13b293e4abd16bf9a9908e94b2446d4d8d605060c126c53d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\bookmarkbackups\bookmarks-2024-10-01_11_+ftwiIQfjYtrlniJNZ3V4g==.jsonlz4

Filesize
945B

MD5
5454384ec38638981ce5e67157b8f07d

SHA1
20da940d1b48d7c555b5f7d050fcc26b9fcaa217

SHA256
faa28431b2b70bce1f1552ef63266622ee731b9a30a3b314c9b6d6e0bdc07e11

SHA512
5526c70002b23f106dbb494742fce905cba27979f8bf8f2a92832232fb34b6bf873043f0b54f88567250f358e5fdd93438f5211318ee303ad71615ea85d1f2f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
11KB

MD5
6fa8c210ace469d73b48608c55c3bee9

SHA1
40cc9de62edd2778e674f9f8f543e4979403bea2

SHA256
8e39574e4252b99a1651210c51dc5b1345d0bc26063500f9627e1ab92eb8e59c

SHA512
593d18479f19e59b3ed0490974952365f65773c08d569efa897962e35ac8f52ee0f23e06112141afa2abf205ae44532108d3c4f6a2065c03764f244ea1f4e45d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b5d56b12d8fd574739341e01a806f4e2

SHA1
187182e1e75129933e98fa0f945ab6a0d3349ce0

SHA256
e6fc7323e29bb11bba7b719b9305d5ec23fd8895ba8117e6d57ee2813ee10163

SHA512
8e47e57e4e335065e0fceaf4edc4c1ec6edd46298b6649d69eb447f56d9a76d71a145cc276e36baee4b194fda0f8d06c18c3a26371ac2b62da9be393cf9adfad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\0132801a-1dd4-4782-9157-171722c97bba

Filesize
1KB

MD5
a51460c520dc93f5e2efaf2b9aaec82b

SHA1
9c4c99be7a5b4797285a86b94a592f5dcd48d784

SHA256
e9eab3760019ad223fbc9e787021dab9838b234c37ba2f53b42ca6a2a2363778

SHA512
4a61098cb2c6f5a6453f79e64498a4348acb037edd08832fc9aaf7faea0564711a7cad14454f7bdb61d7253da2244935185356490915091c7003fbe32848d752

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\1fc00325-df12-4676-ad36-e3bafb1db341

Filesize
9KB

MD5
39708a3f575e0be24ea0990a8b1b0ff4

SHA1
bbde485fea93a11de940901dc7ba8df2fb640e54

SHA256
4c7d224d0e02a46f9a4b634bfc6a679ab2e4a47e0ae33009b5512596b651abb5

SHA512
a89c2b8a1f9a62db4f977f7b5ae45e5134c757da5d4ae5893b18ea6b8f29521f4c1b77f05ac4806031c890c6990bdfefe62383dab26fde9eec893d584198e8d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\34925448-2dd9-4acc-9690-2a69650d8e26

Filesize
1KB

MD5
cbb9f4b3551064d3fa2c6628949aa696

SHA1
d1abc101acd6d050d44ae5d1f9ecf89fac5693c9

SHA256
29a4c2dfece93f6bcfcb7de0304b2b950ba9ab2bd22f47793ef55daf937a6fb4

SHA512
e5ee89e1cedce1aad6e37b1b087b81a1ebe628162f33c983e243882957e080b97776940a08d03354281a3958c30776b1600ffabb3b316a90034ba4ade93cc5ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\66fdb74f-c060-4ada-8c8d-3e1857965420

Filesize
855B

MD5
40c3ccba88871271924f4564c1c3a330

SHA1
1b3a86aeb6098b662eeeab80c4ef31dec7d36aa9

SHA256
dbcbec63dfa6be1d0e399d9ea54352e61057dd620160a3d2975325f025afb8a4

SHA512
6c2f1e53a889701ddabb4241f2ceef37eb4e9a9b9d6d6a03fcdc11f2208ea098cd274aa8f9cc1ddc2cbdac3427be6f5a7be2fa3beb75318c4d326a3a58e36afe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\d7199622-052c-4c37-99ac-1147bdbab1a8

