xworm | b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2

Analysis

user interaction
yes
max time kernel
323s
max time network
328s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/04/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XWorm V5.2/XWormLoader 5.2 x64.exe
Size 109KB
Sample260423-vaaahah17m
SHA256 b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2
MD5 e6a20535b636d6402164a8e2d871ef6d
SHA1 981cb1fd9361ca58f8985104e00132d1836a8736
SHA512 35856a0268ed9d17b1570d5392833ed168c8515d73fac9f150cf63cc1aea61c096aa2e6b3c8e091a1058ba062f9333f6767e323a37dfb6f4fa7e508a2a138a30
SSDEEP 1536:TYogSlNwXosKwOYtV1AS9m3xQyVGNNiLkWNF7XxFqmyVttdGFQeOPigx:TvgSlqGS9m3xQyKNbWNV3qmyBeu
TLSH
T1C5B33B943FCBED97C64B12710CA687341138CD6F58E766172641BEECBAAF89C0607987
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

agilenet discovery xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

kurkupa-rbx.ru:443

Mutex

25gzmn8LZc6EGRMC

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0003000000015d06-1421.dat	family_xworm
behavioral1/files/0x00040000000163ef-1656.dat	family_xworm

Loads dropped DLL 2 IoCs

pid	Process
544	XWormLoader 5.2 x64.exe
5620	msedge.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/544-11-0x00000279E6FC0000-0x00000279E7BF8000-memory.dmp	agile_net

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_420652423\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1915773353\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1304282666\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_802381854\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_2140849637\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1534934482\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1915773353\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1534934482\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5620_1739115208\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1915773353\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1617269407\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1617269407\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_802381854\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_802381854\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_802381854\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1184039060\_locales\lv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5960	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWormLoader 5.2 x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWormLoader 5.2 x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWormLoader 5.2 x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214366133069795"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000001e6d68b49691dc0195561f6aa291dc0195561f6aa291dc0114000000	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000001e6d68b49691dc011ec7f31ea391dc01607bc4a241d3dc0114000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	XWormLoader 5.2 x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWormLoader 5.2 x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	XWormLoader 5.2 x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{A4361C53-BCC1-4C8D-9B76-9DB4D36A6FD3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings	XWormLoader 5.2 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	XWormLoader 5.2 x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	XWormLoader 5.2 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
544	XWormLoader 5.2 x64.exe
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
544	XWormLoader 5.2 x64.exe
7128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	XWormLoader 5.2 x64.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
5620	msedge.exe
544	XWormLoader 5.2 x64.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
544	XWormLoader 5.2 x64.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4172	firefox.exe
544	XWormLoader 5.2 x64.exe
7128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 4172	5828	firefox.exe	87
PID 5828 wrote to memory of 4172	5828	firefox.exe	87
PID 4172 wrote to memory of 4852	4172	firefox.exe	89
PID 4172 wrote to memory of 4852	4172	firefox.exe	89
PID 4172 wrote to memory of 4852	4172	firefox.exe	89
PID 4172 wrote to memory of 1628	4172	firefox.exe	90
PID 4172 wrote to memory of 1628	4172	firefox.exe	90
PID 4172 wrote to memory of 1628	4172	firefox.exe	90
PID 4172 wrote to memory of 1628	4172	firefox.exe	90
PID 4172 wrote to memory of 2728	4172	firefox.exe	91
PID 4172 wrote to memory of 2728	4172	firefox.exe	91
PID 4172 wrote to memory of 2728	4172	firefox.exe	91
PID 4172 wrote to memory of 2728	4172	firefox.exe	91
PID 4172 wrote to memory of 520	4172	firefox.exe	92
PID 4172 wrote to memory of 520	4172	firefox.exe	92
PID 4172 wrote to memory of 520	4172	firefox.exe	92
PID 4172 wrote to memory of 3376	4172	firefox.exe	93
PID 4172 wrote to memory of 3376	4172	firefox.exe	93
PID 4172 wrote to memory of 3376	4172	firefox.exe	93
PID 4172 wrote to memory of 3376	4172	firefox.exe	93
PID 4172 wrote to memory of 3136	4172	firefox.exe	94
PID 4172 wrote to memory of 3136	4172	firefox.exe	94
PID 4172 wrote to memory of 3136	4172	firefox.exe	94
PID 4172 wrote to memory of 3136	4172	firefox.exe	94
PID 4172 wrote to memory of 4828	4172	firefox.exe	95
PID 4172 wrote to memory of 4828	4172	firefox.exe	95
PID 4172 wrote to memory of 4828	4172	firefox.exe	95
PID 4172 wrote to memory of 4828	4172	firefox.exe	95
PID 4172 wrote to memory of 1892	4172	firefox.exe	96
PID 4172 wrote to memory of 1892	4172	firefox.exe	96
PID 4172 wrote to memory of 1892	4172	firefox.exe	96
PID 4172 wrote to memory of 1892	4172	firefox.exe	96
PID 4172 wrote to memory of 784	4172	firefox.exe	97
PID 4172 wrote to memory of 784	4172	firefox.exe	97
PID 4172 wrote to memory of 784	4172	firefox.exe	97
PID 4172 wrote to memory of 784	4172	firefox.exe	97
PID 544 wrote to memory of 5620	544	XWormLoader 5.2 x64.exe	98
PID 5620 wrote to memory of 4816	5620	msedge.exe	99
PID 5620 wrote to memory of 5960	5620	msedge.exe	100
PID 5620 wrote to memory of 5964	5620	msedge.exe	101
PID 5620 wrote to memory of 5964	5620	msedge.exe	101
PID 5620 wrote to memory of 5964	5620	msedge.exe	101
PID 5620 wrote to memory of 748	5620	msedge.exe	102
PID 5620 wrote to memory of 748	5620	msedge.exe	102
PID 5620 wrote to memory of 4912	5620	msedge.exe	104
PID 5620 wrote to memory of 4912	5620	msedge.exe	104
PID 5620 wrote to memory of 4912	5620	msedge.exe	104
PID 5620 wrote to memory of 3248	5620	msedge.exe	105
PID 5620 wrote to memory of 3248	5620	msedge.exe	105
PID 5620 wrote to memory of 3248	5620	msedge.exe	105
PID 5620 wrote to memory of 5976	5620	msedge.exe	108
PID 5620 wrote to memory of 5976	5620	msedge.exe	108
PID 5620 wrote to memory of 5976	5620	msedge.exe	108
PID 544 wrote to memory of 5848	544	XWormLoader 5.2 x64.exe	109
PID 5620 wrote to memory of 5736	5620	msedge.exe	110
PID 5620 wrote to memory of 5736	5620	msedge.exe	110
PID 5620 wrote to memory of 5736	5620	msedge.exe	110
PID 5620 wrote to memory of 5744	5620	msedge.exe	111
PID 5620 wrote to memory of 5744	5620	msedge.exe	111
PID 5620 wrote to memory of 5744	5620	msedge.exe	111
PID 5620 wrote to memory of 1688	5620	msedge.exe	112
PID 5620 wrote to memory of 4772	5620	msedge.exe	113
PID 5620 wrote to memory of 1688	5620	msedge.exe	112
PID 5620 wrote to memory of 4772	5620	msedge.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XWorm V5.2\XWormLoader 5.2 x64.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2\XWormLoader 5.2 x64.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffe8b1ec188,0x7ffe8b1ec194,0x7ffe8b1ec1a0
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,396778155790370239,14871546238911392708,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,4061361766612853548,5221643832138935150,262144 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,15084543833448116443,1425108687363214478,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:8
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,13446647687128017482,9986160560169628979,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,10277408848013867076,8105024176335852789,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,17856067432172083835,16231812069815805351,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3604,i,1175407067587390535,15957686049579303546,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5192,i,17011063154427482124,7656048781310499224,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,6137240372129334324,10760845647930169888,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3056,i,6408737422087532494,10719275468228192509,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,976063481563395071,13704583952030476940,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,976063481563395071,13704583952030476940,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,3397712968116041165,8172992783098945296,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,1253379082822376054,10862569725573457007,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,2670049805137660761,2403054141070880534,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10846144781907298360,4531181000563611006,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,3126546040028450521,17551656785028580919,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,17281959247303870254,7089247502351859432,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
    3⤵
    PID:6488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,12608510217018485240,14982816306701047849,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    PID:6604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11665483947364697715,5289812203091633453,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
    3⤵
    PID:6920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,12002886338003227468,5827080605724409039,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,2859593371819889462,13641571114804455631,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
    3⤵
    PID:6224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6380,i,17947369953697176908,2552749974058012321,262144 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,5180058839717588036,1404455438711177035,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
    3⤵
    PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6512,i,13901220020647116014,11995659191205470535,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5880,i,6867009177846896500,17324071255355388752,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5740,i,8113781088954098618,9287055015546927380,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3956,i,6613804328708961119,962648332628968021,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:1
    3⤵
    PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6360,i,16918293143939386021,10268678124064283815,2097152 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1545679622063566348,7420875695319759383,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
    3⤵
    PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3084,i,11486340768114639677,9116266296210055171,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,1277332866460956893,8676446907416637882,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,10015061811066701419,10621591929740820038,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,14257173202317538429,11906355268126574185,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9389066730040234175,16681706359769735350,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:8
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,3947167857721345887,11952203581535514902,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:8
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,14578950648211897510,2566605586621149834,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:8
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,7976105820561303587,15262887865405560047,524288 --field-trial-handle=2288,i,7997850548525064825,1613482704108889659,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:8
    3⤵
    PID:7052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:5848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qhkx0bu2\qhkx0bu2.cmdline"
  2⤵
  PID:6468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BF1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc32AE1E11FF5F4371832DC04ECE948221.TMP"
    3⤵
    PID:1356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27100 -prefMapHandle 2036 -prefMapSize 270279 -ipcHandle 2104 -initialChannelId {d2f15d58-bd49-4f94-9b71-416fd2df2052} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27136 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {ed7cdff4-1066-41da-8711-8197b2c8b411} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27277 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {828066a7-5625-400e-b2d2-166ab4d8cd7a} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27277 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {ca16d163-abee-4fed-a02c-885b92e69982} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4456 -prefsLen 34776 -prefMapHandle 4460 -prefMapSize 270279 -jsInitHandle 4464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2636 -initialChannelId {f489a562-22ca-4c58-b72e-3dea0f28b05a} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 34906 -prefMapHandle 2772 -prefMapSize 270279 -ipcHandle 3096 -initialChannelId {7a0a826a-6a49-4a41-8619-5fbc1904252a} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 32793 -prefMapHandle 2780 -prefMapSize 270279 -jsInitHandle 5032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5072 -initialChannelId {e2c553d8-41dd-4867-8851-d71c9a00cc1f} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 32793 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {93cb7111-db31-40ef-8233-4b6632df73ef} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32845 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {54389133-1949-4251-9336-39932e6cf79a} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2972

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4d4 0x4e4
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40a64a56a478a0fd099a66c59798b6e279b6b7a22b9c8f9d0e45f56135026fa1
MD5 032db306dcef8996b2e04b1c5fb92915
SHA1 02e99bb7c04d80a0b1c444a4a3141092712f9615
SHA512 12a489ea13d1adccd0f85ea48f28ceabf79d50bb27aa46f0f1f6549e12735380b43d6896a6cf0d0fe25fa658a6b4710cab9bb1e977ad5ee1195bab21537d0a4a
TLSH
T1B7D0806C15715C35CCD66970059577293736C862AD5397561877243C0CC345119AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 216e5a58e94c95e4c592e121ed23c441ec531761e040f8880c57b5a0eeb12a05
MD5 f1f73be01fc9cb63975347633d0f1f5d
SHA1 f230981f769254dfada73ff34023c59d3fc9e431
SHA512 ca6d69ceaaab5881b54441e2b4497f43910120096c7a0d920d8c758912f79a2412a29a5ae43a3a7088a874b76ff84642d7fee5f4e8a9e542d4576447ad768896
TLSH
T19BD0806C15715C35CCE66970055577293726CC62AD5397561837243C0CC345115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 c9c5c98bfb9d2ee89a17a2acb3a77bd78e033e395e2c8c9a8ebe3a25d8764009
MD5 978d35517ef37aaf81d2dea1e8d3bc4f
SHA1 15955ca8698885b8e0c4cdb6f061bc342a49169f
SHA512 f6619d4cafe8876d8d66110d8abac5fb81fee878ea7d2ca58d309fba422c5fb3979a7d426f4542baa1df8356c069a9bfedff486c78592b2755408c2a4653aeb9
SSDEEP 192:Gj7So4ixixixzzz2kkkVVmmAAAdsHHuzcDKHGxqwhjABh:Gj7So4666zzz2kkkVVmmAAAdsHHuzcDS
TLSH
T17FF1574382D5D39ACB0911EB4BA8725D8070B70DFBEDDD1C039C9ED9318E9EAB5A16D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b2037fdd20eb2e73789ace3aff988bf8b5295f543a8f846ba312a0fb71de7598
MD5 6ae1ff7cdd012da1f9c7152729e7e7dc
SHA1 8ac7496ab9fb78e88117837754230dece48f5932
SHA512 9ef8bdeb75d63164e8eb145de7e4f5994458aa10f23fd9954aa9c15e8c0ddbf0b6590f1d64ada13be51daf803e0c6eb9a1b7a9d8d7480bb4b779c116b39c0ba7
TLSH
T123E022AAC9209E3B08F9071E6554574DEA90131B2B428D8B7B3DD61CCFB433A46D785C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 49KB
SHA256 62d5877360957e64ef19c7069fdf814570611b1ad2a4f874c5771efd9e0de663
MD5 745fee3492501d9fd714d5315d084b3d
SHA1 7f97590b638e816ce2e126fa81ac72cfe7a15c6a
SHA512 ebeb50cc98ff9f55659a4ea6cc0be44ed9b0b7b0f459de23f4e1b2e97371ff2d3d5af87359ff5cba6ae2a8bf3d9fe193ccc46aefde924ca52dbb1c0b4afe858e
SSDEEP 768:rKoJu9KjiwioLz/j2ihwF2q62Jp7pKMW+AxTX2JztoRjIxYr3SpX6DEBPXNeIru:WwuKiwiE2iqFZJJhpAUJUBVDSPXNeN
TLSH
T16E33F2D87EBE6382B7EDD95AC9A4BB0C05F5CBD96EB29AC014514F4B72B2A31C441073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a16a8089cef02bb017de4e4f3468f02c902b506d691e7d2e4ff6658df7c4643b
MD5 2e3ac718f726520afd5df3584fcc54b0
SHA1 16d931c43945d4534750f865c3c2c0cc11d74522
SHA512 51ece36988996fc99e7555f43bb00a9f6fee274b5d730071d3cfd874b4f4660ce3b02bf7c588b510bf70a774c460fb2bb67ec2952fd5c183333f4ba968430b2a
TLSH
T1CE612F978392B06BF7E4843C96F7171572347A58054B3E12EEF388FD8AD2B234085876
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 715b56ebe12459a0b9dcc4d69849461b459aa4bcfa72f9dd0182bb2babf0eefc
MD5 94aca195998834f21d7e8b250bca0ca4
SHA1 4e236a3554ccc0de4729c301ce74f20bf9fdeef8
SHA512 588db1fb1c4a12f492608489c15cc6ff67cae14730c30f28e801ad667395e4ad1136f7e03dd7740ed2846cb8e13ffbc5ba58a50eed7e27d7f651d30cde90cf24
SSDEEP 96:yiG2Zgy5HHerkV6fYAvqg2E+3zRCL6ehkX3EaC3wpLNS5hQ:yL23krOFAvbxueaX0TiLgLQ
TLSH
T151E15E8287C6F867FBE8887A91F75A1A3170650014072E129DFF50FD06FB7978B845B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 ace228cc182e3f310152f4c73d69e450def88b190cb757615b3f748181e808b5
MD5 e8f1074ade7be0ca6458bae7df1644c7
SHA1 1fd84c3cebca5b1daf82f13ccd773939b7c4a946
SHA512 ff07357dfd6803ca0dbb913ed2d05100219dbf663850aa782a87464ea7cea75a07d627affe71f6398da4d0713725124ae6a2a555add6cbef1fd60eab5bedcefc
SSDEEP 96:63G2Z1e5AHelQV6oYAHqg2w+dzRCL6eh8X3Ea03mpLNS5ha:622uLlSqAHbnueCX0x8LgLa
TLSH
T1FFD13BC283D5F863FBE8583A92F71A0A3174650011072E169EFF54BD05FB7A38B909B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 5beb7c7a23eabdede97c03d0d2a21394779bd6d8fcccfe972ffa2bfb87067f25
MD5 a199bea2cab9e968702d5faba740925d
SHA1 456fa4f9871b2931ecfda4acf109ec0beb9d82bc
SHA512 cf189120e3e4bb9285d737613b2ab86e9a1c494c637e10f94145e2af8f9b1d24c9c9583d0cdb559f815c6f910879aff0971bb03ab2bd3964dfc25dbc4dbfea77
SSDEEP 96:iDI/f1J/HelQV6oYoHqg2w+dzRCLvehlX3Eaa7piNS5h/:iDI/XWlSqoHDLjenX0tigL/
TLSH
T138C108C293D5F863FBE8483A92F70A1931346904014B2E16AEFF54BD55FB7A383818B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a8be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a8be.TMP
Size 3KB
SHA256 3e770fbf2bce86842c66b87b553365a754443716bc82c1b12b3eb87ee461c069
MD5 13b6af30916e90e597d16268f942b799
SHA1 06da67d3fc57a328a1fb1f9505b1af50c56fe560
SHA512 8ce33b62640acf9f6e320b58400af0035002aefc68fed7a92171b9e644c0f63832833e1443544d725b29ded9d75dc1f8943743b36e275729231db340edb2c9ae
TLSH
T141612F9783A2B467EBE4903C96F7071572307A54054B3E12EEF388FC8AE2B234085876
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 849282b69f62cba5669e8414eb4f5c68b459fa1fe18f3bba12010cae6264ab4f
MD5 110ad1735fc86e0967bbb781f5b3a303
SHA1 92e61be6f24d633c24d1e679bb5455bc46caece2
SHA512 dcbcba22ba054cbcefd81435f2020a8d7574bece851fdf5bba27d40a40a4e3e05b8692956ffdb6465496cae567a43523189be99329460fb7dc6dbfc444c95703
TLSH
T14041CFF783F4856D8A0296F0BA187E2BCE5D0515436C3D5A89E4AF1BA3F3470E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e0df2348333116123de316d5b726b3c5817d9ca813012a322708f98d6f97d1ea
MD5 d44d24a92a05a2cfa07252253495eba2
SHA1 d8fcb9595a046af9f73b44f51252f3a7bec48bb7
SHA512 3e1515cbc89ea1fb6487e794aefc1bc85ab91bd48e6d7be97116e32d64bc565ffb750e97ff962c2b9fa13d30c5875c957e2fc4196e0f5c41e49441d41d3c8e2b
SSDEEP 192:Dqtuf/d4hMhNLGo21Qi6XuaSzxO4RK14NCw+kj6KILCGwi1:Dqtuf/d4hMhNLGo2196XuaSzxO4RK14E
TLSH
T1B202B0F7C3D4862DC81162F1AF283E1BCE2D096453683D66C9E4DF4BA3E6472E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 f84c8c6f1c1406f42c9bc4a7c47f849c51038e27997263c7b28ff4e1222dc002
MD5 19bb1ecde397452f78c507641d09beaf
SHA1 3937f97837f587a2a75baad0dfca0139739ca987
SHA512 e2d34a45d35008dab9195dc8c855156ae24b5681495c27e27fd1f0fd9203b5bc74f6e2578897dc467cc5fbc652b63aafdd5aac20cb2138687d0a1898ea6e3a40
TLSH
T110D0236333113075796C5EC2905AAC8FC32700710CC1EED555F05C5C093545C0517740
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e67386498858573bfc1fd67837cd865a4af8193360fa85915c3b569951652ff3
MD5 7176464726a91707b968b9bb1332dd03
SHA1 9640eba0a706795554f8924c9b1eac8f6311df96
SHA512 f47c2a6583b37652fd4bbe2f0affac60cc262a76185d439dd07e1f8c9920e93222b7a319eaadd13cafe90f1c38e78890dd4b519975f8dee2fde9a5f9b73f3670
SSDEEP 192:sxZRROyMqZ/K1Ml8UQaEw/fZscRnOtcynzodptTHW6+WNcetfYtQq4C+Ig5zZ1J:sxZRLqdw/fZscROtCBHb7fzrf
TLSH
T13A72D91AAA385A77CCDBD219F5457B53D6F91572D1504E44AAFCCB0C00E6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ecd857fad975d9302a1aaf74d6e02d5babbeb07622712323cfb84340395e278c
MD5 8d18c9d7b29b699a71ffb206a279fbb3
SHA1 3d82c0da50b5453ae84f153d215695b50d4e5e46
SHA512 8c7394b434d6acb1819263a635d55ec85d716e720fc085794744a5887870cd0b2673e339d5a1e1360e213e0bcf8131742428f9acfc0c7d5681f741f670b76a15
SSDEEP 384:sxZ8Lqtm1w/fZscROtCQHbG4/fmrN050f:skmtm1w/fZROHbzfk050f
TLSH
T19992F74766248A77CDCBD619B975BF56D6F50522C9910E889AFCCA0C00EB6FD360382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 507cbebe193a5595b6e047db1a81806e96df371991a6bb7089f29bd44a227525
MD5 529d6f9e33515f7aa9bc0eeef7a8ca7f
SHA1 6c6db85d47598d718b84864d29a9cf12bd517175
SHA512 348975a6206a20292aad17e63d4248f3a4dc48deecc306c282231fa520d839ec31497ae06605bb298109bbdfc63203254f8836f0e12614c1f097d2c4fbf0677d
SSDEEP 192:sxZRROyMqZ/K1Ml8UQajw/fZscRnOtcynzodptTHW6+WNcetfYtQQ4C+Ig5zZ1J:sxZRLqew/fZscROtCBHb7f1rf
TLSH
T15972E91AAA385977CCDBD219FA45BB53D6F91572D1500E44AAFCCB0C00E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7df1242be87944165f0f9cf5f60aa539944b17d2b7be7f65cdbfb242c13568cd
MD5 8a594e75b4e1c9bffe696d513ae4f7cf
SHA1 648b3051acecb17f010f5fd61261234fced1a75a
SHA512 571371a43d209dbba0a7d9996defea1c228ae5566ebd7e6115448dc151cf96d1f5e69dfa85e91ff2c8a8951c93fe3ca6302965ba287fb04127a72d1a22e7417c
SSDEEP 192:sxZRROyMqZ/K1Ml8Mjw/fZs/snOtcynzodptTHW6+WNcetfYt7QNC+Igj61J:sxZRL7w/fZs/sOtCBHb7fJj6f
TLSH
T1AD62F9166A389977CCDBD219FA45BB53D6F91573D1904E44AAFCCB0C04E6ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 579cd6a612a1d3af8f05d8a6aa4cbb871df50f992ee07150f0c59929ab6fda31
MD5 8cfb9f015cdf049952be6fc88b6a237d
SHA1 1053f418962f26912b2c05b0576d1e09f8d5ee68
SHA512 12b95b801eefa2cc1370111dfc21a8812135db32d41a0c656dc803fc4b93e82a32af9fbdf9ae2d73d7f71a0b856f85658449ead9fe2c3321912ec85efc5cad9d
SSDEEP 768:wsk8n557pLuL/PvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdI/eLlkqHdvroW:wsk8n5PE/PvWvP5kFu1jasI/eLiId8yZ
TLSH
T18FF2FB3B280CCB7E4F800E9CDC2A7E9E6DE802CF96D8895447E9944C03DA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 164KB
SHA256 fa6943ae0607aa1352269cb21b6e4b11600ca04c68487f19cb71c32f3131ee04
MD5 895d9597388c9fd633cd315e62b641f4
SHA1 643e58b2c9599acd215fb0f9973fdd180c7a820e
SHA512 08a1397edd330524de233e7e33867110aefd52316e167fbc1dba83e48b366d09ed4b1935f2f7eb36c00db9e1799ad312abc62dfd6ad248a765862c3a4aa00f9d
SSDEEP 3072:oQe+sswSjnxPCA1j6mLv15N/HwiHvwRUtxm1KUnC1CvtsC:ocsswip5JwCvwRUF5AWC
TLSH
T12BF38246D1F8D863AF7B0053E8967E82F32C3147E619DAA0F587BFE1501E62A70B5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e09676e82a16089333ec4daa9353a833d4396a98aa7bb4819f15de8595f9bd6f
MD5 405f1f9a3c96061c456ead2e60c2746c
SHA1 971aca3d034fbfbf19b1bf6aff6d304fd3729660
SHA512 f259f8b822555f2e177f269f4e15ac029ea791b461b136db40686187acc414ee1508c150c313bd7edf15721ea351ed50762e89210b29b9a45a501cc0d4d702dc
TLSH
T148A002510565D192E9428370D75305CE23D0882F0315169582B8A474E96C5406F32288
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 bc1651219eadc954c2f64cb9de5983f5cdc0b2967db6fddd07f0bd5182b7f913
MD5 0a5429141d14ae508def72d419c42bc4
SHA1 a487e9addf949b70c3bf51824ad11d97a3ccab27
SHA512 a1440d1ce3fcb31b021493eeb4bfb4e6f7162daa1d822d9a34fee79ec8815442166c0505caff65889af9b448835d6b864870597c2f97212b3440bb9d34a09b55
SSDEEP 96:KcKoKziqGxeK6wyKawKfKAtKKOwSqSYKDCE9+KOAauVOK+0ZwQKpK+KKEKzCssAK:eflBf6532xxBzXcn5H3POrXKjZb
TLSH
T1A0A23651713A02913A7EA9CA8595B81E56C331737018E43B7BB900B64F6BE20DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b7ac1f624504ebc1a89bad2b8df56561e318ede421621d4891c20d879a19c370
MD5 dbde72a23fcbc1a0f784c5dc29946d20
SHA1 50488359ad9a31f4965ba119dca6f7933804b313
SHA512 c732ecd6468831a082b81c9f6e6aa5c18639a50df4b0cf96c5ce706387a115f4368609c77850c5f3cd29b40bab0180553b1bcc5eb02613ef7bb80d62171b5a8f
SSDEEP 384:nWiFejccCs+Bt0S3YUsNiB8TUNTUlI4AXqOABAqA12Twfis2/zmmPdMOQIOFp5tG:9FIccQ3TBwgHN1D2/SmPQIOP7vlnhet
TLSH
T11FE2C4F594E78977E8AE8B87A37D2E4299BCC053B5885984F7C44D0CCC861BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 effa55c142f1cb0349070a0040384443aa8b53b85f4f0cc4a41a1b49e62e1fa5
MD5 614ea687f41ea423898e1731560218fc
SHA1 b703f9248b0c9e08a5e013cf080f8c335e442cc0
SHA512 e1929faf68ee56f4677e33a2e37b292ca67aa05072fd350420ecdf92d920be3bb9164bb92fe89aa858fb3334c7124330621792092f065df8c6daf22235fce015
SSDEEP 384:nWiFJjccCs+Bt0S3YdsNT8TUNTUlI4kXqOABAXr12Twf7Y/zmmPdMOQIOFp5t1vO:9FJccQSGwgrt1DY/SmPQIOPRvlnhet
TLSH
T1C0E2C4F594E78977E89E8B87A37D2E4299BCC053B5885984F7C44D0CCC861BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 289b79a51a59038a676f72d9bc7800452760b792f5226777c984f64e3cdfaeed
MD5 1f0a7fe85d21ba37ecf5ddffd5e1df6b
SHA1 57309f9acdde47c45eaa49b2ca2225e9da158a91
SHA512 6f7cba3ee14a71092f02cd18f9d59b4bf4c7bac93a166758e6bbf2e428e6af49bba56fb8f7da0e29866b4f5047f3e973907f13b334d09fc4bf10c622e3c6028f
SSDEEP 384:nDiFJjccCs+Bt0S35sNT8TUNTUlI4kXqOABAX212Tvf7Y/zmmPdMOQIOFp5tJvlo:uFJccQZGwgrI1UY/SmPQIOPNvlnhet
TLSH
T1F1C25D35E8A4CD6BBCE78B95F79A3743EEE001A3898C5AD8D5C95E0D00871DD170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 65492c13566a1fedc4cdf881a56de10fd975c76f3c3045bab52aa77a651b51be
MD5 1fd85586d024a539fd7757293b0d72f8
SHA1 a32453f968ff5fca894e0c6df175c077c3e1ee7a
SHA512 b8cc80033681ad30f1780073bd9a54ada0b1e5b0045807af55bbf65208a3b77f31427fc042174fa7e1216479a52a83709336260ae18f64c943354f3c8f815e81
SSDEEP 384:noiFavqMg3sNt8TUNTUlImkrqOABApIVTvf7Y/zmmPdMOQgu3Ra4IhrN1k+5vI+T:zFayv3IwgRMpY/SmPQgu3Ratf
TLSH
T15AC24B35E8A8DEABECE64FC9A7597617EEE00197C59C4AD8DAD81D0E00C70DD130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 061e7fce3a4b1153e4e5c8275292cec7f2dd516a81d6ae9c472e3f4946bfc2ca
MD5 2f765f7484ab54ddf77df8bc3074dbc8
SHA1 6ca6a9a017a3432696bdaa176263c6cb8c33f6af
SHA512 1f410397864555eb656b6809604b725f2755fcfbc3d6577b638aa2b77c19b4802339090e75e4ca31d34373c7c3371ab0a8c6da03d81d7b64caa45e4ac4825961
SSDEEP 384:nGiFavqMg3sNf8TUNTUlImkrqOABAnmxTvf7Y/zmmPdMOQIOFp5tJv3Ra4IhrN1f:tFayv3WwgR0dY/SmPQIOPNv3Ratf
TLSH
T1D9C25B35E8A8DEABACEA4BD5A78A3743DEE041A7C98C5ED4D6D81D0D00C71DD130BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0c022b85bacdc8ff0375610be488225228cf36f825741751d0e8c91bea139bc2
MD5 919865980b616e7d4ffab07892a9be4b
SHA1 4292d3c321a256949b801c789cfb17e46a577c30
SHA512 06642ce573653dc8748a71b2f4c0a6371ca49aba5ab709727669cfe0819caf4955645d2b5839945bcb2cb5869133e4fdacac35e78d1625997857c8992cfb0cf0
SSDEEP 384:nHiFavqMYDsNT8TUNTUlI4kPqOABAJPETvf7Y/zmmPdMOQIOFp5tJvzDOMrN1k+j:CFaypGwg77WY/SmPQIOPNvzqop
TLSH
T1C7B24A31E8A8CE67BCEA8B85E75A3647DEE001A7C9CC4AD8D9D85D0D00D71DD270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8262c932a9468136715d4e8831dd6725c40349f8ac32a78a5ad7a6a8d105077c
MD5 48e18bd889e5c049a000d2d01a512d72
SHA1 7751e17c1e8a7fd68d7b474dbbd50cbe0ea535eb
SHA512 1180616cb9128f48d025cead10de0ee9dba808257bf73ea65a6b88c77474e745ebba1b41a2c90fb875a752da063a7abecd8a2f27972314bb87549971d6ef8a32
SSDEEP 384:nHiFJjccCs+Bt0S35sNT8TUNTUlI4kXqOABAX212Tvf7Y/zmmPdMOQIOFp5tJvlo:CFJccQZGwgrI1UY/SmPQIOPNvlnhet
TLSH
T19FC26D35E8A4CD6BBCE78B95F39A3743EEE001A3898C5AD8D5C95E0D00871DD170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b3f884ab7f5ba292f5a148a676a26c64ca2519fcd4649465fa43ef0ab0c5b92e
MD5 b183e6d0d232af431e97820db2bd1efe
SHA1 5003a315b9a4fdaa68718e13bbf3086dc7c5482a
SHA512 57b0a6d70bff5506eaaac836a634ce1e22680a084abd5486a9c449b0ce3d104b1be8d372cb6a9cab627f7c65810ab5560932ccb6950fe31dee21249569377729
TLSH
T169E00102D34000AFC028133100C32B3033F3852403B30747995501B07D273041F24FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1b88f70e9f80c2a9902d39842f9fc6616e9e7335f88184f5c0fb37bd8b0b2db7
MD5 2171e75cfb16c5bc8a08579daee28084
SHA1 d8ba947cd7c2614e51975d6b41725d2538f0ea00
SHA512 ef5cf7b480166ad0c9b927192e9122af25cb794c6065a87085563901f28d99c416324e86f619ebed152f3ac078f9b88fcba1f0f9e34d143025016690c1866729
TLSH
T19EE00201D340009FC034133100C32A3036F2852403730607995401F43C273041B147C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b7b6cc885421c3894dc1ba95fa5f232f567c5d2d491950fac9fd35cdd33d8366
MD5 31a85c1c9295ff67b2bb611cbece5c45
SHA1 0a93186970a27a7a5ad517341c0027356b5237d7
SHA512 04dfec3d88738c5732c09074bb90739481b2e7b4eea8500a441c6eb63bf730c0bde6b05f50f33356b3a3bd83b4957d243bdd2a041e772c0ac48be07ac6b3d9e5
TLSH
T14EE00902D34104AAD028133100832B2033F2892422B34B479A5501B16D273045E24FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 184afd334795ad4b66cf2d1dd6e1d260b36d92132d045c5c018599cbf59e9130
MD5 ad0a91be5aaede1c43987a697c2445d4
SHA1 d474685ce4a588d35b0bba2675eb2d7b866a2a74
SHA512 32dd38066bb187da5602f4b741f70fd0f16062a163446ed5ad49f387ecf81722fe930b5d779646619163404c157368dace8e1906387b5bb4dfe528f16b796d37
TLSH
T105E00902E34104AED03C133000832B2433E2D92523B34B479A5501B17D273485F28FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b2799.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b2799.TMP
Size 392B
SHA256 6b827bd236559215eecd35b05ba24fd0aa11b8f6332cdea3f29c352e41711db8
MD5 2de6fd406465541d19710d662a940e93
SHA1 27050802b820484967e3b5574d4ebdb74a6773ac
SHA512 5bfb0ed722b3f35d1c39f39caa96cc7c0298bf4661cbddf1b60446217cfd075021fca5158c69caaeb38001cc4c553f6c845e30361bb4a3f94960bbc7f957a2a0
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b93c3edcf15a7a4d6e8aeeb4e0421bf9cb8fb114b3385fee5c7f9d96126557cd
MD5 57d2e3eb0048deb027c02104f5ca8bc0
SHA1 d5ec94fa1ab32784ddf5a29a9b38aabab9266c2c
SHA512 88c97d9985d099e0269ae98079d446a0121c4a73495baf0ea2cc2af857d3de6fc940730faa8817e5751643aa2eb297e18315a045b9b9f5ea68980e2d3b945ac1
TLSH
T10F412FE15C3E2AD1D4FE0A6E64A738FC95D8C72AF4B4707D6864DE98073960E644443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ba42e57dd0cb05403c94224757e144a0ae72237c8b047b9b988367f319892a3
MD5 ee8a569d113c36a9eb6ffb7a9951f409
SHA1 8a23ddcb915b9160112f3f9b0c20d8c2ac99f673
SHA512 5566a53767938c8c5e8fae05b4f19ee626c0ecf8ec22ac1fe4578bf3c7be3806085e46ccc3d2eebf3e2cafc1939375fe85e71ff75cb40caa8fd86af59bf00cfc
TLSH
T144412FE15C3E2AD1D0BD0A6E74AB38FC95D8C72AF9A4703D2854D998473960E654443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c58cd649ee95c481a176b1797b02e49a6610318ef5c873551fae7e301fd8e4c2
MD5 f9d338be6fa725ed357da0bfdf3c9c32
SHA1 c88f3e893de895d7cb116ea662874f4bfd406e07
SHA512 740d23902b157c93fe42d6ccce83760e5c92f60e3975313557b34d969e9d36cce6e242c942e9de81cc0b7e0c629e85ef1bc10cff50a2e9aa565ce99730582efe
TLSH
T1894153E15C3D2AD1D4BD0A6F785738FC95DCC72AF8A4303D2864E988077960E254043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 02acaeead7ee6736bfcdd658b7ba18f94e8201e3331ef4ed0e9fce81489ef141
MD5 00ca43fc60b6c2acca4149839741bcae
SHA1 17bc1cb0b1f12d57d92c70b8c8ed04b3b0f196dc
SHA512 9cdb5ace62d561bee1f341efcd63147986ecc92c60d00a860631adefdfdb3af1361ac2ecff3aeae954083c072f85d775f15e3e56ca39540e0982a986cde96545
TLSH
T1104141E14C3D2AD1D4BE0A6FA85B38FC95ECD72AF8A4303D2864D998467921E648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 83a81724eea1d6e2e7956c81701c86dceedb6ad82fcdf4a3d71526089eca6216
MD5 35db430b0192905e0d7082d672319b71
SHA1 acfa1ee333761447f76d874c2e3ba9416562bcf6
SHA512 f67f225c8edc091ee0fadab340d4a8fe40b75b96f8a0e4ed1a349f5b3ed95e5105c8806edc21ce18bdc05db9460dd48a9d642f0d948f18781979b04f9ba26c81
TLSH
T1164143E15C3D19D1D4BE0A6FA45B38FC95ECC31AF4A4303D2814DE94063961E658443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cbe91566e9cedbdc9cb801ba208f943b2d410b375c5b868e51af1133592d6f56
MD5 e9e1a9f110b53c70742ba72a774e852b
SHA1 018caf1201afcd781d922b37f3e3641ad9110f0f
SHA512 8ec69644feae9399e4b1be12bd77122c62ba6c796007e039c9e960c0ad09926f3e310b180faccb18da69d43b1153ce4963f78e69b505811f042d27d7a1a4c77e
TLSH
T152413FE14C3C2AD1D4BE0E6FA45B38FCC1E8D326F9A4313D6828DE840A3A15E658543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 52b47b5ce310968fad4f61f5918e01c117098365d05eb197d2ce75d5068887ea
MD5 9119d7fe249d16e4f58e11dc33dab059
SHA1 06518588e3135a10127361758a4f0a1f3fc9fffe
SHA512 e59ac4cb788c2b64f27f0a91d861d68d3ea8e1fff775cc6ccb21b08ae71044b56bd0c166852a90dd145ac70e2bae3d57a0c4ac107d76eb9a56839ba29bdb9845
TLSH
T14D4130E15C3816D1D5BD0E6FB44B38FCC2E8D729F9A4313D6814DA840A3A65E648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ef925966db8366b7f9b5dee086e97d4d35a0b7633580474faf8c831403869aa
MD5 f7b2213edcd8792b1f1bb7996e10a2f4
SHA1 b1265db1f77f2e42d2826e82b7fc708114d5365f
SHA512 0e8f382ea2be788176b01cca1a1693b7d362a22ce7ff077ac9e40c4530ae9ac3de09a836b7a25b78509c0bb793b0a7fe5a653690a7d50b879c40ffd35ad14710
TLSH
T18E4163E15C3D2AD1D4BE0E6FA45B38FCC1E8D32AF564713D6818DE54063950E658543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8afa839018354d722c42178e54a7c9eb19137f2a3fccc5588e2d22ac9781c4f7
MD5 69d74391605ca4194b16b7f263eabe55
SHA1 3556521c3db025226578c25d72c97981916cb1b7
SHA512 7a4c385a8b43d432217a87d2b954b381c1c739ad6fee440b10a0e7ab0a9000e1328ab69c86ab35aecee604a4a7bbc56afadd802ce9720e4d0d13d3971fdea3af
TLSH
T120414A58ABFA1158B3B77F5A9BF6A86D487B7C331E06D45D00110E4F4A23B40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tmuxgznf.default-release\activity-stream.contile.json
Size 4KB
SHA256 75ad02cd31680f36edf81dbd1c2ba933b353095089d6c83f7176f0e0e4a5dab1
MD5 bd525a0934ca7cf5b810877a6066507e
SHA1 c4a8d84fe0700f6e6d1b72a777ce6d1275b82e7f
SHA512 bc69e89c9675c48b50e2a6a540a15f88280291c4833b0b3f1e6b495e2a5d552829a481f8e7969de8567c92f89bb81630ada3c6047d7d1a18513133fe6e26e348
SSDEEP 96:KKiutowhDBdWyW88Dlbpf4ovTV73ImAkSl:Kqt/hFdWVvlb94ovTVGkSl
TLSH
T1D2A11CDF9C69C803037163E03D9B27BDB10B729BDBF6CC45BB848C15A2A565741EE840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tmuxgznf.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 f03e509840f6d46f7876d8bfae64b26ec76cb1c0da6fe58675afc2c32d42f1fe
MD5 3a13013c8f729f2a99651c0dcb51872f
SHA1 eb142901e006bcb79252d988f141cb53077c6dde
SHA512 ea5cd03acd156cdabba7934f9feec6b806f82b084d1a55f46f3ea93cc7c8731b9eeffd746fcb48f405e5469049541ad22f564284992b1ea1c276d9365533eb2d
SSDEEP 384:HbaFrLiO024YyFuhw+5EL1pPsac4j0lpDII+EwL:7aAZYyFuK+5EB9sac4ID8LX
TLSH
T16D527E7DAF0238BA1A2BD2D4D8A95205CE04D6BBEEE2D16606143C44C6847BDB4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3BF1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3BF1.tmp
Size 1KB
SHA256 e86f6c5ea31e5974841e8fde637cdd1c2e50e70c3db609acb77fd4edee2a948d
MD5 00f0c607f79a62f823ef8d9bd2c5b42f
SHA1 bc31ce96c810a756298266946f6f9dba85e839e2
SHA512 1e92b786fe29f8fcf85ea3d55cece1fa7f8cb51222f177875e43deb97535403ec0f6bc64520a772cc4d0563868a8dcf7721606662938a01006e5e1977ccacfee
TLSH
T17541530083E84B1BF172433119F74B1DA774FE569E9A479EB584422E2F53780DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

TMzpx.dll

Path C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll
Size 112KB
SHA256 47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed
MD5 2f1a50031dcf5c87d92e8b2491fdcea6
SHA1 71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f
SHA512 1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8
SSDEEP 3072:LrNI5AiELn1Sf6T2JFRwkzDyc69rJMWI/S:LBIcA3JFR2rkK
TLSH
T1DCB35B1BB7E500BBE1768239C8635A06D776F8120621DB6F03A4469A1F733919D3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qhkx0bu2.0.vb

Path C:\Users\Admin\AppData\Local\Temp\qhkx0bu2\qhkx0bu2.0.vb
Size 77KB
SHA256 a7ac83a49e36c21682a5dbdfc2da3dbd43f6c5b56917b9014e260191509a00e2
MD5 f17aad51826114843ea3c8f26d84ab02
SHA1 edd0468733104ca6f90ad53addceb100371cc002
SHA512 811c9e72aa95fc58b6a2e0efd254575f6f03b32f318356120eeec2fa00768496c2f21154862923e1f874072c6aae65008ac36eefd8beac26847b247508916915
SSDEEP 384:1E2jj7y30LMdemXV6Ft8LoDZsYRxqkAK543s+GNnNNKmmWeckarZNZkaFnlidI1q:IpM9qMfKqz3FiZqQccZPhkGFoAJ2Drq
TLSH
T1A173A6273C0756B44AFF8D04AD1FB54AFAA2162371385850F48CA2E54FB65CCE3A53E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qhkx0bu2.cmdline

Path C:\Users\Admin\AppData\Local\Temp\qhkx0bu2\qhkx0bu2.cmdline
Size 292B
SHA256 86ba1b0f6dd8d8ec7bd066ff237da770074b9c0aeb76a401869057e8a74c85f2
MD5 a51c497eed44f16b8b03e19f88a3068a
SHA1 9d51b55251349b62453606bc2fd6cd2534c40f26
SHA512 28bd81d6fc7ea74ea9fa86dd437e992b577d120e4de25ba7e949c7e16e56922a423f0c2b35f80b02d6670ffe78f83ac60371db96b89e928b26d422d3cac6fc1b
TLSH
T113E0C23B02BFCB6C5228448B04B5D5ED52F34E232909BAA49581C898952F0947BA1E06
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbc32AE1E11FF5F4371832DC04ECE948221.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc32AE1E11FF5F4371832DC04ECE948221.TMP
Size 1KB
SHA256 21b6a69a8df9abb66813152e7a5b63224a3527ca77fa7be27e9e512fe6152617
MD5 af2546c23c8fc80b9ab6586ee37118c0
SHA1 030b8d0786fd512bf035f664418648ba72e5e0ee
SHA512 a3894b3521342e61502527e8d1d88d6d87fe50ad5794d09ce37ba2c64e2adf89f3cf77e9fd3e868ec8cd08546400b701833ba88bc8d6c8a429983e687d250b01
TLSH
T1EB21E240A3E8421DF2B3473029F183629269BE679D6D43EC7488175F2F26511C5436B1
MD5 SHA1 SHA512 TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 5KB
SHA256 a6be097b6d65c1351024efe197f4f8faaf94cdeb507b359a21840e5bd4037ed8
MD5 6849a71e903d9b30f5bb1a2768a5b63e
SHA1 b2f78816ab1d1b37f3cbbf1926ce2a05752621a0
SHA512 af819b178dc5d58e3f20ec34fd26d141186f0343f3ff4d2739f90dacedd602f22b0a277a8ddb4c45b9a7b8e7770e191bccfd549b96a018191b7198ee12c96814
SSDEEP 48:IjvdUHJ5UgdwozeGvdUHJ/6BdwAeIvdUHJ/adwiq:tpcp/pp/D
TLSH
T118B1AD011BFB0995F5F393313631B7129777FD019B1B026DC285924909323A085AEFAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 86b049b9e805241e253c50cc329b74054accdfa2106779dbad81c244d1a10be5
MD5 f46d3c9d57b1a7d919dff7a02095243b
SHA1 83efc603cb1701af18c8a61b0e47576c04deebe5
SHA512 eff4fac6470a34c2338982a41e112123f51476212f2d95d33979dcf35a139b3ab1de54529e6be2921843fb1e29c1e92dadfeb271dac5f1f7ccca5f56bf6094cb
SSDEEP 192:5Ov5zbo1bTryjXpb1d66Joz1zgCl6mc0d:Wbo1bTryjrd66Joz1zgC1j
TLSH
T134D1CD68E639563BC414423BCCB61B400F76385AD88E7F2932EC640D2DA63DD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9a9bb239bd3004ee14b9fc9670f3bd26316233ebf2559c9aa5a72965d624cad7
MD5 c67a2baf981881c60e1ba2ee9d293393
SHA1 f36207d8501c86d430ebaa542f5550714d89e654
SHA512 bc1607a4146153fceb1e269ab5f4097635dad78e8dd755d02a9e93694e60064081dc8666eaa065614d2d749f31dcdb080ab46a72b35b60ace1fefe4eca23c3f6
SSDEEP 192:rb1d66Joz1zgCl6mc0dhOv5zboAdZTryjXI:td66Joz1zgC1jMbosZTryjY
TLSH
T12CD1DE68E639567BC418023BDCA61B400F75388AD88F7F2532DC641D2D963DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 95fa169997591c47504c0f01ef2a6ebc6c58942e95589e280565f1847a5e87d8
MD5 6871fa9e1851f4bfa6e1a29dc808e4d0
SHA1 aa81191822524af79f9a1d47e1b0b670e3933d6b
SHA512 cbd6adfb67c9315a83f459c29849672fcea4e4abfe12696b9ce944352ca18f7054ff80ca5eac86a2b51b73a30a24b80b66ae4314ebf8e496822ddc0f8708f5e8
SSDEEP 768:KPYSIEFlqE2q6GcmhunGWqDKPakAP0NZ8iafbebFbPbTb3bobgbAbPIj8KZqd0ds:BEFlqEeGPDTIj8KZqd0dGD5
TLSH
T186130E44EB1A963FD82812BBDCE507002F39F889551A2F67365D64687C872EC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 8c3de27dddd8b14e7b2e482fd7da54f18f9778f8497cae03c2f44e1050c50b10
MD5 3543e0c3c8a1fc7417b3fa9a2d2de0eb
SHA1 be540901e580a1932a51bdb98bdb5b3616087e1d
SHA512 82fc75fd7da3fb4756f4c4adf4aa7e18fd90b9dea3fd84a388190e05d7261595d004c6a7d10461b23812859c967408f043a5b4faad10b5fd1ae9a89180d7504a
SSDEEP 768:KPsEFlqE2q6GcmhunGWqDKPakAP0NZ8iafbebFbPbTb3bobgbAbPIj8KZqd0dGDv:NEFlqEeGPDTIj8KZqd0dGDv
TLSH
T148130E44EB1A963FD82812BBDCE507002F78F889551A2F67365D64687C872EC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 522b4e4a17e32723bf64d1b7470d84bc66780ba4b3ce0b085dcd662919ff633a
MD5 d3dfaf10c1438f82a8a05788297e30b4
SHA1 3e29f3da17fbb0e9cba24d30ede0215d60df25d8
SHA512 83385d900692c5f9e271e1ed21cc44cce3cb548b15e7265321e7c45356f637762c4a4e856381c4e5d24e38b6fe3e70fb04a60edeb260956e9e154695871bb514
SSDEEP 768:zEFlqE2q6GcmhunGWqDKPakAP0NZ8iafbebFbPbTb3bobgbAbPIj8KZqd0dGDjPt:zEFlqEeGPDTIj8KZqd0dGDx
TLSH
T123130E44EB1A963FD82812BBDCE507002F38F889551A2F67365D64687C872EC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 9030d9740077e3c7010cad3c93629d68a74000e3c95a8e250252807572df0ff7
MD5 c58b190c9668d933bdb2188e863b84e6
SHA1 5913cd97101a0f911fa2f20e166b28d2ccdb5715
SHA512 2d88d1ffab205da01c1b2741494aa2124eb574da4b6d6c050e605cc86341b62a7f74aa7db50347eae6904eadeace80415bcf225afff71fcc2187bd7c3f23e7ff
SSDEEP 768:hSBPPEFKMF54Gcmhu8yWqEKPakA70NJ8iXBbebFbPbVb3bob9bAbTIj8KZqd0dGN:MEFKMFRyPEhIj8KZqd0dGD5
TLSH
T158030E44EB1A953FD42812BBDCE50B002F78F889551A2FA73A5D64787C872DC3D9E06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 854f5ebedda2fa81672e0b08bc1672ad5ef20863f96fd3eda6eb28b95b7b2ec7
MD5 9687d198da96c6696da99b715b08168d
SHA1 bc2ee7303660c289bd8338a68cccafc3431c4bc2
SHA512 3e2ce0ce560cdfb95afc83b6996c0155d900f0a66b033afd516fa1c8377447d90c75515198600d6f300938a565ffedadc67edc1a72c22d8e1ec3fa60187568cf
TLSH
T108214F5C39F94D2AB99BE29CB481078E53518E065C871D438E02DF8DCDC5ED9326983D
MD5 SHA1 SHA512 TLSH

Submit Download

558e23f6-2486-468c-9395-672b5c1c3dbc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\558e23f6-2486-468c-9395-672b5c1c3dbc
Size 235B
SHA256 2ac142c0a19c04d3c1fe6801468aab4d98fa436ccfd65f70dda78ee86f5416dd
MD5 9de5814be81b84f37d0d7715e54f1b09
SHA1 b0a1d5cdeea66626efc0b11c763fa93f166fd0cf
SHA512 68b629f37a1c635717816aa37b64149843c98d853f8c9841208916d436e48af2afe21ac6ccac2b0de92b708cf41cbfcf11b2a3da645e71ce6e1c9ede2587bcb5
TLSH
T109D0979928A8273D08140F03F0E078C631844C3310A468508AA21875A9B9DC84271C17
MD5 SHA1 SHA512 TLSH

Submit Download

a0850476-80a1-48ef-9c3f-0bd3257f8b36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\a0850476-80a1-48ef-9c3f-0bd3257f8b36
Size 886B
SHA256 bd0eb4ee8070110bf423d47bc80f76d0dcad08f05edef3e7d865c6a47f5a71fb
MD5 069975e674e77eda2360d7a918b08310
SHA1 ca894ec0a9163d2effaadb3974ad49e37ef7eb58
SHA512 51fe82dd060de23a8bc91b5017756a2f3e6b775902c550edc72f61cc6593a5ebe0c2972c1616f0f31045b2ee7e0f5cfd73ff2010009126a9ff5b28347a4110b3
TLSH
T1E61100808A34BDB1CC28E2ABC5A1B74747E07023C0C69D1C3EF95A184DFA65D9397607
MD5 SHA1 SHA512 TLSH

Submit Download

bf404a52-6f8f-4488-82f8-319ff64ffc11

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\bf404a52-6f8f-4488-82f8-319ff64ffc11
Size 883B
SHA256 c8f9c1d420c94c4549a300bb92b13a5ef92506e6f65ea2428afab9d5f19f3bcd
MD5 f4827099d9debc182c0ec4294dabfa1a
SHA1 21d37c4768b4664cde2cfe947d010ce58669c5ed
SHA512 4543c1f0058d4a327e2454998afe96bcc60d582dd0421210cb493df10c47bd4a1546e145a0d53130ee5a3b0bcf1eb44f36abcc004c88cc73899bdf70084a970b
TLSH
T142110085D730BDB2CC38D25BC5A0774647F47423C0CA95143EB459044DBAA69D76760B
MD5 SHA1 SHA512 TLSH

Submit Download

c578c07f-4223-488c-91e1-5af4a84ffe1d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\c578c07f-4223-488c-91e1-5af4a84ffe1d
Size 2KB
SHA256 c6c6a19bb3e3027a776ae3f0eb56f893bf4afd76269bcf6f06009f7550513670
MD5 08d60cffb0614622a38677aa2d545eb8
SHA1 45d5fcb1378cb2dac64f1d7064bdcea703cef828
SHA512 4a77d187e895781eb7d69e7aea9bf9e25d1c3509a610d2a583ace5334e0a55b3aa1e4267a709dbeb5de7b63a2b76133fe90db19deb2830c7a24357f97108d964
TLSH
T1C15186698270DC79C979B31BDC2437828BF2140A80CB290EAFECAE0A157FD5D9359645
MD5 SHA1 SHA512 TLSH

Submit Download

d5291a89-f6c4-4f25-99ed-ec926850490e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\d5291a89-f6c4-4f25-99ed-ec926850490e
Size 2KB
SHA256 88d958bef8ac371090f0b8bb4f710b8c9d786dbe87a623fffa08a9f3eb93e093
MD5 5fcf70203dc7e5206d1ba44ee2023b28
SHA1 0780e21fc38a778113abbea142324a2e36fb8b75
SHA512 9947637e00cbbcb8609cc87153df7a34f854f0e1115ca45a7ecc139127cb5b5e89fed28c7d97a53e8b874e198b62ee059cc5d48552853f1b569538c3948b1682
TLSH
T12D41215C39784C7A8CD6F55D9442378D57A08A0A40C26D832EA1DF0C8ED67DD63AA43B
MD5 SHA1 SHA512 TLSH

Submit Download

fe60d1ea-3c20-4219-bca6-142615da0ad3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\fe60d1ea-3c20-4219-bca6-142615da0ad3
Size 235B
SHA256 bd38e384e62e1602581174b5001cffc536472962b882c76ac2c9cbc98cbb35c4
MD5 a8da527be218c1fdf3b82e12991d481c
SHA1 bc1382c90e7f503bedea43e567fbe6381986e9bc
SHA512 c5d8934e9cea80635fb3ff0f94125666083fe811a763908916ebce5ca1231b4c0f9f96139dc14d50c161ec4e21f52b84632031dec1a72e3fa375b2f8cc3f53f3
TLSH
T16DD097C024D8A72E08190F02B0E46DC631858C331874A814D5A0093C8BBE9D89222826
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\extensions.json
Size 16KB
SHA256 47009c3d17dff1b706028eeb2fc9e19b5c7a40d84ae8106e320911892456a9ec
MD5 7b1bac1738c48ff75e2876860bc50abe
SHA1 aedb78b24268c5a2af74b7d95e87a07d65097436
SHA512 30ce31f6df718ef058cd09105ae46b367c679f0d5f642095e7ad64bb38079f893c408eb1c82d7b5204b254afd713299e1235a26ad609951d2171d5a5f931d595
SSDEEP 384:1kI4vaUmldvPC8dhWC94zP96oNL4H9L4PBL4H1L4HYL4HNc4hX:mI4CRfX/XL4p6C494B4V4a424t
TLSH
T19272431545049EB8294EA79BAA367E01C37D473B60845C38F4DD8FC842FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\prefs-1.js
Size 6KB
SHA256 720e049f5ac79805c78b334925d770f1f065e9509b341e1905c08313e2f5e413
MD5 bf7c39dcad7ae86eb69f9cf248b29a24
SHA1 6b88fecfb9b408e633130cba670a6b1f20052b6d
SHA512 0dce98cc9e3aafcc6f05177234a379178b717e8bd1ce1b0bf0c9358394efdf2d592ab2f5df8b5f6aae7d0d2afbfc9070b82867da581e4ad183fe54263edd0d5c
SSDEEP 96:xHJUTUiqGqQfTzpObzS3SSlddv9janrHX97ti3Bw88P8L4cnQVlz:H1RQfTzpdSSSX97tsBw8857
TLSH
T166E12F7890088B7F78B67B6CAC688C715AB2013BBBBF68D750B55485050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\prefs-1.js
Size 7KB
SHA256 4898715de9af8207309e14dc274c2aafe81ab429074dad71852ffa20c15bb8be
MD5 d4be94e0a793f6ad371f4dbc5ed91f7a
SHA1 fd908fbf5f59beb4b7bafe9f163257ddb5514de1
SHA512 63ddc5498320a7dec030bd80728cbbe6c66ad7a5844e90e01d97be71b2c47d34167e6014270ca79542b1b8d2942e6a4e925f00c065d0074d1dc97e520afed48b
SSDEEP 96:xHJVTUiqGqQf3zpObzS3SSlddv9janrWRwr97ti6Bw88CWp8L4cnQVlz:HoRQf3zpdSSXRa97t9Bw88NT7
TLSH
T1DDF11E785004CB7F74B6766CAC288D715A62023BBAFF68C755F944850548F3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\prefs.js
Size 6KB
SHA256 d5fa6e7c8f3b680eded7e8751935df75d42f550fe8a9993efbc2f632ca48d167
MD5 4b570a8ad751e601ef5915a80a55fb14
SHA1 6677309315d3e7947ea0a8bf641b11d7d106e5af
SHA512 11207e5c770f019a6225c14b97edef8e04020adacdf17d331a336cf1f1f91faae9a220f9f13a7d42cb1b4cb7b523aeff11c8736bc33c695487d535ff0158044c
SSDEEP 96:xHJUTUiqGqQfTKjtnjh1zSmxSSlddv9jv8nrHX97ti3Bw88P8L4cnQVlz:H1RQfTGVzxSSD0X97tsBw8857
TLSH
T1E3E11E7894089F7F68B67BACAC6888715AB2013B77BF68D350B54485054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\prefs.js
Size 6KB
SHA256 1d564865295c363aa6f8fc1434d3f73a26c33791691cef37bba238e38108ae48
MD5 c4c8a5be91b916f16b65e2c203a5c901
SHA1 3af6de993c549370e55d175546d6dd53e372f4a4
SHA512 a0324d0b31e6f9358058ee9c6b9cbe9f3509c73edc7577f95eeb91e3c03a17d62922d8598d804115f2df99fe384bceda0a351777e942fca7445dc93507c2e6f6
SSDEEP 96:xHJUTUiqGqQfTzp1zSoxSSlddv9jv8nrHX97ti3Bw88P8L4cnQVlz:H1RQfTzpdxSSD0X97tsBw8857
TLSH
T185E11E7890089B7F78B67B6CAC688C715AB2013BBBBF68D750B54485054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\prefs.js
Size 6KB
SHA256 4aeb3f0bb9946c5209b3cbfdfb92d5f8fb2cb271d581f9cfb4b0c68b7400a589
MD5 ba159efebf9a9fea71e244b6ca8416e1
SHA1 3f688249faa290e1cb63ce028284f3962a77cdf4
SHA512 1078ea4e5a398749d46cb0153bd9ef6a7d718cccb14484937fbee22271021954c694af706e09d68f4ad456a803a94cd358eae1f3c23abfe74bdc384f0d4a347a
SSDEEP 96:xHJUTUiqGqQfTKjtnjh1zSoxSSlddv9jv8nrHX97ti3Bw88P8L4cnQVlz:H1RQfTGVdxSSD0X97tsBw8857
TLSH
T1BEE11E7894089B7F78B67BACAC6888715AB2013B7BBF68D350B54485054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 3fdb51323a288688c6760dcb5078ea98f72239871c790d3d37c0c9f982380195
MD5 709a58f50e8e333c2208a9a682485b02
SHA1 fba7a5fe283b8837e2c7b655edd6669bb5da11aa
SHA512 1058ee5afcf8968b851fa1352348d8947e47e3661006133b8df0d30d1da3f85837f62538a643d536586bced9a5f5f45b506a192d7bc24473be8ec76d869f945b
TLSH
T1A821EA46DF2B7DB23509C18680CA5FD4F7A670238174A4F0ED945B0106C450E32C920E
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 cdb5a8d207eba9348eb2ac47c9e5f3e80153d4c7cd37bcaab0501d0437fc3639
MD5 aac2a75309990e97c2175028370df942
SHA1 d340315a492ac2ca3eabcd2126677dffa03475a8
SHA512 47c9cb410f74a5f0da2fc6fe3065ee95918bea69ca2cb18330b07ec65da3efa41fa53c7dca1ca37c776ff4bd1f1b4a62b1fb3dac213501c7ce2eb1e019ee71ff
SSDEEP 49152:/mkYRVaAIoW8zN6wlJOyUlx1LA0s3KiSMwtKwGuVMAwAuYzu3T8PxAuKyYG8XeTq:ngMHk6JmrYVHgqLB4P
TLSH
T1E9565DE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.8MB
SHA256 f2193e758cad7e177b9a2ad8169e116fdac73bcf51bbd47ad5d4ef0678407dba
MD5 ff1c6b7fe3f89e7a063d01a840e9849f
SHA1 262660658cc2e859338960eda82c41104b340398
SHA512 725c2cf479fe8ed2cce84b68fb0a2fff3e81bb7a21a221b6ffefc5728cb57c76b411de12f6d4dbe091adcf44c9cfe0586a20295141f1ae361ad1a4d2dd77206a
SSDEEP 24576:AWHdVB6zA9u2nDDYyBnpTJESRy66HrJOJE127qOPvl0cKt6sXYDIA:AWHAARnYy1pTJfurYG127qO10cKYz
TLSH
T1A3063AF460D2A397F3418037A64593EB21AFD00C6467DE440BA956F895B8CEF9E05B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 974b56f461fcb383dfcb188ebb4b7b4c33600a112065359dc1cf0957c602f549
MD5 08ab54bfae54fd2a0a3a573f6106c8b1
SHA1 7c0f6ad3203182426f4c8f0d21670aa4b2b1f80c
SHA512 8cb2137d66604f6e30e39124f825d355421d916127eaf30c463d47d97f57480b19afc3e24a419238f830078f3a91c1ff276522eab56c18484ec7293756690075
SSDEEP 49152:Ho2AMKWYWSQlTJfurYvy2RqLevKKVYntZb0xc4xDIa+pXUHR8a3tF66Q0hlLH+cb:ITyrBRJmrYvHRqLiUt
TLSH
T128565DE420E2D252F38540B3719A53FB10EFC01C60768E44579896FAA5B8CEB8D977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 7bfbe095d9a1b3e2338fa5e600c5d7ca9849d86742d94447c6141ede5f1ec4b8
MD5 d4f1a072a4eabd376f88885d8a0a1327
SHA1 aa432d92d912ab0334f2207547a453b5a0302f96
SHA512 41d96631a0cc56a16b931ec8eef8c96dd916325075fc81ea89c8c94fd56f3bb5343db9f1a5f4a88d61b2e3438790b0786431db29c9a63cf91704aa21b08763d1
SSDEEP 49152:hmkYRVaAIoW8zN6wlJOyUlx1LA0s3KiSMwtKwGuVMAwAuYzu3T8PxAuKyYG8XeTo:pgMHk6JmrYVHgqLB45
TLSH
T16C565DE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freerobux.exe

Path C:\Users\Admin\Desktop\freerobux.exe
Size 34KB
SHA256 0330dbe50dfbaef7fcb33302c480e8344ddbda1087996d751e3c381888d5299c
MD5 f812ee7776ebf83500f8a0ed88fb0a98
SHA1 c83829c9e8ef4dfe508179b288f3b7ae2c5d0a78
SHA512 4fe05ea40ad8299f566dd28c805e926b96116adbf5cc7cf978ba978c04b1006fe570cf1e09d29b17f641f943911c414a8c8c6e7751871eb80063aee3ad9cf2bb
SSDEEP 768:qiosnhTYeQGtkLQ1kYkTa0ybRFy59XTL6LOjho9vL:BosnmehiU1kYkTzytFw9XTL6LOjKvL
TLSH
T1C2F23A0837D14622D6FD6FF52DB3A20A1274D6179917EF5E0CD885AABB73AC187003E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_1219256587\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-620-0x0000017D7F1D0000-0x0000017D7F1FF000-memory.dmp

Download

memory/544-10-0x00000279CDA10000-0x00000279CDA2A000-memory.dmp

Download

memory/544-11-0x00000279E6FC0000-0x00000279E7BF8000-memory.dmp

Download

memory/544-340-0x00000279CC030000-0x00000279CC040000-memory.dmp

Download

memory/544-328-0x00000279CC030000-0x00000279CC040000-memory.dmp

Download

memory/544-326-0x00000279CBF40000-0x00000279CBF6F000-memory.dmp

Download

memory/544-327-0x00000279CC000000-0x00000279CC00C000-memory.dmp

Download

memory/544-325-0x00000279CC030000-0x00000279CC040000-memory.dmp

Download

memory/544-565-0x00000279CC030000-0x00000279CC040000-memory.dmp

Download

memory/544-1-0x00000279CC050000-0x00000279CC092000-memory.dmp

Download

memory/544-21-0x00000279CC030000-0x00000279CC040000-memory.dmp

Download

memory/544-20-0x00000279CC030000-0x00000279CC040000-memory.dmp

Download

memory/544-19-0x00000279E6BE0000-0x00000279E6DD4000-memory.dmp

Download

memory/544-18-0x00000279E8400000-0x00000279E8FEC000-memory.dmp

Download

memory/544-377-0x00000279CC030000-0x00000279CC040000-memory.dmp

Download

memory/544-2-0x00000279CC0E0000-0x00000279CC108000-memory.dmp

Download

memory/544-9-0x00000279E6340000-0x00000279E637C000-memory.dmp

Download

memory/544-8-0x00000279CC120000-0x00000279CC126000-memory.dmp

Download

memory/544-0-0x0000000000DB0000-0x0000000000DD0000-memory.dmp

Download

memory/544-3-0x00000279CC110000-0x00000279CC116000-memory.dmp

Download

memory/544-1416-0x00000279F3D50000-0x00000279F3EB8000-memory.dmp

Download

memory/544-7-0x00000279CC010000-0x00000279CC016000-memory.dmp

Download

memory/544-6-0x00000279CC030000-0x00000279CC040000-memory.dmp

Download

memory/544-4-0x00000279E6280000-0x00000279E62DE000-memory.dmp

Download

memory/544-5-0x00000279E62E0000-0x00000279E6336000-memory.dmp

Download

memory/1356-1427-0x000002D7B3250000-0x000002D7B325C000-memory.dmp

Download

memory/6468-1430-0x000002D3DBDC0000-0x000002D3DBDEF000-memory.dmp

Download

memory/6468-1431-0x000002D3DD7B0000-0x000002D3DD7BC000-memory.dmp

Download