4c8ab6f95b6518c05d7f635e8b2188f66acb305a7a28e7c987dda8f5a7409ae1

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
login.html
Size 28KB
Sample260504-mk7pragy5y
SHA256 4c8ab6f95b6518c05d7f635e8b2188f66acb305a7a28e7c987dda8f5a7409ae1
MD5 4ec3673331c6589b7c339b9698ce936e
SHA1 e76e1f6c2aca6d73970017aa48e1ef9f42ec5036
SHA512 44447ab2331f8b3d59a4e293477d6b2efbcb21632ce9179cf9544221a0c769a4eee8707aff981ba5996f1e30c7ce3ed624d4c359611fccd7cba491bee5503ad0
SSDEEP 768:55b9Iwxkr43NgHUV/utAauuj3UWXJ7syZ9x:r9IwxNcUuuuj3UWv
TLSH
T150D2289653B493B88903C37C862A687078596CFF7A51F205FB9E0561FB9C8CC8896DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4904	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223829955595557"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{085C7BB2-D765-4851-85DB-CF0F56E3CAD4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	firefox.exe
Token: SeDebugPrivilege	5072	firefox.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
5072	firefox.exe
5072	firefox.exe
5072	firefox.exe
5072	firefox.exe
5072	firefox.exe
5072	firefox.exe
5072	firefox.exe
5072	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5072	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3604	4760	msedge.exe	85
PID 4760 wrote to memory of 4904	4760	msedge.exe	86
PID 4760 wrote to memory of 2784	4760	msedge.exe	87
PID 4760 wrote to memory of 2784	4760	msedge.exe	87
PID 4760 wrote to memory of 2784	4760	msedge.exe	87
PID 4760 wrote to memory of 3052	4760	msedge.exe	88
PID 4760 wrote to memory of 3052	4760	msedge.exe	88
PID 4760 wrote to memory of 4540	4760	msedge.exe	90
PID 4760 wrote to memory of 4540	4760	msedge.exe	90
PID 4760 wrote to memory of 4540	4760	msedge.exe	90
PID 4760 wrote to memory of 3024	4760	msedge.exe	91
PID 4760 wrote to memory of 3024	4760	msedge.exe	91
PID 4760 wrote to memory of 3024	4760	msedge.exe	91
PID 4760 wrote to memory of 4088	4760	msedge.exe	92
PID 4760 wrote to memory of 2696	4760	msedge.exe	93
PID 4760 wrote to memory of 4088	4760	msedge.exe	92
PID 4760 wrote to memory of 4088	4760	msedge.exe	92
PID 4760 wrote to memory of 2696	4760	msedge.exe	93
PID 4760 wrote to memory of 2696	4760	msedge.exe	93
PID 4760 wrote to memory of 4228	4760	msedge.exe	96
PID 4760 wrote to memory of 4228	4760	msedge.exe	96
PID 4760 wrote to memory of 1276	4760	msedge.exe	98
PID 4760 wrote to memory of 1276	4760	msedge.exe	98
PID 4760 wrote to memory of 2380	4760	msedge.exe	99
PID 4760 wrote to memory of 2380	4760	msedge.exe	99
PID 4760 wrote to memory of 2816	4760	msedge.exe	100
PID 4760 wrote to memory of 2816	4760	msedge.exe	100
PID 4760 wrote to memory of 2192	4760	msedge.exe	102
PID 4760 wrote to memory of 3492	4760	msedge.exe	103
PID 4760 wrote to memory of 3492	4760	msedge.exe	103
PID 4760 wrote to memory of 3824	4760	msedge.exe	104
PID 4760 wrote to memory of 3824	4760	msedge.exe	104
PID 4760 wrote to memory of 1640	4760	msedge.exe	105
PID 4760 wrote to memory of 1640	4760	msedge.exe	105
PID 4760 wrote to memory of 1640	4760	msedge.exe	105
PID 4760 wrote to memory of 1008	4760	msedge.exe	106
PID 4760 wrote to memory of 1008	4760	msedge.exe	106
PID 4760 wrote to memory of 1328	4760	msedge.exe	107
PID 4760 wrote to memory of 1328	4760	msedge.exe	107
PID 4760 wrote to memory of 4888	4760	msedge.exe	108
PID 4760 wrote to memory of 4888	4760	msedge.exe	108
PID 2116 wrote to memory of 5072	2116	firefox.exe	125
PID 2116 wrote to memory of 5072	2116	firefox.exe	125
PID 5072 wrote to memory of 5108	5072	firefox.exe	126
PID 5072 wrote to memory of 5108	5072	firefox.exe	126
PID 5072 wrote to memory of 5108	5072	firefox.exe	126
PID 5072 wrote to memory of 1420	5072	firefox.exe	127
PID 5072 wrote to memory of 1420	5072	firefox.exe	127
PID 5072 wrote to memory of 1420	5072	firefox.exe	127
PID 5072 wrote to memory of 1420	5072	firefox.exe	127
PID 5072 wrote to memory of 4632	5072	firefox.exe	128
PID 5072 wrote to memory of 4632	5072	firefox.exe	128
PID 5072 wrote to memory of 4632	5072	firefox.exe	128
PID 5072 wrote to memory of 4632	5072	firefox.exe	128
PID 5072 wrote to memory of 3364	5072	firefox.exe	129
PID 5072 wrote to memory of 3364	5072	firefox.exe	129
PID 5072 wrote to memory of 3364	5072	firefox.exe	129
PID 5072 wrote to memory of 4212	5072	firefox.exe	130
PID 5072 wrote to memory of 4212	5072	firefox.exe	130
PID 5072 wrote to memory of 4212	5072	firefox.exe	130
PID 5072 wrote to memory of 4212	5072	firefox.exe	130
PID 5072 wrote to memory of 5916	5072	firefox.exe	131
PID 5072 wrote to memory of 5916	5072	firefox.exe	131
PID 5072 wrote to memory of 5916	5072	firefox.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\login.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x23c,0x240,0x214,0x254,0x7ffaff8ac188,0x7ffaff8ac194,0x7ffaff8ac1a0