Filesize
774B

MD5
5efb04a8c14bc6d6dc973b1947fa2118

SHA1
fe81b78d99dec3054d0a6cee8876d008dde416c3

SHA256
6bd4958c5ab94c1fae06a334ed694b9be6f4d90a0884de057340973d81508a5a

SHA512
78a8966d50eef23e706495bcc6f3c00119d90b3583c232d93b4811786d339f55c50f95f758110c27893df07d619a5a14fb8228b7b2ed54056d9242bb63bc5b39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\f682a138-7c1f-48ba-978d-cdc8cea9f67b

Filesize
746B

MD5
1dd8a936a1fa844e83a3cfad3572dfc2

SHA1
001013b5fe22b3d5d7909df640ade8bf115d8e7a

SHA256
fed31233a6d7fe7a6fb3b9709759394139dc88f8ec63b377b61ed7b63a48c144

SHA512
db4be6410782a5533a8e0ff8095cf917bb4e0f872e976f68934c017f0cfd8a73596be592d0b3d0f8360efd9b799c71a722b39c7c0a67a4566a7ccbc48dcffa85

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
fc1de0655563e10af58760c6e52a2eb7

SHA1
73f2922427efd28b018104dbd8f8935cc38fb6a5

SHA256
2863f44e11280dad8379fd0b6776a5decf936ee89e33ba8ce1c6d78b761fac37

SHA512
a207d8116a9d757d9d23beee6d4736e6da08c27cb2f69b26729878c167195e62668a70b5613c0ab03516312c0d57d5b807bc892eaffecd1823bdb1b7a8444816

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
7KB

MD5
0129c1f970e27261e483dfda6f91d125

SHA1
1eb4b372ad666fb2f968d07f76af66835a052ab8

SHA256
40663d92673074ac859124b243fabc5c096c74924fe5b2e05ca0a9c00ff7089b

SHA512
7e80763d409edfd690ec8399eec10db90959dfdc573c53a6cc78dded3564ab59cf6bd100a442a9219bb21cf840605129329c104be8e642c6bc0a397a8f4858e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
3cf376baa331661c189bf9eaea0f77d5

SHA1
5361809cd9934c50ad9e9616076729659b79949d

SHA256
d5124cecb9bd082bb35b14122eb27c88f4f3763778388a1340568035bf594199

SHA512
ed43191dd20cf00f79fb57ececba2b6438b51d560fe6f5c987246dcd0f89b09d2f9cf7cc8ee48f9fabc4e6d724c4c267aa65960ed3e8b6de43be5e9a722864cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
7KB

MD5
2098f2fbbaa4fd98ceddbc1c905adf89

SHA1
3368611319e66f81fafe214d30a38527042ff422

SHA256
e284f70440515525e6d150c577e09693c13e14a1845abd2bb9b3da6df4e992ca

SHA512
dde523379b2ff3ae8436d675ddd8156e7a49709785c716a1e9e387599511f3ec89963de16bbbcef45a67d8f09014c3cbc511ca34561a646397899942edef0565

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
c3f6d70af3597f7c4e15b173d29a7ca2

SHA1
98c5d788cfa055e3f5942fdb93c0c34d68db6307

SHA256
39216ab2c5e9f3d2ef6e89474c4297e2c59fa1d36cb18cbabc5fbea60047cbe5

SHA512
ed77f01a8160c8dad1c073b03c0fa194d24124b8ca6f1336db7cece380223c2a002abf467dea205c2edacc565f38c34117c524de925f86d2fea0bda38c0a6cef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
a58dc66d6383de4f10418809afb1fefc

