05d2276bd3fe6d7343feb59627866d3300f0eb91d5c530ad3e506bd751534a5e

Resubmissions

04/05/2026, 04:14

260504-etmryafy9q7

04/05/2026, 04:08

260504-eql18sfy5n8

Analysis

user interaction
yes
max time kernel
195s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
社媒助手-v3.2.4.zip
Size 1.5MB
Sample260504-eql18sfy5n
SHA256 05d2276bd3fe6d7343feb59627866d3300f0eb91d5c530ad3e506bd751534a5e
MD5 6f94bc1e95833898958183fb1ca2aecd
SHA1 745a450191b3acc0500d305cb281e5330b5a6ea5
SHA512 0c1e1a89cf62cf693cac8a5d2664e67d13d2ce02df873fb98a9f55f5b1f0cb9d0fa0380775f3f3ce1f46a55b9e05d073207491f60b87322659527b055632f19e
SSDEEP 49152:iEzG4kkw1zNPhxDmITkFFoeqvOMr2LTHN:iV4kkaNPhBTUFBqvOMcTHN
TLSH
T1F075334A74CAE416C51C913D9CFC05771A2D24BDB102D4BFA1A9ACE06A34B92BF66CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_992619027\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_992619027\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_797093312\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_797093312\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_2088193331\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_1041718266\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_2088193331\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping568_2088193331\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4660	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223414810479289"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{AEAEEDBF-6F0E-45EE-8D9B-1344E450CF16}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5216	msedge.exe
5216	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5680	firefox.exe
Token: SeDebugPrivilege	5680	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
5680	firefox.exe
568	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5680	firefox.exe
3428	msedge.exe
3004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 5680	4020	firefox.exe	96
PID 4020 wrote to memory of 5680	4020	firefox.exe	96
PID 5680 wrote to memory of 3824	5680	firefox.exe	97
PID 5680 wrote to memory of 3824	5680	firefox.exe	97
PID 5680 wrote to memory of 3824	5680	firefox.exe	97
PID 5680 wrote to memory of 3696	5680	firefox.exe	98
PID 5680 wrote to memory of 3696	5680	firefox.exe	98
PID 5680 wrote to memory of 3696	5680	firefox.exe	98
PID 5680 wrote to memory of 3696	5680	firefox.exe	98
PID 5680 wrote to memory of 3620	5680	firefox.exe	99
PID 5680 wrote to memory of 3620	5680	firefox.exe	99
PID 5680 wrote to memory of 3620	5680	firefox.exe	99
PID 5680 wrote to memory of 3620	5680	firefox.exe	99
PID 5680 wrote to memory of 5416	5680	firefox.exe	100
PID 5680 wrote to memory of 5416	5680	firefox.exe	100
PID 5680 wrote to memory of 5416	5680	firefox.exe	100
PID 5680 wrote to memory of 4956	5680	firefox.exe	101
PID 5680 wrote to memory of 4956	5680	firefox.exe	101
PID 5680 wrote to memory of 4956	5680	firefox.exe	101
PID 5680 wrote to memory of 4956	5680	firefox.exe	101
PID 5680 wrote to memory of 5924	5680	firefox.exe	102
PID 5680 wrote to memory of 5924	5680	firefox.exe	102
PID 5680 wrote to memory of 5924	5680	firefox.exe	102
PID 5680 wrote to memory of 5924	5680	firefox.exe	102
PID 5680 wrote to memory of 2660	5680	firefox.exe	103
PID 5680 wrote to memory of 2660	5680	firefox.exe	103
PID 5680 wrote to memory of 2660	5680	firefox.exe	103
PID 5680 wrote to memory of 2660	5680	firefox.exe	103
PID 5680 wrote to memory of 6008	5680	firefox.exe	104
PID 5680 wrote to memory of 6008	5680	firefox.exe	104
PID 5680 wrote to memory of 6008	5680	firefox.exe	104
PID 5680 wrote to memory of 6008	5680	firefox.exe	104
PID 5680 wrote to memory of 3264	5680	firefox.exe	105
PID 5680 wrote to memory of 3264	5680	firefox.exe	105
PID 5680 wrote to memory of 3264	5680	firefox.exe	105
PID 5680 wrote to memory of 3264	5680	firefox.exe	105
PID 2972 wrote to memory of 568	2972	msedge.exe	108
PID 568 wrote to memory of 5204	568	msedge.exe	109
PID 568 wrote to memory of 660	568	msedge.exe	111
PID 568 wrote to memory of 4660	568	msedge.exe	110
PID 568 wrote to memory of 660	568	msedge.exe	111
PID 568 wrote to memory of 660	568	msedge.exe	111
PID 568 wrote to memory of 4440	568	msedge.exe	112
PID 568 wrote to memory of 4440	568	msedge.exe	112
PID 568 wrote to memory of 4000	568	msedge.exe	114
PID 568 wrote to memory of 4000	568	msedge.exe	114
PID 568 wrote to memory of 4000	568	msedge.exe	114
PID 568 wrote to memory of 4264	568	msedge.exe	115
PID 568 wrote to memory of 4264	568	msedge.exe	115
PID 568 wrote to memory of 4264	568	msedge.exe	115
PID 568 wrote to memory of 4200	568	msedge.exe	118
PID 568 wrote to memory of 4200	568	msedge.exe	118
PID 568 wrote to memory of 5160	568	msedge.exe	117
PID 568 wrote to memory of 5160	568	msedge.exe	117
PID 568 wrote to memory of 3232	568	msedge.exe	121
PID 568 wrote to memory of 4680	568	msedge.exe	124
PID 568 wrote to memory of 4680	568	msedge.exe	124
PID 568 wrote to memory of 4680	568	msedge.exe	124
PID 568 wrote to memory of 4192	568	msedge.exe	126
PID 568 wrote to memory of 1592	568	msedge.exe	127
PID 568 wrote to memory of 4772	568	msedge.exe	128
PID 568 wrote to memory of 5488	568	msedge.exe	129
PID 568 wrote to memory of 4152	568	msedge.exe	130
PID 568 wrote to memory of 4152	568	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\社媒助手-v3.2.4.zip
1⤵
PID:4796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {87a578d0-8d9f-4f05-b824-4b7e10bb43a7} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {ef4dc586-01e6-4746-b40b-6f988ae144b7} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 27276 -prefMapHandle 3816 -prefMapSize 270279 -jsInitHandle 3820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3828 -initialChannelId {66c4eef0-3196-4847-bc62-88a2f775e42b} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27276 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {976a8548-0d7b-4883-ad5b-6d15124a6bc8} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3116 -prefsLen 34775 -prefMapHandle 3120 -prefMapSize 270279 -jsInitHandle 4360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3652 -initialChannelId {f8ca8e29-7895-49fa-b19e-a3e86c15c855} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4888 -prefsLen 35012 -prefMapHandle 4892 -prefMapSize 270279 -ipcHandle 4900 -initialChannelId {395609c1-3194-4c3d-bdbb-c36119a44b71} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4744 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 1652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4740 -initialChannelId {0084befa-6112-4bc8-9ef1-5f5869430ddd} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 32952 -prefMapHandle 3256 -prefMapSize 270279 -jsInitHandle 3348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {e9eb34a2-7da9-474b-9448-c5b3a50a6287} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32952 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2856 -initialChannelId {1b18e403-da51-4d49-98d2-58f71a10dfe3} -parentPid 5680 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5680" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x20c,0x7ff9cd33c188,0x7ff9cd33c194,0x7ff9cd33c1a0
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,12784585152121771056,14517068604576069405,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,14609130446972676396,17254406306265234902,262144 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,11851013655148495968,12724170024639153900,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15549745236198895394,12177586133990197887,2097152 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1860000059511951073,720779260740947094,2097152 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,6429941024412305752,1947081091756736244,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,18304717797664153494,14608461056553507318,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,848199060735020277,3811253076339500606,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,848199060735020277,3811253076339500606,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5060,i,17855453099286597937,1507301126844785310,2097152 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2592514740953008668,8795444193661730239,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2592514740953008668,8795444193661730239,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,8077007496804699778,3553266446414859317,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,1709733332351436856,894432796262292900,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,12588566828768449305,12169941033850498270,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,12194732605140178230,13478686381101862277,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,12144653414878180857,9176946645071836376,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5356,i,9003413449125243443,3586786116615420708,2097152 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6188,i,5795096230085687346,12651053555682694531,2097152 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:2
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3236,i,5879105876694492527,4961470671464642757,2097152 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5308,i,6608044352210921735,548048226431034774,2097152 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:2
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,12781827642340740582,16188097588227613262,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,13737794689523310788,7504510747556951051,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,2262908272801823343,2185258919692664351,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,15952246356336342989,6748739647205513317,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,10492063396212625853,16586096252370962721,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8819620523346693971,9261114380824249176,524288 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6744,i,6419146088459250474,16738960600922146100,262144 --field-trial-handle=2324,i,17966408550975867365,9772983125913774081,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping568_2088193331\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping568_2088193331\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping568_797093312\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping568_992619027\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

