hxxps://www[.]mediafire[.]com/file/l2pz84tyfxa0gtg/slip020030420530010[.]JPG[.]z/file

Analysis

user interaction
yes
max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/l2pz84tyfxa0gtg/slip020030420530010.JPG.z/file
Sample260424-h68fyscv3r

Score

6^/10

discovery persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping436_765404232\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping436_1494090409\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping436_1494090409\protocols.json	msedge.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1736	msedge.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214889610574863"	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{DEB934D8-8748-453A-B1B4-4EF26DB332F0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\z_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\z_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\z_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\z_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\.z	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\.z\ = "z_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\z_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
864	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	firefox.exe
Token: SeDebugPrivilege	2124	firefox.exe
Token: SeDebugPrivilege	2124	firefox.exe
Token: SeShutdownPrivilege	6988	unregmp2.exe
Token: SeCreatePagefilePrivilege	6988	unregmp2.exe
Token: SeShutdownPrivilege	7040	wmplayer.exe
Token: SeCreatePagefilePrivilege	7040	wmplayer.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
7040	wmplayer.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
864	OpenWith.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe
2124	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 60	436	msedge.exe	84
PID 436 wrote to memory of 1736	436	msedge.exe	86
PID 436 wrote to memory of 3408	436	msedge.exe	87
PID 436 wrote to memory of 4260	436	msedge.exe	88
PID 436 wrote to memory of 3408	436	msedge.exe	87
PID 436 wrote to memory of 4260	436	msedge.exe	88
PID 436 wrote to memory of 4260	436	msedge.exe	88
PID 436 wrote to memory of 1108	436	msedge.exe	89
PID 436 wrote to memory of 4916	436	msedge.exe	90
PID 436 wrote to memory of 1108	436	msedge.exe	89
PID 436 wrote to memory of 1108	436	msedge.exe	89
PID 436 wrote to memory of 4916	436	msedge.exe	90
PID 436 wrote to memory of 4916	436	msedge.exe	90
PID 436 wrote to memory of 3944	436	msedge.exe	91
PID 436 wrote to memory of 3944	436	msedge.exe	91
PID 436 wrote to memory of 3944	436	msedge.exe	91
PID 436 wrote to memory of 2576	436	msedge.exe	92
PID 436 wrote to memory of 2576	436	msedge.exe	92
PID 436 wrote to memory of 2576	436	msedge.exe	92
PID 436 wrote to memory of 2392	436	msedge.exe	95
PID 436 wrote to memory of 2392	436	msedge.exe	95
PID 436 wrote to memory of 4324	436	msedge.exe	96
PID 436 wrote to memory of 4324	436	msedge.exe	96
PID 436 wrote to memory of 4872	436	msedge.exe	98
PID 436 wrote to memory of 4872	436	msedge.exe	98
PID 436 wrote to memory of 4668	436	msedge.exe	99
PID 436 wrote to memory of 4668	436	msedge.exe	99
PID 436 wrote to memory of 1432	436	msedge.exe	100
PID 436 wrote to memory of 4648	436	msedge.exe	101
PID 436 wrote to memory of 1432	436	msedge.exe	100
PID 436 wrote to memory of 4648	436	msedge.exe	101
PID 436 wrote to memory of 4648	436	msedge.exe	101
PID 436 wrote to memory of 1728	436	msedge.exe	102
PID 436 wrote to memory of 4196	436	msedge.exe	104
PID 436 wrote to memory of 2564	436	msedge.exe	105
PID 436 wrote to memory of 2564	436	msedge.exe	105
PID 436 wrote to memory of 1460	436	msedge.exe	106
PID 436 wrote to memory of 1460	436	msedge.exe	106
PID 436 wrote to memory of 1268	436	msedge.exe	107
PID 436 wrote to memory of 1268	436	msedge.exe	107
PID 436 wrote to memory of 560	436	msedge.exe	108
PID 436 wrote to memory of 560	436	msedge.exe	108
PID 436 wrote to memory of 2428	436	msedge.exe	109
PID 436 wrote to memory of 2428	436	msedge.exe	109
PID 864 wrote to memory of 4488	864	OpenWith.exe	118
PID 4488 wrote to memory of 2124	4488	firefox.exe	120
PID 4488 wrote to memory of 2124	4488	firefox.exe	120
PID 2124 wrote to memory of 2080	2124	firefox.exe	122
PID 2124 wrote to memory of 2080	2124	firefox.exe	122
PID 2124 wrote to memory of 2080	2124	firefox.exe	122
PID 2124 wrote to memory of 1028	2124	firefox.exe	123
PID 2124 wrote to memory of 1028	2124	firefox.exe	123
PID 2124 wrote to memory of 1028	2124	firefox.exe	123
PID 2124 wrote to memory of 1028	2124	firefox.exe	123
PID 2124 wrote to memory of 5240	2124	firefox.exe	124
PID 2124 wrote to memory of 5240	2124	firefox.exe	124
PID 2124 wrote to memory of 5240	2124	firefox.exe	124
PID 2124 wrote to memory of 5240	2124	firefox.exe	124
PID 2124 wrote to memory of 5272	2124	firefox.exe	125
PID 2124 wrote to memory of 5272	2124	firefox.exe	125
PID 2124 wrote to memory of 5272	2124	firefox.exe	125
PID 2124 wrote to memory of 5512	2124	firefox.exe	126
PID 2124 wrote to memory of 5512	2124	firefox.exe	126
PID 2124 wrote to memory of 5512	2124	firefox.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/l2pz84tyfxa0gtg/slip020030420530010.JPG.z/file
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7fff4c67c188,0x7fff4c67c194,0x7fff4c67c1a0
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,18156956063188358151,8707989495569176848,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,12240778137542590934,13724035639262584695,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3850597088454476635,4144255664488440922,262144 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12888054558520039207,8886217326303124303,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,11028964644686045835,13356792510369075379,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,18418961163712650061,4837260643307969920,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,4558218475486215859,17573503584577807788,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,2318998765755680415,3604882524043875163,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5390426505804694963,11923125866427818005,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,17205045172102842220,4413947651477425098,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8308101029254466088,8281760236055619288,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,7804805722109575274,5512942586713572078,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6048,i,12578288239401070599,17737204999897726016,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,9985000311818094612,4069001045475747354,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13351661341011536833,15361209268840271526,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13351661341011536833,15361209268840271526,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,16640629873981465233,15427232119171170927,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,6836998238795216644,7795058185040592751,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,5171623897374385629,10265340605909932369,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,3328390141775291132,307352807680657043,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,461174341418995730,612140404117545285,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,30527839712817023,13432353260833533367,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,12268262308401252462,11184915813362406284,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,64166273640084149,17732851630744808858,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,8757250095004972257,3053786776672849381,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,2823127673707881277,203634857885924340,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5906130862565786497,2359138335218793489,524288 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=1224,i,18003695221940712976,14789848258432750594,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6100,i,3998616274815908851,12247508666264499578,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:6612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4312,i,13677536555564252747,11204282505836089966,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5768,i,18281951228672926463,13062506754979346916,2097152 --field-trial-handle=2500,i,15636153988283135068,449355215186594259,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\slip020030420530010.JPG.z"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\slip020030420530010.JPG.z
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2112 -initialChannelId {23f3cdcd-f628-45b6-89e7-77a68ecd0a54} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27135 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2524 -initialChannelId {ec8e09fc-9a8c-42e3-b399-98a63dd3fb8e} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 27276 -prefMapHandle 3752 -prefMapSize 270279 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {62825f91-f7bb-4228-a6ac-ef2cb1e40056} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27276 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 3748 -initialChannelId {fbed20b2-c87c-41e3-a14f-8deeb8a1e905} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4340 -prefsLen 34775 -prefMapHandle 4344 -prefMapSize 270279 -jsInitHandle 4348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4356 -initialChannelId {b6c94ce8-43fb-4ce3-bb63-30bae0059c90} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5512
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5116 -prefsLen 35012 -prefMapHandle 5144 -prefMapSize 270279 -ipcHandle 5136 -initialChannelId {8d43827d-48c7-4a88-94a2-d63f7378fe21} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6500
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1620 -initialChannelId {b520b8c7-f236-46ea-8f31-058fb3145d45} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360 -prefsLen 32952 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5388 -initialChannelId {db1c8c4a-513e-4d14-8f26-7723caa212c5} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {c7c619da-fc9e-4679-8a47-9815fccfb19e} -parentPid 2124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6900