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,14494607456161701729,15702123290450216285,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,12549716555141394533,17327463725157836194,262144 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,3048306820387173892,17998614893979648269,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,15774294482406586438,10641591727060122426,2097152 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,5223640324999707361,420943954298356152,2097152 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16162092462431043541,14110692350619871119,2097152 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,6216614088756815399,16722825866002701554,2097152 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,13947633443808553769,1252247709160686836,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,1230448152482261960,4181390246289817837,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,12544918905922014111,3852751494177004029,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,15623100313455224101,15267234652193786921,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,5039292423503676051,13285025941974359795,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,5039292423503676051,13285025941974359795,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,13515932566072006156,10904816422598405717,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,13350160430340678717,2216357038914518055,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6572,i,10685801499289641118,11030669349452019892,2097152 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,10531220731827395167,17835625481958853891,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,3084923332771754804,11925016948739770212,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,2148627847920496616,10639557233856848944,524288 --field-trial-handle=2240,i,9755202966469174610,8694142116157179111,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {b31e2c64-0b99-4677-a8cb-a1881b1cc367} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {7fd1391b-2b68-49cb-b67a-4f900e7e1247} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27276 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {522ab0e3-8df6-4c50-a55b-f3ac9f0622d5} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3164 -prefsLen 27276 -prefMapHandle 3168 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {e20ef4d6-0d53-4761-8089-f237e03751e2} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3300 -prefsLen 34775 -prefMapHandle 864 -prefMapSize 270279 -jsInitHandle 1156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2992 -initialChannelId {c5b3224e-e274-40bb-8130-00d169335be3} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4756 -prefsLen 35012 -prefMapHandle 4708 -prefMapSize 270279 -ipcHandle 4772 -initialChannelId {6571311c-a978-4e48-b5c6-f71d293b9427} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 32900 -prefMapHandle 5068 -prefMapSize 270279 -jsInitHandle 5072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {dc70dc1e-f91d-48f0-8be1-269f77f1d26f} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32900 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {466dbb2e-adb6-4a93-a4cf-4bc83d1ea828} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5096 -prefsLen 32952 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {20554955-1feb-4897-87ef-77d07e0aea1c} -parentPid 5072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d027a6f-6364-4f12-9fc0-26d51122c30c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d027a6f-6364-4f12-9fc0-26d51122c30c.tmp
Size 18KB
SHA256 f6581340d7eae51e3a66b10e58c1e161065a1390726c0a5daaed21f4173c50fb
MD5 40f8edc85e9a7afd44cefcadc6c100e3
SHA1 0ecbf1ac5cfd67cb8af482b92a4814273771b785
SHA512 9887b3d34fee6eb326c75d6c23bb266bf65ec9a32ae00be32d6207a8ee276d94e6a4807ca67151f2dcc69454eec6453aa93cf895185cd4b3d58e3278082f78ba
SSDEEP 384:nnsNR6TnBoxie2gD9GMIgeJASwhZXUsc95k8uU8:nXezDTdSuc9fuU8
TLSH
T1708219B0D8A49CE745E2EAC97147F5132FA4013B8A9C5E5CE6F4BA3D309F4F85712822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
MD5 3c974a700ca35a09f8c2b49b1532d825
SHA1 c8bfc7bbffa5a8b16f303fb3855c7272f8cd2207
SHA512 d0f0c915c5c5723353ebb14545f03ebb586f6004eadf2c4989a392b096d18eb0d4d7b393ef79d0e5b3d4fcce239d92a12d86c978f01ea96a23a5eccc24d012f9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T1AAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0eeec51fc100e7b6d41d0c2c132909358d54036c9172db0ddc9348ad37d31a3
MD5 e9515e75ccc77dd335e02bf442763576
SHA1 74af3762e5b9a921825ff76e422962aa4753da98
SHA512 7fcf9dfe8ec3a9515e5f7aea8233f62fd362cdb69ef896f19c7117e55202a1b1aaa0e89ff5f9a8fdda136f24804652f2cc2aad299e2a5b26f55a3c9f5f2917b6
TLSH
T1DBD08051FAB9A451D1434CF2580553127E16C6F6BF535213B051683CDC135A4D3C5343
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 34KB
SHA256 afd4782e0b7442187ef3334e0dd04804eec2f7e78b66f2486e9aad0e2c0f415d
MD5 86838477fc764344efbfb59db3377e02
SHA1 975ba960ae9f272dcbbffa0bb4846ae66a217bca
SHA512 c070be0783368b0cfc2c82c404a77b3d3a54d4fa7276947675c29af0c0f1596c0820ab6b7f55ffef78204b6270599e52685c465a5e5a14719affedfcc6e5171c
SSDEEP 768:UyU08MPVeXS+IFU8EHGmvKhcxSDctxyvsi0PD:IsdeCV5mG3hcwwLyX0b
TLSH
T1AFF2E1309D56284B8376EC684F46B9E2D4953252873AB157063E974835F13ECB3899CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 97KB
SHA256 08c1ade001a530f1e243f27f19e1b070ac4b43ed38dd3bb1d7c40715dc4c87f2
MD5 171a26291b479857a5abeaece2104b09
SHA1 82a1796ad885412da94a5f0f15e91f3e07ca888d
SHA512 9ca77cc7db39ee4dffae42300e1494f9f8fbd6233d7740e9e9d5679b7d8979a58bc8ea510262719af0b4941a62584cafc404f0e8a875fa90baa0a9c1a5af93ac
SSDEEP 1536:wq/tCttbQz328dc9mqGiTLFu5ptbSOcOL1Rnz/Cl0jMHweWcPJsD/gPG2wMpatK:wq/tCjbrYUmqGiTLc3BBHMHweEkw4atK
TLSH
T10CA31289F732DB1F9313943896AC73046FC80367244986FE104FB9D32EDA55B2276D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 68KB
SHA256 10b42aed09380e9e8dbbff509acea3e1a3d5dec55ad67a7762d0ad134aa73e6c
MD5 4a93e1e7966665fe1c220053539f24ad
SHA1 f9068912a5c403d85a47a070c8245d9d85b055de
SHA512 238c07f8a77eb2403d9ccbf66435f3d2732430fff02ac4569a5c580d7575d22be0f3bf356f46ea70f8ee88fd3ee09d8f2b86af195c333ae868ddcf1517bbdd10