SHA1
7ebf472ccfd7d5aa30b1306416d9429aa7079bad

SHA256
5b4de6ec934dae929723c6c590cd0812cb30161f07e608f64e355856bc82709c

SHA512
9ad2cfdca9b0ddef322936fd1a204954206e226f7df3c285f22bedd2e828076e6611126829c39b32ba198f8651e300f97dd80882a207fa74ffb465ea5d46248e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
33KB

MD5
8b747431709a2b0fa1441af9e4c07967

SHA1
e8a86981eee26039b16a0759d3d953d3a0ab9cda

SHA256
eea424ac4518f801d5622172c1cd58616b56078f9afbb1ab3fea4abb3ac79098

SHA512
3e9dc5280e12a00b2026ba6af43b5ce679ceb6b313cbb8665cde1becdb61e3ce924adc661d3251bca1d75ed7c722681eefca7aef187e65b736c72269a931ed88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
34KB

MD5
b6d261bb2f0dcf4c3a538f5c01b225eb

SHA1
f9a8d4ccb62dcf7f36e7b0a2fb301d514e7b888c

SHA256
facda38dfae767a7053447c6d4c0b055fe3cec29ed9c087fb33c14a550273333

SHA512
6a7c6eac939fa62c0cdc178c5a8b0f599ce1bb47170020944753b24f54170a07cd25662a2ad52cb9563d7be2f57e87682ae0a46b5e11e303a1c6214c76dbfbde

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
48KB

MD5
014cf112b556c57ca2d0caf3b4f6ccb5

SHA1
3a1816ddfacf1333be54aa429c7db9abe634ce28

SHA256
b57acc22e812923fc38e595254735b25caf0f4139d5d470deed98c54453086b3

SHA512
fb8c2082f45edd1ecd20879b8b92346975066063e16f012e01ae47fa17170ca86d306f7be77bca81389a4dbfc55f249e6ac1e35dc458e82b12609068a1563575

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
53KB

MD5
8d7ef48267c2b80be63ad9d8226ad16f

SHA1
982d350b8a018d09d3110aaea5212f8f2c544a80

SHA256
3e5b2248e860bb6d7af539e06c21bf2503bd51053179b148c82dbcb45b9cb5bc

SHA512
461e0b6d9d193f3efca5ee427a34325a68ad627fad17c355802a20c347b9f6ab47c702bc62d7f9d1a0605983ee05d8d9f280c0d8a66d548b85b8e413dff42af0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
56KB

MD5
7fca9bb76a0a9dfdf2d007b1e950dd47

SHA1
3f8e4d6f6c2528ca2fe74b56fbf904d14f75ddbf

SHA256
3cc6f8640cc491661b81699e8d2408b744937f081bfeedd3c1a917380b94f9e3

SHA512
15465e39831b922d10df7602b8ce498fe96a07860921da2566b7d0e014d07c6cb1bef0d27a238065f4ed2688b4640b0e6ea6ae9d0d5c2f2b97e725212f264db7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
4e63a21b21d0fd0b41676c046d90125f

SHA1
a401d3c5c73401c2f47911a750e9e715e8b4ccdf

SHA256
75fc255725126fb76430672568f66a13d9f145efe29ad6050e51893940985d56

SHA512
0c69d8c44fd01c7676b39a387a17cbafcb3370aa38a6c5df35ab95823b9208ee8f8971a6fae2c42ffe481af45c5c9f366884132bda3fcdbf9b0602345382809c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
7f264aa6e13ab53a4d053ba8722ee510

SHA1
6434c499243f09d0beb215d20a510ace3c85eaf1

SHA256
6edf48d806b6b121073890254733504312c046d14fd59a18ef9907eb69ac8593

SHA512
c2e68f9cad7f892595a26dffc9ef14e7d5e18ec2c5cbc90efd815bab03c6a3a12914e0ab85a45c87544fc9e8bb7dc5a51a67058cc391fece0ac9f4f9c211fa4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e1631df0a021059fc2a5c0d78458577d