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\slip020030420530010.JPG.z"
1⤵
PID:5628
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\slip020030420530010.JPG.z
  2⤵
  - Checks processor information in registry
  PID:5644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\slip020030420530010(1).JPG.z"
1⤵
PID:2560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\slip020030420530010(1).JPG.z
  2⤵
  - Checks processor information in registry
  PID:3348

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" C:\Users\Admin\Downloads\slip020030420530010(1).JPG.z
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:7040
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7068
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:6988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=120764&mpver=12.0.19041.1266&id=C00D1199&contextid=83&originalid=80040265
  2⤵
  PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping436_1494090409\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping436_765404232\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 538c1a0bded49157881b1c0e111a58732912def07977f599efb60ebb986ecbbb
MD5 2e5f50c6e7cd1b1d6049d9d3e57a9866
SHA1 28319f3d040fd1e80776d82fef3baa00dc34dec2
SHA512 1a56a7d8e7dc2aa514d9d57d40d74133033bdabf84bd35a3b65f0b62eeda07a00060dd4058de9c4703a2c70d201c867647a11b5cbacf4bb2c1ee4acd92d13058
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3a50f242ed7ce95df5cbc05ce6ddb8db9a955d687e026a005f48022f9ee56c44
MD5 71bf0c7224efdfbe3da46f90da204999
SHA1 143ce408c4c90f6ae9e79f17231cb4fdb96c2740
SHA512 6adc37b06253b007865a737b3f50ce6a645eb9c1bb1f7130820d9bc297c1a27acb4b8343a8515110f8410a4c2e990b7ce5c7c8a3b13f6502b5519c845723d3c9
TLSH
T18D6109D8A19D802CE3E4417F66D126AA71F2871E44770E51F3F0067DCB1FB1161B0728
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586d2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586d2c.TMP
Size 3KB
SHA256 b2cb346cb53c48e83d1e06359fce01a3238f17a4d6083388c86c1023b673a7c5
MD5 e690b9de706377d62651cfb413caa2fa
SHA1 7cf361fbaa13b755268c51410fe789424c1360d2
SHA512 1141bfd5b8d568ea7cbaa588f1d770b934324fffcb3c04ed4bd1b6536c71502f50469e1670ddeed7b3b87140ce80b8b5a95fff392030132544da82c51a46ade6
TLSH
T16261F9D8A19D402CE3E4417FA6D126AA71F2875E45770E52F2F4067DCB1FB0261B0728
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e0b941a5d0b3a04bb2796802825c3be38fd3b46f493ec29b25a25b46dfcbdfe9
MD5 3ff82e123e0ebefa760f11c0faca3b93
SHA1 2b08a7405d97abc444f0ce255868e7ab4b29c34f
SHA512 a8da2a970da77b620fd439404d62fe57ba7ef35dd5231f9890b078d05860f9c077ab634e73ea30373caea02824527ed98dee5f58b6aae5c04cc2a312c52f6aad
TLSH
T1F951CEF7C3E4856E891156F0AB287E2BCE1D0A14832C3D5AC8E4EF5B93E2471D14595F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 27f599608c339676150e2deb7567b9e2410ef24fd01f84deb2a2e49eec92d84a
MD5 807d44de3876b1297f97fe8766958856
SHA1 36edcbc3ceb91c8949b8e03b7bf3d2742d421dd4
SHA512 30dc06023c911c142cd79b9d9a994586ae64f2b397f1ed17a7792cb460876d7adf96361839cd285a962045fc9822fab8ce5552ffbb09e40531b0f113c42c547a
SSDEEP 192:sxZlRIyM//K1Ml8M9Y/fSskmZLWjGcIdpJHW6+WNGYJ0SU6Ig4J:sxZl+1Y/fSskmZKyFJHbGyc
TLSH
T1E452F915AA34AA77CCCBD209BA557F53D6F91573A2901D44ADFCCB0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 33eb52ca4ba12fa7a602aa74808bb6b83fe2c744ac3f01e6d1cfe716b645d491