SSDEEP 1536:kv7iX/3S9HHJYdpdKl0wgwHMVFn85E7B3k+g2qiyyyg:kmv3fdG0wqVFn6g0sUE
TLSH
T179630207769844C18ACFE9DF121EE523A52073A09242A7DE331DEBF4D7B369358A51B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 401KB
SHA256 569664398afd2d61516d4e79e6e62738f2f03a3d8821bcdde9b6268c8dbe9f75
MD5 4ff5bd70179ef5269c1728dbdbf74a07
SHA1 4de4e59a7b27a5d9905cabdbc4d0a7981241739b
SHA512 b3a2bb243f6c5ef34e2b2eae052b0d4c2fa9037b55e9038f5b76bc376b746f746f1cac71ab74b9f2d6353e24f808b549b658ad9954f1ed6d63e03db651c5cfa8
SSDEEP 12288:P6JUnWUGAop/SfI4Gl97/aGPVM0LB2mMSj:PZW3AtQ597/9tP4ij
TLSH
T1D7942370883BAE4C1D5F3738986FD93005A4ED37606B02C9D25DE969E8043977FA9E0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6455cb7a640b93f8522df6fee90b80e3c435e2dcda426f213c9c804cb5153988
MD5 44679d91506c2de39e0850c33ea73f11
SHA1 b64146b9423309468f5848c0cc991534eb690f1c
SHA512 1e47579708bebe58122fe1c1800191e218351af537467b00a009df149d0aa300426f1430357a23d2c8a1f8ca7bef4dd3be7ad78eeafdca6b6843c6521b27c125
SSDEEP 96:ddqD+ItzKhFN9C2lSwxCA19abFtkRANQkp3S5fHeRL9:dgGFN9wqH1OFtkRAr5SZ+RL9
TLSH
T1FED11024C7F5447EFFE849715AB22981F2F44A641352BFAB0DCAD27C0987691618174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588e60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588e60.TMP
Size 3KB
SHA256 029fb53511d33b117e770ce0a7de65609505ac09fc1e7862eccd64aa01140149
MD5 65e36cba79bd29e964d999980d1c90fc
SHA1 b0a0272244740a93b533f2a6aba5718797bd4fa6
SHA512 16dea78f66fd8dd53f12c90bfb2a4b0d2f0e02ee8f3a07aca86b36813b5007d713d1fdf656d9f1a2d9eb57eb03a1349c04af03a2e3cb244d4c58841b65d986d8
TLSH
T1D361F89413B9847CFBE400B0AEF62566F2B04E6983073FA616EC963C5B86F11308178F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2353acf4ed8b621cb954f1e21c8b06c38faa30d5f027d4a768a855d0e913e254
MD5 9755fd55bcc89b1d55406eece80aa836
SHA1 283fc8f70c193d5ad69f6da0c82ff19fb9ec4917
SHA512 2b70aa42e2d7666360eda13d5abcae0c8271205d179560219e3ef0ea9b67296a57e17c9f2ccdd7bc1f1fb507a0996394cc910d83006a51a537d36051ab536bd3
TLSH
T1FA81BEF7C3E5826DCA1196F0AA186F1BCF1C0552436C3D5A85E4AF4B93F2471E152B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7ee5e2d21259533494453cc2534a621610d15ec5ef7e0e86b38405c6e3e5c423
MD5 b2fe112d73584d04849fb8f807eede2d
SHA1 10d00cec4a1455a79c08d2fa36c6761ff84f6dad
SHA512 ddf108671e82a77403a2b85082e0a40f25c32bc1224f5b5bd34acf563ca8f8b2095641efd771f84b814fc5566fe7c594c5091d6cefe488a511fe72204ca27aaf
SSDEEP 192:sxZdQUnGRByM//K1Ml8MWOL/f6sN0lGAG2b5We0dpmALHW6+WNB06/YNv8eIIg4J:sxZ1nGvuOL/f6sN0UxyWe0hHbP/Fc
TLSH
T1E562E812AA349977DCDBC219F915BB53D6F91522E6940E48A9FC8A0C04E6BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 72bf321891065f456de6bbd6f1e438345194e40758cdd36872409fd4f27277da
MD5 a5b1d31765c7eef8ae29a5ea33a76d97
SHA1 6e81fbfa002aa5369261410c172a74c3425b55af
SHA512 3626f07b39cd1f86a9f5a7aff61f38b44f00478e0850a3109551fdfa90f1ec1cfbaaabf1966289ca66cb48bf617583b156fd11e8ec503fe43acae61a20a31c27
SSDEEP 192:sxZdDUnfRByM//K1Ml83kL/f6sUWpVH086GAGtb5WoddpmALHW6+WN4Se9XYNinL:sxZCnfv9L/f6sUWvH02xDWahHbGXF1
TLSH
T151721A12A634497BDCDBD229F915BB53D6F91422E6944E44A9FCCA0C04F6BED2313C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a8959f75d99f0063efce7ef7b71543fbffb04ba68fed6a0fec0b62a93edc2f5e
MD5 e0c131aeea1b8e89b450a37370b5c570
SHA1 41fffa09bc6176de54b5a614e47f60a2acc6b8e7
SHA512 21295eccf6f8750e2dbd4c07ff9d5101f785799866d5d7fcbdf4aa52fe33e7e31da6cb3fcd4ff488c6b10caeb23637f048a02b8998932952eed10be601fcec4c
SSDEEP 192:sxZdDUnfRByM//K1Ml8MWOL/f6sd086GAGtb5WMdpmALHW6+WNBe9XYNp8eIIg5h:sxZCnfvuOL/f6sd02xDW8hHbSXv/
TLSH
T190720912AA345977DCDBD219F905BB53D6F91422E6944E44A9FCCA0C04E6BED2313C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a7fcd770c9d219d279264ff1209c080cc39bd07ec4ee5b822a08b6502c6fd0c8
MD5 86bc69daa6ff56b6da776185f26de71f
SHA1 5c0dff2955d562b9fd692473743032da61cb95ae
SHA512 fd570a471abce0f2c557930fc08e3ff0fd1f408c1038628f1572cada99d0618745f19c5e2498c9848e44c0a4631780cf9ce4ae38b83e162d1fb993d8494bc154
SSDEEP 768:70qQQv2KqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8HnFLllnWhq8roxj58:70qQQv2KqWve+l+u1jaJHnFLfWhqnxd8
TLSH
T115E20B3B280CCB7E4FC44E9CEC2AAF8A6DE801CBA6944D5447FA494C03D66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 ca25913469aa7dc8a36945f77635a093dfe0148f25d07410e7482ac21d762bf9
MD5 d305081c6b7f4670244a31bca718f8ff
SHA1 ed478897a2f3eb777e5cb89120a4db0bd61aeb4b
SHA512 dc828876cddbc49707f5b36367ca0b68c5eb2782f0b50f209dc2e6659f342ca532386f438842f2d64788a1339bbc309d53db429bd6d3c918b9eb48a6b80e280c
TLSH
T1E5A0022803915000E50611B5E75A4341B384CD140120130B48B00145CCE0D454D4140E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 0b3c4b6c637a681e088356e612e6b948f22eaa93d52075276f4a3d25ab287782
MD5 10ab1f70775d5440775e67519e6831a2
SHA1 de27e7d4947972c9a6ee6486e57b46e34bf56c95
SHA512 f7db6e13889b5bc0fc3dc8ea19ce8d1bb1fb2fbbbea1e4a0d79f413435d1df34e8ea7a31d85cba0cadade4b56b9011fd0db09132bfdda6daf0b49f2a576e97fb
TLSH
T12DA0026123D01075D01217B9559302451204C82051081246889608C4CD58454468132E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 3KB
SHA256 265fc0ce629d9d7f04cdd3fb2bcaaf60e11ce5998720c001cdc2c5ba441f253f
MD5 869c087f0d6ad1fa5c663caa2e1bce12
SHA1 1e91f5d10ee045a1fecb9e302e3d4ecae1dccbf2
SHA512 da16abdfb2c15c39afd2ed446e398e74e82d17f73fc4fa30c8934633df7b020c2e4095c9dfd2005d311a55e9307c9de6666b1cabbe286a68bc51acbb67f0e4fe
TLSH
T1FC51D8CD5D476666C9BC85F20D7254D133B805CDABD0AB0B7CAC6179A0DBA2A0F0B30B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 2KB
SHA256 01f8717c9ae2d1caa13dd9d6c900bb3db2fa8db4823f0b92dff13219707d1536
MD5 fcb8cd37a64f3a48dceb9be8c993d8db
SHA1 51c388a1d3d6a4e5eb70fad78c51540b6ec9cbfb
SHA512 06f984334d9023d3cca23eae4c6efd5d534601663554604a74411c2bdf8700f368085b2a51ed2bd8db42cb372aec4381af9723930893e309b47255f3bc0543b5
TLSH
T18441B74D6C8A9E27CA3D41F15DB61479337448FE1A88470B79BCA13D9C8F9911AE3328
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584e5a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index~RFe584e5a.TMP
Size 2KB
SHA256 408a5d8e221f73690abdccda1ae538668573a34fe3a34fa61abb2cbd6cb3f940
MD5 e117ba96105debffb0649eee426fda09
SHA1 c1e792ca4ab2a85976b1be3382c609f98d056f86
SHA512 57c44f5b0d23c5fd0ff3964b763dbd27e590f1f975c1caa797c67642fe2d749e2d44d56707403f465e1b82612be70f8751f4561b618fcf7fbf6d03982a390770
TLSH
T16A41C95A9C864A23CD3180B249C92469333DA8A509449F0F34FCCA33ACD76A83D52254
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2cbcf2630735327d923175a71f86f1c4555367d6f91a34c7637abb27ee0678fe
MD5 084e805122a478a42d649fe23dc8db64
SHA1 360422527167d45bb093d7d1bd44e6a79be62f3b
SHA512 fe0e65b76c2f1498ce3ef5b6794c9b543eaee76b024f003aa097e80080983c5996972210976e852d55afb56c0dfaddc4e5b2656bef1871bb0d3259fb071bb483
TLSH
T1F4E0D8BB2CA31514ECAF93D5283154A50149B856C951EC8E50ABA1D714E3650348AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 605b596e0fdf7eb63059923efe85dd1507cae0babda76d9b04468e64e758c54d
MD5 f769302373ae5e788bf4d96d64406002
SHA1 b51db95e239c68755535e56938283e36aa56f8f8
SHA512 be2dd123783ac1ee7d24d3d367107d63d70548ca490f710efb289bbd4ea7bde09fa2560866f51bc2873aee5d927bbe878acf7748551706239167b1611e2e7e4d
TLSH
T1B4A00293DB759454D2460178BA7205985240C8ED05086A16C4AC20999A505418AF2005
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588e31.TMP
Size 48B
SHA256 47dd14675f9ed38e4b84819b95fff99937d58291897095a8f5c4fdaadc757333
MD5 9b618ee29b919538201a01ca56342ea6
SHA1 9d8d014df88bc5b61dcaad096bd2fa38e00758d4
SHA512 1c3c6c0474b3d522f3a895d062b361182b76c05b979f6d4e209eec78c74523ef7749e2b9d313976f17f262043651ee9e56b2b0e0c354c3590a7380c17a97f3ae
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0645317d937cccfaa75e64740a1f9ea9bcfb04c967eddeb3e699435779ac5dac
MD5 dd3251fb29c7af0b36c265efb2885dce
SHA1 7c59e5e45e08cceb006a3d62c70b0cc120861e85
SHA512 5c15c1e41272c614a8fb97e3ed2c792f9f8329989e64b4ba2caac4010f630364a0e551a9f4ca26b50ebe501a96b1fbe8e4ace214ef905c3f7ab7d6aa8c4a7810
SSDEEP 96:KkE4Kh6CqWQKTilmTKKMkjisKXKOuBqKK4g:SnvAJ7DdN
TLSH
T162E13652313702803A3E244EAA64B49F56D2B0E73069F92B37B820655F27E21DDFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e19d0770-d5e8-4dd5-8ae8-acffbb5515db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e19d0770-d5e8-4dd5-8ae8-acffbb5515db.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b72ab8b47aca68d2b314364798cb380ec35f51cacdd1c5fc2b1b792696217a80
MD5 46d860f16c420e1bc90fb07347271724
SHA1 f1eeef9d844c54b96dc31acdce376deed6c89270
SHA512 4ab966b50fcca1a684ccab20e1ee73fb4bb28717c11f5204b348f63b17db2a28ffd780f8be18b94632d52c6d342617af422ce17df396fef07e22e5522fa99f68
SSDEEP 192:ZONG6IT0JZQmiUy1F1MOgibF7/uFuaIDU6:ZONG6B3zOgi9fJU6
TLSH
T1C902E775B86CAC7B8EF3AE59B0873B235FA5107BAA952F84DAE44B1D01D754C1703832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c987a817583c617754f756893c23f1fbe62687a100f55a411e3bf53b37725b1d
MD5 d02135b9a5f7908686175b345ba47250
SHA1 125f48d9223a7644765b1d2e2598eb2f1931fa5c
SHA512 93219ef4db810369a7069c9312af21dcda28473c64ef6f24342f2a49d9f5c2127dff8cd33426a310c15fdc461a9b1923ec559c358482350b846d0fe8541d6f53
SSDEEP 192:uu/zLsNRRToTJpzNtBT0P4z7miU11S1Ge8BgDbF7/GMId4ekOqDpU8:nHsNR6TnBoxXe2gD9GMIgxU8
TLSH
T1BE42FA75A878AC3B8EE79A55B4477B239FA4106B57C82F94C9D94B0C04C729C2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 189225f70a6549bc4fb37bebee03fc3a51d1a2d7f0fca209fe551a39e277c03c
MD5 0989393fd7b6e858ce64ef52d1a5cdb9
SHA1 e5616388b34e7b4228ff0b21c93525f5d687c9dc
SHA512 a99fc0981d4470661fe99e4358aa7db5bcf544c21c328d22094eaef55c0d3e4d5c8b1abcb25ef10e627d1896dfec5bad18ef7dfcb2278869814162e1d93cadee
SSDEEP 192:zJONE6IT0cQmiUy161MAGgibF7/GMIdah1OqDpU6:NONE6U8Hgi9GMI6xU6
TLSH
T15A12F971B868AC6B8FE3AD56B0873B239FA5116B97892F94D9D44B1D01C758C1307833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b41df3a0-237c-4919-9139-e6b39d50b5f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b41df3a0-237c-4919-9139-e6b39d50b5f7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b2e55c1d90152f4cbcf1638fa85ee9c0bcbeeff631e981d1e327a6a5d3c877b
MD5 214fef71f459926d644049bb68a5ef7a
SHA1 71f27df82f66885197adddb49f9cd9a48617cc9f
SHA512 18bd8b10137068df98b50493218228b9d46814c7e69d40d9be3f64be51d1dfe484a3df6f9b08fdde356ae7ee654fbb549c3fa49637fc7fb03854c96a2aad5d3e
TLSH
T1EA41255CA6ED1148B3B7AE165BF2B86E487EB9372E4A945E00110E4E0A23E00CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6cxu2nva.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 71c1498369bd2b081823c88940c687015cfa2836445568aa24b42a05b4b52347
MD5 6ae7f472506eb1a004e1026d56deb23a
SHA1 7dec735e7078b3ef83388c226279bf8989cb0b40
SHA512 546c061fa2dd32f7fc3edd2ddf2249b664f92109a4f791e228ed7545653007eab919abc44b6d1f0119b27ad751352abd433bb40ed199cbcb602d80f5256c6e8d
SSDEEP 384:HHMO0iO024Y5Fuhw+5EL1pPsac4j0lpDII+mXBXn:nrZY5FuK+5EB9sac4ID8Li
TLSH
T111527D7EAF0139BE0A27D1C4DCAA6209CE04E6BBEFD2D05615543C45C680779B8F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4087fc3c-571e-4bd6-bb1a-042e766e6978.tmp

Path C:\Users\Admin\AppData\Local\Temp\4087fc3c-571e-4bd6-bb1a-042e766e6978.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5646b6e9-73fc-430f-9c17-5415eefd800e.zip

Path C:\Users\Admin\AppData\Local\Temp\5646b6e9-73fc-430f-9c17-5415eefd800e.zip
Size 3.8MB
SHA256 6ae235b8ff5729383d3cf219320341b1456ad9c47696a519535abde34bc06004
MD5 22d280b2b7cf41f372676e1ad87a2788
SHA1 c191fa824f41a7785a4e4423e3bb19debeb9fe76
SHA512 0dcee546cd38ec992b9d4b722c96e5c20d42ec3efdf4c48b865ef1002662e6ddd274fcf259649fda5d9516e567c041e36b8bda2723a9eec852738708ec15043c
SSDEEP 49152:5trtdv2tUMTenCTqL2NQTpkMXjumT8XwQzqiUlUsPPMLvzhOF3myTIvIeOX2hxNr:5tr1C4FtkMp89JUlUEPMZOPTLmhxNsK
TLSH
T19A06E135F67C9708CDCF83BA810E2FD29C4C5F6680D8A57B6A6AA5715CA31E21F448CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adcfab96-95e9-4fef-9d2f-a661aa6f4ef8.tmp