3e95ff9d-f10e-4b5d-9030-57eebeee752b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e95ff9d-f10e-4b5d-9030-57eebeee752b.tmp
Size 26KB
SHA256 3420b2502140a0c64e0c086aec2fc68013a127419eacc2eebd94f6d56aa29e57
MD5 b15f6e2c8161866d34a33a093c738188
SHA1 81f1baa3ccc03515bfe77e76d05209bebd955a14
SHA512 635af82ef290d60a146b67bb63954cbca32706ffd8577a755dec68ad34149badb861a7ac4af5e8d9e41d55d6214e1c84aadc78ff12794f06324bfb8321b327d8
SSDEEP 768:4Fayv3SwgHguY7tcR93CJIfRYk1mC/0KS:zyv3odD3CmmkEC/e
TLSH
T14AC24B35E8A8DEBBEDEA5FC9A7497A07DEE00167C59C0AD4DAD80E1E00D719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bf12953389ce6671f14265f9135aa3ed9dc571c14200b2c08baaf4c48c8e255e
MD5 850825df388351cd1b9c57cb23ffc806
SHA1 0f524fce4ae0480799fff1c9b4f8027dc472494f
SHA512 21360527ce2d37c4b7582a823a9baaace355e39662f8fce2df1b33167d815bec82f863211a44cc97646a6a72caedec52082ab53382deec741f13c39e941b1cfe
TLSH
T1ACE02BA6C962AC3718FD175850585682E74413672781498F3A3D93088FB1D37458AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 447377b71f7ce10a3c671fdb4007bcdd7e6118dbbfe8f35b8b8f9705006a35bd
MD5 112715a46516e74865c61b2e0ac1db89
SHA1 4477cc34751e917428c99fadcd07778b99b759f4
SHA512 0a917ef5b3bb2dae9423e13e719bf2a2bdf8d1c769dfab23984c1a641a3b3e749e57b9354e8f8a435219d95d96e6f3454667225a034bd422420c01b80201dcfa
SSDEEP 48:gFuYcsjP6o2VGjUQA3iHh+JY1lISKSG0XLbZ/RQ3aJG4LLRQ4yTPPKV01FBwXJ:goYcszpjwi4Y1lISKSXbbPgIjXeh3Ha5
TLSH
T1EAC18500BBB3509ADFE30933699C5B6871728A4EA0022F3FB1E8443C66A779553CC7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 a6c381996495c36d08d6a2df7866a03cb1ac9af6e700f701417da6edb3cb6403
MD5 e6225e4b8953afcb17fe2620092ab4ae
SHA1 34829ced21b519c6ee667cb36e6b90abf79dccf0
SHA512 9aa3437e2c412e7985f88c8501ba71d45890e0a9b1520a828d972657ef54707f1c73f60a37ebde9e8f207984c00b6cc1b80ef4d2d5daf486a2b8a011d85300bc
SSDEEP 96:eoYSd7bpjvSEmyY1lISnSXbbZgbjXeh3vae:eQdpjvgp1bnSXRye
TLSH
T1A5D19840BBF3508EDFE38933699C5B297176898EA0022B3FB0E8643C65A769553CC7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe598b6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598b6d.TMP
Size 3KB
SHA256 522f283ea72e5f27d0cf593647f8925f0aae9b4b3bf91b07ae366184297b5e11
MD5 24710344f8ae67690adeda6bbe761e2d
SHA1 5e76230870d9d4546acd629fc604949d43a259b0
SHA512 7af2294cf1f14c6edbf63e01133f494c7890eb97c60fb0d1a68082dcdde727952319c381557bca7d75d16dfbbbe61e26a72ebd6d452a0ef0084b6bc9cccd54e2
TLSH
T148614010B3B5842FF3F341700AEE6069B2B68A0D414B3E7E01E1897D8A17B4663C97E4
MD5 SHA1 SHA512 TLSH

Submit Download

7026dcc8-f779-4839-b68f-eb0e47207e55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7026dcc8-f779-4839-b68f-eb0e47207e55.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\service_worker_bin_prod.js
Size 121KB
SHA256 ed3803ef5bac39e8b153d283695ee3562398e5d771a6c7fe5d1a85805672ab3e
MD5 aac97879e3f1c5a71cfb46b0fdbb29a1
SHA1 0cb02f7bbcbf207606888361be551e6d682c4c05
SHA512 8878736f8500a668e51e1f543ad7fe13eb7b4e19632918714dc64e952cb1f8400fa2026cfdac9ec757f4a285eacf6ce89f606a395500c56d2f2f39f8a64aa760
SSDEEP 3072:L3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sk:LwB34GASx/DLETk
TLSH
T15FC3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f1bcf03953a0cd5071645aeb8640409556b4d49390fc976dba6ddf64afdfbd94
MD5 a55d2fc279b0efe364dbe3bc3b064643
SHA1 b60fdb32f8ea9f915e81e40c26bc89476ce6ad25
SHA512 7c0c2ec0a76d1ea547d6fd139549da949867680ce1f87e0e3d1580271dfa436a6bd1f2f22ad01286ca7ae3f75a08b9c86c40b3bdcac40ecc654c33694f332e00
SSDEEP 96:DmDLNZzBGO5c4AGj6NTL334Y/HzaEaPBGBJh0MvBwBtteBKfmQ:DmDLNZ175c4AGj6NTL334Y/TaEa5eJhO
TLSH
T186A19AF783B5852D9A1196F0AA18AF1FCF1C0552436C3D5A89E4AE17A3B3471E042B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e95fad6022fe729a510bcaa4b3bad69870fbdc8528256cf5eacd077ae283ba17
MD5 4ac33e9b71bea8697f8b93a08b73b29b
SHA1 38827eaeb2437832311c5bc18aa8b143387d2c16
SHA512 3b4781f49f9abf054b4727ef17e02ce7e0e4d1422350f13a68b621d42ee6246657a339a1f7ace4af64775f3f2ba1dd90d31b0b250948feeb550b32557184636d
SSDEEP 384:sxZIJ57d/fpsYgDGSiR4pHbFJVIz/8msw4:syJd/fNgDGVoHbc8mu
TLSH
T16682F8066A3C497B8CD7D229F946BB93D7F85122D6844E48A5FC8F0C14E6BDD220782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c21661700028f23062f279bf5e63198509371cb4c31732e68b1c5588294299db
MD5 9df70941ef0c2d095b1784a2d4ca8495
SHA1 0148280e23614a96fd38e7b68b48ea039e80a6be
SHA512 8087770cf1cade4961118877554300667fb6b9a61abe6991811f91de45fcbeae9be73d81051a102cc661c708004d6d4cfc57caa4f4df408b80e9c1cdd5d32e1e
SSDEEP 192:sxZHDUtRIyMqZ/K1Ml8M3d/fpsLgh0j1SqrjO+pvbb+odp4gHW6+WNBHou/YKLWv:sxZIt5/d/fpsLghGSiRHpHb9z/bFmsjo
TLSH
T13F82F9166A38493BCCD7D229FA46BB93D7F81123D5944E48A5FC8F0C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 025aa244b87fc8eaa97b69e2b8dd91dee586e5206fdb000a00635421ce0269db
MD5 edc1fb8500c3350e69b25dfe66899562
SHA1 1b98055de72ee970c169a690596c61ea8e1c69c3
SHA512 3704f59b9435856ef98adda7b7614b8ee16ffb44168af485b20a77e47e8ae9ce866f78fc4047bcbf012bcb3e51ede112f13f44f64649c94fb3abb25965f5ea35
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWMKJLlhzCpUroJ:DcgLiAUE/aeWvaShqu1jaXMKJLDOp/J
TLSH
T1F2F20C3B2C0CCB7E4F844E9CDC2ABE8E6DE8028B9698C95447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 bade0c366f4b4fdcc6e897383845497727890a5474f829793419f4a74385628a
MD5 3136336eb0c0e1850db1f445fd3f0539
SHA1 64312d077f968b904eca857653eab61c1ffc6205
SHA512 b2d0f643db9236fbaf43967245513d8468151840fe41fd0a572db92ed527e17e1221802d1f964267000c51a877e10db9782e969d893aa528a5fb2fae52155e41
SSDEEP 768:DyqLins7pLuLPeWvaSFq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDMsJLlhzCVUro0h:DyqLinQEPeWvaSFqu1ja+MsJLDOV/0h
TLSH
T177F20B3B7C0CCB7E4F805A9CDD2ABE8F2DE8028B9A98C95447F9445C03C66EB55161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\93aa865a-268a-453b-ba8a-daebe072f0d4\index-dir\the-real-index
Size 72B
SHA256 0e7d5646b63a031289570fca7ab3c5d432f670fae787398bb95bfcb6caf3ac14
MD5 c933c14e53c5ff788467f60dc82bbcbf
SHA1 2d90c61f7db3c0ed23d8734d9ccb4acc57a4ba4e
SHA512 03939f37cd28c17560ac64fcf7c7d3520aeba2aa9f59e5db20cc5c98d8f7bd5b01877148669b082627b2176b8a2bbc77db497f13f536e14735254790fb97987d
TLSH
T1F5A0029442808109D8B632B536960ABA2311CE102302175B52E08464DF9258D5D654CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59718c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\93aa865a-268a-453b-ba8a-daebe072f0d4\index-dir\the-real-index~RFe59718c.TMP
Size 72B
SHA256 7295936fb14a7ecdffecc1ddf3038c65e3ba5c54603dce99e402fafb7a8b9721
MD5 1c6848af2bbbde0307947c5ac65bc984
SHA1 5df085288be4044ce549a0c3f886323cbedfed9a
SHA512 208011ef6d559865b930ed32d25568ae55e43f63fa1d4b73b0fc4d30626bebfed53573ac072d77a9ee0d50785c2893c31e88548f5b19bcaebd7813247b8b726e
TLSH
T169A002D003B30C09F43362B5555312411204C8146167B30692950495EC54C40654350D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c525634b-d4e3-42ee-ba7f-48d143c62b85\index-dir\the-real-index
Size 3KB
SHA256 56ec7a3297bbe62c33aac1b2706f50e15775cd22c5bae1206795ffe93f459cf5
MD5 ee3846aaf5500e4897b9b1c69c61e569
SHA1 01146cdec2fe61b64981145ed6e28bc0289a4ebc
SHA512 887bd9ba51ed1a1ed07e297f04e26cf3d8473e08c097a6ad756b7795ddeffadf7c64c5558982bb9b4dfdedb2183dea4b380d6b463ca5afc1435715f2f2ba037a
TLSH
T13851A5CD5C4356ABDC6C49B318B2109933BC49DC57E4AA13BCAD1136B4DB36E0E1A35D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5981b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c525634b-d4e3-42ee-ba7f-48d143c62b85\index-dir\the-real-index~RFe5981b9.TMP
Size 2KB
SHA256 91228c77825975db8183369e87b141d9e0fff9b541d885ab544ca7625cf8f0d4
MD5 4b357df18a8400866fc28bfaed2dc181
SHA1 e7fd843a432cda5636de2597a8609debee5cd1aa
SHA512 2c93bbd9186a9f68116188d68cd3be3dd352484ea5e7668358739b892e372c1055cfa0c2dec700692ef9fa96b158b539860df88ef4eff9d4d8d8e7f9fca6e996
TLSH
T1F151B59E9C430A32C9A495B359CA6469333D68958A49AF0735FC8A33ACC37AD3D56344
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 a4f92feca73d91688274f49c9c6bfa08f91055866fd1ebaeceb8c0c7fb944376
MD5 5eea486e2a6b2156241ab98a7514315b
SHA1 6705721c034d4c632cb2a17cc2c57243c5d97bf8
SHA512 21e7d543911c169a9044f318fc66727112394734ff5671061637f9ebc21bf7d4e1d548a8cc080df3e8f6c0b770e990b3c5cc2a20a03e444a2cf3fd3e82f4e202
TLSH
T143F05C773FE71814FCFFD7D5247100A604017D5A8954ED9F1426798764F17282469C72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 810508c626a285c1c1d25db11f9ee5c36bb4f3f820b8f1754deb1dc75c0c31c9
MD5 73a7924f2370397010cf762e039990f1
SHA1 0931441417fb95f474f7202a96b5c6ddb64941c9
SHA512 ee0532194ed35789cf31f7636cd2c7879abe45d91af569bbea2061bcb5df0d948d831bcee13e3c0597c6d2f01d8441ab3f1260ff6c43657b2cbb2a68472c22b4
TLSH
T14BA002D3CB79C141C2011279B06107D8BA32CA9C0B052B1554AC057588651458197005
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 19f9735697ca7ab6f66ffb6749f10a6f683dadfaf272ea200dfe9bfe4c9946f5
MD5 70b5c9f74c925aef998a747dbda4c4bd
SHA1 fc55cd35822386d279313186ea625a40dcb4de53
SHA512 f71cc4f8878c51d809b39df82fcb4b962e5721934ec5cdb252cfebbd2576c45cdd2465f6d4639c729c4be7e1dbac3fe648ffa3ba93047e27fe54c6590f44e87f
TLSH
T17AA002D7CFB5C295E3020678B07152C43210CC9807052E1555BC0194899018085A6404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597d44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597d44.TMP
Size 72B
SHA256 c46416eb105cfd3be8fb366db947b1820c6929acd04abcfa17c4a49fba44e49a
MD5 02d1f4214efdefddc7d461bf73c881f2
SHA1 76041742d90710e69a4f23ea6309043076f5a73d
SHA512 e1fd8e709ae8f87300f6b21ed6d69afa694a23b4796187abe80c4270fe4860bacf67283f572c3cf3de1c942d72688ffe92387b956c97051dce2c9957e01bb3af
TLSH
T10BA002628B9E5800D808097F10095A442360886941441642C4F094ECADD1C44DEC1363
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 01e2db2f0e216e43e7839830dea29c53957a9b5849fc1eec323dcbe078edafbe
MD5 256cc793442a7bad39dc322f3f539948
SHA1 3d264cb6c42ab980fe94f78b0268b2afb3a7cce5
SHA512 75ee438fea317cb1b664f649cb58815834740e085110d78ef1ea055f0eda0a2ba38b43cfa39637fc9b8b20458c4dc93e928e9fd0a053291d3dc6b652597bb9dc
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BVnpC:krN/INhx+kcxKBzxVpC
TLSH
T12BB22B11717A02813A7E398A8595B42F76C230A371D8B53B7BB914A60F6BE20DDFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f7c337ff2e0f59780803ee17dc16241fda56bb113294d5cbaf6bd000ff82e9d7
MD5 4f90c119cb3976aa5df1b207260a88a7
SHA1 d2bd728982ee195539f25f64939d4d58d45a2e11
SHA512 3980246e5bfd6a8f42bb82435d12251bc110deffc840cdd37a017cd897d654bf7d8298e5cbd52ebaf3c4195d7b3e20a541df2b77ab3d7be04aeef82570ae7e66
SSDEEP 384:nRiFavqMW3sNw8TUNTUlI40TOTPrHHOwfjY7rpJeR9I2rYsAJnWTB9gqFvvZrN1i:4Fayh35wg6vdY7tcR93CJc6qVdi
TLSH
T156C24B76E8A8DA7BBDEA9BD5B70A7603EEE04157C58C0AD4D6D81E0D00DB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3c995dc27095141237a1bb6c1bdb12042e0219d0219b62aad16f71b58960b031
MD5 2b24db11c8542ac5239b6f4b4809eea5
SHA1 2d7cc55e8cb93f6b1bbfacae6a15e9a3915d6552
SHA512 9088f923c8fe514e8388e6acadd542ea34be130ceff3378428078f7f0ef592d68b8aabbaaf22bebd1e62102f9efdef72b4e63a27db63477620dc5c2bca1e44cb
SSDEEP 384:nRiFrcXqn53sNw8TUNTUlI4NTOTP2HHOwfjY7rpJeR9I2rYsAJnWTB9gqFvvZrNp:4Fz535wgBwdY7tcR93CJc6qVdfHT
TLSH
T1C6C24B36E8A8DD6BADEA4BC5B70A7643AFE05253C58C1AD4DAD81E4D00CB1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 040e2806af3b6e8a03d436920e8a8ea3bbfaf9f3addf946237cf3f170a03422e
MD5 5f08bd42e7cd0eae002a5cb60bc3bd03
SHA1 60adede44dbd92299bd63d744a3e37ccc9b62a00
SHA512 67ff449b2794089a714ac1e666df49893b3325adf7cceac9eccfd9a43201bac402e761a618bf6992a627d9c1e0448e611507e66571c4f5bd77f85043f2f32d34
SSDEEP 384:noiFrcXqng3sNw8TUNTUlI4NTOTPcfgI2OwfjY7rpJeR9I2rYsAJnWTB9gqFvvZP:zFzg35wgBBI6Y7tcR93CJc6qVdfHT
TLSH
T1BDC24B36E8A8DD7BADEA4BC5B74A7643AFE05253C58C1AD4DAD81E4D00C71DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 477307a70de986afebc2d3f0b6a08075153dbd920e7d84882887844bf18a90a5
MD5 7981999b84ec51741470ce233103f90d
SHA1 659df9b47a7460b2613748fec32da3d236908dc9
SHA512 446b3b9fc6d3ed19be8cefdd0114a784f877488922eb28ca289f864745fccd7e09a52ca2254b054a9e1bfd2722212d39373b682808a065d306e30c962fbbc0a2
SSDEEP 384:nGiFHcXqnX3sNw8TUNTUlI4xTOTPcMTOwfjY7rpJeR9I2rYsAJnWTA9gqFvvZrNp:tFfX35wgFlZY7tcR93CJL6qVdfHT
TLSH
T167E2C5F594EB8976E99E4B87A33E6E029AFCC153B5480994F7C81E0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 adf5f9e5edcd4ad13f7234405adc85ca3b3854cb030e84a0d0088b9ddd632089
MD5 dc60ea5e8366187ddb8f19d5868c334f
SHA1 d2bf9aa9bf4b7331bbc978b031ffbbbe673f9215
SHA512 6623689175197c4b5fa964e52012a8d1f80163c6b416877519e58a1bb63350d32eee3eda44748258975744aa935facf952701b68a7451ba0dc5a2d2fd856e6f3
SSDEEP 384:nGiFhcXqnj3sNZ8TUNTUlI4xTOTP0MTOTfeoY7rpJeR9I2rYsAJnWTB9gqFvvZr7:tFFj3QwgF9UY7tcR93CJq6qVdfHT
TLSH
T170E2C5F594EB8976E99E4B87A73E6E029AFCC153B5480994F7C81D0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 5915f48b73b6f9f864a0c934ef7c18dceb1b38ff9befb706c46c8c1c5ca8cc92
MD5 0ea3e683ec537968ccd643623763751c
SHA1 8db46c8fe587a81d4eec498ac1154342e841f090
SHA512 1038e8619210343f638e28d618b84b1b5e577b9c3a3a94ba0b9960f8664a6f688770a1318e7f453792f25ca8a6ecbe16a4664b39d61c780fc73a00721bcc9a44
SSDEEP 384:nGiFpcXqno3sNw8TUNTUlI4xTOTPpMTOTfjY7rpJeR9I2rYsAJnWTR9gqFvvZrNp:tFdo35wgFumY7tcR93CJW6qVdfHT
TLSH
T115E2C5F594EB8976E99E4B87A33E6E029AFCC153B5480994F7C81E0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 87d1033780a32fa575cb53b6fbfd7fa8c28726cee8ab69829d45171b6ca14472
MD5 b6904c973125bdcee2c646bd38fb8d89
SHA1 612e66cc1db0c1d7330adebf227ed69942de41ed
SHA512 a724c89ecdf55528e40fcf1dd5a85a1cd6e52248aa0dac37449f2bdffa0d1534b4a113ff46d3228cc5972a9127e176be5e63de1cabc5ccb03a5252f30739f8d4
SSDEEP 768:4Fayv3JwgHX0Y7tcR93CJi6RYk1mC/0KS:zyv3f+D3CZmkEC/e
TLSH
T111C24A36E8A8DE6BEDE65FD5A70A7603DEE04267C58C4AD4DAD80E1E00DB09D530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 226a8e2239e466ae774b5056d76b35be719a2b1ad02c577f5874037e446c8adf
MD5 d8fd4af283094c2ee8642050c2b353b5
SHA1 f2b8aafa8fa858418f60d82c357bc8461cb45e8c
SHA512 673b45dda10213924f4e2678163790d2ef6fd7f0f3bd9979cb606fa89a95ae6d9c6839ffc8498ae919edc5491d16fcb6ba07238fb8cc7d33d0fd40abb77dfd0c
SSDEEP 384:nGiFscXqnj3sNZ8TUNTUlI4xTOTP0MTOTfekY7rpJeR9I2rYsAJnWTB9gqFvvZr7:tFuj3QwgF9QY7tcR93CJq6qVdfHT
TLSH
T160E2C5F594EB8976E99E4B87A73E6E029AFCC153B5480994F7C81D0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 61a898160913b257edce37ac9bc0d1d3d71fa629e86459fae945842216a9970b
MD5 88ff9f37ee0391c61a019b52cc446c70
SHA1 ddf99b2fc3bbd1f82d9588ef208e110a91e0acbb
SHA512 1212f6c00834156af87507f58bbc13ef0ed82a0fbbd8bb6a8b7e5ee67d7220f70f83f8e99a9525c7a386fba47cd856660a4d75c2bed20c1150a89c1c2c2b253f
TLSH
T1BAE00151D710546DC07813718A231B302FD1C45511A012465625129CBC377003E66BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f27915cd40c2050b546619c02b5c6aab8643ae14999a098d2f91a933d45b52c7
MD5 7b6ee97be8c802183588a233b8ae26a2
SHA1 6c2e4061ed6c4a6b13a48fd266dd61a76bf6b776
SHA512 98d8dcbe9024c72030ac2a45d782d68d7d3179b45b79570404a19d92a0cfdd30288d87b5af3654a629d022d563d71e396d8a116f222849b26702449f8d76b22c
TLSH
T15AE00151DB10546DC47817718A231B302FD1C49511B023475725129CBC377003E66BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c4dc440ebee28c8cbaf3901528badbf8d6dab2d63b55dd6a0fc730c624bd139e
MD5 113ae9eac21dffabc07598f9d608d8f9
SHA1 cfdc0411711135a79290d69e360fe9c7f501e0b0
SHA512 a316e99c40534adff3f9f5166f747cfcc7819f1062592879758dc03dbe286f310388974eb71c135740cfc6c97cc542a7930ff85de8b8572d3dbaa1900b57e810
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59b02c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59b02c.TMP
Size 392B
SHA256 ed51b63410eba2967afac3297cb7817c44450fabf581184048d98b5c33c0b3f4
MD5 c397d39518cba56717e80e7645f8942c
SHA1 ffa0a1e5077f22fa935f36019c482fa040d53afd
SHA512 e4d30b94983dbcad07f6ab4a2846462428584589b2dbd72dc59e2366b5df7a585e54b49f63a0d51e582822c7c5b027555df6e94d4c310cace84d36b51132f2c2
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 551b5d45674e685ce42bfad9fff59c2b88013f6b55f022edbc16b0f3c5331515
MD5 dfadd3bbcae128d4205fcb6c178f3aaf
SHA1 005be079c2cf9d7cc57b17192391298786f0cd6e
SHA512 ccca0bb1a5dda3e846892598fcdd5961f95b6b76e8677699fb846d206cef5b8a3a9e3dad59b6d18bcf83adc115474e843a457865545a24a5e42003b77e227ce1
TLSH
T15F4120E1983D2AE1D4BD0E6EA04B78FC84D8D326F178747D6868EE98463A95E640143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4d3d367dbed92af02a9e922ff69c96f99ab9e97faf22c0c87626cbed108aa29
MD5 46827a1af8036ffe4592dca134cc6a7c
SHA1 fbbc69c584eedda43d64fb1acb1475265acfc1eb
SHA512 7c55a965e5d045447e40031c86e59d5f28d6eddabab63758427a789caea0398a3ad28171b0718c4481abd574eb37f124010a74a4623cb91c0df1912a57eaad33
TLSH
T173412EE05C3D2AD1E0BE0AAFB04B38FC84D8D726F568747D6858EA98473A54E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 991b9f93117701e57e14915af3d800c21ab5c8b22bca75c0cf6c3657bc746cad
MD5 9f84164a2f788947be2197708128730a
SHA1 b650f3952145efef5b953a44e6b3c7e7f063864a
SHA512 d92709570bec91940d799ebc02c78fc35c206bad0a7f326c2a454134c386b049c0d5b051acfc7b5a415abd4f458b614d260e89aa993b6353e648b3461783c655
TLSH
T19E4162E15C3D1AD1D0BE0A6FA04B38FC84C8D32AF168347D6868EE984B3E94D240143F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fccae2b47d360bcc4001220a3a3e4c7c95e56458815e00b858deb9db82f2be3c
MD5 27da2365b44502c759672f3b8044fb96
SHA1 47936b98ccd7a3e41292028eaf47ef85ed3ae571
SHA512 4d8eca8ffb60d25b681d77d983455bc4029abc8f06e5a687103d40ce0079af5c219d2d2efaa3e8715b65251879782bda12164c9aacc3e0173b20044a91511b37
TLSH
T1C2411A5DB6E91108B3B36E5A9BF7B46E447EB9772E06959D00110D4F0A23A41CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7a71acf9ee689f16355c48bc645fde711de500720eab338f9d3666a3ab9a9492
MD5 afcc0fc540edf4f9cf267d40c9f61ef3
SHA1 ba0af820d9fdb69bf6a80b5ade28e4b92602cb7e
SHA512 a07659fc19b6c74b08af6b38cdd13f040d1eeec15f9f1ef5477482a0e14cef6d0209ddd2f2ca05616c1bed7136315d57f8256468a631d47540fef8e8914a4d9a
SSDEEP 192:fOv5zboCZKxyjEy21d66JozGzgCl6mc0dz:QboCZKxyjMd66JozGzgC1jd
TLSH
T125E11268EA29863FC414427BCDA61F404F39385BD84E3F19319C641C2D572EE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 f1a6100ab33cd688d0d26c002e337ac06c74d908558807168481b18d75a6fb84
MD5 882b3682c8916aabf7994e5a482ffd2f
SHA1 2dc05ab794ef736308ccef1f34cef5c19f603834
SHA512 c52924de671b41919bdbe2e0b546780f6ab3509e92445020d0d246819d6b4e9549d8f674eb12037746bb4de0603aa782ede1adee5bd9f912bba7ec140297b3f6
TLSH
T17461975CF229463FE445813ACD861B411F347456A8AF7F2A35AC604D1E1B2CE7B8D53D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 04b440b2859036090d5bad2d869ade506635d953b98f939c1d68a0e0b3c2f392
MD5 c2938cfbfb53ca23b57ac144963208a5
SHA1 e7743000e607699a8f0473baa750765a40145b48
SHA512 9133bc1a942a709c554f9f0763fcfb5d8cceed2c6ff44f20b7aef5f5b9811c45f53671bf8675369fcb58c69a2ad2d8fddc17db97b9687b6f3ceedf9770328323
TLSH
T15421974C3EB84D2AA8D7E698B445028E53018A0A08C71C434D02DE8ECED5AD9726A4BC
MD5 SHA1 SHA512 TLSH

Submit Download

06670cff-a3b4-4e7a-8a1a-f37e3346ff84

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\06670cff-a3b4-4e7a-8a1a-f37e3346ff84
Size 235B
SHA256 a74f70f759425d7c5f0f35f228231cfbeea4139159d4bf8ce6428001352020aa
MD5 bd0b56b73b9e5660706609d52f6be57a
SHA1 226e789ec79d0aab92534e5f48aec2a0dacb5af2
SHA512 7c40d4121ea580f19c86569b32310b8a3d572f4fc1daedfc26a76351adcb67a52fa7e255fb16bc644520a3eb66e147cc47115e6b617c0403e2d353bcb4acf83e
TLSH
T168D097D83499276D08000F0AF0A03BC2F0844C3728BCA860AA5209748EBDAC84222C2B
MD5 SHA1 SHA512 TLSH

Submit Download

19497c4f-1afe-4329-be63-7a4cfbee636f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\19497c4f-1afe-4329-be63-7a4cfbee636f
Size 235B
SHA256 4c51037fb6891ee9f69f77b872189efce8873a39f761af8bda553c9f48005bea
MD5 b0039d5dc6a0f91abfadc41a72b1e21d
SHA1 9f28cd1662ba9efc05f40c8711aad4d6bc4f22e0
SHA512 ec0757d28e556b221b88a6d000a637a59e71d2e3e415339a149ba125db8bd30387f11ac1d24a493c05eab89f9c34b12407d61d8487c39bb98407505e24fd3604
TLSH
T15FD097B12C88271C08084F07B0B06CC631458C332860A810DA604079D9BCFC54122806
MD5 SHA1 SHA512 TLSH

Submit Download

1b76a25e-39fc-4851-a5ac-ab52c7cc6974

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\1b76a25e-39fc-4851-a5ac-ab52c7cc6974
Size 886B
SHA256 037f8e5292beda02c032ecf08328877b718b962db42449d03976166c3cfb20ee
MD5 d479b70855834e5da004d0a9bc87a35a
SHA1 1a80a5d642d23e74848c48fb85012b2b5c33e615
SHA512 94aa95d1c1e4503b396437e88d2db86a23561b08d996d512d032db780c3cfe2531bb4aaaf45f8ec37416b8c495cebe7bf1c565ed04dc93cd60459915fbd9ff1b
TLSH
T1561100448E3976B3CC78C28B85D83B424FE07123C0C64D083E605E180DEA16F67AA60B
MD5 SHA1 SHA512 TLSH

Submit Download

2440e571-dcb6-40d1-8c63-c919fadc8ccb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\2440e571-dcb6-40d1-8c63-c919fadc8ccb
Size 2KB
SHA256 aa1832a597d87491e21a31b0d4678cb3ffce622b32d1efcee8803e38d94c0b85
MD5 32e7cfef506bff78b572c857d9087aef
SHA1 1444a00fddd324f6c2540cd3b2d3d78710215a87
SHA512 5d1fc27a4645b00d8d05dc5d099185b8914427fc7313f6c33d2f3d2de968450be8682a55747743ac6a635ec2938d2fbd42754c5875024e28e39142ed29b2e9e1
TLSH
T16141105C35788D7B5CDAE19DE481378AABA04A1340C61C432E51DE0C8D926EE636A02B
MD5 SHA1 SHA512 TLSH

Submit Download

eccc6bb0-0b53-4e20-a442-2f5d697e42a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\eccc6bb0-0b53-4e20-a442-2f5d697e42a8
Size 883B
SHA256 13f7d50112784af1689d81fff9c1cbdd66b7c2cf4e70a654f99614fa9ab9328f
MD5 4c9b2f376543c5d5dce486c429ddf726
SHA1 03bfa958b862ac29a140c02b641c001341f77f5c
SHA512 b7a6f1c7a3487b70f80334cbe96a4c1f6316f7bfded7f22bb1810b943b851d8a34f68c7523e68a66750bcb878937ab145f4bcd5589c2591158bb2e2b79c04d98
TLSH
T14811C085A635BAB28C78C28F89953B029FF4751780C649143E704A180DBE66FA76B31B
MD5 SHA1 SHA512 TLSH

Submit Download

fe813cf4-8408-4444-ab5d-38f50afee88f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\fe813cf4-8408-4444-ab5d-38f50afee88f
Size 16KB
SHA256 748af5e377337a187b41ea6c23598e3649fbb961dcf52b2728ba696aba7cdd99
MD5 08f6a8b7adec9317ea0b8f981c39988d
SHA1 e8329096a499ed115adea3e8509a1fef7f577a46
SHA512 72357a209673610251f1ff6abc015a6cad96bf50331e599d771009208b51b8a48ddd130a941ecff04858fa8d7f63db5245614f04a0c78c211cd99903c67c09a5
SSDEEP 192:sU51pJcvBO8F4QXs3dVhDpOcZDvlTMeLMGxhJT5ViRzxREuiYKmY8EueukkPdgkQ:bJ2lKQ+JzT5ViRlRLiYLY8JRbPdDw1
TLSH
T1E272CA16682049BB8691E35895FCBFC3E5F538CB4C429FC997E0BD092DEE0AD112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs-1.js
Size 7KB
SHA256 b598202aa8d2156c4f257bce1eaf3df8876d4a59f268187c2cd15ac73a8c9d83
MD5 c9e70f07bcfac873d7670920c518ee36
SHA1 f23e9cd9e18f3d1e68843524277f1e273e9ae75b
SHA512 1093143db56686fb725d41b8f20e0ed49a9727752926f7ae10f22a0531c266d5397e85f1b61cb6266c0ee87f6698ac6982e7d430778d27593c8b37246fa25a01
SSDEEP 96:xHDUTU0qGqwfCjbuObzSpSSl8pdv9jKn1lHjv325YAp+Bw88n8L4cnMVgt:NXRwfCjbubSSG+Zjf2DEBw88lS
TLSH
T110E120789508CB7F64B6776CAC6888716AB2413BB7BF68C750B544C4054CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs.js
Size 6KB
SHA256 9fa3924250eab10f4430101215e0a8d1bb18c9139af001cd5131b8a8cd632f47
MD5 fd5aa38f8318d9e3360b05d4dd99a96d
SHA1 61ef72878dd6974b4e278da40fe72787a68c0f3e
SHA512 bdf0fe8193493f9eba4ac8529edfc9f9222fbc778825101164b21e3c8ee484ea01d6398f0daa827bc9c68fa9b1c8a7860cc175c4c1297bf95bc9fcfe2aab9bc3
SSDEEP 96:xHDUTU0qGqwfCjKjGnj81zSpDAiSSl8pdv9jKn1lHQ25YAp+Bw88n8L4cnMV81t:NXRwfCjFgoDAiSSG+ZQ2DEBw88lyv
TLSH
T1D6E121785408CB7F64B6776CAC688D716AB2413B77BF68C750B54484054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs.js
Size 6KB
SHA256 cc5b4fb11833a51b9f2d2c758b03454edb6318aa79ee723495a24fb39c949e68
MD5 71d73d049a5736502287f12bcbbd650f
SHA1 f1325d5d6567149edfb3cbff0411e8a8b19e87e2
SHA512 0b7586a05c11beb5d42c41d9d2aece79895663d5e23c4e560209364e6bd76c2da0ff81cb4423057349cca617978fa253f55e6ba0fb2342ab3f41d91142fb019a
SSDEEP 96:xHDUTU0qGqwfCjbu1zSpSSl8pdv9jKn1lHQ25YAp+Bw88n8L4cnMV81t:NXRwfCjbucSSG+ZQ2DEBw88lyv
TLSH
T102E13F789508CB7F64B6776CAC688C716AB2413BB7BF68C750B94484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 86ab9472a2399e0714fcb77f1cda9c642da7442661ee471731d73b8683d29949
MD5 4e5d4cc4f4e0b2ad35c7f74d84868850
SHA1 3b57b054822ddbcf65f114926d79154397f3eb2b
SHA512 7fd0b6bba2da8904bd78b02929773cd1d6b6e870192c036944df8ed454c0c2ff98bdf53379746a9cb77b6056d284014c3401d881318ca612fa460f48c392cfca
SSDEEP 24576:+aR6O/IB6jo4oa6jBfXmr1Op5VdT3QJgqlbUsP+:+E2aoA6NXmr1K5VdbQJgIbUsW
TLSH
T1AFF52AF820D2B357F3418033A64553EB21AFD00CA467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download