MD5 f38cf11d8023dcb852175d2c8d5593b1
SHA1 a9dc99bedb713b6303d6d8e4c621628d6ef721ac
SHA512 b20277b70e62553ad64800929395f32864015a169b08bfea5546fc6e0cfdf316b10bce012a6d5ef4111293ff3cf9c89fc3900c848690920c2afcfedfd51f5550
SSDEEP 192:sxZlRIyM//K1Ml8M9Y/fSs6mQLWEGcIdpDFeHW6+WNq16/YJMSD6Ig56J:sxZlG1Y/fSs6mQKjFcHbp/H0
TLSH
T1E862D816AA345A77CCDBD209BA55BB53D6F5057392901E44AEFCCB0C05E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 643f5adfb076064a944898b6d466a8b6ff12f757bcce536e5fd39f0dd47ce8d1
MD5 33d53d5addbd9d3db701122358e36904
SHA1 f910088a26c731fba1ecb3828fe73c6a0c90cf1c
SHA512 b05738d8d92195eab66f52aa1aa831f33aa14511ff8b2499ff129385048a0290b3b412d67049f5db77ec1d6b53e3621e48f2767eea77292b39962796d1a3600e
SSDEEP 768:1GQv20K7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHu0FLllnWh9roP:1GQv20iEneqWve+l+u1jauu0FLfWh2xh
TLSH
T1A5F20C3B6C0CCB7E4F804E9CEC2A7E8E6DE801CB9698895447F9844C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 94f925feec4bcb2c11752e6f5e363b8f8a96ab53ec7f7ebe0e9bc2c2a60835f3
MD5 ffe0cff7a522a3f522196e0a8620f17d
SHA1 fba857afe173805530602b598bbdf2b1c87cc763
SHA512 955f32bc547cdc35cb3dbe05879a46cf5954a578799d58deafae14a2585a6735f1fafcab1d9eed2fab6ae1b73de9cbe06eaa50d629ba5aa148b2c95a8d920400
SSDEEP 96:KkE4Kh6CykAKheS+bGKoU7oQKRmu2F6KWMRz:SnLr5v/xs
TLSH
T17EE18B56313B07853A7D248D9979B46F0AC230A33968F52B3B7844661F27E20CEFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 380d2185e2edc332e6ff734c1ed2dc28db2ac21d49f6f2fe392f694242fc027d
MD5 ca22164d2427a25a1a5e02180dc4c242
SHA1 926580ce4ab975745a51c93428cdf26a831ec559
SHA512 0c14b56237a6aec36d801b3e46dbb93b3bf9c0657a03f4503f4d3398ae56af66145e6d1657e69223e78d81dae412954dd3e449ff2d0d36d6abf15a4af473465b
SSDEEP 384:n2jccCs+Bt0S3BsN/HCJtjbgDo8MeKuJ6wWJpH1ZfGx1f3X:wccQhpsseKuJ65JnZOxBX
TLSH
T1F3827B7128B85D3ADAE39959B04B7B13AFB441AF87E13F64C9D99B1C00CB29C2707536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 0d246b7cb64ed1d9399750211f5ee2debc1cb020e68da369426fa1cdc0327183
MD5 aecf8435c37ceef0eeb151ca89e7f9f4
SHA1 c029b84626fa40352ec019d2d933c32f6aaffecd
SHA512 36e8b3850d1131e06522a6da8fe297d786f5c7847d89d3d718736916f15da304d9054ac49a455c8e99fb168d7144524dae14a2f2034303b8e171274adc108847
SSDEEP 384:n2jccCs+Bt0S3J3sNWmCJBSc2gTifhpo8Me2uJ6wWJpH1ZfGx1f3X:wccQ1Wcz0Ge2uJ65JnZOxBX
TLSH
T161A23A75E8A5DE3BE9E39B95B20BBB839EE0016747D82ED4CCD95E0C00C769D1707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d25eb13f788d865c3f9cbc333aeac6b2aedb7e440aae21884314510f83441a06
MD5 faa0c6975a0b91899eaf3f659d07ec2d
SHA1 9a865414e5d0df334a6f694709bc588e60e6762a
SHA512 5d7a6afdf203f03cb21db17984cf6db6869719e2609d1d2e93b93c33b538c5c2fecfa2973d597ce56110005e736adbe3f16dbbdc9635544fc4cc07ee188415fb
SSDEEP 192:ZONf6IT0JZQmiUy5AOgibFj2RlKFuY6U6:ZONf6B3LOgioLfU6
TLSH
T19702D875A8ACAC7F8EA3AE49B48B3B235FA4107FDA956F94C6D45B1C00D714C1707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cd04d58c3249227a91ac0268ef7a2990a4d7fe67ea8319cd43e16dcd0cc36160
MD5 82aea892926f702e8784086b5c61a1f3
SHA1 fd793c1069c8fbea0db7fbc33a022fc275c9269b
SHA512 199eb5403a12dcdb0a21ff2d8fa54bb19685ef8acaafce41de0773ae88bcd3fdd9479537983189ef4124c5613fd2aedfa3de7eb48f4f1c3ae6c25782042af756
SSDEEP 384:nxjccCs+Bt0S37sN/mCJ6jbgDo8MeAuJ6wWJpH1ZfGx1f3X:BccQb3sseAuJ65JnZOxBX
TLSH
T181827C7228B85D3AD9E39959B04B7B53AFB440AF87E13F60C9D99B1C00CB29C2707536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 7cb7b49f16d9366210cc7642aa6f227ae58b2802b00e81c43be0fa0a5d0bf09b
MD5 28c7e54dcda45b24984223aeefd39249
SHA1 21dbf389c47fa13f3cbc564216db22adab6414ed
SHA512 d0b20975b745c1d3c4cedd4788ee1ffbf2c5e3db464b81a5f0b99a73c824f2153fc91267b6a7feb0fb718c5687970da7faa8f018b86ff726965931f1fa822153
SSDEEP 384:nWjccCs+Bt0S3J3sN/mCJ6jbgTDf4po8Me9uJ6wWJpH1ZfGx1f3X:QccQ13s4Ge9uJ65JnZOxBX
TLSH
T122A22975E8A5DE3BE9E38785B20BBB839EE0016B47D82ED4CCD95E0C00C769D1707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0f67af51379a2354b18789b6db34bbeae44c40cb77119bf057fe4b383ea84fc9
MD5 6aa289237a29fd287b2d3539af33b2ba
SHA1 e0df21eb02501db8aebb44ad5de5aa46a4cc2be3
SHA512 48bf3cefb85b3864dcf4d0edd6da359c25eb077ca22c305f53426700fa9b9622de0de6287b1ad8f53aaabd0c5432a2d3de206e4594c69bd6cb1c57bd291faff4
SSDEEP 384:nRjccCs+Bt0S3BsN/zCJtjbgDo8MeKuJ6wWJpH1ZfGx1f3X:hccQh1sseKuJ65JnZOxBX
TLSH
T190827C7128B85D3ADAE39959B04B7B13AFB441AF87E13F60C9D99B1C00CB29C2707536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 adcaab6395e93fbde4206956c2238d0b2c1ec5c21232f791cf1ffd1fb1231f89
MD5 9de9783c608d70b723e1740f7380863e
SHA1 116384bdb0b97e6aef611aaa94a91a13f9f32fe2
SHA512 dcf2c23d5bc725bf9aaabf696081c944d64c16245760768a98456e7b993c2174adc125e708f4d0fc988882d97bfe12eb733884caaedb9f88d6511743245af984
SSDEEP 192:SONq6IT0UQmiUyuA5gibFj2Rl8Meah1HqVU6:SONq6MS5gio8MekuU6
TLSH
T14D120875A4ACAC6B9EA3AD15B48B7B139FA4113F9B966F94CAD44E1C04C718C1707833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 17c4d7d4ea733922953f935c9e55051d5513066cd5b4c98fbf5417518a6ecd63
MD5 21e38538b4aaa33133bebcb4cd6864cb
SHA1 da4e0680172636bcb95d6802ae729af8994f1b3c
SHA512 e7bddcb321f1327282f4c94cdcea33fdfdd2b9ff1c153263a80586b10c85fbc2e411f3356f15b5fa5dd65265eed7be2ee3ad31a7e7f04335ca1cbee372a63795
SSDEEP 768:47KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzAqUmNKX0AooJImdba5aSt3MO:O9ZZQeoVYkYpktMGAKt2hZC
TLSH
T14ED42F379560A088DF3C35B1E2BD5F4CBD72A01612E012461F74B67F7A233D89A1B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5371a8950f2a6ade39130fbf6c5c5cd055ebf3eb139cfe6ae8f48ff4e4ca1f4a
MD5 e3c4690fbcb550169d04b715582ba493
SHA1 7e62a5a0d07aa5f8160e537a03268377ee53fcb7
SHA512 244739858328ef0e6d633efd9cf9f8399fad4de729ba2370d24969a019d2495e76e3950cae17500d2083300b0245d2170d70e36760b31f2124f0551ee4169547
TLSH
T13A41299CA6ED1158B3B76F5AABF6A46E447BB8372F06C59E10010E4F0A36B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
MD5 5433eab10c6b5c6d55b7cbd302426a39
SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
TLSH
T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6cxu2nva.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 7a0f964a75e77536b71d0a4151ea12918cd255e50b2eba35ac873fdeb9e8e8b2
MD5 c60eb664b4e7a8cfa30660914fa5159f
SHA1 c5222c9c31bd104f19e2317f373bd92b9a71ca24
SHA512 925d27df613803bb85b56ea771ca0e0fe906621f60b53c8e4fc326ca95432fe9ae8c2632ffe50af1e79b271a16143f2fb11dbcf745d7d0b69dcf378eb2c0975f
SSDEEP 384:HbaFrLiO024Y0Fuhw+5EL1pPsac4j0lpDII+Ab1:7aAZY0FuK+5EB9sac4ID8L0
TLSH
T15E527E7D9F023CBA1A2BD1D4D8A99218CE04E6BBEFE2D16605143944C7843BDB4F60DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46535942-d672-4c7e-999d-c564d8687a39.tmp