Path C:\Users\Admin\AppData\Local\Temp\adcfab96-95e9-4fef-9d2f-a661aa6f4ef8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

830fb461-332d-4be4-a893-bf7caa4dd8a7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4760_187371381\830fb461-332d-4be4-a893-bf7caa4dd8a7.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4760_45812244\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 64c89de79d5083539b83053ca0033e3d4e082a2d9a1e4ab506a3d9a1ad8ec6df
MD5 be517875509ec16b6f8ccc4b45667164
SHA1 49a426298502a625d365fc8dcf6b45d52fe21ad0
SHA512 909ddd8609387d3ca4851d14f505811db15766194e96f38841f13ac54f1f97216d1be13725f328a2f6e82288c541a4236025a0456b5a4ec581e39a07db91dbbe
SSDEEP 192:xOv5zboIZy0yjg8U1d66JozGzgCl6mc0dz:uboIZy0yjQd66JozGzgC1jd
TLSH
T1C3E11F64EA29863FC448427BCCA61B404F3A384ADC5F7F1535ADA01C2D572DE7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c9a4a65599079592190f36410a8ae3fe29593d0c0eca55cd0bad67b44a9e23dc
MD5 9210c6d49f45f096997b863929cccdf4
SHA1 dc792d84de0b975bde7bd072867d57aef928cfe3
SHA512 d7ef9c37e5019b5185deac71a0dabe6359d267343d1c3dd8c75ca4a881731bc91c18b126b2dd14f896fe39ad2a27f816dd32ccc094dfaa850303969082518b8d
SSDEEP 192:GOv5zbowby0yjg8f1d66JozGzgCl6mc0dz:9bowby0yjzd66JozGzgC1jd
TLSH
T156D10E64FA28463FC448427BCCA60B414F3A395BD85E7F1535ADA0082D5B2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3d1a9459540387198586a141aae7c54c0ec248fedcb773988cf60002e6b63160
MD5 bfb6f6719b07b042c49843cbc33b93be
SHA1 6c12abed8fe1dd77c87f5adecb0f2ab6463cd039
SHA512 eda71c6f20c84df95473563486ef0c2fcfe0aa4854b7c93bc44b01713e9471a0afc45fcda6cd9b0a9cc9daf262605ecfa804b447a40b74955da186ad46afb6f9
TLSH
T1A811AA8C3AB48E2A989AE29CB055038F63518E0B16871C434D12DF8DCDC4AD9322E83C
MD5 SHA1 SHA512 TLSH

Submit Download

2948ed3f-b40e-4e9b-87db-32e9d79fdc65

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\2948ed3f-b40e-4e9b-87db-32e9d79fdc65
Size 235B
SHA256 9913c1b739dacbd9773e91957a85976086c392d2d8ba63e0b299da181a840d07
MD5 601e43f7fb428b977a4c5d455f013502
SHA1 21398298ab599b57d7361205d1b89e2f8ad44417
SHA512 701244d427d7c9b1f9b4b6f582fbc8b05942856af89ffe29bde37efe4080d557677f1772c36924f59899134a769661543a776a8477305db78d127ada5d284fe5
TLSH
T162D097C52888331D08144F0BF0A038C23148CC3318B4AC20D9B050789AB8EC88122847
MD5 SHA1 SHA512 TLSH