SHA1
fc1c91efcea982e155101cc673bd4166ec11cbdd

SHA256
f41e52c165c32c60058f8d29269b39409711ba27a276a40ea3558708c502228b

SHA512
d88b5a3998107fdc43ab522c73a6ba86ed7b8fb090d741ccdda84a4b5f0dbca7bc88092c8bb7fd415ebba47d19ada119b6eb61c3f7dd34a4636222468cfb5afc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
42c2f502c33d95b28dd3277e7d55c94c

SHA1
21ace3b50488209ef9545e20a59b1327e642d776

SHA256
0acdca28a9dfa7f404020cc6eccb00a2819bc81e04d97841c1343437e8737178

SHA512
a688857bc3b67de5c6b2d2bfc514d5e380408d5239e050090a54098cf95df9666bc84a2a85db02104de8dbb24dcddb42e5f343d252fc393b9df5f899f080f71f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
32KB

MD5
75726ca53737853390afe277cb227a10

SHA1
805cfa69fbad7f643ea5359ca306909df364d72f

SHA256
5b10da38106df9513caef25d5f0c27ea2c5a8918eb07767b9937fdfde4bae241

SHA512
3394ec0b2070462e60e6ccc4f4da9fa6ae8c8d187b8acbbffbb8c009ee8b8a43aa5ceb549b85b08c528748dfac0f48648d4572b319c4e159634208c91a10b555

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
46c2c8fe8cf5c1747cc1f135dfee15ec

SHA1
fc2433ee16d222d2ffba46517980bbcb5677fbce

SHA256
11b9fc7b2c74b1c0af788468e4c2db437e1ebe7e30ab57e7ee78c0c324b84642

SHA512
f7ab35e9988431a35aa5028af9966a63fe0ec85036a8651512ea433724bb24249d4f15a7984c419e3632b0b413814747d8e7b1641a93185a88597274b1b3d4bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
34KB

MD5
8dbd5dce2ecbaa3a1d127fb3e99a82fd

SHA1
782a0f900eebeb1e51c8fcae501ada5f44bf9145

SHA256
c31896b0f02346c3f98bf001ade0399ef33c22174c2f7f069b69058b2e5fe60e

SHA512
80c3c61280add6e3faeb793ff928926cbc86aaa67de4a35e4f0dbbdf87ef46d84f6f72f7857361e2ba8af171add64b7d26856baa4f30db9f2cbef6f8e92794dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
cb2df151086c72ae8a4318a30b98bc8f

SHA1
26fd0452ff13b9cb8361f46b5c498ef31dba326c

SHA256
59a556883612f82a7958d706e25df31696a4d95fcdaaef8e64c5b3fbbe997f05

SHA512
13fefc5f095432c304c77e77f1c280737c9ee78dee3d389d77a7c4358fb23806d70977645be0808b2e6afb6ff7848a0351060ea71e7c0108caea1fcc08e79235

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
42KB

MD5
a57f250a94fa3d7108f0b972e1732eb5

SHA1
288b8179df4cdccf52716dce40f37f6915b7f8df

SHA256
6666d5642964256f1a46d58b484bb7e113af7e3437a9df13f0b22b7ba5715d71

SHA512
401b5ddf7e95c7cacd16365a4e07214ee04b3d201d019b390dbe011932cffb2785bdec36024c75d4ee88baf8e801c356e7f04e30b1ad6d3eebf09ef82411434c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
819f040853555d1c137e5438963d7efb

SHA1
8c6947b4a95a352cf0d38645af4bd126056301b6

SHA256
575e2233d5056fedbe601895d9c4c846dfc861ab1040866f969c1b827e5b3a44

SHA512
0f78969b4aebb03ff258f55328fcc1e0cd1688ebd9aa46f2d930c3ce262f2c34d84e38075c909c4d0ed172787fdea120ad35107f127dcf0e14c72f4a2a3f71b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
52KB

MD5
7ad8163e7f5d924e4832f099403ddbcf

SHA1
a8dbf8bd5a89dabc833547594ff33f69240bac06

SHA256
531926d0079d18432ee330006a4ee76e6355b3db63b10f7cd9bcdb8a50785085

SHA512
9ffa1bb68602620cfef5c809bde908748fcf4fb49eebd5f1162b3810465a38a3aa4a151f539e4d4cf16a495338f7894df0cdb27dd7ed527d909399a13f5ee6cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
54KB

MD5
6c6863a098b1c4babc68ff14c7795ed3

SHA1
71c95b463304f4f86504b2bc09154f8b94cac8df

SHA256
4211d58eebea1dd5a0e172c221000c97496cf7cba0f0c4723f500662d4fce977

SHA512
8d0ad4e154c1d5e0641900fc69e9e775e2e6216a5ea33b16a5950043f62a8271d67e90d47c924e4be4ba9b34752006245e5d031575fbcc80c778f5753e7b177c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
56KB

MD5
8035b1a8bd6561bc268abbb3d33563e0

SHA1
b11308abd9df36c3e5151e7e9a7290365441cb38

SHA256
5d3a36614b1fc7613121c5c193e623e57947579040ce4ec3d5eef66dec2a40b7

SHA512
61342b90090368b66445ca6348d74579e6f4be699539021ed7a72efb23d844960113fe4d6e9f77e72b7f2db9e9eaaed50d6dbfaed137608e0b4927e399db132b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
e7d901ad03d22078f4c42ecc83c3bd45

SHA1
13ffe2ced2026e6b99c39a96d006c7832a72ba17

SHA256
fddee54013f830a84e74dce5679f6e4c3c71b4c5c51ecdf58bcef7e27eba4f17

SHA512
8e7373116183db845f03c74e28effbe85b53c6c109f0a1a867fc4daa2944c099846644c5b6ecfa6408091d097a08b3f1b8cedcbeffbdcfaa14147f6b76663ec9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
376d4f503c73db03c86f8fb41f681697

SHA1
26cb2aebfef15a9ae245af0410427a1eccb9f909

SHA256
d19541e2751c3bdf4ec36665a2211540a587ea03043f42b0a8dc7bc52e90aed4

SHA512
2c4a90e75b6ca4edb2cce8112e57783b372dfdd2629e1513308a8db4893e820df9e38b6ac2fedeaa0f77c6aa966733cc7dc5761554382fcac216db48eca8bb07

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\targeting.snapshot.json

Filesize
3KB

MD5
312617d19e1e57b7ab1eedba766a20de

SHA1
d6e9028a22cf9fbe3d04258230c3779c957d9df3

SHA256
7b342a787f4211dc1e0965a783c4853fc5476119ac68eae20c9f4a85cfaf0d2d

SHA512
eb719f2b14f6421b926c79657902dfcbae846635f12b314464d66defcd8e204916f7dfb068d924015658ea2f6c4a54e11c063e95df61f2f71428517a2f8e5631

Download Submit
memory/196-65-0x0000020793D90000-0x0000020793D91000-memory.dmp

Filesize
4KB

Download
memory/196-62-0x0000020798D50000-0x0000020798D52000-memory.dmp

Filesize
8KB

Download
memory/196-69-0x0000020791FE0000-0x0000020791FE1000-memory.dmp

Filesize
4KB

Download
memory/196-35-0x0000020791FF0000-0x0000020791FF2000-memory.dmp

Filesize
8KB

Download
memory/196-0-0x0000020794A20000-0x0000020794A30000-memory.dmp

Filesize
64KB

Download
memory/196-16-0x0000020794B20000-0x0000020794B30000-memory.dmp

Filesize
64KB

Download
memory/932-52-0x00000215CEC20000-0x00000215CED20000-memory.dmp

Filesize
1024KB

Download
memory/5036-44-0x000002803A940000-0x000002803AA40000-memory.dmp

Filesize
1024KB

Download
memory/5036-42-0x000002803A940000-0x000002803AA40000-memory.dmp

Filesize
1024KB

Download