hxxp://google[.]com

Analysis

max time kernel
1133s
max time network
1198s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
14/10/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 14 IoCs

pid	Process
5848	MEMZ.exe
5976	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
6000	MEMZ.exe
6008	MEMZ.exe
6080	MEMZ.exe
5416	MEMZ.exe
5584	MEMZ.exe
5600	MEMZ.exe
5640	MEMZ.exe
5588	MEMZ.exe
3988	MEMZ.exe
5604	MEMZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
105	raw.githubusercontent.com
142	raw.githubusercontent.com
143	raw.githubusercontent.com
144	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.google.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\youtube.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4a475f865a1edb01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a1eb47a45a1edb01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c23b9c38591edb01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5e91fc335a1edb01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\embeds.beehiiv.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = b0affb9a591edb01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.google.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "523"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\Total = "377"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\beehiiv.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.youtube.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier	firefox.exe

Runs regedit.exe 2 IoCs

pid	Process
7220	regedit.exe
13156	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5976	MEMZ.exe
5976	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
5976	MEMZ.exe
5976	MEMZ.exe
6000	MEMZ.exe
6008	MEMZ.exe
6000	MEMZ.exe
6008	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
5976	MEMZ.exe
5976	MEMZ.exe
6008	MEMZ.exe
6000	MEMZ.exe
6008	MEMZ.exe
6000	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
5976	MEMZ.exe
5976	MEMZ.exe
6000	MEMZ.exe
6000	MEMZ.exe
6008	MEMZ.exe
6008	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
5976	MEMZ.exe
5976	MEMZ.exe
6000	MEMZ.exe
6000	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
6008	MEMZ.exe
6008	MEMZ.exe
5976	MEMZ.exe
5976	MEMZ.exe
6000	MEMZ.exe
6000	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
5976	MEMZ.exe
6008	MEMZ.exe
6008	MEMZ.exe
5976	MEMZ.exe
6000	MEMZ.exe
6000	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe
6028	MEMZ.exe
5992	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3000	OpenWith.exe
5640	MEMZ.exe
6640	mmc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4260	MicrosoftEdgeCP.exe
4260	MicrosoftEdgeCP.exe
4260	MicrosoftEdgeCP.exe
4260	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
11144	mmc.exe
12092	mmc.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4396	MicrosoftEdge.exe
Token: SeDebugPrivilege	4396	MicrosoftEdge.exe
Token: SeDebugPrivilege	2352	firefox.exe
Token: SeDebugPrivilege	2352	firefox.exe
Token: SeDebugPrivilege	5676	firefox.exe
Token: SeDebugPrivilege	5676	firefox.exe
Token: 33	1464	mmc.exe
Token: SeIncBasePriorityPrivilege	1464	mmc.exe
Token: 33	1464	mmc.exe
Token: SeIncBasePriorityPrivilege	1464	mmc.exe
Token: 33	1464	mmc.exe
Token: SeIncBasePriorityPrivilege	1464	mmc.exe
Token: SeDebugPrivilege	5652	firefox.exe
Token: SeDebugPrivilege	5652	firefox.exe
Token: 33	5184	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5184	AUDIODG.EXE
Token: 33	6640	mmc.exe
Token: SeIncBasePriorityPrivilege	6640	mmc.exe
Token: 33	6640	mmc.exe
Token: SeIncBasePriorityPrivilege	6640	mmc.exe
Token: 33	6640	mmc.exe
Token: SeIncBasePriorityPrivilege	6640	mmc.exe
Token: 33	11144	mmc.exe
Token: SeIncBasePriorityPrivilege	11144	mmc.exe
Token: 33	11144	mmc.exe
Token: SeIncBasePriorityPrivilege	11144	mmc.exe
Token: 33	11144	mmc.exe
Token: SeIncBasePriorityPrivilege	11144	mmc.exe
Token: 33	12092	mmc.exe
Token: SeIncBasePriorityPrivilege	12092	mmc.exe
Token: 33	12092	mmc.exe
Token: SeIncBasePriorityPrivilege	12092	mmc.exe
Token: 33	12092	mmc.exe
Token: SeIncBasePriorityPrivilege	12092	mmc.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2352	firefox.exe
2352	firefox.exe
2352	firefox.exe
2352	firefox.exe
5676	firefox.exe
5676	firefox.exe
5676	firefox.exe
5676	firefox.exe
5676	firefox.exe
5652	firefox.exe
5652	firefox.exe
5652	firefox.exe
5652	firefox.exe
5652	firefox.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
2352	firefox.exe
2352	firefox.exe
2352	firefox.exe
5676	firefox.exe
5676	firefox.exe
5676	firefox.exe
5676	firefox.exe
5652	firefox.exe
5652	firefox.exe
5652	firefox.exe
5652	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4396	MicrosoftEdge.exe
4260	MicrosoftEdgeCP.exe
4156	MicrosoftEdgeCP.exe
4260	MicrosoftEdgeCP.exe
2352	firefox.exe
2352	firefox.exe
2352	firefox.exe
2352	firefox.exe
5676	firefox.exe
816	mmc.exe
1464	mmc.exe
1464	mmc.exe
5652	firefox.exe
5484	MicrosoftEdge.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
3000	OpenWith.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
6244	OpenWith.exe
5640	MEMZ.exe
5640	MEMZ.exe
7016	mspaint.exe
7016	mspaint.exe
7016	mspaint.exe
7016	mspaint.exe
5640	MEMZ.exe
6580	mmc.exe
6640	mmc.exe
6640	mmc.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
8372	wordpad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 4260 wrote to memory of 4716	4260	MicrosoftEdgeCP.exe	77
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 1900 wrote to memory of 2352	1900	firefox.exe	80
PID 2352 wrote to memory of 2588	2352	firefox.exe	81
PID 2352 wrote to memory of 2588	2352	firefox.exe	81
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82
PID 2352 wrote to memory of 4012	2352	firefox.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "http://google.com"
1⤵
PID:524

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1684

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.0.663652367\2020802580" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1724 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9520d8ba-294a-4b33-8e34-3bf5156a6f91} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 1828 1caf90d5358 gpu
    3⤵
    PID:2588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.1.334086663\803074065" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adce08a4-d17f-4fce-b84c-16935dcdcd25} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 2184 1caee070158 socket
    3⤵
    - Checks processor information in registry
    PID:4012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.2.971747228\1211853591" -childID 1 -isForBrowser -prefsHandle 2956 -prefMapHandle 2784 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13cf8c9a-1da2-4ed9-b0a9-d023fbfd66f0} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 3040 1cafd2e3558 tab
    3⤵
    PID:2916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.3.1898810529\2043809968" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3488 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02ba911a-27ad-4204-9d8a-cce580838bab} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 3528 1cafb8e9d58 tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.4.1610185559\1921244168" -childID 3 -isForBrowser -prefsHandle 4120 -prefMapHandle 4116 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1e97755-fbf3-40bc-8eb0-d02066905db9} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 4256 1cafe50f758 tab
    3⤵
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.5.1676129813\525055768" -childID 4 -isForBrowser -prefsHandle 4696 -prefMapHandle 4732 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d57cc435-b674-42bb-a7be-2eacb01e7f17} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 2600 1cafd8f2458 tab
    3⤵
    PID:4992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.6.473919548\1449074814" -childID 5 -isForBrowser -prefsHandle 4884 -prefMapHandle 4888 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {44a879f6-7134-46e9-a0ad-9cb200be4db5} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 4876 1caff97f258 tab
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.7.508997773\1157837719" -childID 6 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52116e26-8173-4270-85c6-5d9e1c72773c} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 5060 1caff980a58 tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.8.910152849\210130370" -childID 7 -isForBrowser -prefsHandle 5652 -prefMapHandle 5648 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3039a4c-ec5c-49e0-923a-d1eebbdb1d20} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 5660 1cb01707a58 tab
    3⤵
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2352.9.900243329\1051642013" -childID 8 -isForBrowser -prefsHandle 5268 -prefMapHandle 5264 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {875cd14a-967f-40ba-9d4e-32ccbcacb009} 2352 "\\.\pipe\gecko-crash-server-pipe.2352" 5272 1caff97fe58 tab
    3⤵
    PID:496
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5848
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5976
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5992
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6000
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6008
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6028
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /main
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      PID:6080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4628

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  PID:5584
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  PID:5588
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  PID:5600
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  PID:5604
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5640
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4712
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:816
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1464
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5880
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:596
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:600
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5576
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6248
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:7016
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6580
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:6640
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7964
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:7220
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8620
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:8372
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:8296
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9676
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11172
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: SetClipboardViewer
      Suspicious use of AdjustPrivilegeToken
      PID:11144
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11556
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11312
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: SetClipboardViewer
      Suspicious use of AdjustPrivilegeToken
      PID:12092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11928
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12616
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:13156
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    PID:15248
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    PID:14364
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:15012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2532
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5676.0.1241728879\663464475" -parentBuildID 20221007134813 -prefsHandle 1604 -prefMapHandle 1580 -prefsLen 21136 -prefMapSize 233536 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79e0f440-b5b4-47a3-9df4-036d4b9a9032} 5676 "\\.\pipe\gecko-crash-server-pipe.5676" 1684 188508fb058 gpu
    3⤵
    PID:5800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5676.1.493584973\182006268" -parentBuildID 20221007134813 -prefsHandle 1980 -prefMapHandle 1976 -prefsLen 21181 -prefMapSize 233536 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e2fba7b-b380-4861-80ed-0124d3368d91} 5676 "\\.\pipe\gecko-crash-server-pipe.5676" 1992 188459e5558 socket
    3⤵
    - Checks processor information in registry
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5676.2.844215037\304024223" -childID 1 -isForBrowser -prefsHandle 2784 -prefMapHandle 2780 -prefsLen 21642 -prefMapSize 233536 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c5bc5fa-eafa-4e65-a4da-aa1afadc1389} 5676 "\\.\pipe\gecko-crash-server-pipe.5676" 2796 18854483958 tab
    3⤵
    PID:4964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5676.3.2017680270\1677385894" -childID 2 -isForBrowser -prefsHandle 3216 -prefMapHandle 3212 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36427a4a-e603-43c4-8e73-0c338046c8ff} 5676 "\\.\pipe\gecko-crash-server-pipe.5676" 3228 18845962b58 tab
    3⤵
    PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5676.4.1862259880\248054547" -childID 3 -isForBrowser -prefsHandle 3984 -prefMapHandle 3976 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a149a3fe-2ee6-4f48-9961-f912c717b80f} 5676 "\\.\pipe\gecko-crash-server-pipe.5676" 4012 18856778258 tab
    3⤵
    PID:5520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5676.5.519175999\1204745257" -childID 4 -isForBrowser -prefsHandle 4512 -prefMapHandle 4508 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5c90591-d2e0-47d5-9092-6d2960040e6e} 5676 "\\.\pipe\gecko-crash-server-pipe.5676" 4444 1885491d958 tab
    3⤵
    PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5676.6.1870938898\102117860" -childID 5 -isForBrowser -prefsHandle 4664 -prefMapHandle 4668 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af865393-562b-434b-bd0d-8544a5b48502} 5676 "\\.\pipe\gecko-crash-server-pipe.5676" 4656 188569dc558 tab
    3⤵
    PID:4172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5676.7.495585720\2066946347" -childID 6 -isForBrowser -prefsHandle 4852 -prefMapHandle 4856 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bb1ef52-1c9d-4f8e-82c7-1e4890572887} 5676 "\\.\pipe\gecko-crash-server-pipe.5676" 4844 188569dad58 tab
    3⤵
    PID:4484

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5504
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5652.0.1467199830\1709558019" -parentBuildID 20221007134813 -prefsHandle 1544 -prefMapHandle 1532 -prefsLen 21136 -prefMapSize 233536 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de0af19b-7bb0-46f3-b584-7994956402b1} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 1640 1d0c20f9558 gpu
    3⤵
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5652.1.1866081687\197667256" -parentBuildID 20221007134813 -prefsHandle 1980 -prefMapHandle 1976 -prefsLen 21181 -prefMapSize 233536 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac644a87-6f11-4fc7-a7d7-990ed49082e0} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 2000 1d0b71dca58 socket
    3⤵
    - Checks processor information in registry
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5652.2.1041784018\1981125426" -childID 1 -isForBrowser -prefsHandle 2732 -prefMapHandle 2668 -prefsLen 21642 -prefMapSize 233536 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b935d51a-c030-444b-9f9e-79b7aea48300} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 2860 1d0c2156b58 tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5652.3.711623988\810471379" -childID 2 -isForBrowser -prefsHandle 3332 -prefMapHandle 3312 -prefsLen 26040 -prefMapSize 233536 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {273c45bb-c484-43ea-8e02-1a3654223665} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 3344 1d0b7161c58 tab
    3⤵
    PID:2108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5484

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1400

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x42c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2716

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:4332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4696

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5332

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3000

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:852

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:4284

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:800

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4360

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:7124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6756

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:6148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6392

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:6724

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:7516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:7456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:7768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:6212

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:7232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:8032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:9060

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:8476

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:9004

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:8816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:7764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:9412

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:8332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:8128

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:9744

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:10140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:9212

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:9828

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:7272

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3360

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:7524

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:10292

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:11244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:10668

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:4804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:10420

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:10300

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:12244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:11724

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:11736

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:11976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:11424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:11308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:12336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:13148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:11984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:12876

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:12644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:12608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:13516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:13436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:14068

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:12516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13848

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:13856

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:14976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:15096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:15048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\doomed\1370

Filesize
9KB

MD5
1a025534e5f8bb375bd3665bd824bc00

SHA1
a80824a5686e495c381bd058441d38aab9e941d0

SHA256
de363d0ab0adeabc6457165b29d72a3d162dfaae873cb2e8ef242774889ad220

SHA512
be50397f683a6406239ddce86fd6a2535892565335cb50476f9c48ed080c058594500115ec6cd876c9629cd4218cbf879c39f1ce432b9f7b9a9b639edf12b593

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
15KB

MD5
1cc0a17094b8d81bab9f5466c7bc96fc

SHA1
12547f5142ac6e61981d74c9d4b7fe06080502a5

SHA256
358db98b89693f31bb7977f9d570415301c04d41f94afd043ae3911e6b0ae3e8

SHA512
b403e0b23875eb4377e2c2ca4ed4eb145aaec5b30eb173db20616c367c1d3035c4b2c98b2270715327e6eda55279776ab4c1946a68d1b93da69bb0d83c4e287e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
15KB

MD5
aa43a4e084fa1742c6b3d9eccfdd93e8

SHA1
1fd9e2f67d30995682d619657561b43ed5d68fb3

SHA256
f6353b787d8c50f028389da7f55245911167565bc43aba0fe18f0bbea69737ec

SHA512
bbd015bac823113a01cb2957f5ecdb7620e20a4ca04d6d428136f07f1c781906fd1c3e2f7a0299fe9912fd0f68ca582f097401afd4a959dccfd30c94bd5ebb3e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\entries\79679B23E6BBEB689E1C79E27C32C20C5EC9DF47

Filesize
22KB

MD5
0bd2f2926b8022f040bbbd9423633b15

SHA1
145a7a557015d29a78a5ac677ecd41e8acda861e

SHA256
c531d986a09f8e7b732f16ad3e1e61c86a7f2cdd52bff2ad5ee09e9b5906e7e1

SHA512
61103259f0dbc00d9077f3fc55a6f46283d1277d9c4a0be072bd65b333ca47869ec60f000fb309b2339a1241771b35be79298eeba680bd04bd123bc9d38e8b21

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\startupCache\scriptCache-child.bin

Filesize
464KB

MD5
b1c0b3951a7abee30fb0ab72941beba3

SHA1
3d996cedee1d6eb87d144f8e220d41740978247e

SHA256
41edcec5320de0978c90cc2563ad07fd3e1e39b00be164ec27a299885b71299f

SHA512
dc2f9b4b5e4a81d9537d47372763b7570e8dee1b25e80131548ad816c8823424e9e2e298975932ea2d36e680922312cab5e65ee6c5715ba078a4c28d11b8829f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\startupCache\scriptCache.bin

Filesize
7.6MB

MD5
84be45766824b7d2d0c64c3aa1cd94d7

SHA1
54cfc4e175b36aa1ba83adcb6764b02d85d37f9f

SHA256
4eabd727ab5926d56aff3ab4c16a4cb708dbe3fce5e61258cac5bc7514ec0ec2

SHA512
258022d994fa95125e6e8f8ec5b8c9753899e0df31957483d5f336ec7d4c88140fd344e9048d435bcb981ac6bb0cbbbdccfa7042d117f4899f6b6f6ef3e63e31

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\startupCache\scriptCache.bin

Filesize
7.7MB

MD5
c46cc52843acd7d723dead7f4ecd82de

SHA1
9860353b90329e1290e70ee819aa22cacb20e8ba

SHA256
0fea882d1d7a8ab14cc64cff3e6136a7cf123af398733df25329db1c3224bec4

SHA512
4e6a40a2147eb727fb02062409641b454c8e58b4ceae9bd84cb25dc412fb5c491558da27986eafdaa16d04b421ac11a94f5d04d59e3f1c5758e6aa95fcd07f08

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
2cf8f420e4fafc01b7ba0086d30bbcfd

SHA1
d643fb591c07868d487ac246461028c7b1267182

SHA256
b5f3543e98f510b89f69a1d52d1f32445394a5a4152016bb9f22b0a6d0be7028

SHA512
13730e5ae1967f90fec2290b242a3989ab77d58ee81789dd1c01cf2b4b30139bd0a880cac50b2a389019d898a151acc08db4a0989691a7f14ae6029cb183000d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
1b56104a4f0a0b43d3d6ccedebccceab

SHA1
0fc13faca49bf572d627c91b17491e8e8ffb5a84

SHA256
0d8d296609b534ec0279ef25b87b15bedb2d8c2d65d31cdbf855911d1c89fc06

SHA512
7fa856800e87b9795983671670406553b92139069597a3092b2fe38372e7db911a71d2ff27517effabeb372157e47f36b9f8a5e6e49a85efed279ef13ce71218

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D4Y7IN1P\wcp-consent[1].js

Filesize
272KB

MD5
5f524e20ce61f542125454baf867c47b

SHA1
7e9834fd30dcfd27532ce79165344a438c31d78b

SHA256
c688d3f2135b6b51617a306a0b1a665324402a00a6bceba475881af281503ad9

SHA512
224a6e2961c75be0236140fed3606507bca49eb10cb13f7df2bcfbb3b12ebeced7107de7aa8b2b2bb3fc2aa07cd4f057739735c040ef908381be5bc86e0479b2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D4Y7IN1P\webworker[1].js

Filesize
102B

MD5
f3dfe1a46e91c1c5521b4ed0e336ae06

SHA1
8112055ed07a442dd199c15a8b2c451a3e4b54e6

SHA256
724fc56703e050f8625d033339e4c69746c05564ba34df35003a34ed59432657

SHA512
0570aadedb1ffb2eaeb8a8454004c1ea63109712d07e9f0e1d08fdeefa06fc8cd64c75688a2fe5af7ee314e056bc744337fefa8b5fda95f17b2b0e4146d81c5c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\P7079AH0\MeControl_UQ5Cf7sjpn6_1JWqHlJQMg2[1].js

Filesize
16KB

MD5
510e427fbb23a67ebfd495aa1e525032

SHA1
adafc97a733f39d314915d8ea00a1b6547fa5770

SHA256
2194f0f5d4d870c74bbfff1f0228bca8fbdf1eb45ad9d87454f9d784decb84c1

SHA512
947617c26829f373cba7bd155dce06895e219cd4b58e0f17e12edeed1985cc0bc085fd8ac74b06b0779b0260794c7ba28c0b594c69c032a6e37d91a76d961acd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\P7079AH0\recaptcha__en[1].js

Filesize
546KB

MD5
99210e7c2195de81c0eedf98787a69b3

SHA1
7b26c66058385b60109aa6129c2161a399a6034d

SHA256
5f75bfbfbf0c7cac2c87d6ca5de0661aedc188b0900b6cef5efbaea134b53302

SHA512
c3198d7943b3311679d77bcffea75d7043801277bf03ac10ca20bbe424e9ae896c060c7e0ef4143e23c2a41e367917a258404fba428099316705b7252aea8a6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\P7079AH0\variables[1].js

Filesize
479B

MD5
3187dcfe8a528c533df3e4224d52dba0

SHA1
03ecbbcf25262a272b1740335969d3596d2f3496

SHA256
1b632d8f79f22f7400d92b386ccd11aa57e2f00d392970f03f5ef1565af1546b

SHA512
b3cb038ae94c40e6cdb36e3247b02de31a8cdea574625b14448256c6a840277b673123669168548b8612888f6f773bf9e6797c8c399098a58cef1088edf3db21

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U34FX1UA\anchor[3].htm

Filesize
48KB

MD5
3aaf41925256eab3e8084b5d5b5857b4

SHA1
eba2db41909ef9306e32060ac73a8be7e03dd253

SHA256
e37656b0ad308209e3abb397d7fe41810558e2479ef141483a7f0e36df2d48c3

SHA512
6b2ecff13b39dbbed68a79b4a6ea208469e683783dfe972b328f7eddd2a1d10283cd9764870b2cf6e7384badc2f36476b793eb5e61b2a0bcc54b1e3bee90b1f9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U34FX1UA\api[1].js

Filesize
870B

MD5
0f193e774135c524efc628d561555bb5

SHA1
db82d62c0536579d3bbd770064543fe041e5e6c9

SHA256
201beb2da2d2460893d75c7f140c73eefcf24e10e822df826788e72a04bf8b3a

SHA512
8c16d29bcd905ae9c3b8d9df6fabf6f08f263a49997398333d4efca242eed347ba2db8352545c40729abbef3a8ae47efc42f50d1a8df42f62cf222b596662541

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U34FX1UA\bframe[3].htm

Filesize
7KB

MD5
66541d8da7b94d06e572491e101adc52

SHA1
a2e2bf63fb92fcb5d491daf7f8a2699a7ea31407

SHA256
93224f7e08fcc9a5047967fac4ce7e86e12b025faa82d665e9a85bbc08a85aab

SHA512
bf4fdcc898ac4c7e985c2c809b1baec8c35832991d69264bfbb30f25c71c17360bb9ac73e6cc979ef25303207ec1225f67ed7addaf94a0a2337906d9608840ce

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZD7DHIHA\styles__ltr[1].css

Filesize
77KB

MD5
a0ce64213f4f6193a598de1cdbaea665

SHA1
fec9a873b214601198f7312bcb1bf99204014085

SHA256
f0dff86310e9d08a2d80dbe68bae9367f8cd6cbd4b7d036f09b0702d035c7e8c

SHA512
72da125d31fd39b9b6571286c9b4b35d2b8875c8e299155a4d44742ff2b3fdf9b8cd5a7b888cf2ba26faf4842ea6810cf7d6dee5dc4b7e55aed03c623884356c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\BBPWD6YZ\www.vice[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\DGVODP25\www.youtube[1].xml

Filesize
229B

MD5
812b954d463223e5274f65f46e0e61e8

SHA1
6a3387d82e2f0c1edf3cd4ed73cee29ad9263b30

SHA256
2ce9a69af037285289acc427429dece2680fa8970a3e687708be0656c9408973

SHA512
80da05f292f50d6152283de763de7b5076ed491f8bf12bfd12db9e356fc159e299bab783a8daa2956c14b192e211a68970ed3600dd1f106aa2769a1222e017a4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\DGVODP25\www.youtube[1].xml

Filesize
641B

MD5
9dc7141f2db6cdbafd090d3fd918a250

SHA1
92be4af601b6003f293b3edb52492f5253c4d084

SHA256
137b6f81dfc1fb963e5fad5f3cd6c51fa7ecc89061289774b82d3b0594c1befb

SHA512
b1ed9fc67c13e23deaffdbe39858540dce11d1493ed67b1d59ae2a5bc6362474abc6d55e52023c013722188e57c9df4464478fce0c3eb660450db56664cec5cc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\DGVODP25\www.youtube[1].xml

Filesize
988B

MD5
8eabdc1d30e9a45f696a57e9c06e778e

SHA1
e73e1aa3bc345c2c89a88d23226e368fb733ad3f

SHA256
1fbdd1c291b23d6c7e1795c8c462fab0e93e7b34f2c54bde5649970e7aea926e

SHA512
c13e30ef71652dbf6ef81301b1ba6374bb48b40f32b65a22c640c9a07337a60cb71b2f7a7ebc7f733dc679d45e5e01a1978c505e809b9f265b3515f3896fd8c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\DGVODP25\www.youtube[1].xml

Filesize
18KB

MD5
6b65b2189f54a56c01a72934d520d2dc

SHA1
d88af98d31c13ec1d864a56c67c1c1d93e22d7fc

SHA256
f4c84bf02c860596f660bf8adc5eb66ac7a5d24767a8cbf1ee5c1fea378756a0

SHA512
bba74d25e638f64c5ec4acb225156271cb9fe0ef3e01fffb97178f497c6e2864df728dfbe3057af66852d9fea8c2d932aec790408e791ad8191a693e0f3c82c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\DGVODP25\www.youtube[1].xml

Filesize
990B

MD5
b7a4987d3b1d2d83de8f2d5e1ce20313

SHA1
6afd41e6ec725e621ce63cc5c00cbce2e7dda272

SHA256
c942c4b74b7e4d555c74566f4c2d021c76e13e46d5240767c176058620b6dcb6

SHA512
5ff4e4bc818d17145ad0cbdfa6544276c147fd464fb1ce306efcc17732ec3fafa3fb1464a527c043bb7aefe358696a41e367b10fe16237d24926efaff22ab0cb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\DGVODP25\www.youtube[1].xml

Filesize
990B

MD5
bf50b583fa2ba39b5a2541a38cd0cbec

SHA1
cd8a647b70956e9f9aebf70c25352a48919099ea

SHA256
c4c79c9689284b97ae6bc9d02ed8fbe698693583f4657cedafc4844500b881cc

SHA512
06a5bd6cd353dbdddce0ab70497e480bcf4f74e20b17afbddb091e2287d083eedd432325cae337039806dc1c5f35b5cc2244bba8c5d59d3ceed8bcabee1ea349

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3G5PGBGK\PCOP[1].ico

Filesize
6KB

MD5
6303f12d8874cff180eecf8f113f75e9

SHA1
f68c3b96b039a05a77657a76f4330482877dc047

SHA256
cd2756b9a2e47b55a7e8e6b6ab2ca63392ed8b6ff400b8d2c99d061b9a4a615e

SHA512
6c0c234b9249ed2d755faf2d568c88e6f3db3665df59f4817684b78aaa03edaf1adc72a589d7168e0d706ddf4db2d6e69c6b25a317648bdedf5b1b4ab2ab92c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3G5PGBGK\cropped-site-icon-1[1].png

Filesize
384B

MD5
6d50702ca9855b57d6d1a21dd764e5cb

SHA1
e23607df9dd152010df5afbdeb021014ecd4bbfe

SHA256
37e6c9ad51b349ae4673c27554573809cbd80fdcb0029735de40053ce3e4c536

SHA512
380e98230eb2eeacdfe4b6dee01400d5f82a6e2d7531b18c5f4e1cc62e7851f6e7b7cefc54b96cb6f3b4350b265d49d0331ed84e60e2ce38357759d4227b6f87

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3TY4SLSU\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\JVPI1MKM\b80692[1].ico

Filesize
1KB

MD5
ac0cd867e03ed914827807d4715bdfe7

SHA1
4051a8c23756c10d9cc00fcde6f7215c780fdf6f

SHA256
b50546da121186fbffd2aec430249cb21c7c2e2c85e561a393a9df9abfc4477c

SHA512
fa11d1d76c39719c218b4ffa34de8dd44d398bdcbb236a666f0be6eeee96bcbe4da9ac65a89441ad284c0de21788c135dc4fd21f6f82c7039f00c8a7c705c8e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\JVPI1MKM\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\TJLGDJUO\favicon[1].ico

Filesize
4KB

MD5
b939aee911231447cbd2e3ff044b3cce

SHA1
0f79060358bea92b93ded65860ffbc9ecae3dc14

SHA256
f35fe126f90cecbb6addd79308e296e8409dbebf6bc589c31749e67713e9bb3c

SHA512
8053232364d54966f4b8acdf9af61a1366bae09789d6a76b8e723d7c3f96287460248eda12083795766809569527f4821f7e87ca4a644ae900c3df33002c9977

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\pep9w1k\imagestore.dat

Filesize
16KB

MD5
19bc9c36476ef4226c5f254129dee5dd

SHA1
e0cc91c7d9acd5ca1f64018fc552eacaebf5f56a

SHA256
4a63398b68c0a66874e1de164188a51a844ffe0aea93ea0e42e04a5672de6d81

SHA512
aac481213dcff6a60b5568850c06e4e3fd0748623be3012c66c2e326733d2aaad3dde781d535ec9de63e5ea90992ba2208e2aac1d98a61151a7a07e6e9bcf774

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
a60e714bbc7342d72ecaba877225a242

SHA1
2ec698e458730921272e7487daad848ec39da21c

SHA256
672361f366b811764ab5d3623f694df5bb2e9584efc70dec50eab5c714f03af4

SHA512
ebaad070eef834528f34c2faf72bb797f8dbea67860776349ee8a2d4bc204525274e8249127dbdded91d8f94b0c3ef51f4088c10356a0586eb830274d3aef878

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_CFDBFDB29AA6A71EBDC3E04CD6E276F4

Filesize
472B

MD5
1ad4491483b9980f4608a7923ebb364e

SHA1
6d1e66da4d76f5d1c045cad25499223454a0e722

SHA256
51906193c0a4e8d70ecc05d0b224dd57f2b13f8a3dc49258b860edee74617e21

SHA512
2c31e6dc4c5bc7af5090dc544e0501c97dfd945d6f46feeb98f59aba86a54d27a7b10c46f98a52737cac2b245f0b64fc6c475b9adadc9792f0b7b73a64c2303a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
069dfc3d1d8d83d9dee80abc16b12308

SHA1
f2fc46a90430c5d675175a2fb317e7c9fb0ce321

SHA256
d8e4966e475fe30002df0b13e979b16b50f64975df1041fcec2bafc905943d27

SHA512
4d56ec1226a8955f41969a6ae914a988126778b729e78e06ffd12cb2ce08de35b75d7be1ecade67ede6094018c9f8a0b1873a13aafe6f0c48f3245e03873c548

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
1406770cfa79cbf6f163c866b877e01a

SHA1
ea6cd4a3611ca8c863f4edc83b3f00d2075b0838

SHA256
2f1ef3fe911d18cf582e28d213e5e78bf6a2dfa8c48afafab1c7f28a5b9881da

SHA512
dfaea30edce577b064143609921efa8e827ae4fd589342459d3254ee1428e25d816b61826ff78bff923015738fee12202c0aa752860a86acc95c0df8d2467f9f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_CFDBFDB29AA6A71EBDC3E04CD6E276F4

Filesize
398B

MD5
db09c60a63982454def911abb4fc6c2c

SHA1
d79de23592a3826de9c17c39f19d96d8f891e4b8

SHA256
1cdc4b73a6204b908ea2b3d915239464a2eaa230bb2b20f552ef5179560d8898

SHA512
29e75ae7394d6b244f664fc72d410fd16e3207ed352fd7a4200cf4668cd88ce37d4593117eaf65c648957505a734b540972bde2c16105b7755103fe67594fe35

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

Filesize
512KB

MD5
6b1471f5d32a25c438e4dc4a1e34039e

SHA1
ba857e41db96554c4825c2c6b4703fea8ce7c84b

SHA256
688528128fd7649f18083ec056870f8deaded0cc45142cf17296182d359e27c2

SHA512
a97e33bc0fceea72c9313e0c44ac5b0976c6fc4b33178386dea958b11b3a1195e0dfcdd8e7373a7487ee6a95f9363ebb0dd2cb1ac805f20406f5c61ccdbd8aa1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk

Filesize
8KB

MD5
c4902c4fd62618df4f99b029629b6fcd

SHA1
21616765ec3da4a40bb10d7fb735ad55e0d061c7

SHA256
f655a5cd7e8a574efef21fa111966247fde7b9201826790687fa23aed5b7ccd4

SHA512
c4e295fbbaaf911c42804faf5a552b83550e2134eb6d7b19f8f422bed6813b2c12b0727bfd74b9a9f3392fe113c6442fb1bd6393e3c81d4b141b47c3a75aaf75

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb

Filesize
2.0MB

MD5
a2e6e3725eda067f3f877d4cff0de399

SHA1
4774328eaca84099a7a497d94c37ba17c7a69045

SHA256
ac468d45833ce5f7b33d69ae50dcede4daedd58c8a77855ce6b952ededd9d307

SHA512
390d03178f245ebcdecd30d6e8c4b424fcfe3ea042073ce9f349497e981d25c8c0190562c0b41db4fdaa170991b3616a69a941b37e3cbac553ab6f50bc828190

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm

Filesize
16KB

MD5
1128cd8424875b4d226b601ef55b1c60

SHA1
a797212df02fb56a4e2e69cbe6dd0f473291a7f4

SHA256
91f6485be977f4e826cc403aa685027363f8c3e5b86b92cf7fa1a25c16f3424b

SHA512
d8a15f590aa1ddfaa7f924e23f8370fa55e90f676b68fa504a19a982ca3966166998a1b53b2f2a565b2922ae3551408274fa571ee727fd32d8b61dd153077513

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\pep9w1k\imagestore.dat

Filesize
5KB

MD5
54df9922fc54622b40fc38b6d085e792

SHA1
12d33f90f1a65badd0ab01d4fa5cae2596ad7872

SHA256
99cde0e2defe04d88159585437f0aa6f69a7c70783d0f0397d907c0ab195573a

SHA512
0129d075be59fc581e75f4a04f5e422fd3a9ab8760f38b90442766045f85511086371454aa2243530a74f4788bbbb6120f827188f868703f3f01f8ee3f5d9999

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{578E92F1-FB09-4B9B-82E4-BC6E2AEA2C7F}.dat

Filesize
4KB

MD5
cc7227ee3c2e04d7ac102b8eed0c54c8

SHA1
76ce7ce3805f3af8d88b29516c782a7dd5d43fda

SHA256
d4fa7f24c9912be310d7a82f5f2e62f69767d1cae55e63491ae3f0bf70c02290

SHA512
ad9e5a73ece28208ec9ff4ee1e131cfd2e2999082a04d826d3f676182e04faffd36d916caa32f3c9d8a2a157acd2f9d942f72a47573ff449ed721255d0a5c12a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{73BE5EAC-C8E5-4E6A-8F9F-B56DF1597255}.dat

Filesize
6KB

MD5
3dcab59d2ab48dfb37d2e7f0e550048e

SHA1
301e243a07b48f9cf19cbda436e84c896e8ffb86

SHA256
4d7689a5e14dd6183ac4807fe8d4bc0b5dbe8e89527d0b77ec70d9e63a2badad

SHA512
de8ed478b32d88c6fb5023fb632d013cf99b009bbc22edcd82031680b5d3ecdddcee71f5a9c82117ae63ff04e3f099021a62709f6f8818aaee092eb4aaeb7163

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\AlternateServices.txt

Filesize
1KB

MD5
6a240eeda83ca7a1ce760183751cd1e0

SHA1
e75fc5d7a8df7f3ba9967e9b6e27438bd76cccb7

SHA256
87f10954f48d7a9ac1329c0075cb381650e894ae7a835ce916dd17ff49f24200

SHA512
44589e7250e4f339efa95e474fa0c1d5db1281c0852739d56589b8396462cc36e8ba5d09b56b5aa208fca4e16ffd85386e9b007bdb4bd27f714e269927d5aff0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\SiteSecurityServiceState.txt

Filesize
658B

MD5
fae9164fa33c815c04c570e4f7ecbc93

SHA1
ee6579068404c81b966263bbf560850f0e152e53

SHA256
c1b2350d9da0419c74fa1d4e4a2b79206c7ec96ecf9b7c88da779fa86d0bc0e4

SHA512
2e0b8470e7ac0282a9693fc34db3f8b4e1882c66691e4ac51d297e1e0ab03b7ddf703faf0d3a49b5efe205479a2a20fe10083906da933416a8944fc5458446d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cert9.db

Filesize
224KB

MD5
750a661b3f9cb3a260b479f0192c3093

SHA1
57741e736acb00b0e80de173763df0cbbf42e430

SHA256
60066521f8e747894d99e94deebd887925e1b151e08ab6e6160330e6888f40be

SHA512
626bc0bd9a2b5e02e7aae95e4fe74be44e51760cfeb9fe5ac2a79022a7053e68aa287d9255ff8555b8133a992c418af995578fb46e2183541bba53696bdcd17c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cookies.sqlite

Filesize
512KB

MD5
8353e0bfdfcae7e0478e0c51c520a541

SHA1
92af021cdc0bb263aebb87a310620f70638dd8a7

SHA256
6a3d748ca6c84b4af1c14160ac690a30ca9783a632f3f4c70173f4f99333bc61

SHA512
cf69c58c9c06d1deab9b4292147554b6afdc81fa5822024dd87e90608c31c3d22b85eb846ac88c9c6a408fd53c47ebcbb44a29211b8527f76aa92ec22eb9c339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
ca969a9db893df3eedfffd0b22be11cf

SHA1
c6b573b797345c4d14ab1b575eb3ffed9699aad5

SHA256
76993efe2b9d62e7c91985ebf38a1937773a61bcbdcf6a61d747618b60809f6a

SHA512
37485f996aecb909075f32cd526e6df181f0514d1d1f7386a3e261a1c41758c6c7197169678d35b802b300b6085e4834ec4381315f73caa69317143f5d3bae31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
729b91ed9804c2bfb73a8b519c75fb62

SHA1
dda1d4990273a83a15785d1c60bff496b2785b2c

SHA256
25962a031180ef0383ecce788375774aaf92fff57d444212753492a9b4ff0701

SHA512
acd16fca0575969e4f9c4670ce5348e53ca1b79158df514eef7351363b9e51f6f686f32e5d405952fe323e6383d8ff230d0f65062a80d45180058eeb096c8387

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
3c67216a847ad47cf7bedaebea308ac9

SHA1
1677122ed2d604544a09e43ac38aaab51799a9eb

SHA256
72e795a0b89f80ab894327ee027730c98c07c8c9cd15dffbfab36a1f0d6b9bec

SHA512
402ff5b2727f808d80583b389d86289af92f5ec16dba002c5003b851e9082e75105a533cd56757948d08c47c22d29f34e5cbef475ded5b1ec38c0c8fb62c2c14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\events\events

Filesize
488B

MD5
d8595d7a0cd48bac85360a026d3793b9

SHA1
9811ca17c892344ae8804084627983e20d26e82b

SHA256
fed5401d92abeb4b9d0dcbf8387b15b65a096c1a867150f4db716e2c35da4a06

SHA512
3f7a5868f9c1557ff1dabd2503a653a5be3f82be6cf385c93f6d8bb90e244c231a7dbd1978436d9f479bdf9d1f665aefb5bbb8e220b96a9bbab5f5f076fa6e75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\05718384-1ead-4932-b8e7-df2bb09feb0e

Filesize
746B

MD5
d29f3f7c15e6b69cbd2f51e672f56fee

SHA1
3c987330e0ed2898b929b2676360b9714afc27e8

SHA256
b6bb97dbda6dc831c80d05aa0239bb3e995634478335e93b0de7ea319bbe1104

SHA512
168f3571882fa95690ea6ad2a5c677fa1d8feed7aeec99f232273d77c9511e948065a73520b7db23c8c6a77aca0f6e727bf16574deb55b69c0cc3c9eef986335

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\4bee088b-6a24-4bb2-9106-f8eea96f18c2

Filesize
1KB

MD5
8ed00d1f9b3742d7dbe7af321ca71f10

SHA1
b5b444ecb7f42185528211861b2943dcb424cd2c

SHA256
0dbea05e48120e6f628687977e16123c94ad2619e8c6c6f8f9ad6b7c32a3f704

SHA512
498bd33e1366995dbcebef0008a3961bdc33603fbe5f06ed01b42a6ba10459cd0bb7821847653a316fce2dc08f2351b36702e8f173ac3f3a9ea6ee630901e585

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\840114f9-239b-400b-986d-4ded5cdeaaf6

Filesize
9KB

MD5
d522a926a8429983087d938a866886d0

SHA1
46ad33e48d435e14a9f6451507f5b14861e6c830

SHA256
e73c5157a238c7674bd2f183b8020297a5fc1b2bc8558011a492fee74b68d1fa

SHA512
bbfa0169fd8a91450df1bdeb5d2416e5fdcc17a069fcc71de55f5f465893e4a7e6089336c95de63d0296da7be8ccab30592f56b79c9ef9032a45fc75c2c7e84c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\8d934dcb-570f-41e5-adcb-14f186cf2e8a

Filesize
657B

MD5
3692ed5e9435161ff1837af36d7bf314

SHA1
c802ac61d679a7870f0cec55ff2af2e5f1583d6a

SHA256
c6655d0ff6625f82e622e28cd9e3e77f2f1e663e930b1e9d7f8df533edb60d52

SHA512
e25f77807cc87b39ffa7af846347bd48151feeaf9be79795856b4c026843e93748db719eaa5bcf7451cc2ec5947ec7620bd04407a65e0222b467d86287fb75c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\b8d226c4-3802-4e64-8567-11cea4636f92

Filesize
791B

MD5
fb6f8df58d6b834540afe2516cb9ff79

SHA1
8f69c5a83f568724d34b587e993aad4b842dc4e1

SHA256
3ef665f31b5cfcdbde7125d9cd80aeb977889136dc3a22c6905d57c1a1a45b08

SHA512
95eeaa0cfbe6b434a4f12a916349144fa5e6c9ae8c8444dbf8d78fcaea8e0caee29c3c01420142759eed83f1ed9e076e29d96815727295d09fc902b1e1d46765

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\favicons.sqlite

Filesize
5.0MB

MD5
e25f82dc25187e382b5fb2f1e3740587

SHA1
bdd8c31a67651ee51cb6e226a3c93ff16c3d6df0

SHA256
7292cd271acc4bd67a979d36dd7bce09b5f3dfca6904a50b39d949485069db46

SHA512
7fc0c9ecb6c960b8803f60dcd15872edff1fb68e91d4cd47c99497d5d079d4b0bb042370ad51e74c84b876dcfb3a3ee43cfcbd066535e06e0e8777d36cb98cd8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\permissions.sqlite

Filesize
96KB

MD5
897022fd10f9b69215127198702a36a7

SHA1
06e05cd70505fd448e232acbee518ed088aa862a

SHA256
796804bde32e6f4dab46a1389a075414e475d9ebe1b9325dc4b0b8f808663273

SHA512
077093840c178e5cab1d753564791819d508c69cf4796b3929c4d1871e27275dc01c9d0bff8fa59c9d70101890a856832dd6fee7c4e1f323e7787f220db6d7e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\places.sqlite

Filesize
5.0MB

MD5
eb402d6bcb2119537c635a3a7f491ffe

SHA1
544d621483536c855b85330e56bd8b09a667ccdb

SHA256
6971d0884119429b8a1b6783ebbb3d93cd3b6763c0c068e2f27f4b500e6f5997

SHA512
b5899f4d57e452603d61fb0b98635b960f5438aa65ef9701fc1267215645de17a5991b821839cd8f7866a999dad04463c2da6cd6942ada4e4a25181e6dd744a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
1c4044b893b773e22ec62064698f0772

SHA1
6f7e0876764631ea1883defe38f8a2b96ee6d5db

SHA256
d3c6d7065cca40a5c4618fe2dafc42c958c572e25935768eb57815e644cd513b

SHA512
adb849965ea022e2a9b4f4f634a599dd13084b336b627ec28253e57a20276b5d5c0ce9cbc6ca7132aa1cad7c717f4ac4373175e66f2e7409fdcda2dbd57b3f49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
d70143ed157355d59e5d4e79a5de7c18

SHA1
b35bf960c0a3d95ed6aa8c418f53001f0c87be20

SHA256
cc5b143805a3161563d4f348e73522e06c8b6b5f47661c0bcdb105dc23c837ce

SHA512
10619441cde064db289917d9b7c1a476593423277859c247b5143606dccab4996f2714714b10e98a0a6244e397331fa235b1fbddb35070fa0900e5d2e0bba527

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
99b4e087005a569b7a6ac87e2c1e8a00

SHA1
9e933e33c0e703ff026abcfc24ee09a9b860fa0d

SHA256
6de8b9d8f30a2ef0d7d87033ec1f8eacea02c93a55eb185f7949cd942b1a3d0f

SHA512
7818c8875832d8c757bb6b567aef0bd1b40dd5377df6605d57f902148718f7930dc8709294279b16e146e82c0fbf9e5df43bdbdd656bfd1663baa2507e880deb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
bab0f29d9022905683b529dccc1b3cca

SHA1
803edb140400f3a3da3757f7736fc9fa333b6d90

SHA256
b85caa5e58d494659ad55eaabaa3a83a283d7c86cc5ab8086bf8b2077033567c

SHA512
dd4d6c3e9969f32a05089a1a5424b7c545c9294085699af38500368e4e64e6810b2f750f56471571da775d8a1d87b5032d98ba3d6c3f84d6ae9c85802e3d10d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js

Filesize
6KB

MD5
28f7477719f902d880a93453b74f70c1

SHA1
50ca122fb2037461a98dd55b4c68d03fa4817525

SHA256
cb3572c5559340ebc8e24477ca711222c9279ab64702dc5de6858f7bbd9285ed

SHA512
82a864668d18768fa8bbaddff06712b43013dedaf842f1c9dade31d2aea3d126467ea187fe43570b0931c54e882a312f940beeb9ebce99c01df3d65a5803f8d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js

Filesize
6KB

MD5
0d7c8d70f645dba947e354c002e450a1

SHA1
b61620b3f34ac76ba79768ec60576fd30749c2f4

SHA256
818c5efcba5a79d399bf9116e785a1450167b05bab2c24b17f1e43cda18ea855

SHA512
c899776f009b8a5bfbeb0442b491735cbedbd78d26b17606878c1d269bbf08ad63fe74abeef7bfc281f194d94c9f465245a580bd38babd2b31315d0b2b243a7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\protections.sqlite

Filesize
64KB

MD5
49397db0486dc59d607907a086f40c9b

SHA1
08742ce9db9569062def08e99eea8470702feb7d

SHA256
890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

SHA512
fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionCheckpoints.json

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionCheckpoints.json.tmp

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
6b77a9f779399e95d1cee931a2c8f8ff

SHA1
826efd4feb0d50fcce5696111af7c811b81adcd9

SHA256
3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3

SHA512
ef537c75fab8e86483ac03cc0d2feaf41575e35f54b95669a26bf6dfbf58021dc9a5bbe54d9537b55da3fbb0e0262adf6c5efd4394faaec81a31604533afec4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b3f0f00d8a35acec1198473f56ef0d8f

SHA1
35ca74d638a847379d49e90e1a3a94fd75b277d7

SHA256
d23c43ccb45d8f8e7338f4ebf5cf51ef3e653967e7ddcb6449ee24e2d54328f9

SHA512
f38882332be4b589b4ec54f6b0e4771b541a1edf426646aec7280c46953f96755d6e1fd0bddabd488f224812a49e6f461dcd94fc65b7c56246516eadcc330b60

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
10e5339699c9a58b0be9d34c4db44a16

SHA1
5f1528f60eb233f84b06841a8a69dbba765498ef

SHA256
09270769b0eb651acb16f7ea784b1cfca51f5eb62709d3b9fbabaf79b746eb89

SHA512
aa4f35bdf9b4f5902f54f1185701e03929e40741edb50c5de61e86f6ab445b13024c29fa6c6e85c3b3a184614990f994ab37806e791242e2060f604c38ddbcd0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
3c91e03e66353d0e40db2aba06b1acd6

SHA1
9e2c5c27f00d0c1ba244535adae3b2f8d0d10b1b

SHA256
89785985a6e578c7a4d509d14c4bc673bc3557f803e675eeef3e4488328f9426

SHA512
123e62586b09a33da41d14d0cadfc3f651af34e114be038f29823e812ccbc99cfcaf3bba6c82eea8b383395d10d9fee811150111b4d52474761ca0813a066ed1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore.jsonlz4

Filesize
5KB

MD5
57f4d395445ce19e4a88f8b4043c2799

SHA1
30a7339031a7deb60c3a56b56e5cc6e1d6915b27

SHA256
a3110423e9093c9e8912d198b9aeaa7519907bd7e9ff082350a5cc5700c26838

SHA512
26c44de4b97f875e2360ff88aefa78149583552043c0b94b75fa1f43b0f5184e06691329e4111a9b304056f6254c768d5e9758f2abfa8fdfdf9ba39052ff2672

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore.jsonlz4

Filesize
880B

MD5
3ce47151333b0e85996e820f12d57490

SHA1
3c0043f03a43b2cbe6b937a8c02cede756a93150

SHA256
1c891acdb2c77ca3da654016283834191007cfc9e615cd67a62ea646a4a79fb9

SHA512
d7f7b3e82aefa7d9b1c2c4a2226a956c7a1e6fba7e672edd52ce706ff6ac65cda42f77b237a11518d5e73be32a207a73d7ae1e309aec2fbaab9959524289a162

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore.jsonlz4

Filesize
871B

MD5
294b04d55aa0565698ed04c8258aceb4

SHA1
25fdddcca2c723698f59d07d8a7f956f01ca02a1

SHA256
54ec5042ffc7fa75f76f75026ce001b9dd3f071e95711618d6cb475f2d714389

SHA512
8b02b3cd556716069134e02269561950e527c10ecff33d6959371cc371adb2a7b8c89cef6a8d7ee162380edb30f65b41448070f2eead8c19fe9a4ef329c563cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage.sqlite

Filesize
4KB

MD5
924802404fcb8446eb1bc9998d377d2d

SHA1
ef60fef4d8addc89a63feb3e594561b0e54da6e3

SHA256
775bc2d295e539265eb1c4d503ad99171260520f8e9e9017f28fe42ab190fc51

SHA512
7dabe3971dc4a9f27da832478ca1bc0de55fb9761a6349f63d75d3d85fca322c8320e306e58e2429ea4e6c7bed4e5374f83a74c8dc2facb55f86e8d0ab2b033c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
7aa680e291e88330f40f14c30da7592a

SHA1
18c4da78dcc6a00e086a4dd1ae7e17ea4dd48fe6

SHA256
2bcde01e7d8fcda848002e31de4d674adbbf598001739718ffb9f4c2408feb61

SHA512
2e0bfa289dfc0fa3cda08f57eff5a5f0542d24aca9e120171f6476e1977a89578aa1260d6069f6baa427cff48370a85cf0959fea5ed804e201fc3ca19f0f0b31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
3018d1aad8385b734068dbad441e344e

SHA1
2a3925bc92ec843db64b6db2cd6fe18ccf084a86

SHA256
f33415b0b1fc8c7e52356318d44aef1ae6bd9c64a89afa012d43a01a79954f88

SHA512
7ab1a1115a4f7ac61ba41bfe5875792cfa84d81f14f71239e43848de5940bfa07e2e34ea4be85a61c091d0b4b7742f3f55961fd26734b528cdb2c0b4d169c5e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\xulstore.json

Filesize
141B

MD5
1995825c748914809df775643764920f

SHA1
55c55d77bb712d2d831996344f0a1b3e0b7ff98a

SHA256
87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776

SHA512
c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\xulstore.json

Filesize
217B

MD5
58e240288763218d12bf235d34e5aee2

SHA1
89135494b57f590011c09668dec3b90d2c5ee9ae

SHA256
615f80e71dfde24711e7fefc1b7959f7592c5e5cf9ad0f3aecb4235b93187176

SHA512
caed2638902987aead199e73cffb90881bf245bbb616cb38c46b281d4aaaa54dc20a54e9bfe17a8d6e68847394c113fb7606e94b64f44ab0b52bf7846f26e936

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/4156-44-0x000002377C380000-0x000002377C480000-memory.dmp

Filesize
1024KB

Download
memory/4156-43-0x000002377C380000-0x000002377C480000-memory.dmp

Filesize
1024KB

Download
memory/4156-42-0x000002377C380000-0x000002377C480000-memory.dmp

Filesize
1024KB

Download
memory/4396-229-0x0000013CB2C10000-0x0000013CB2C12000-memory.dmp

Filesize
8KB

Download
memory/4396-156-0x0000013CBA6B0000-0x0000013CBA6B1000-memory.dmp

Filesize
4KB

Download
memory/4396-155-0x0000013CBA1F0000-0x0000013CBA1F1000-memory.dmp

Filesize
4KB

Download
memory/4396-0-0x0000013CB3A20000-0x0000013CB3A30000-memory.dmp

Filesize
64KB

Download
memory/4396-35-0x0000013CB0EC0000-0x0000013CB0EC2000-memory.dmp

Filesize
8KB

Download
memory/4396-232-0x0000013CB0EF0000-0x0000013CB0EF1000-memory.dmp

Filesize
4KB

Download
memory/4396-236-0x0000013CB0EB0000-0x0000013CB0EB1000-memory.dmp

Filesize
4KB

Download
memory/4396-16-0x0000013CB3B20000-0x0000013CB3B30000-memory.dmp

Filesize
64KB

Download
memory/4716-82-0x00000212795E0000-0x00000212795E2000-memory.dmp

Filesize
8KB

Download
memory/4716-88-0x0000021279810000-0x0000021279812000-memory.dmp

Filesize
8KB

Download
memory/4716-90-0x0000021279830000-0x0000021279832000-memory.dmp

Filesize
8KB

Download
memory/4716-70-0x0000020A668E0000-0x0000020A669E0000-memory.dmp

Filesize
1024KB

Download
memory/4716-64-0x0000021278E30000-0x0000021278E32000-memory.dmp

Filesize
8KB

Download
memory/4716-66-0x0000021278E50000-0x0000021278E52000-memory.dmp

Filesize
8KB

Download
memory/4716-68-0x0000021278E70000-0x0000021278E72000-memory.dmp

Filesize
8KB

Download
memory/4716-86-0x00000212797F0000-0x00000212797F2000-memory.dmp

Filesize
8KB

Download
memory/4716-84-0x00000212797D0000-0x00000212797D2000-memory.dmp

Filesize
8KB

Download
memory/4716-80-0x00000212791F0000-0x00000212791F2000-memory.dmp

Filesize
8KB

Download
memory/4716-98-0x000002127C620000-0x000002127C640000-memory.dmp

Filesize
128KB

Download
memory/4716-132-0x0000021279A80000-0x0000021279A82000-memory.dmp

Filesize
8KB

Download