Path C:\Users\Admin\AppData\Local\Temp\46535942-d672-4c7e-999d-c564d8687a39.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

a2ab522f-ef7f-4817-9499-65c300627bb8.tmp

Path C:\Users\Admin\AppData\Local\Temp\a2ab522f-ef7f-4817-9499-65c300627bb8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0b2293e-6d39-46b5-8a38-61f8641ee220.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir436_122397377\f0b2293e-6d39-46b5-8a38-61f8641ee220.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir436_4735584\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 e45eabc21eb57f8533c4769bd6cb2f99804ca0225d53f4972c7042c9b08d99ed
MD5 3b8813144d48b909bbd84a52affcc335
SHA1 be7c99cd763d92f25e989630a05be3e2a77a59c2
SHA512 cbd5458f9ace109ea36774bc758730a0c24a3d627d6b5c946cc9745234d4eaec4be23c5c4747e274a19f73bb9e4e59fb26da4ae5cf1958a2985df6db46dc48e0
TLSH
T1A22149671B4AE47089E01BE71DEC8E3573B787CE93A0D0A5B34DA02D880216D5B3D05D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0836e94196e1682a0be392fd6b03a3210f42331d3103a16fd26e9b620bf85569
MD5 8273aa233e546a8d14339cd7f4644047
SHA1 dcd4a2a7176ce163dbbbddf5e4f6a745b9c0478c
SHA512 234b6e50f8b701584c09b8931ffa4b52ac2e56f8fb786bd6132fcbf28dbeae1f06e3fdd16637b4698696c10fc31e3c7cc2ce4b2d2792950ce3e126633be286eb
SSDEEP 192:GOv5zbowby0yjghxc1d66JozGzgCl6mc0dz:9bowby0yj3d66JozGzgC1jd
TLSH
T181D10C64EA28463FC448437BCCA60B404F3A384BD84E3F1935ADA1082D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e194fbe934b48f6613697221e401a8c6b90f007d03d34642120e10bbaeb42bd1
MD5 1d29ce1615ac992559c34dd8eb4af4c2
SHA1 e43b72706923392eddfd47de280f556a901f0a84
SHA512 8db54508fe67aadaa5526d98cc948cd1d95f0f708e4d70512330da2c8d0754def95063f22c975526a2380de121d4c43f9cf61805aa970f80a5524f7f36a8356d
SSDEEP 192:Pc1d66JozGzgCl6mc0dIOv5zboPgZy0yjgh:ud66JozGzgC1jBboIZy0yj
TLSH
T18EE1FD64E628863FC418437BDCA61B414F39388AD84E3F1935ADA11C2D5B2DE7B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\events\events
Size 1KB
SHA256 68b1e845eb4bfe0d73d873b61032bcea6fb00910703dcd33f748d2615ddc0331
MD5 38246776358f9215e0d72baa0c8d787f
SHA1 4a01d73bfe937b97d9fcc191ed2cf67f5a74e5c6
SHA512 55f432f09a6b8f138021a1991a73599c774d4db7b42ad53ed3d9d842a37f0b76ba18646f47b2bb28f4dd393a3af41f919b9bbefd9ba866c03e5760587b8ff47a
TLSH
T1BF21678C79B88D2AA98BE29CB48512CF53418E4604C71C834D02DECDCCE5ADA32AE43C
MD5 SHA1 SHA512 TLSH