Submit Download

694003fc-2e91-49a3-ac99-bc3baf73a7a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\694003fc-2e91-49a3-ac99-bc3baf73a7a6
Size 883B
SHA256 9a12c7e243473733c1b9f0fd6a409abda5770d7543425a91eb4d2528f07ae856
MD5 ae3c3271db624a6f5927f01bf5041109
SHA1 68527194dc7306b447eae643dd54fa08afde4617
SHA512 32f492224404ebbac9a25150c49fd58f49bcc42ef88677b7eaba4fb9ef60dbd8518820372d85877fdf0f1c061758e7eb3ac483bc718c15760880ac3941427273
TLSH
T15411DC50973575A2CDA8D39B89A136028BE4A913C0CB84003EB65A240D6E12ED76B30A
MD5 SHA1 SHA512 TLSH

Submit Download

8d39453d-c89e-4d5d-a533-38a759fd45b7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\8d39453d-c89e-4d5d-a533-38a759fd45b7
Size 235B
SHA256 8dea012a5b6c441163e917da3ab71dd5cfac5e229e820d6ec47433b42c967ed5
MD5 b304448b58f426e1f7400457313af5f9
SHA1 bc479d3de2dfd52404528e19c6e275814e9b4076
SHA512 c0fff61e08f9359eb6ab8f0ed46fa8deeb334bb5b81a863dfe141b753d82a2dc90017bf9bf33dafde64a9480c5a5eddfe7bef4fe01f835ff5fab9b36707e7ee1
TLSH
T182D0A781299867BD4D145F4AB0E079E630448C3325B9B9509A9286749EFADC842D285A
MD5 SHA1 SHA512 TLSH

Submit Download

ac630777-f29e-46ab-a6fb-8ab3f8f6fbd2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\ac630777-f29e-46ab-a6fb-8ab3f8f6fbd2
Size 2KB
SHA256 0170e739421c4d814f074c4bdb5c091f784678e17a6e0dd99abb328faf814e19
MD5 9885a444e7a7acebe8c8debe9dfcf8c4
SHA1 eeda169bd7de5ac102a2f233b2dc8926f6bb1bf0
SHA512 e88ff8b12499d8ed06d8ff782872be89b5e87d147758d3b272c34f8cde71d02df2fcc0842850da16f387a46adb0ab84bcbc18bbe9fa467b081fac09bc2af66c2
TLSH
T17F41345836B88C7B9CDEF29CE481378E57A08A0300C71D436E52DE4C8DD6699736F52B
MD5 SHA1 SHA512 TLSH

Submit Download

e52e8c5f-7ca7-481e-8b88-3239ed1f248d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\e52e8c5f-7ca7-481e-8b88-3239ed1f248d
Size 16KB
SHA256 e7b6c1e3f7982e474d1566645aed116b0dccd475013f43be1bd0bd261f074445
MD5 be8ddcb9aedd3b4a5939e7fd36b287bf
SHA1 3cb839e8e8e9cf1e7f9758e7216189571df37965
SHA512 58c02be59352ff6509ac6297ce09e3560e1089265b8c108dc92045e23665c6ba1bb2890e111c52f90cc1f33ebb1cafd0268d335c6b9c4be2da5c3f71d80fe438
SSDEEP 192:cGV41JsluE/goIRjvsgloUGlm5JRfhG+LBOChbBDX6w1LsJ+JGPNkxuDLkbSzX7s:TZ4WGrgChb4PJ+IPNiuDLkbSr78IKj
TLSH
T11372B8166830457A8291E36894ECBFC3E6F538CF4C429FC99BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3eab880-7ac7-4513-8b8a-1a2a588edf5d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\datareporting\glean\pending_pings\f3eab880-7ac7-4513-8b8a-1a2a588edf5d
Size 886B
SHA256 76ed2b18b3a63063a7c485ca207f0d03e70950281752c2030d3a34314ef5dbda
MD5 d62d4709512171f280fbab6fce09ee13
SHA1 8e0b76f190c0b950d82035479ef93f7d8594073d
SHA512 27da06da21196cfbdc6ad2c8f812ae34074f4fdd30a43d3ec2809ff7879190374c3625db7da2bc786a127ce334ff35734d523cd7584201bcf7b46a076b1cd478
TLSH
T1341140409634B8B3CD7CC3D79AA1760247E87113C0CB49183EA45E180DAE06EA7A730B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\extensions.json
Size 16KB
SHA256 e95a16e9ba5dca69959edd9e35b36888f8e4e415d30350e4eb5692301c2ed84a
MD5 86dea0471d45926cf24034618d4ae2c4
SHA1 d9ae63cca2224f246e47209008106186d8c23928
SHA512 8808d7262742d162b6a06a8965e26395b2b619832352dca91c9e46b816e074945f5218fc065a7e42e958b38258285093d1564f863f2a067771c271975ef06dda
SSDEEP 384:7kI4v7UmldvG8dhWpV94zTG96oyL4HxL4P9L4HmUuL4HDL4H5i34hEk:II4jRfbX8n4y6b4J414Gl4P4k4j
TLSH
T16772421545049EB8298FA79BAA367E01C37D533B60845C78F4DD8FC802FB5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs-1.js
Size 12KB
SHA256 a8762a2d5a7a71325de4be0d76c82780b1dd8dd83daa4f650ebe806ccd77b517
MD5 a0d00237a34c344bb63f5a28cf0aa9d4
SHA1 12fabbf27615857265f0b6ec173e606afa949a55
SHA512 5048f6c65f406c4b7ace0bbda2d225ce78357c8d8ba2cb4ff2a1b6d654d4dae0eeb1729563ec00cdb0aec013a07c2363fe3646bb8898868deeaf845ec94860b0
SSDEEP 192:yeROfBU+WSSGVLRESe3q8mBw88uZURKjX:qrJRESQqfwmtz
TLSH
T16342EF3C56508B3F28B7317E6C294AB059914127BBFFBCD705F98491058CF2441EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs-1.js
Size 6KB
SHA256 57d70e93d8eb7854db841d59f2e05210692dc986346c973f5b19039f5b4a2579
MD5 2e7d766e8ee5870b594bb16454c02bbe
SHA1 92a6c68ab9beb15056503f565ffbecc347981c1d
SHA512 e10291b40afa4610ea076a79829e12941dceade322378501a88ca73f08b5e2b887dd759777438ad4a21063b6e3c0e178a763d96a1eecdcc11e6fe1d6ead2aa83
SSDEEP 96:xHNUTUr4qGqOfCyU+1zS4SSl8pdv9jfn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyU+hSSGTMeaBw88Z9
TLSH
T129E1307894088B6F74B677ACAC688831AAB2413BBBBF28D750B544C4055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 6KB
SHA256 4b448f642a058ef26d4e9a75323d00d5412f3706550c148639bc2683e9c1c124
MD5 ea7be17db596517b262cde799a93f99a
SHA1 215820ff5af3b9f1e2f90b484fcc13181853b6d9
SHA512 6f2f0f01601996fc74d979798181be99bf4042578769348632c392f0b28518fb87929be9b77089a275ddb4665ad3621d8723f80664da0554f0d3554d81e94242
SSDEEP 96:xHNUTUr4qGqOfCyKjcnjl1zSpY0SSl8pdv9jIn5HDg/GY9Bw88n8L4cnd88Lg:TnROfCyvBoY0SSGEMeaBw88Z9
TLSH
T1F0E130789008CB7F64B677ACAC6888316AB2413BB7BF68D750B58484055CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 7KB
SHA256 7ac626a10753ff4bdc343e5e129ee51cb96caadf0807b5a802dfd246cb9ce0f0
MD5 13662afeb7c9d4080998f8e67d5efe41
SHA1 c231c9a61db7513570455ec07b662f504a6c2746
SHA512 6129e8948cb772819cf71bc2d726b515c0344255f2c61332d23d3b76d56d96a79021c0b668ebd39b5e6ea6338b91afbdcc56543faf968b017e4d257756b7091e
SSDEEP 96:xHNNTUr4qGqOfCyU+ObzS4SSl8pdv9jfn5HDg/GY9Bw88E8L4cnd8LdGS:TeROfCyU+WSSGTMeaBw88g
TLSH
T15FF12E785108CB7F68B277ACAC2889715AB2013BBBBF68D750B544C4055CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 8KB
SHA256 7ba24f7cc0acf1de3cff9455f901178e9e3cfe1be9aa02019a9d95db15717f21
MD5 bfa401fb117f44fe8c08eb3b8b7a9216
SHA1 fddef79e3d1a09ea16c9bc431ce780b305fdc15b
SHA512 3ff4a470ac40e9a49fabff5c951ed4d37761151d97f5782a9b7aeec604d0337bfca80e419b0dfa6a0f396a769ad1f3fe086d6ee5988cd2a5f098fad5d86aacf6
SSDEEP 96:xHNNTUr4qGqOfBU+ObzS4SSl8pdv9jfn5WREV/g/G3zBw883UA8L4cnd8LdGS:TeROfBU+WSSGaRESe3zBw88F
TLSH
T109021E385148DB7F68B6366DAC2889715AB2013BB7BF68D750B98484015CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\prefs.js
Size 7KB
SHA256 c0c0d89861b7869be33e1acdcb6e2e3e8b770b1be86eff89319f589dbb29cf62
MD5 13944f10356ff6a851468789d5099afe
SHA1 c9088b615885ab3b2f06435bf0d0bf78e15ec67c
SHA512 a91092cb1088a210df67f0e58685e1c9744fd62325a947d8c3d8dbb68e9f0e9107de6fc88beb8714f5ab3a110cfd115a7a03c29daa30f570fe9e866cf0e3a05d
SSDEEP 96:xHNUTUr4qGqOfCyU+ObzS4SSl8pdv9jfn5HDg/GY9Bw88n8L4cnd88LdGS:TnROfCyU+WSSGTMeaBw88ZG
TLSH
T176E1427895088B7F74B6776CAC6888315AB2413BBBBF68D750B544C4015CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6cxu2nva.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8736eae266e5d63c43b01a59ce896d554063e498aeabba443ba829de7bd9cc98
MD5 8f7cb0990861d7e50ac117874496e6ff
SHA1 65f37059cb41cdbe34a17ded805509fbef89c76e
SHA512 99f68220879d138ac37b2bbb73e538895b3446e240b5afb3bb934813a6dc8f6afe164fb00073763406571cf8b503e04eebb0752f74203694032de480722e61f7
TLSH
T14C21F943953A1EF9BE792379D4808FB5CA493831C1754CF04159DA8220DF11D77CB549
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads