4162ed7718715c6cb3a8453751c6b5316dba50d25794eef414ed908562840aa5

Analysis

user interaction
yes
max time kernel
192s
max time network
199s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/04/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Iridia/6jjiudbg7f.exe
Size 16.8MB
Sample260416-hadayagy2k
SHA256 4162ed7718715c6cb3a8453751c6b5316dba50d25794eef414ed908562840aa5
MD5 7e9931d96866055243df994ed0225b58
SHA1 f3e4eaf93c6cb6a8968efb2329d973100ed9ecaa
SHA512 2c034f6f413921b07c08a2fd00bf53a09d2d0f3ab21a8a62f98d971cd08ab18a5f4979f2c2ec47b349aac65a5205471378cd0912990a8682579dc0cca91cda69
SSDEEP 393216:6Io1A3bTGtRSJrEwTCzCHEY5XW55Hmwxnk6EtlD:6L1QTa4JowVdW59dJ
TLSH
T1640712D666D913B8D4E34634664B139AB0C0754EC1F9D96F37C62C026A20DFA858FBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	procexp64.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	procexp64.exe

Deletes itself 1 IoCs

pid	Process
3600	6jjiudbg7f.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	procexp64.exe
File opened (read-only)	\??\M:	procexp64.exe
File opened (read-only)	\??\N:	procexp64.exe
File opened (read-only)	\??\P:	procexp64.exe
File opened (read-only)	\??\U:	procexp64.exe
File opened (read-only)	\??\V:	procexp64.exe
File opened (read-only)	\??\A:	procexp64.exe
File opened (read-only)	\??\H:	procexp64.exe
File opened (read-only)	\??\J:	procexp64.exe
File opened (read-only)	\??\T:	procexp64.exe
File opened (read-only)	\??\Y:	procexp64.exe
File opened (read-only)	\??\D:	procexp64.exe
File opened (read-only)	\??\G:	procexp64.exe
File opened (read-only)	\??\K:	procexp64.exe
File opened (read-only)	\??\O:	procexp64.exe
File opened (read-only)	\??\Q:	procexp64.exe
File opened (read-only)	\??\R:	procexp64.exe
File opened (read-only)	\??\W:	procexp64.exe
File opened (read-only)	\??\X:	procexp64.exe
File opened (read-only)	\??\I:	procexp64.exe
File opened (read-only)	\??\L:	procexp64.exe
File opened (read-only)	\??\S:	procexp64.exe
File opened (read-only)	\??\Z:	procexp64.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6872_89627668\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6872_1806220348\_locales\bg\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2964	msedge.exe
4208	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	procexp64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	procexp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207949178582619"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\0\NodeSlot = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\0\0 = 5a00310000000000905c2c34100053657474696e67730000420009000400efbe905c2c34905c4d342e0000002b8502000000070000000000000000000000000000008879dc00530065007400740069006e0067007300000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626041545-1565650712-3224088082-1000\{81E905C1-8F40-4249-9331-EF2E8BF5C224}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\0 = 5400310000000000905c2c34100049726964696100003e0009000400efbe905c2c34905c4d342e00000028850200000007000000000000000000000000000000c51bdb00490072006900640069006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0 = 4e00310000000000905c6b34100054656d7000003a0009000400efbe3e5cc81a905c6b342e00000012060100000002000000000000000000000000000000b363dc00540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626041545-1565650712-3224088082-1000\{74E83DC8-8C81-4CAF-9F14-1943D55C4E19}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\0\0\0\NodeSlot = "5"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\ProcessExplorer.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4784	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3600	6jjiudbg7f.exe
3600	6jjiudbg7f.exe
3600	6jjiudbg7f.exe
3600	6jjiudbg7f.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
3600	6jjiudbg7f.exe
3600	6jjiudbg7f.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4784	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3280	procexp64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3600	6jjiudbg7f.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	5344	taskmgr.exe
Token: SeSystemProfilePrivilege	5344	taskmgr.exe
Token: SeCreateGlobalPrivilege	5344	taskmgr.exe
Token: 33	5344	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5344	taskmgr.exe
Token: SeDebugPrivilege	6060	firefox.exe
Token: SeDebugPrivilege	6060	firefox.exe
Token: SeDebugPrivilege	6060	firefox.exe
Token: SeDebugPrivilege	3280	procexp64.exe
Token: SeBackupPrivilege	3280	procexp64.exe
Token: SeSecurityPrivilege	3280	procexp64.exe
Token: SeLoadDriverPrivilege	3280	procexp64.exe
Token: SeShutdownPrivilege	3280	procexp64.exe
Token: SeCreatePagefilePrivilege	3280	procexp64.exe
Token: SeShutdownPrivilege	3280	procexp64.exe
Token: SeCreatePagefilePrivilege	3280	procexp64.exe
Token: SeDebugPrivilege	3280	procexp64.exe
Token: SeImpersonatePrivilege	3280	procexp64.exe
Token: SeSecurityPrivilege	3280	procexp64.exe
Token: SeDebugPrivilege	3280	procexp64.exe
Token: SeBackupPrivilege	3280	procexp64.exe
Token: SeRestorePrivilege	3280	procexp64.exe
Token: SeDebugPrivilege	3280	procexp64.exe
Token: SeDebugPrivilege	6060	firefox.exe
Token: SeDebugPrivilege	6060	firefox.exe
Token: SeDebugPrivilege	6060	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
6060	firefox.exe
6060	firefox.exe
6060	firefox.exe
6060	firefox.exe
6060	firefox.exe
6060	firefox.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
5344	taskmgr.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe
3280	procexp64.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
6060	firefox.exe
6060	firefox.exe
6060	firefox.exe
6060	firefox.exe
3280	procexp64.exe
3280	procexp64.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 6060	1860	firefox.exe	97
PID 1860 wrote to memory of 6060	1860	firefox.exe	97
PID 6060 wrote to memory of 2236	6060	firefox.exe	98
PID 6060 wrote to memory of 2236	6060	firefox.exe	98
PID 6060 wrote to memory of 2236	6060	firefox.exe	98
PID 6060 wrote to memory of 1864	6060	firefox.exe	99
PID 6060 wrote to memory of 1864	6060	firefox.exe	99
PID 6060 wrote to memory of 1864	6060	firefox.exe	99
PID 6060 wrote to memory of 1864	6060	firefox.exe	99
PID 6060 wrote to memory of 3316	6060	firefox.exe	100
PID 6060 wrote to memory of 3316	6060	firefox.exe	100
PID 6060 wrote to memory of 3316	6060	firefox.exe	100
PID 6060 wrote to memory of 3316	6060	firefox.exe	100
PID 6060 wrote to memory of 6096	6060	firefox.exe	101
PID 6060 wrote to memory of 6096	6060	firefox.exe	101
PID 6060 wrote to memory of 6096	6060	firefox.exe	101
PID 6060 wrote to memory of 3080	6060	firefox.exe	102
PID 6060 wrote to memory of 3080	6060	firefox.exe	102
PID 6060 wrote to memory of 3080	6060	firefox.exe	102
PID 6060 wrote to memory of 3080	6060	firefox.exe	102
PID 6060 wrote to memory of 3048	6060	firefox.exe	103
PID 6060 wrote to memory of 3048	6060	firefox.exe	103
PID 6060 wrote to memory of 3048	6060	firefox.exe	103
PID 6060 wrote to memory of 3048	6060	firefox.exe	103
PID 6060 wrote to memory of 396	6060	firefox.exe	105
PID 6060 wrote to memory of 396	6060	firefox.exe	105
PID 6060 wrote to memory of 396	6060	firefox.exe	105
PID 6060 wrote to memory of 396	6060	firefox.exe	105
PID 6060 wrote to memory of 5112	6060	firefox.exe	106
PID 6060 wrote to memory of 5112	6060	firefox.exe	106
PID 6060 wrote to memory of 5112	6060	firefox.exe	106
PID 6060 wrote to memory of 5112	6060	firefox.exe	106
PID 6060 wrote to memory of 2440	6060	firefox.exe	107
PID 6060 wrote to memory of 2440	6060	firefox.exe	107
PID 6060 wrote to memory of 2440	6060	firefox.exe	107
PID 6060 wrote to memory of 2440	6060	firefox.exe	107
PID 6060 wrote to memory of 5500	6060	firefox.exe	109
PID 6060 wrote to memory of 5500	6060	firefox.exe	109
PID 6060 wrote to memory of 5500	6060	firefox.exe	109
PID 6060 wrote to memory of 5500	6060	firefox.exe	109
PID 6060 wrote to memory of 2260	6060	firefox.exe	110
PID 6060 wrote to memory of 2260	6060	firefox.exe	110
PID 6060 wrote to memory of 2260	6060	firefox.exe	110
PID 6060 wrote to memory of 2260	6060	firefox.exe	110
PID 3600 wrote to memory of 4492	3600	6jjiudbg7f.exe	112
PID 3600 wrote to memory of 4116	3600	6jjiudbg7f.exe	113
PID 4504 wrote to memory of 6084	4504	msedge.exe	121
PID 6084 wrote to memory of 2560	6084	msedge.exe	122
PID 6084 wrote to memory of 2964	6084	msedge.exe	123
PID 6084 wrote to memory of 2436	6084	msedge.exe	124
PID 6084 wrote to memory of 2436	6084	msedge.exe	124
PID 6084 wrote to memory of 2436	6084	msedge.exe	124
PID 6084 wrote to memory of 1676	6084	msedge.exe	126
PID 6084 wrote to memory of 1676	6084	msedge.exe	126
PID 6084 wrote to memory of 5640	6084	msedge.exe	127
PID 6084 wrote to memory of 5640	6084	msedge.exe	127
PID 6084 wrote to memory of 2524	6084	msedge.exe	128
PID 6084 wrote to memory of 5640	6084	msedge.exe	127
PID 6084 wrote to memory of 2524	6084	msedge.exe	128
PID 6084 wrote to memory of 2524	6084	msedge.exe	128
PID 6084 wrote to memory of 6312	6084	msedge.exe	131
PID 6084 wrote to memory of 6312	6084	msedge.exe	131
PID 6084 wrote to memory of 6312	6084	msedge.exe	131
PID 6084 wrote to memory of 6288	6084	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Iridia\6jjiudbg7f.exe
"C:\Users\Admin\AppData\Local\Temp\Iridia\6jjiudbg7f.exe"
1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  C:\Program Files\Google\Chrome\Application\chrome.exe
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  2⤵
  PID:4116

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5344

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27100 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {d25f5d45-2025-4d27-8ccf-d7fe0e5c094a} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27136 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {988c4c11-74c8-4a2b-89db-0b087d8482dc} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27277 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {bc17f0a0-1216-492c-8200-f499d6e61c94} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27277 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {27d0e4a1-5f01-4fe5-886a-58db7c680ac3} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2644 -prefsLen 34776 -prefMapHandle 2648 -prefMapSize 270279 -jsInitHandle 2776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3044 -initialChannelId {0161836a-bef3-4c7b-be68-3eac10ef7b21} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4900 -prefsLen 35013 -prefMapHandle 4936 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {1d8539d9-0b5a-4f35-866c-6d4a6bb75325} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32900 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {71623ed0-ef4c-4ac5-988d-49da816b211f} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32952 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {1671cdda-b062-4f94-bbe2-24d27b34035f} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5616 -initialChannelId {f09d170e-999f-4987-a2ba-884f6c6a8493} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6208 -prefsLen 33071 -prefMapHandle 3220 -prefMapSize 270279 -jsInitHandle 2908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6232 -initialChannelId {a311998b-c875-4347-849e-40fbe87dc678} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 33071 -prefMapHandle 5364 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {a5ef654c-64ff-4320-9b3b-c38d4ee1506d} -parentPid 6060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1252

C:\Users\Admin\Downloads\ProcessExplorer\procexp64.exe
"C:\Users\Admin\Downloads\ProcessExplorer\procexp64.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3280
- C:\Windows\explorer.exe
  explorer /select,C:\Users\Admin\AppData\Local\Temp\Iridia\6jjiudbg7f.exe
  2⤵
  PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.virustotal.com/about/terms-of-service
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch https://www.virustotal.com/about/terms-of-service
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffc0edbc188,0x7ffc0edbc194,0x7ffc0edbc1a0
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,6205395009813033712,15499676418359275636,524288 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1824,i,15051208228231764126,16447853330415293175,262144 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,1614180069814235471,12281915175694631402,524288 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,9027735014621859532,4375278085398006259,2097152 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,6101237858658784009,4376260752909680153,2097152 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4960,i,13876716349531035831,11619275510113924452,2097152 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,4469105970315756599,1179663585471671824,524288 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
    3⤵
    PID:6276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,17151845995109712287,3432222760914343432,524288 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,16089034292337036648,17896752487450611410,524288 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,16089034292337036648,17896752487450611410,524288 --field-trial-handle=2380,i,17540912968501564267,14420339356637302356,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:6440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:6872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7ffc0edbc188,0x7ffc0edbc194,0x7ffc0edbc1a0
      4⤵
      PID:7104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,15961949355738356215,15778058659002479711,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      System Time Discovery
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,16554368062197342366,3668003539243788361,262144 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:6204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,11697213780207496353,13361912498488134030,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
      4⤵
      PID:6548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,14477400363398113072,8402644542816733704,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
      4⤵
      PID:7016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,14477400363398113072,8402644542816733704,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
      4⤵
      PID:6644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,11458201186187757965,1908589246834408012,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
      4⤵
      PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,7271940756629778134,5394893406545214675,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,14703427035620837112,8451279671855694562,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,13409030904341492925,7002897596453367830,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:8
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,17377850788641930715,8248900732323215071,524288 --field-trial-handle=2228,i,7022064455541742245,12543354952796198288,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
      4⤵
      PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4784
- C:\Users\Admin\AppData\Local\Temp\Iridia\6jjiudbg7f.exe
  "C:\Users\Admin\AppData\Local\Temp\Iridia\6jjiudbg7f.exe"
  2⤵
  PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 96f45b5bf3f547d17e5732304dc980fbe456d82f6d2ff767a06a514f19299746
MD5 a3e3f2365b4a9f5e892bdab0cb23f5ff
SHA1 00437210a19ac4044fc5ab8b05fc67fb3d2c3e39
SHA512 61f23f7d3bb28843c3e55b500350240a688ef13fea94a492e7dd1721000f5fbe101214ecb44b96a44e9b73a8654ea1975ab3fa42ab07cca58e408d71a26671fc
TLSH
T17DD0C04C11F07C33C0488A700F417306350ED89BEF4193151833286C0CC300040D25C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a00ba8ef73fdaead5f6fc8fc7453eddc857672cd6cf95c269041d6d428c5cbee
MD5 dea7f3eef1452a228e17c5faf66cc14a
SHA1 2efaf765c09959e18fa808dda7dac1263a42f6d6
SHA512 238f5c239f86b2e0b242c67a3f00372fd8635bdf2247b05d989ca8b973df2a3c1300988cef634d7776e745d9ac4e946a274b28976cf8baa41782625bf768e797
TLSH
T16AD0233475E8F003C33C00334750D151230FC9093F828000F21C804CE8C417A93D1883
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 811237bd865d14ce394485fa34bd6a224b1199657e9feb1272fc7743913cfc4b
MD5 b5e5beeb818d7d812343cf3eeb2b6d45
SHA1 d31f02b3bf0d79177fcf6d250dbd82e2475732ae
SHA512 8fb7f5b398b205b780ce330f95afcbfb00b85d509ec8f6184473a2c2144db954e55a1305fa551f9f576490575e1a11b1f08db1ace88cdebfd2206194effcd4d8
TLSH
T16CD02338759CB103CB18223387C0F1802B4F4C8C7F704142366C840DDCC18B1A2D9A83
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 60db0a9532cdd00a2f00ecaeea2158ae7a763fe11cc7ad6e53d59aeeb1aa700c
MD5 b54615afff228191c8b1bfab933a4237
SHA1 d33c958956ba4d1747d2913e54757cfb2abcaedc
SHA512 fb2eae476ccc98894c4750b6415cc9ef1610b15d24810aceb3a6a57290e3ebf6f3d8e6eef7cbd967cfc48ea3029be99e633e48d32255a40c0ccb003e2563dd47
TLSH
T190D02334759CB203CB04223387C0F1802B4F488D7F704142366C840DFCC08B1A2D9A83
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2701018cd27c4946846a233b2808bfc7993b76fae755e7a22a791e82b176a546
MD5 dbc933955c11aa81b70b640f18e125dc
SHA1 724ef17c28aa600c64cde137098694e56f2fcbaa
SHA512 8ba15a50d96e6f9648bcb90820eb75148f7696d9c2c80d4773f9d62ca1d7f7386ac02d68288dc5670d6f30eb57100831998a442260dbf894b42313ad84257ada
TLSH
T1ECD0C04811F07C33C0448A700F817306361ED49BEF4193151833287C0CC300044D25C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7a568715b4c71fb4935b48003e31859009ae0d2ec79d586a21de8255c6fc47cf
MD5 fda0500306deb5f40b374fba300f9b7d
SHA1 31769c73a4eba4f581019b8949c42ab6f177b7ce
SHA512 098bec0294d74d5baf751e4f0039f0f0149f43d8320c6247bbf4acf46b6cf6aa93773a3e01794ef3cd096614d0303213f285cb7459ccda54c9e753389acdaaa3
TLSH
T1E8E02BAEC861FC7719F90B1CA0514787F79413672A51945F363C810D4FB523B068685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9686f9aec074a8844cfec93a5bd70db74f99143a013ac0de178f928b6a0befc0
MD5 59272bc10f9445ea330ea944fa73b094
SHA1 f77df4eab281a7acf1ca2cfd0164cb4bfa8c5fea
SHA512 b63091d3dd193d819190b7b59f552911a76c16a3fe4d72eb282de68cad62869744748be2564423fc30c6f6854008116be8dfc43f7ca97eb81a00251f6f18a66c
SSDEEP 384:FOakRUlnDVYM/8qU2c3AY+J6RfIth1xrBaKbcOBtW4iH1TWzLs:bdnh8qs3A9YItVtZWh8L
TLSH
T14513C6FCF6CD9C5EEAD6103D5D8B4A342B76C860F5C210170B75B44E026A72A39BE971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 32345a407c74a2ae3e00107f7dd7431557bf563cb415fe70e7ecf19a0a71e4fd
MD5 f7497605d01511ef529e6b23e81757f4
SHA1 e45b89583a15ed33d3317c25681a09937d05a98d
SHA512 a28afd5ff7dbdf0321910fa1b20940a3c3243f2d633b0915402c73edcb0484b26539ac97b66caaaa75fa4dccfa196bacc648fdd807b633f2ea45f64408c8f7ef
SSDEEP 1536:jKkDx88RqDVKk9vJJvCLM2UV8IUxicIZ5UHKMApQZrp5SGRiWn117EGfO+mI5:jghJJvUqVYyA35SG/rcrC
TLSH
T1A5B481F71951E01BCFA802F5E2123A3DD13B011D6CE5E8E9E6780CD92865F21B6BCE64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 a04cb303344ca4222d037686173056c3abb3b73e41f12913346b5ed0a133a212
MD5 e20bb5fd55fa62a33273a6cda17b8000
SHA1 45eb5b5cfca7756738f1cb54b05140314fa3e51a
SHA512 06251d3f9c1181cee2ff61e7a3ef489e9c8d33e4c9b45be1000f4df9c52cdde609c066b0765191a85a4f3cfdc0ac000cfe505326d43364f06641b81617d70b38
SSDEEP 3072:7S5m2T6HKUGWU8F8HoLHXO8+jF+iG4RyrRD6lk2Nz9e0:e5jTMG38iobe8+jF+iG4wRKrt
TLSH
T195258CEE9F342C86DE6A4D70B4E0EC22BCB41193B505E1D34C18C994875A3C667DB6EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 90d010201f48aa18b38444942fe0be433c8c26abb67a0765f5ff616aeb38a8dc
MD5 ef430607f01e21babdfa2c8386f76c6d
SHA1 a66426b53ffc9e28c649b8291ac54a9b1cdd5cef
SHA512 e45919dd1c0cd0d17901916a3ae8b11a0d75d452aa0f6194123e6ecffca16d1788097ec0d0826593706b936b3437b947c2fa5b8bc79d84a282f891225b43a6e1
SSDEEP 49152:l0poG3IfiqUdA7D8aqoLNhrCUkJww9YYpUoxGaE:ooGqAdABlmYuGaE
TLSH
T14F868EEECA785C83CE638A70B5E0EC177C7412C3F995D1D38458C69806A77C1BB9A26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 eee844e1a7db0565d978371603b4a7e54f6c8be2e100c17ff284e144f75020e7
MD5 1c55eba71a667ab5e905725be9298a5f
SHA1 c2074689d6fe64fa8eca132482338a0a3f3d12e9
SHA512 51416b9c6968c5bd50463152369d4075d0ff82d98624c7c8587f2c56aa9d437c5360b95fff7bac60efd50dc066e16eaf4d6e6fd26e4d89017ba1c1bf6f7b17ce
SSDEEP 48:yAGnGO3cv7L7PcAay5CAMalyingMU0TTwu1NQmWRGYhgaA3fk84iexlAmmfk5kaC:8GmcD0Aay5zMa0igtswFu7MiedpkaAEw
TLSH
T188912F9A60D0C4ACEFE002B492D32A9571F44599726BCF8A3FC78C3D6513B636184F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 6fe4d563b0a3a973913c0a595215ff7c6d4f7d3211b6c6ed634e0595a4250b54
MD5 cd9e291b1daff76a53b7ec177c9ec834
SHA1 bdcd292a9b9ce67eb80ffce2da7292a69519602b
SHA512 f9d6b1613f72a390d5064f1d4e1fd8eac6bfe6e90fbf4b153abeaf7e5fc049c53a92631759e7b9d587a02e3de40ab00736e6e6f6c7d44017164d34fa414824c9
TLSH
T162E0C091E7CAC57F54A434CB813C5B08C3C033A2E694AD032B44DCD43702100F341D4A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 e1c178e678b712f742bba481dcbd207e2ca5ddf8eb4696a67dcfc7185b44ae90
MD5 8ed7e32389f5d72ee191f017747a1dfb
SHA1 b1ad6b171b60032b2d933ee6bb283d14981fec8a
SHA512 dc7685ceaa9354e2caf5bd406d516740f40f0fed2448f22850f7a63d10d6262a3b85e70bb58bcaaf732c71eca11b3e8ab05990519ff71f83e6c42ccf4a5065c3
SSDEEP 48:Tyi+7f+UZD4jJ/Bdmf3CzyPtRzWx7CHKWx0CFnNCXCs+eYdv+wpYu:GLnD4jJ/Of3Ckz9qeFMXp+e4+wpd
TLSH
T17EE2C644E632F6AFCFAD1D3EA7C8B2F5C5D8342C95DC1A50137D7AE604A8AE8644D01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 0c81a9839d3570fba974b09e85920f1f37b977752c7a65f8e7a8b9d99836809a
MD5 6a4d48569af7fa9e64d3dd32f5949bdc
SHA1 1a27ec8411e4f6521560623c22e3c03114aa60bd
SHA512 359271cc2c4ec6495bfe8e3709c6f05b9dd4c79ec2b4ee517a719f218fd79ae30bc05609f94b226f6ca94845ac4e141d44a2e83a0bb9ba0026d1510343a6b891
TLSH
T196E026040AC8CA7ED1D879A3C66D630CC3D0378AB2BC3D02279C9C887202341B3CE6C0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 fcdbea17bcd0f7a6cae9c25592a1654c0363cff2cfa6aed9c018036c1e3f3b7b
MD5 7d9bec48410c4e05ea429f7df4fec785
SHA1 990af5c01d055f96a023806fb1a51e4e44e23b9f
SHA512 0cadd07b2bf2e131fb86461385d35615dd8ce192b46a0e925d4ff9d80df335a5b08cd8d334c98814249a0820a5afe72b9df07dfd749f0e2c1c8c800cc7dab5f7
SSDEEP 48:uzBmw6QU1PzfBun7/gDCnG1OrsVhGm/5TPMRqSk2nCVRBC/emT8qLl:6BCxfBu9UOrs5hkaRBVmt
TLSH
T16C92F7534E78B023E7104DB63B9BE032DE37020E9FABAC8476A684301EF995AD03504A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 2108a7eaf855da5dc0992084a525d7477d7945c716aa928cfc81fb1694b74263
MD5 97832552be135154c19802ecd81e30ca
SHA1 a127f6d57633af7abd3bdb141432004ed7ed4fa4
SHA512 794e04f28db5299d0b9b9ec1b39d1720a1fecc9c33fec488e41264c12af3eaa6a4169225df6b1fee99feb736e324ab439985e4135613d6e5b9eaef6397c07abd
SSDEEP 96:7aMioIU+bGz83uy3+u4tgp4DLjGQLBze9z3NxjBHMsDEuspU0wbtqrOQpPfR4J+X:WSf+G83uy3Ct7XBBKlH7DXspU3i3
TLSH
T16914411F5B602721CD7D917629E744B35D6DF03FCB5366CA68B104B0CEE2B52A02C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_cloud.google.com_0.indexeddb.leveldb\000003.log
Size 3KB
SHA256 6ee78f63cce19e701c5169842867897564c2dee1ed3df4f4671f14ffc7361262
MD5 c2cd5188441e17e5b98a8a67a897578e
SHA1 199687e7e0b586c585f2bd6f2beb4c984bd8ff38
SHA512 42657c75d6e3feb02db8309c06d019f9d05d165870889f8e7492f9a347ef40cd953c8dbc09d74380dd9e442e68da53aa4ff6232cba9647f861c728e7c57c97d2
TLSH
T13181852B77C06D5EFA2A07710D361BDC5637BDC17E4AA40DF5D1B6ADC6739400E20A61
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_cloud.google.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_cloud.google.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 774c39e43315de4e9fade833bd86d4537d88bc68a7b15973fde68a287bf1beea
MD5 56279723ac583cbbf5f1f0fc91fe4402
SHA1 e06ea9431fcf6d4697b84f75969b6fcbaf211d7c
SHA512 97c20c9b1f5cfad27540d9a8bbfece6ee276cb75da226df52e10c3b64f10623eff6b387b03b0ced6f4cae24dd8bf1fac7e903740926ac96caa6f622ce06330cf
TLSH
T129E0682989C8C36B621452A284397B0ECDA3634AA68CBD818F81DE247582044A06E5D1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_cloud.google.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 474B
SHA256 0babd1df459664e82d670fbb8c3d62e94f02b3f93c7e7636386bf81095177dbb
MD5 e1b1af405492a60ff609fc66bfd9a1b2
SHA1 035447b52fab25f4f0f4eece3f1413d8fc738edc
SHA512 3f047a5b7d4c512885ea30d5346d37daeb67f99032b36c89f222cb40d51139eb04f11aab152650e845a8178f03abbfbe4d55475cd5740467b10515eca7f0aa3a
TLSH
T1AAF065F33A15EAC3E2824CB461402BDCBF37B22595D9E2D5D647D5664D82CE101859F2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 082008b61b68e9f543f064f88502cdda904308c75d45e7cd40f52965da3d9719
MD5 c1f6147c5c3094a5b59946c19a57b597
SHA1 d373b5ac2848122e3bfd19627fb4dbd13d6e40f9
SHA512 e9b63e6b4cfb0f534efd293e996e119809792f7b66279697fb7997a88e9b06a343be99acd34b4ba2f4c950dbaad811fa097eef8c5860ed6316aee56b0c6f7b28
TLSH
T1F8E0206057DDC17F51482597C31DA74CC3B03796F689BF036B44FD45B145104B7919C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 c4ab2004708641d9e889e31caf7841ab8f3abac61503ec93775e79184b4ea144
MD5 85523b3db6d5ddac7df4e9bb08cc8e99
SHA1 62bd0a639accbe778f31d51a5e3f7e04e90afed1
SHA512 7f2bcba6fe5ec50fc397076dcb6022dbdb3107fa2bed1b0f4c171424c8c933c7997b084d11c640f440f890d7586a8ee3678473259f9a23b39ed04c2de8e13913
SSDEEP 48:TNLopFMatSaw/auUOt84c1Lvqhj8VlKl3dkXzhjCgoKcQroAwsqTC4tcCF9O6wla:deMatUaAgpShj8j3zkOxqTsCF9JAZle
TLSH
T1BB92969F2F215361D1538B33D9E489262E3D011D8327A6D8D93560B3DCE2642B5036F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 23c89302284038032b4c8c8ca2e3f69e35a64c2ce86695248d0474180f269a84
MD5 b152d099febcc91bc6825d987f56addf
SHA1 bc548db9897b15ce353180fd6e7e1abf1d0758b5
SHA512 20601ebf35c936a5b57df5e27502cceb2de18c32921a516e29b768cae5cdc5cc5cacdfe8e131a45e6b93e313ef6989bb76b2ecdd89d322ddc3b9d710670ac866
SSDEEP 192:D1DZNYPp/2xib3aT6hzcbuc0qRIlXt3XGkj6dMB:D1DZNYPp/2xib3aT6hzcbuc0qRIlXt3b
TLSH
T1EEE18DF7C3D8851DC85256F4AB15AF1FCE2A0518432C3C6688E8EF5BD3E2471E22565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 834e773d4462973ce5b4a17bc0553b7d5453cf0a52fc6af530bca37d781adbd5
MD5 aad00804a2e686e8dcc2aac58dcfe17b
SHA1 a58e7c3e74bb5ad77b11a1b8ca267b1dce3aad5a
SHA512 51c8be52dbb659795d1c4a2a9c5ff744148e39d1570f8dfad3d942c96c3c4dddf75b5781b2656bf6844be0b01fd119c6793a72c17dd8834b89b59e043ffb215d
TLSH
T16F116F67C17EFC5B506C0D371E44BC092677B436A292B8E4CB7AC07E25C24F31B29425
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 be06d59bf5b67b6fba55ae269987a432d42592c3693874fe73790c5e7efa007c
MD5 4327c0ede59be302a1b7fe03e3e874e1
SHA1 df5d164ca84f6b36c7cdbf0f53588464abd235d8
SHA512 8c4315d33d0092d3597dce290cf18b3fef4f4af58314d564d30fa95a8d3eba609812ad4920287986181e5b7fbde96f45f6df308c44be16feaad60cfb282a1859
SSDEEP 384:sxZFSqC/fKsSWvK1TsBSIqc+rHbTj/ROSrnZY:sdTC/fEYK1TH5HbfROSrC
TLSH
T12482F91669389D7B8CD7D219FA85BB63D7F90563E5905E449AFC8A0C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e9b4c7168ed28fedf449bde4cea2dfb3ddba8d271211c1543c94a614e8ae9547
MD5 1ca468e848596655cfe38170f973c9f8
SHA1 68b75609cbade50ad83825429cb389dcc4fa2d28
SHA512 1a9ad1049327c42115a2b4f056268f27d607a7d28d98ebd8073306210443c9ea7709867dac56d8ce9064e12805f03a15b4af5c731b4124563730565eb1a3adb0
SSDEEP 768:/E0HmkK7pLuL/+SWv+2p28F1+UoAYDCx9Tuqh0VfUC9xbog/OVUSMuNLlpvGl0ry:/E0HmkiE/+SWv+2p2u1jabSMuNLfOlfF
TLSH
T106F2FB3B680CCB7F4F844E9CED2A7E8A6DE8028F96D8895447FA440C03C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c02d92c21a1041fdacc219d920cfe5fb2eb28a9f\90b176a3-35f1-4086-8e5f-ee227b9bd798\index-dir\the-real-index
Size 1KB
SHA256 282e8fc6c4bf9690fa8aff9bafb4e82b7b0e5f2f149ecb01bad6749bd75bca57
MD5 56aff313fa8d0bf173d4ec70840d4ff4
SHA1 d757492b33d0264dcc7f9eeaff77f3b231596efa
SHA512 1d48d1996e135a95957d256dae6a5077f4aa9440e649f835f7fc98695470a440d31e18368118c9bf58af34d338dc95f77b72138c1efb566474fac44a088671b9
TLSH
T1D9215255E016CA3EFDB048B1A4E209F2373C7600BA4A212E900EE1427F8B74C27982E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e9ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c02d92c21a1041fdacc219d920cfe5fb2eb28a9f\90b176a3-35f1-4086-8e5f-ee227b9bd798\index-dir\the-real-index~RFe59e9ca.TMP
Size 48B
SHA256 0c204393eb937100a2c2120740ac4909994aeb41c9c022d9e77c2437a5d0e7c6
MD5 806a691006c9fe29882f7aa5738547ef
SHA1 a04f0b90060009c1147476909ecc98c8e751e883
SHA512 fc19fde3edb7b3e828d1376dbbb04faf5ca4649c838663ab838e7ddf771b77f1a34cd7d9ba295f71181f462a9d545f18333b45e062e5dd83805dcc84768824dd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c02d92c21a1041fdacc219d920cfe5fb2eb28a9f\index.txt
Size 187B
SHA256 9048c3f8ac2810456e7f9304cb435a313015d9853fdf9acadd4ad20672baef4c
MD5 4488ad1a0609e99e2da1da773c0abeec
SHA1 9c4e234c2de8b11d2fe6d5ac9c6961f68bda0061
SHA512 826908ab7460362551c4d281126a746d3665064ab4edf651ff14b5e0bb9a0b9ecdab9103062a546d51f7b8cc1793054b74007b0941e488d5c3db1c54f94938ec
TLSH
T151C022A738C043A03870D280B100290E8AB211858D49BAC929D2A1732C4246B201AEA1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59e9ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c02d92c21a1041fdacc219d920cfe5fb2eb28a9f\index.txt~RFe59e9ca.TMP
Size 187B
SHA256 42bb9adefc2affb74d001eaae1810fba2ea7bfb64f235b7cb2ca3ccd5aa11b2e
MD5 ea65d9ff4444eae2c3b58b270831cf8a
SHA1 219213d3eb9a7bb9fcbb0f197b0d804982f73276
SHA512 ed42f0830aced79520dcb40a4323707c2571723098935bdb400362b18841d29ab60915827fbe8a8e872e3eb6e56afb3e417412061639c877d33fdc5188082aa4
TLSH
T141C0C0F738C043903970D182F100150E8A731FC48C49FAC92DD2B0733C704676006DE1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 1KB
SHA256 e3fa3fe82370e18ab31bfd7f99f22d8394f7fca7dfde52abcd2a23f1f1ba7a72
MD5 2ee551e8304d25cdf14950624a5ccc08
SHA1 542c034e1bf97c5c08142b50fe5e140d9d6679d8
SHA512 ed596d38f069d1ef3243319217413282dbdc1090f2c9fe54de187f84b5a446d5f6f114f15bbc4be789231cd56368c60ce85c7b27339a0981da2b407dac990fd0
TLSH
T18B2166DB1E004393F94584F3B466335C5EF2C20C4FEDE2D7EA5750A61ED9AAA25119D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 08386bea1dcdf56e9b63bf9a9176146b37a9c881490fd5eb54ee3398e4ef39a0
MD5 dcd9cab7e2956b2ed66991ca297c379a
SHA1 43177af6ca62eea149c12a98d7cc2ce3bd21dfc2
SHA512 b521867aaf417df291bff0820e4f5ab75aad8045fef81bfc9dffebf9efbe4c0859bb520e3be6702e53faf15c9372858b0362b42fbe60221ed45b2ea6feda9ea8
TLSH
T126E026145BCAD1BF60A9236386298348C3F4B647E2C8BD02BFC9DE847242604B3D2580
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0b66d864bd8573089f675fc7234213de216e32883fb5f06d2d98712bba7841c1
MD5 16a9ccf94d5fb9434f90c372aadbb817
SHA1 a6980e28f81207251a3c4897fcfa0214ff72033f
SHA512 70cd20536a7643b0f3e9f933477ae9e834c7730f96d3ba59004ec2e316dde6f51b01c71b935d92ba2e2f4220de1a9ab0e82f2b3aaca93f8080973361071361f8
TLSH
T12BA00453DF744054C4D03171F4015FD45F004C305140171540F440F4CCDC153411F005
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e9ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e9ba.TMP
Size 48B
SHA256 4ebd0db62a741440950b9dde928444948f1f74c5bc18e03424b95eab14d330d3
MD5 21ef6ea22991bde2a94d1e05a427dac8
SHA1 91e72d42c7a72ec94f290b8302e2426464358e29
SHA512 e0f89ba58b71ad6bd47fd6aff8f48bd2df9269638c1a0ce8a26977fa71676b4160e961083b27e3c272e8c651bf7f36148b147809b29d6a79426b1fe5a09d4a08
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 e4457a133965892c444eab874088338067ef2931e25ef27e220cf9732c424b1e
MD5 0613499a47620dcb6cb34bf7ac5f9bbb
SHA1 52cae7f7aeb33a368dafc7ae46763f5907c9e830
SHA512 ef89740db13fd55318f88ad9472beec65d30ddad1c3655dcb44a6902a56502b1274580f46d11da06a600af37bbfcf8c1b6dbdd16c6b4d19f17de3c934d895108
TLSH
T15DB0128CBB20A632DCDE44361280C7C8D620F10200454C17CC895F305E0D3F87F01C84
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 3f1f28334c05454de86589a469e5f46fe012892f2fdaf45138f388e92dd0859f
MD5 4e4a88a4f95936c72b5536306b85c3fa
SHA1 9d6731389d46ea8fa3007b40a262b3271fc4c7f3
SHA512 420777d640885309a019d7da936bc714bdac5b935a32d01b68824e6c695f73ae9661c5fd3685b131123bb6c80615092e7b5079d54d4519cc5b861be10fbbc399
TLSH
T1D6E0D1201FC9C67B51DD31574215E34CC3B17641E5E95D117B58A98873052407397580
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 a9f7742342b5fe4f5ee40a5e2b6532631a2018a509a5f8b55c29ef928d4dd8f6
MD5 4d4d3c797ab0d43712306d72ff66ce9c
SHA1 4998eae6e37927ad9a484d4788406f68e54d21af
SHA512 3a9f1c03a0de8bd256e3886ac9c927f9c6c87698643bda8f4cf3280c4445675ffef6ad9d94816326d66d0e1a3b0f27d338491f742b6d62cca541b2931a8d3cc4
TLSH
T173E026704FC8C67B5158629382BF9B4DC2F1BA46A3E83A03B75C5C44B201200B3F6980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b7bd17be5c2c9b4ca54773f54b2ffe882c6a91e84588be2b47ad947e1ee8a761
MD5 7bfc736aa8b0b4291038d00b376b54d4
SHA1 1ec314656a3c54e989e70ce873a983edf7569236
SHA512 9f291228b1e937f5a30d1054ee4d43ff510436a54d9a4d66b2062b062d954b0cbde1243dd129e9d258c893f8532ac078bfcb2dc8d0e806b1296d19dc01320075
SSDEEP 384:chg7IZUdoEOKm7K3w8QBIGLkEXOwnAFCffT3Z+1UBVbDDeT6l11LLXq91SHFJo1Q:chg7IZUdoEOKm7K3w8QBIGLkEXOwnAFW
TLSH
T1B0B21851713706803A7EA9CA85A5F82E46C730733028A53B7BB904A61F67E21DDFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 bfc2330f63aa40f4bab5c3a2ff58d5b413300786992d9511ca125e121c5100c7
MD5 1f81ab3dae9fe5fbbe1ecee9b953a139
SHA1 752c255f30a0272378b5810f24a80f3026abca8a
SHA512 f49b09f92ae9eea12943d745653bd2d17dcf9485e4aec09099326cfc3b217d17d96a1017fc12b1480cfc8cc91005091f4ef873726386a3c949c11607f57c539e
SSDEEP 768:chg7IZUdoEOKm7K3w8QBIGLkEXOwnAFCffT3Z+1UBVbDDeT6l11LLXq91SHFJo1A:chg7IZUdoEOKm7K3w8QBIGLkEXOwnAFK
TLSH
T1F2C22511713B16813A7E69CA81A5B86E46C330733029E53B7BB904A61F67E11EDFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 651dfd1c019c4a4269442bded1d1ac3a92d43ae01cd1d7c9152434d88d692d3d
MD5 68b1192192678890305614d40cc5a071
SHA1 86077d9651bb5cec6d10ccd484bd4b3ea8c53907
SHA512 194daacd51c49d2af773697dabb5fe45b88745926ea27d89f690f51f14997b468cc5f51b45e3c5326ceb5d78222cd20be92f9c46c6aa0ed2e9e54f570ce1d3e7
SSDEEP 192:P+xWtjA1fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx2SfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524740A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 bc46fbf1f895473bd0aad54ac8cd0d212af6b9dda48c6ed4e1db501215b5285e
MD5 4a383f1cc398b43b380519e0f8391acd
SHA1 c7d2d2e13bf7610aea23cba4003ab04bb8475b64
SHA512 026aac95e9ac5fcd5f8f0c20a64357ce3bd627867559cfa24e42197e800f34272d94d84614735b3c14827f095f27fa1f50a97bd38253b70661bbcc231dc23e04
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgFvcKrOjGt:DEK3tjkSI5IUltGhp22iSBgyFW
TLSH
T1CE52DD9BFA742312DDE583319AC102E17E7A513D8FC2E70355D620111FF5A51931A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 10c6dee87f4d24f30b544b387d97229875e2dc6b3cf8b3bae756df9a3474ea70
MD5 463b1cfafc0bceb654f3d4b7030aaab0
SHA1 0890c73d5fffa31c997a2b57a5d5e0521ff8110f
SHA512 3108151ec5b1a375bba00b81b9c66bce6cdf11bdc048f5f62d2698775e05482ac99ab9568c9b5213b174b88205df4dcda69a47954b87e69652cec87078225a49
SSDEEP 192:E+KOLFAs6lrw5Q2syMHdUlrVQTIII6bqMIM4RYcYK:EwL2swz2sbiVQTIII6bqMIMmBf
TLSH
T1F352831A2A451F33C25F5FBF126AC6961FD688818572222D3521185F9DF3B938BC93F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 a081191c2af399a85d0e67df6d9930f780a23e1bc9a83533874ea54971083e09
MD5 9e8caf723195fbb4726943c1e7777564
SHA1 02ac6c56e2b36f5d24756abd2080a106f9cdd111
SHA512 b3287d447cc0548b136d1a00556478e09fc136a5a2a0e29caa8a421e3f644a2494ea1fdec301d2c236b5c485cfa063f252d6025a2cd9b86e4d107c1e00a3d9bd
TLSH
T1FEE02654ABC8C9BFA1A832D7552D430DD3803B43FB9839062F54C84CB202204B38A582
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 dd5a9034d6eab384ab6972d2b352f12dd87a3d920f376b68877c4337b28b80bc
MD5 9d51bc7197c03314ad3ecf950a7d2145
SHA1 2f49c3a9c3835e13085b2ab82ac3cf002ce802c7
SHA512 b322a5a3605f5c11bab1a30b4964ae5f6313cf081774e983df0437a441f918867ba6b2c61b98ca0652d9a1fb8444a5171965085a4776cd83d759fbb34e8313a8
TLSH
T18021C456F321C018E14A823E906B97351338E8429FBCED0F547920352EB5B150F8B6F5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 6b0a95c429974e95623c200dd6e64627e46cf06a22b02503f24a937ae2dbbbc5
MD5 4e9efe81278934b65ba06702928e95e4
SHA1 b1497aaa4f26d87a4ef0143ad9a418b9ff171979
SHA512 a6c993ce008a225d13cda9ea16586345c7653cc6ffd5e8c4e931469694d5f7c1410a071eaa129f3b0d14eb1a4edb0e1e4c3f1d8685f562b0d4bdbab38cab8dc4
TLSH
T16CE0201066C5C5FF509422D38D698348C3D13E43FA942E012F41CD48720224573CF541
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 bc7802e6a059c6388e0eb2b13094829eba4222458bef49fec9f9208c64b6d4de
MD5 138a2c34e8ab40b62214f78701028b9a
SHA1 c3e3bb39fb90b3b5765da6b9fe9f936c1121f6c5
SHA512 fee9e933ac9c1a1ca28238ad09595c4341a68aa6d253ea98b3d387140076f38b6e9f340402af1993b68457540518bd7719b49b0f108f173c033969ca793d0121
SSDEEP 3:MsEllllkEthXllkl2zEflsa/l:/M/xT02zNa
TLSH
T1684404447FCC0C45C5443030C473C3501370D4100557574334D5043F5CC75551C1C010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cdca1513e7141f19acceec0381eeca5b05c64c257af50ab5ba10943f465b80a1
MD5 f8a3d86a2c3f80c289673fa3ea37b800
SHA1 4c88b4623c9d0c58969c680e84c86230214d9c03
SHA512 41b41f7764b691c7c103dcc0c284872d7411c4eb7c7d9556615de278d48d94367b5e9b86be30ec30862627f307b4d72496cae5029908e997f00465942c06fafe
SSDEEP 384:ncfiFavqMg3sNJ8TUNTUlImkrIJW2cZrf7YcUjbUPt1oOt/QldnS4mtm5POrNlkE:jFayv3Kwg+r0YcuQPk+YldS4smVmN
TLSH
T125C23B75EC98DAABEDE78FC9AB497A07EEE00197D58C49D8DAC81D0D00D719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 c7032feed4eaf24e99881eecb0326c7dc3980890c72d2a9f6b8096f33c8dd1b1
MD5 0390a7c1021b7879a972b85789c59903
SHA1 348d85548ec3403704a1eda15780808a15d9f8c7
SHA512 431eff10b6e2b4670dc5c32178d2ddff04f8c6598cdf048e2fca64cb164427737930513ca8d0b85238736d487f231b608919faee8d8ab4b0a83190ab8aeb918b
SSDEEP 768:YFQccQTBwg3r9YcuQPks1I2Q9uAV9abW6Cp:1ccQTz8GLk3VwWxp
TLSH
T187D25C39DC94CD7F98EAAB84B74E7617ADE001B3D5AC4998EBC84F0C00971DD670B85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 252e222a51e57658e475cb0f5772f63075d111746da8f6270ba8a592c89537ba
MD5 712a345d6a9d294a7d5dc001e87c81f1
SHA1 8e1c192077fbd61c7d55f591a9994d7114fbde3d
SHA512 a6f14afad41e47958b8b930906562d2ac5bee5b1bba87e78d0e87e73bf155868d7b1dc9f34d22ce8aafecceaa88a7e32a153bfefc0516f5311cd71f51b0335f9
SSDEEP 768:eFQccQTMwg3Z9YcuQPkhjvlew2rW4uffvXabW6tD8:fccQTu8hjdejr8fvyWy8
TLSH
T1EAF227399C94CD7F98EEBB88674E2A17A9E00177D5B84998E7C80F0C807359CF70B965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 804bd0613637a3cdb8aab73415da371a48f527be15714c19decbbb8df6fe20d9
MD5 77c8d8fe9a23c2a79d9bc77d81577ad0
SHA1 eeaac4b89888a52a87d98741ac1f25af6fdb93ce
SHA512 17fda09b4aa74e619eb637e9ea7303a7188a36b321f722363554db6452fbf9b4bb5459d375548976c05cb10de33c2ef3345a89b04e3ad59df0e98955e6d3c218
SSDEEP 384:nrfiFWjccCs+Bt0S3zsNm8TUNTUlI4kOIJpvDZrf7YcUjbUPt1oOwMqVlX5PqYXb:2FQccQTBwg3r9YcuQPkhjJPqYXabW6Cp
TLSH
T13EC25C32D8A8DD7BADE78BC5B74A7647EEF001A3998C5AD8D9D84E0C00871DD170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 358785233e669c7a8c59c01ab14b962f6e17118e2409241ff0c1c3d6c6657575
MD5 0d1f6652c5f00cd36ff6acc590ef3da3
SHA1 d220d31a83216f5093075bf7c1cbc2d5695a2c64
SHA512 7d1747890ee3894de8a1ca975d8d213a09a813e80858fd84be45d105174342fe51fcfae0f8b94997605c3b32a439b58c912218fc4efa810b519746358011ed4d
SSDEEP 384:njfiFavqMg3sN38TUNTUlImkrIJ7gwZrf7YcUjbUPt1oOwMqVlnZdnS4mtm5POrF:OFayv3cwg+W4YcuQPkhjnZdS4smVmN
TLSH
T1E7C25C71EC98CAABADD78FC5AB497A07EEE04157D98C4AD4DACC1D0D00DB1AE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9eca873c4caf5365c35f6a73ce907c7cd5d87eebae8a3291b21b18cd5e02de76
MD5 3356eb1b1b65c5c39398dce2332592f8
SHA1 6ba4522a91224fa72f827180d369c98a16d215af
SHA512 e19cea6413965003bdd59fccb2ade8e55a3f2e4f228a924f3ba78d3d33aa63a856ad9da941929bc30d301be1697a5ac508c765ca93e3b2f6cb314856047b854c
SSDEEP 384:nTfiFJjccCs+Bt0S3B3sNL8TUNTUlI4kOIJ7FDZrf7YcUjbUPt1oOwMqVlvZXU/2:eFJccQh3Mwg3X9YcuQPkhjvZXabW6tD8
TLSH
T1F7C24C32D8A4DDAFADE68FD5B74A3607EEE041A7968C5AD8D5CC1E0D00CB1ED530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e0b935fa7b53bcc337a6e6d665e00e398e909afbeeafec8518ffbe74e336430c
MD5 22ff8db94ea7dd382e8b45bda98c7c55
SHA1 9f93ec60dfd318a0f1b008ab82a5cb76313561d9
SHA512 a503a699b60fbd7fafac2b25cf8823d9eaa965950b17349943c374b85ba6b1ca205356d9abe18287f36bcce1018c7480edfece1b03f7706462852165b9e4581b
SSDEEP 768:eFQccQh3Mwg3U9YcuQPkhjvlew2rW4uffvXabW6tD8:fccQh3X8hjdejr8fvyWy8
TLSH
T17BF227399C94CD7F98EEBB88674E2A17A9E00177D5B84998E7C80F0C807359CF70B965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 6988df6352eb355c4984c285059b7c59ba4019087d3b1c498dbecace465e7bcf
MD5 a264cb62666581563730a07d491be7d5
SHA1 877802eaa527e63ad8894db847274322d6b34c37
SHA512 aa58f286a65a5c163c23bf0672fa1600144e4738ac157184f6eecb4d4427e3eb2d507ecebaaed059cb3c5da9ca48594bd8d6970c9ae07bad15b8ec4a29c2c8da
SSDEEP 3:MsEllllkEthXllkl2zEfloMal:/M/xT02zZ
TLSH
T1294402046F845C06C54021304452835013B0D4100612578765D1187A5CC79451D04024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7a7adb7bcdbf4964468cfb7acd00c70193c4fa5566740a272d7c7adb440e5c86
MD5 b9c3922bd04c3b0433570c75a72f155d
SHA1 b52f1316a727efe11c7ed20558b5a15878c5b0a7
SHA512 b316d9d3481a54068a3d9b2616cd5b859a8a605557cae0bac827bc00d0b07e3110f2dde86e612846f4a5627e40fac5bf75e2deb547e87e752115dfa2d34a7aa8
TLSH
T16E411758A6F90148B3B77E5A9FF7A86D887ABD372E06D45D00110E4F0A76A00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 0c95923b033c679373eb00979d822027e13abcaf23068ee0fe0f3c7ca7d86666
MD5 cfe8922649438bbfd96b3edde5dff5bb
SHA1 85abafe9ab05836efd646e7faae5816cc88956d8
SHA512 36abf69ee79ee209dc205fed9b05baff5cb6d7662d7b4bb7e621ce1971c6efc1aa34f48efc7d0811e009376c8adac8420403d3957f1912cb87d3e33497b9805b
TLSH
T1B5514B687AF9105873B36F5A6FF674AE587FB9373A0A949E10110E4F4A23A01CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\cache2\entries\BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1
Size 21KB
SHA256 c9480d7ccd239342f2d71415854942bb1942c06d1164eff3b0ae99bdb930d160
MD5 bd7fe59ee835be22ed7a68be9b4e9b8d
SHA1 f878fc0bbca075868e763dfb4b0528eca4dd3efd
SHA512 ab99918eba9cf57ba20b459d5982b460e96b8ffc071cf22a70814a37ba4566a326dad77c36cf43048c23d4c1f160f4266b2ad80ad6f662e2da462b824bd6030e
SSDEEP 384:kjbMegNp7L7KCopFDUtCZvjU73zqFiubcBt5V3CBt5VjaaYSuVplhcP+AWRMABeb:kjUp37K7D4CZvja3+FUBt5V3CBt5Vja6
TLSH
T1BAA2BF7F2C26049CDDA314F258B83086A92DF5B31FB89A1E9B0D284480887F896F5CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 33e3d96530a83cd3a7035bc037bccc7a1a5de01b42675c3629c64d15de96b909
MD5 8ad4aef898c82df5e9cf221732c56b03
SHA1 8cf42d187b5d1983b348b0e8294ebfe88c0e4db3
SHA512 7f7038b5a4779b81581c084cea6dbd528f35fd83264b3bdce22ddc1a48a0a55049893dee5f71b48e95e61ce750eff212472ff29609c370d351efd1f96774f6a1
SSDEEP 384:HbaFrLiO024YMFuhw+5EL1pPsac4j0lpDII+lahaU:7aAZYMFuK+5EB9sac4ID8L4UU
TLSH
T129528E7E9F0238BA0A67D2D4D9AD5214CE04D6BBEEE3E16606143844C6847BCB4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2dc0ef5-bd5f-47de-a8dd-9c0924840c7b.tmp

Path C:\Users\Admin\AppData\Local\Temp\e2dc0ef5-bd5f-47de-a8dd-9c0924840c7b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\AlternateServices.bin
Size 10KB
SHA256 868438f675eaac75b8eaad9bd4a8ae7a21548d12ea8cc1e1a9c7a6f24f2044c1
MD5 cea9cb743738606441f59426aa8e6ed1
SHA1 d978de099cfd5faab68a6a5456a1bcc802b9cba7
SHA512 486d509f68f01fb9132104f445bc530e8521352371483ea2825d8d5c82671b85e3e2e9fa66cacdb3081fd242163fcdc8b8b34448470d882e2748416841e6b27b
SSDEEP 24:huhMZN91cf1u9xCW9BWm9Vv4m9lQ2i5q9F55A5TTk29Bbh:7c0wMMcB4cyvI56TTj9h
TLSH
T1FE2267E76B726466F0A78FF08058718CCC33132559AC91C4C72490F306C6AE9943FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\AlternateServices.bin
Size 13KB
SHA256 632a8159d13dd54da3809e71d9ebed6baf518bc42b4d9c52c79e0b20c691cb4a
MD5 6d7b8fd41f5eb940b852ebdc8cb415b3
SHA1 8bb6e41e831518e6ab727538be42b3a9e3fa4c74
SHA512 e2df57ee5ce65e8510524fd92686dae3327e437a084e1df622ce22900d5f1aa225aa60e37e246303156a27ea2969e2ce8d21175eb932635a558d9ea240c2b44d
SSDEEP 48:R2uWyaaB+OYv5I56ZTj9hQM/pVJio2ius4F:R2uWyaaB+OYv5I56ZTjbQM/pVJilih4
TLSH
T1435213F76B72646AF0A38FB08459709CDC33033659ACA184CB64D0F706D6BA5913FB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\cert9.db
Size 224KB
SHA256 afcfec46c88fb6de327f3037c6222f38da653a47926141c8be5e94cca4605d87
MD5 da0852804a3cff57ec3773390158ad93
SHA1 2c92d61154431c8e3311fc843e2d680838b302eb
SHA512 80cea12b9e7d915da77ada2fb2917afba35545a4d1196d212a1ffe3d5308bda9ba72fb75e8872afb90518887cfa4e706f7e7e2c6fc3167ae4c79a9cd32a00504
SSDEEP 192:zOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vgNHaRPNnKoP70I+:K1zkVmvQhyn+Zoz67PcPVPQ7
TLSH
T13E2421C3F820745ADF8A6D31B662DCF23D7627410385A422CE289D3F1D64A1F67A68DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\cookies.sqlite
Size 512KB
SHA256 01069c29f2779bb95e0c069fdbe7755c6892b08c081e922b0711ac5c36639cd9
MD5 1d2c9be7bea3aa8bfdba400c577c2957
SHA1 70ead9657963a0646c27ce2106abf14c5d211441
SHA512 37cb63595649569b06f75af5a84cf6c1db9318e3bc95064bb24674ffe401a429d3bb87f35cf221a4ab37b1e5d0f3a9fafaa39b3701dc9db8488660bf4b49b25d
SSDEEP 96:DQnSa332LqJbJac6x8qoTyF84e0T1joDlw62E0wocH8PyJxoWWXfe7Yg5d:8Sa3WqJSo3HDWTcH8nW
TLSH
T1EDB4B6E7BDB81282DE921B36D920E518293DB32641D2C9CD3C9D51360D977CBA9330F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 481e8de28c896b37789034d30519ba75f97ba1df3d6cd4bb10081db46f8dbbf7
MD5 60098f8e4be6d14985120c564de3322c
SHA1 14c16487eea526f831a3d51712b240e58b4174b5
SHA512 bb49ba15ba8898119d53ba4a72312c2886c9c0772df4fa63d4a9bf80ab0c5ec74bf2ec7b557a40ecaee2138a5349c9bf7436b97cefc38b19262adb0c0228c4f4
SSDEEP 192:6S1d66Joz1zgCl6mc0dRXOv5zbo5Zv7yj7V6mQ:Ld66Joz1zgC1jjobo5Zv7yj74z
TLSH
T146E11D64E6288A3FC415427BCCA22B410F39399ADC4E3F1A35ED21492C572DD3A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8a1cf53a57d5439249d5fa7f046d4fbcbd13bb6a49e0a89bb5c83a7f0ac38168
MD5 57931e995a5935b8cac9d269a621493b
SHA1 f0d089961a3b54ac773262bb2f40e974c1d8f37b
SHA512 5067c610b0f1fff44c175e0677b7b86f9480e8497d44b0ae5f0f533abfd5f4098836ea0936098955616da680769394bd46ff92acabab0a48e44671604428f017
TLSH
T1D5216A8C3ABA4D2E7CC7E29C7841038E53658A1A04871C430F22DF8CCD99ED9326E83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\events\events
Size 4KB
SHA256 7d759885a6ec44029e373b6eccab40f397f2553a25af6f0eb4dfbee14fbbe458
MD5 3861255593a18f86bee71e891b531cc8
SHA1 57bc9715304cbf87f09460c7f58bf3ebdb357129
SHA512 978ca1bed6f59b5cb8b8115243ca3487800e0fafef55d64e8be6fa007ce8251458e1b3ca1cbd1b87e5d160bba81d6d894106761b77e0f62784f06e7192bc574d
SSDEEP 96:MQuSk4c0lojkd4tXkLTd1kkVdDP0aiM3Hu2+:M8c0O8qXO1RbDPhV3Hu2+
TLSH
T145A1FE5D65BA0C7E39EBD39CB840038D86E94B0690C71C870EA7DE49CC8AE99325F43D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

015f1c4f-9cb4-4e9a-9757-80654bb05513

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\pending_pings\015f1c4f-9cb4-4e9a-9757-80654bb05513
Size 2KB
SHA256 90347a6968f58c11de68ac2e8b39bd403114d60911756e9e8a53e4b11da1138d
MD5 10a1bd612670976b6bd9cd0a00db5f12
SHA1 b8b58c824c2a7b171d66a53cdc9f80f3a8abaf7e
SHA512 ae49d64b464ab298eb0d79564a18bb0f094b51022c125c328d4a874ccaf6cb6b2a67b1a39eab95a9e3206efab5da9f7064705d4d4b121ca4189d239120a08728
TLSH
T13B51A7695120DC7DC979A31AD8213783CBF3140F408B184EAFE89E0F257FC5D9359645
MD5 SHA1 SHA512 TLSH

Submit Download

55dafdbd-fb48-489d-994a-a8705c6203fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\pending_pings\55dafdbd-fb48-489d-994a-a8705c6203fa
Size 235B
SHA256 0a31a7cf41c1c412c3cdb75b0eb8c24e419b9898de684d3fbef65a5adcf1667a
MD5 5729f07047120a5f3aedc208f136c238
SHA1 d05344405ca0d9f048d0e8d64ed122d69d323663
SHA512 a618ff0fa25a49f7c609411448d13f94df22b942180d8e85f90a20f27d88872a011093556ec2bed96f433315168bd98c028c406f229ff16a3c9114337b8df2b9
TLSH
T130D0978818A8A77E0C008F0BB0A068CA30484C3320A89860C5A1017689B9EC8415385A
MD5 SHA1 SHA512 TLSH

Submit Download

849249ae-4cca-46d0-8566-448ee8e016a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\pending_pings\849249ae-4cca-46d0-8566-448ee8e016a7
Size 886B
SHA256 5ac7a168b4dca601e4df91d851a6052151e1ddb59cd02cd4100d4cf1fae8be51
MD5 00dead630d98f27fba43ebb3203cac39
SHA1 4367950aef420be8d2246cc5549a252386781217
SHA512 2a5db4a92281129501fe388bf2296cbfa6c7b24a6cdf496365e34015df2b8e85c8642b4d4e9b203a870eed8978d5c5089637ef3de8d66463c99453b66db22d71
TLSH
T1F71100809A347EF28E35D14B84E2BB038BE83117C4CB5A147D915F084CABA1E536AA07
MD5 SHA1 SHA512 TLSH

Submit Download

a58c3a52-166f-45b1-95ea-76e3d1f44ef2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\pending_pings\a58c3a52-166f-45b1-95ea-76e3d1f44ef2
Size 2KB
SHA256 8a5a415ab8c89a84d0fc266d6186d2046a0ff3782e991682425dea05b4838b9b
MD5 58265ef66e95171b99876f7af4721559
SHA1 5ba3413f7474587690ebb6595478d02a6460437c
SHA512 313d90645263fd2ab82a4036e39d7f708b91dcc1760feeb0814eb14f8196be25df9c9d97e71812ecfe69b6bf7da87977639018f3b91e2214ef41239ce6e54066
TLSH
T1B341315C35789DBE8C8AE54D9482374E53A48E0B00C62C936E51DF4CDDD27DD33AA92B
MD5 SHA1 SHA512 TLSH

Submit Download

c94a66de-c906-4971-b7f8-eb52a348a90e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\pending_pings\c94a66de-c906-4971-b7f8-eb52a348a90e
Size 235B
SHA256 ee852efda42daa1f7e3ebd17b23c23981446c623b2d121eb8542248c23dd18d1
MD5 a76e3bcac17e312af139a5fe7c1bffb4
SHA1 820c1051bd1afeb16edb2f797bf28b4499b2c950
SHA512 800e582621bea70c387986bc28b91731ec623286847104a1013f7e5cb38212a3a9c7530864159aac23e7c5b9edd293ce4a86b753e8d973e80a967b5b8c535f2e
TLSH
T19ED0978534987B2E08080F06B0E16AC23088CC331078B8208AA202B49DFEEC44221806
MD5 SHA1 SHA512 TLSH

Submit Download

c9f9ca57-ab47-487a-a388-dd4834ecd75f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\datareporting\glean\pending_pings\c9f9ca57-ab47-487a-a388-dd4834ecd75f
Size 883B
SHA256 de779bf8b68281affc869ca4e4bc14bd5bdffafda7b02dd829405a9a61ace1d9
MD5 81cb343da8e080eace4093148bc5918e
SHA1 82a60a0aa5da01728bc1e32ab1ff7eb98769f7ac
SHA512 ebd8e6cc47a09d7e89a136f532e71fe7d80e6730baff08d9034c0e0ebbf04185739854e419cd73ca7fe4fb9ee819affdc12cc94dd93c8dafc23184bd42784214
TLSH
T19711278095347BB2CE24D14BC49237038FF83517C4C7A4147EA15E184CBBA6D9367747
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\extensions.json
Size 16KB
SHA256 f758fa4d480632e67117ba62869d3601809f5f8294664baa9bea8dae2e4cbdcc
MD5 4e2348dbc1e32c702e1366f2cb548a9e
SHA1 5dcb89785efab95b661aef2f909993ce262744a2
SHA512 19dc286402aff0debacdcc26ca88728101ea2eb2f3a5114ae189f4c8e5fb104a2caf93f761880109211e225cbfe1c70e269c7e2b775ff697473b3ad745f49c10
SSDEEP 384:fkI4vBUmldvu8dhWF94zE96orL4HwL4PYL4HyL4HSL4Hau4hR:sI4pRfjXo486g4S4i4g4A4V4v
TLSH
T16E72431545049EB8294F978BAA367E01C37D473B60845C78F4DD8FC842FA5B902FBA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

formhistory.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\formhistory.sqlite
Size 256KB
SHA256 0609f2a80b46c074f5844d69e511ffca91084bd73135f7f6114c30b855da80db
MD5 99d16a840531cc9a4b214d912179d9d6
SHA1 898033ddba5d763420bb51a030c2faaa62e161b7
SHA512 ead64e7e6a979df083d5e5b17b86546b7a6170529dc52cff3a4081a9a6b0b30ebd13f77f78fa2e4249ebd70595452cfd34b29fb94c93115495d3462c15ed68f9
SSDEEP 24:DLN8VxExBWrkier5NzW6LlmProNpNmVIpPuVM7rBmxF/EzgVqSSbqIh:DR8HMArt0pmcNptpGVM7rBw/vVqNb9h
TLSH
T14444F50F56252832C9C789B7FDD22E5349EE1046C6636B953DFC001D4FB190ACFA9EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\prefs-1.js
Size 6KB
SHA256 eb018bdebc15721b4476d2afbb98d7ba7a3db86b6c7967ad182733b1cdecbe2b
MD5 a6d7522cc4a9a707608953277d5b9d8b
SHA1 66a113ac6eb121ede691c006700d70aaf670c77c
SHA512 72508e4882f241e1ab058a657996816daa82c3011aee872b69652b16f9f508c140133ed87780b6af7553e8f5bd13692639e21a85a7d0ca52f90088c0bad41de0
SSDEEP 96:xHcUTU3qGq4fB5nkzShSSladv9jflAnnHt0dFBw88P8L4cngXYaGS:6KR4fB5nPSSJt0dFBw88T
TLSH
T121E12F785408CB7F74B676ACAC6888715AB2013BBBBF68C750B544C4050CF3846F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\prefs-1.js
Size 6KB
SHA256 48c255358e43e327aeab43e2071e85056d19d490801f7074051bdac2016ada9d
MD5 ba27dfa195aa83fbd40af53ad6934572
SHA1 eefa8067df2feb6c10b29ab25db1987ed3e200e1
SHA512 81e711423f19ed616bc7801e39a237f0aeb88a35d3e1fce9e7fa7706678c498d4e8c15724af2feca838ef1de3ae36b47b895c3c8810f1a767a076b183b8bc368
SSDEEP 96:xHcUTU3qGq4fB5n1zShSSladv9jflAnnHt0dFBw88P8L4cngXYaGS:6KR4fB5nkSSJt0dFBw88T
TLSH
T199E13F785408CB7F74B676ACAC6888715AB2013BBBBF68C750B544C4050CF3446F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\prefs-1.js
Size 7KB
SHA256 629002685f5f87842bc35d2b96fec276b6d02cd86687211f8c53b3f4474c1336
MD5 eaae609a709b2859ffe77d18dab67ac2
SHA1 e7615957c8d5766361c521b5c8888310433cec0b
SHA512 223d42755b583d2928fc305f2fb581161fb56589678e47211f7a580945b85b528344d3c93bb4648bb99c6131e95fceb0ba1bc63c17be6c514b885543a7d80f88
SSDEEP 96:xHcUTU3qGq4fB5nNbzShSSladv9jflAnnHt0dFBw88P8L4cngXYaGS:6KR4fB5nQSSJt0dFBw88T
TLSH
T1ECE1207855088B7F74B6766CAC6889715AB2013B7BBF68C750B544C4050CF3446F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\prefs-1.js
Size 8KB
SHA256 1d40c849320a58e072f83d6c4235123f4a6178db76802313ee3fcb9491c56130
MD5 d84292c90ee238d9f96fbe98480e4693
SHA1 6a13dc4717686e8604004754e2339a78d8c602f9
SHA512 d349e5da383d806a405ef669e9bd5be6f06457ab3dcb7173e7be80ce600d95f8768a95919209bc429b96c7842f408770420cdda26bd74381de8b86ee798e37d3
SSDEEP 96:xHc9TUaPqGq4fS5nNbzShSSladv9jflAnnWRMIp0d8Bw88PG8L4cngkYaGS:6PCR4fS5nQSSARD0d8Bw88PF
TLSH
T1BE021D785508CB7F74B276ACAC2889715AB2013BB6BF68C751F944C4050CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\prefs.js
Size 6KB
SHA256 bba3004434b39a87bf347ee367473689d6cbe171889ae0c44340120f8a863c60
MD5 5403b12d50f67d341eef3d3197d956ee
SHA1 c53f8406e612a6ae810aaf0d5f1955b3fa38c5ad
SHA512 2e5953aa3c083063d20ccf4ad15eaf62bc7bffc8c1d42427af7037741d42b8ddf2147fed8bc7249e67d7ccca68098b21a57510cc92312e402fbf7aba688a161a
SSDEEP 96:xHcUTU3qGq4fBKjvnjC1zSjxSSladv9jrnnHt0dFBw88P8L4cngXYT:6KR4fB8+6xSSst0dFBw88c
TLSH
T130E12F789508CB7F74B677ACAC688C716AB2413B7BBF68D750A54484010CF3446FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\prefs.js
Size 12KB
SHA256 554b6e449a23d15b44889619c30a15eaf5e0115e0161514d1881a5bac7e76e7a
MD5 a57bc2a57039584a2809f99cb5e9d112
SHA1 cd2f17bb017b963f2df16fba97460135da1e25b0
SHA512 fdfb569e63c05d40be76602820c0553a8dda92c2796bfdf0cf87e935890d0b8c8413ba2ef678235cc9bf137178f9cd718134361395dbecdd38f1208dd244fea1
SSDEEP 96:xHc9TUaPqGq4fS5nNbzShSSladv9jflAnnpwoDRMIp0dsz6mBw88cGyILeXL2V8v:6PCR4fS5nQSSDLRD0dw6mBw88cILeXLd
TLSH
T1BD42BD789544CB3F34F332BDAC2949A01972013B76BFBCD206F98491485DF6541EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\prefs.js
Size 7KB
SHA256 7ed3242dfc16e1781a4e6f73805f917e9801ed03f151f96d010778e9710c5f59
MD5 5723740ad69fde22c4cbf6881537acfe
SHA1 d4ec7e69850c0aa54666ab7c29cbb39450764233
SHA512 69a90dfdf1cd66f1a35d1abe77096e719fa35cd52a55be7a255fff0241e4afd3fe17561155b553f66e5ea285b9c96eebf1a8cb77a7de15796bbb9456d4937983
SSDEEP 96:xHcUTUaPqGq4fB5nNbzShSSladv9jflAnnHt0dFBw88P8L4cngXYaGS:6qCR4fB5nQSSJt0dFBw88T
TLSH
T1BFE1207895088B7F78B6766CAC688D715AB2013B7BBF68C750B544C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kmoz7t9k.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 244beeac48f60f6a52468cb3fe632e0dc9997b47c3fb8227474c1525c514f0e1
MD5 3d2a200171391b5bbae96db0add7dda4
SHA1 6488e3cc2f814af9ff3e20188c8176acc6299862
SHA512 308ee651b4179931f9c79a52ab12080f3312dcc3eb51a4445b06d29adf2b0f69fedc750b1d5dd310b5d84a6eb2fd217b76c935cd07296ad8f0b871194f98b7ad
TLSH
T13D21D742FEEE4CFA296AA26750C56BF8C7695843822898F0C80916004ADC55777EB77A
MD5 SHA1 SHA512 TLSH

Submit Download

ProcessExplorer.hxXZvgVk.zip.part

Path C:\Users\Admin\Downloads\ProcessExplorer.hxXZvgVk.zip.part
Size 3.4MB
SHA256 7b3498c606413794badf773d0e00e9b2b1afafa82921946da39b411c2b3710bb
MD5 c33085a0960a76373502e2641ea12a17
SHA1 bbbd53f6e4ba9e2b927a4d96222f0a05edb764df
SHA512 9bde4232ece390954e8d6de2ab4b2f5e8b0070ebc30eefe96a2d69f488fcf0a3ed96255e9fefaf42590c7a5885e17fbd1e706fef885c997f47c9ff45dd291972
SSDEEP 98304:hcOCpQ6x3KV7mcUO2PWwmj2VxcTdvKCNk19IJqY5:2J4VMgjCkdvKCGcwY5
TLSH
T1ABF533E3A08E92B41CE02AFDC3ABD9188D2AE6D4E03CAF7A3467F095788D4F555715C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2960-2025-0x0000000140000000-0x00000001410DF000-memory.dmp

Download

memory/2960-2008-0x0000000001FB0000-0x000000000204E000-memory.dmp

Download

memory/2960-1993-0x0000000140000000-0x00000001410DF000-memory.dmp

Download

memory/3280-949-0x0000023D8FDB0000-0x0000023D8FDCD000-memory.dmp

Download

memory/3280-947-0x0000023D8D9A0000-0x0000023D8D9F9000-memory.dmp

Download

memory/3280-948-0x0000023D8FDA0000-0x0000023D8FDAC000-memory.dmp

Download

memory/3600-956-0x0000000001FC0000-0x000000000205E000-memory.dmp

Download

memory/3600-0-0x00007FFC31DB0000-0x00007FFC31DB2000-memory.dmp

Download

memory/3600-354-0x0000000001FC0000-0x000000000205E000-memory.dmp

Download

memory/3600-2011-0x0000000140000000-0x00000001410DF000-memory.dmp

Download

memory/3600-2012-0x0000000001FC0000-0x000000000205E000-memory.dmp

Download

memory/3600-2013-0x0000000003600000-0x000000000360C000-memory.dmp

Download

memory/3600-788-0x0000000001FC0000-0x000000000205E000-memory.dmp

Download

memory/3600-5-0x0000000003600000-0x000000000360C000-memory.dmp

Download

memory/3600-4-0x0000000001FC0000-0x000000000205E000-memory.dmp

Download

memory/3600-2-0x0000000140000000-0x00000001410DF000-memory.dmp

Download

memory/3600-965-0x0000000001FC0000-0x000000000205E000-memory.dmp

Download

memory/5344-10-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-16-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-17-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-15-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-14-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-18-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-8-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-9-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-20-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download

memory/5344-19-0x00000185C6AE0000-0x00000185C6AE1000-memory.dmp

Download