Submit Download

07041870-f8d6-479c-b378-b4c21ec6667a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\07041870-f8d6-479c-b378-b4c21ec6667a
Size 235B
SHA256 186f69b164b24179326a07b4784677c6fd9658e51a745d48a8c365335c2694f2
MD5 781ca098ed9f4da38b494e80f2e3026c
SHA1 288ed124c647a6b0fcee56d6d0e07bd76d15e18d
SHA512 9ad801d99f797b7c633aa38dfe31d9ead55233ec6e87f402ec62f3f11f5b78b705c999fc53a4f9f081e0d0d495b5b4501644c9ab9fc07a6afa0d446a3f8a195a
TLSH
T1D2D097A428987B1D08184F06F4E029C230888C3364A0A820CB624578DEFCDC80261C07
MD5 SHA1 SHA512 TLSH

Submit Download

23bbb6b6-f3cb-44d5-a7cd-325deac1083e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\23bbb6b6-f3cb-44d5-a7cd-325deac1083e
Size 2KB
SHA256 729ee684f213a3588f314cfd18affd8682848bfea78670fb2d2fe82981f699f7
MD5 2aad94372de495647d0eb703cbc8be43
SHA1 9b1bea7cffc1b71933c9fe62ec8a1cf1a4923448
SHA512 bdc8d68f994fd8f487a6d1825040aeb1e711ed14687e964e8d960b587d1b6ba7510d3ab2401186c151c948f77bee0c8f3e7c0056cdca9bf80733e001c6b5e4ef
TLSH
T1BE41F35836785C7B9CDAF65DE482338E53A0890350C62D432E92DE4C8C966DA736F51F
MD5 SHA1 SHA512 TLSH

Submit Download

3b9ce25f-b0c8-4891-9118-f1dd226615c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\3b9ce25f-b0c8-4891-9118-f1dd226615c1
Size 235B
SHA256 d1bbaac097da4c0bdc1349565c6bd282c31821fa36200c1f150d0991de56267c
MD5 97509a0cfc6a28be57e3ba9caa146f08
SHA1 17cc9c367ae858c682b095c16e6bc314d36567fe
SHA512 b2829507236fb0b8aee912bd0df1d5956e7e55d6570cd0487e17b3b4d2f68b7b5faa59234e9c370583a74b023586d2e85d25ff667e189a02c9147bf9fbcaab8b
TLSH
T146D097D168EC23AD0C100F0BB0E06AD631444C3734B49850D7910138E9B99C482A2C1A
MD5 SHA1 SHA512 TLSH

Submit Download

9a06a154-1f9f-47f1-a41c-5c9d8c123099

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\9a06a154-1f9f-47f1-a41c-5c9d8c123099
Size 16KB
SHA256 1287192e9680c04f0b9d439f51b06b47876db01cc46c1d10119f348d1340d362
MD5 2456041cb0720814a141856c44c11154
SHA1 23d3bd0cdb4c77fb90834a534f93c5530fe3bfaf
SHA512 424746f626570a40c1926e2d042729673d17c62f4c8783ca1d393a2a175d0e766e5e8c12699621750df4fe243eee08b42d46d51c13cf1dd5954900c06d76c52b
SSDEEP 192:xryhx9G02bohxsx3ZktN45gE2PczjEZe1cJvrH/GqpaeGT19BEhJAG68acV/5Sz0:Jyhx9Gz6YqjvUe4WhNDacVBSlR7UX3
TLSH
T1E372C9166820457AC291E36894FDBFC3E6F638CB4C419FC99BE4BD086DDE05E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5a8613a-57f3-4120-8c4e-4dc8357eb065

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\a5a8613a-57f3-4120-8c4e-4dc8357eb065
Size 886B
SHA256 a5f1d1da278adf704080f045584dde51c76b38f59d129d7d2e86c11536966cbe
MD5 c69de393454e7e94f60ce4db262be3e7
SHA1 5ada29b5c371d482fe6d2e794b00ae213ef263e6
SHA512 b44521175c80fb2be36d37f5400440f3dde66e49de85d8f0f99748a1889ac684dbca4300c7c4f0c9332612c16a862402dbe20456c73ae20efa48cc654069fccb
TLSH
T12A111040963574B3C868C29695A17A8287E4741380CB49103E615A180DFE11EA76BB0A
MD5 SHA1 SHA512 TLSH

Submit Download

d1de47f3-aa05-42f9-99ad-48027b797b6b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\d1de47f3-aa05-42f9-99ad-48027b797b6b
Size 883B
SHA256 0349934a0524ebea82b0e5a5112e90bb4e07fe0080e5999d1a2bb3caa93be659
MD5 ba86c46a8683b7952ccae4fcbef4f7fd
SHA1 2899cd42f9f25e7fd8c0a6cbce80667ea8b99138
SHA512 713d4e855b2fe08e978cb69ca7b6719b0d1f304a4ca91cf0ed53d07595c29c8cf922c765089fab0e6c81a9467e31caff1364fb5fa95eea0ede90fa51863b2b1f
TLSH
T17E110041D73575A2CDA8D39AC56637424BE4751380CB84043EA289180D7F52EE7AB70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\extensions.json
Size 16KB
SHA256 dbfe256903949261df76c695341ae95f9676a61171aee6cecf90b55c845ae22a
MD5 de62d5995f868740e0ad070144de111e
SHA1 003ef337833051ee767d8d9bb68bfb6d163b372d
SHA512 361aa55f3d22eafa8b8f75ed9ca71008e82c4c7cb2a22827a60cf9d31e153ff8cb3ef693ebd242fee24210225415bfeb1480c6faaad93a7860233dd979c7ccc5
SSDEEP 384:7kI4v7UmldvG8dhWpV94zTG96oyL4HxL4P9L4HmUuL4HDL4HpR4hU:II4jRfbX8n4y6b4J414Gl4P4j4+
TLSH
T17572421545149EB8298FA78BAA367E01C37D473B60855C78F4DD8FC802FB5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs-1.js
Size 8KB
SHA256 fcdfcbdf4f64f83f11dc8c4dc171a44d27e9a046cd47d4a7e74bf39f5ecb12e4
MD5 4fc414adec74bcebcccc7a5a108bab20
SHA1 18bbf69f33dedfb9921b0b68f6472b24f513cf53
SHA512 01a3d8d51f022ad0ac492fb578ef723d1cda251a31075857980eb7351ca6f67db9b39f9ba6569161f61a30688954c121de74b9cc237906803829b5910fa8d40d
SSDEEP 96:xHNtTUr4qGqOfxGqObzSeSSl8pdv9jFn5WRF/g/GeBw88IeZ8L4cndbLg:T+ROfxGqgSSGARieeBw88Pn
TLSH
T1AC020E7CA144CB6F78B6766CAC284DB15AB2013BBABF68D714B944C4015CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 6KB
SHA256 630ec0368d32ffbe6331beed7b68e85a3d46013d06709e9ccaf583ca146b3f8e
MD5 318d7dbbd29fa1f22d7800f5ce4a65f7
SHA1 705645965c558a111d96113ca7be5cd678d6a473
SHA512 30dca267528710d7308afd0630f9fd9ed5eb47a7ef2b957deb55163cd3ecdfa4842120f56ae1497ed48698b67cf795c36b0460491769622aa0f12ab1c7fb4b2e
SSDEEP 96:xHNUTUr4qGqOfCyGq1zSeSSl8pdv9jFn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyGqjSSGJMeaBw88Z9
TLSH
T1B0E130789008CB7F64B677ACAC688871AAB2413BBBBF68D750B544C4055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 6KB
SHA256 109aa5e3561d7380bfacceea8d5b859114f06abd591ec64e6103e0f42ae00fc4
MD5 713b8675050e0f4f7ad0b5575872984c
SHA1 512aae1888713b5f217fb0c5a1dde3b4c20e72b7
SHA512 c950fc500941255ee792c830658b23473ac6508fdd42a1050d974e734e74db41db4fcead37d79cff2d16494b76d932ac5b6da8cb9fa76526ac0ce5c1f3015676
SSDEEP 96:xHNUTUr4qGqOfCyKjcnjl1zSeSSl8pdv9jDn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyvBjSSGDMeaBw88Z9
TLSH
T11AE13F789008CB7F64B677ACAC688831AAB2413BBBBF28D750B554C4055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 6KB
SHA256 d709f486776c5fce4c18dabea44a415409c50cb86c431232980a347f4c7b901e
MD5 6ab1d678a42d513cb2ed64e1321c0613
SHA1 d5dd2af1b7397d2716bfa7fa23643140e8df47a9
SHA512 37d8ba03bcd47b079b69af5819d4cd022a8634b3975d2a74428cd22b5a25cf81f3b25eb5bc9fcef9934b216fcc355f2097a7e68640fb08746f39e3263e28faff
SSDEEP 96:xHNUTUr4qGqOfCyGqObzSeSSl8pdv9jFn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyGqgSSGJMeaBw88Z9
TLSH
T1A4E140789008CB7F64B6776CAC688871AAB2413BBBBF28D750B544C4055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f15f4b9a9b38a719064150744ce920d928a5864478d2bb2a41942a73b08889cd
MD5 f90cf2c093888c0b246af7c509265096
SHA1 ed9a11137b16945f6e0889e178eb4af8235e350c
SHA512 7447c9c842e98acb06a3dd526a4658be341faf5369b5f2069d43f5212354e534018293882ebc2e9ed5cb950630821aa34083bf54ea7154439de17194c2c9caa9
TLSH
T1FE21F84BE4373BF5BB31566AA0445FEA8F55347184B48CE0858ACE8C26DF0D97B45851
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b3fb8dd099d94e9efb0a01b67e6a063dc35283a5165831eb8f2219c7781c80f0
MD5 43872d45fbe2805483711116368c734e
SHA1 6c9be793708b148b993e163c2230acf66d199a9f
SHA512 9aa83ea26b63684744b6bfb2f75b96aead6e96ea5e2ca860bdeb7d4cb6df85ad4ead36c562d973a1f3d11925a54532b37e6a3f2d7d0144cb41b01d81e4aadbc4
TLSH
T1FF21170BE43B2FF0FA33A23990488BA98A55283180B048E0C589CD8826DF55C774A416
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ccaf88a4101e8735f714dbb83c2740c1ddaf0a29bf9b0d5fe956907870e8cdb1
MD5 ba37296ae85239f194cee52563e37408
SHA1 bbcb45ceb86ea9b9c3857e740082b5ebe25b95c1
SHA512 a0748a42ff67efa58c7aae942038d5e9283a088126f17434f7934e6acff2e94cfe698617e31f2dc9b6f9d62063c34403ed2f91852d176bd7a613d5697835a8e4
TLSH
T162212B8BE06F3EF2B635D22890440BF985A52470C874C4E08145DC886BCE17D734A821
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 6366e899982a44f603b35d58f030139029483f7efebe2cf534df75e1389d1cdf
MD5 5fd6f1b5b594bdd6d9e5c62427f00019
SHA1 64c52b05ba0b52eb8d8163aafb4d65086343cdff
SHA512 ed8a9dd86c542ad6795a62e8fe42247fe6e38085fd4cdae1b7d148dde93e0065f1a4c1c5c35f059e536fb0b4322c4459f218ea1f24538a4b92e4197d8e7ad889
SSDEEP 24576:xYSr+tIUJlBITA6N/rZbr20eOVR7cmShHMg2OJ:xJ8/BF6BZbr2zOVRAmShsg2O
TLSH
T18CF52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slip020030420530010.JPG.z

Path C:\Users\Admin\Downloads\slip020030420530010.JPG.z
Size 1.1MB
SHA256 2c84e99de803888f270bbe8048adeaeb5215737dfd5d4e80a3dcb0e93b47d8f7
MD5 d756dddef0cdf047977e656c34b899bd
SHA1 8192e07428a2413e05579e117ad33b5328326990
SHA512 ea7da0724f6d85a03613d384d0e59135e4da95ad49308e4964dcebc938bc7e5e7a1b800341a7fe1338e48d3f77e3660ffa8ae048f6f0751658e7be32e07a5ef7
SSDEEP 24576:yX8BkoDx3pAQfoQKn3iDm1/V8HJC6k45Pl0DMI7KcVpTn1zbGNeMRJiktCf7F/46:oodQQKsi/V8HJnRVl0d7rZGTi5J
TLSH
T192353323B55CFA7C339A61691C98920A8FFF81F163E362AD04C158999217E9E434FCD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-911-0x00000209D0E90000-0x00000209D0EE5000-memory.dmp

Download

memory/864-529-0x0000025631F00000-0x0000025631F55000-memory.dmp

Download

memory/4196-525-0x0000024003840000-0x0000024003895000-memory.dmp

Download

memory/5960-1355-0x0000020AC0BC0000-0x0000020AC0BC8000-memory.dmp

Download

memory/6988-1315-0x000002BC1C240000-0x000002BC1C295000-memory.dmp

Download

memory/7040-1347-0x0000000009D20000-0x0000000009D30000-memory.dmp

Download

memory/7040-1345-0x0000000009D20000-0x0000000009D30000-memory.dmp

Download

memory/7040-1350-0x0000000009D20000-0x0000000009D30000-memory.dmp

Download

memory/7040-1351-0x0000000009D20000-0x0000000009D30000-memory.dmp

Download

memory/7040-1352-0x0000000000BA0000-0x0000000000BFF000-memory.dmp

Download

memory/7040-1354-0x0000000004160000-0x0000000004168000-memory.dmp

Download

memory/7040-1353-0x00000000027D0000-0x00000000027F9000-memory.dmp

Download

memory/7040-1346-0x0000000009D20000-0x0000000009D30000-memory.dmp

Download

memory/7040-1349-0x0000000009D20000-0x0000000009D30000-memory.dmp

Download

memory/7040-1348-0x0000000009D20000-0x0000000009D30000-memory.dmp

Download

memory/7040-1336-0x0000000009D20000-0x0000000009D30000-memory.dmp

Download

memory/7040-1335-0x00000000054A0000-0x00000000054B0000-memory.dmp

Download

memory/7068-1290-0x0000000002610000-0x000000000266F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads