7ca27efd899c47263f74b7b866fb23d2288ea3361e36dd8f279412c389eee84a

Analysis

user interaction
yes
max time kernel
265s
max time network
271s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quarantined Messages.zip
Size 398KB
Sample260506-p2cbaae19m
SHA256 7ca27efd899c47263f74b7b866fb23d2288ea3361e36dd8f279412c389eee84a
MD5 bd36f5eba8a0ab4b6aeff8b9d6aabe7d
SHA1 d08840f5aaff9c12a40df68ee2449ca24f9faaac
SHA512 5f92e00ffc5d414414e7f53c25f91edca5d73659834b3496c14682e3ecade5480121c556909c6119e35413d8840e79264b4e57f2b348c4dad59811b8cacb9ce7
SSDEEP 12288:cwsO16Z0cfOFt70aigPvhDI6qqWe7SAhhS:RT1qoFl0aigPR1BWe7SAhM
TLSH
T1168423F133189739BC5D3680D0A38219EFC1A706EF1E0744B57B9DCA85B658422BB5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5720_67155161\_locales\fr\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5720_802231801\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3080	msedge.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225455708701778"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{98E600FF-6A73-47C5-9DD7-0F9CC4B548A6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ardsystems Updated Agreement.pdf:Zone.Identifier	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeRestorePrivilege	1784	7zFM.exe
Token: 35	1784	7zFM.exe
Token: SeDebugPrivilege	1940	firefox.exe
Token: SeDebugPrivilege	1940	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	1940	firefox.exe
Token: SeDebugPrivilege	1940	firefox.exe
Token: SeDebugPrivilege	1940	firefox.exe
Token: SeDebugPrivilege	1940	firefox.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1784	7zFM.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
5720	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1940	firefox.exe
3764	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe
1940	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1940	2152	firefox.exe	84
PID 2152 wrote to memory of 1940	2152	firefox.exe	84
PID 1940 wrote to memory of 4732	1940	firefox.exe	85
PID 1940 wrote to memory of 4732	1940	firefox.exe	85
PID 1940 wrote to memory of 4732	1940	firefox.exe	85
PID 1940 wrote to memory of 3752	1940	firefox.exe	86
PID 1940 wrote to memory of 3752	1940	firefox.exe	86
PID 1940 wrote to memory of 3752	1940	firefox.exe	86
PID 1940 wrote to memory of 3752	1940	firefox.exe	86
PID 1940 wrote to memory of 6060	1940	firefox.exe	87
PID 1940 wrote to memory of 6060	1940	firefox.exe	87
PID 1940 wrote to memory of 6060	1940	firefox.exe	87
PID 1940 wrote to memory of 6060	1940	firefox.exe	87
PID 1940 wrote to memory of 4552	1940	firefox.exe	88
PID 1940 wrote to memory of 4552	1940	firefox.exe	88
PID 1940 wrote to memory of 4552	1940	firefox.exe	88
PID 1940 wrote to memory of 3008	1940	firefox.exe	89
PID 1940 wrote to memory of 3008	1940	firefox.exe	89
PID 1940 wrote to memory of 3008	1940	firefox.exe	89
PID 1940 wrote to memory of 3008	1940	firefox.exe	89
PID 1940 wrote to memory of 4576	1940	firefox.exe	90
PID 1940 wrote to memory of 4576	1940	firefox.exe	90
PID 1940 wrote to memory of 4576	1940	firefox.exe	90
PID 1940 wrote to memory of 4576	1940	firefox.exe	90
PID 1940 wrote to memory of 4436	1940	firefox.exe	91
PID 1940 wrote to memory of 4436	1940	firefox.exe	91
PID 1940 wrote to memory of 4436	1940	firefox.exe	91
PID 1940 wrote to memory of 4436	1940	firefox.exe	91
PID 1940 wrote to memory of 3552	1940	firefox.exe	92
PID 1940 wrote to memory of 3552	1940	firefox.exe	92
PID 1940 wrote to memory of 3552	1940	firefox.exe	92
PID 1940 wrote to memory of 3552	1940	firefox.exe	92
PID 1940 wrote to memory of 820	1940	firefox.exe	93
PID 1940 wrote to memory of 820	1940	firefox.exe	93
PID 1940 wrote to memory of 820	1940	firefox.exe	93
PID 1940 wrote to memory of 820	1940	firefox.exe	93
PID 1940 wrote to memory of 5460	1940	firefox.exe	94
PID 1940 wrote to memory of 5460	1940	firefox.exe	94
PID 1940 wrote to memory of 5460	1940	firefox.exe	94
PID 1940 wrote to memory of 5460	1940	firefox.exe	94
PID 1940 wrote to memory of 1684	1940	firefox.exe	95
PID 1940 wrote to memory of 1684	1940	firefox.exe	95
PID 1940 wrote to memory of 1684	1940	firefox.exe	95
PID 1940 wrote to memory of 1684	1940	firefox.exe	95
PID 1940 wrote to memory of 4352	1940	firefox.exe	96
PID 1940 wrote to memory of 4352	1940	firefox.exe	96
PID 1940 wrote to memory of 4352	1940	firefox.exe	96
PID 1940 wrote to memory of 4352	1940	firefox.exe	96
PID 1940 wrote to memory of 2228	1940	firefox.exe	97
PID 1940 wrote to memory of 2228	1940	firefox.exe	97
PID 1940 wrote to memory of 2228	1940	firefox.exe	97
PID 1940 wrote to memory of 2228	1940	firefox.exe	97
PID 1940 wrote to memory of 3764	1940	firefox.exe	98
PID 1940 wrote to memory of 1452	1940	firefox.exe	99
PID 1940 wrote to memory of 1452	1940	firefox.exe	99
PID 1940 wrote to memory of 1452	1940	firefox.exe	99
PID 1940 wrote to memory of 1452	1940	firefox.exe	99
PID 5720 wrote to memory of 2428	5720	msedge.exe	101
PID 5720 wrote to memory of 4088	5720	msedge.exe	102
PID 5720 wrote to memory of 3080	5720	msedge.exe	103
PID 5720 wrote to memory of 4088	5720	msedge.exe	102
PID 5720 wrote to memory of 4088	5720	msedge.exe	102
PID 5720 wrote to memory of 1000	5720	msedge.exe	104
PID 5720 wrote to memory of 1000	5720	msedge.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Quarantined Messages.zip"
1⤵
PID:4604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2852

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\Quarantined Messages\cab44b03-3c00-4973-732c-08deab69da5d\2fc08f4e-21fb-5385-7ea5-aaecc6560bdb.eml"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {d4e82a13-f230-42cc-8b2a-5cf135dbd46e} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {eeac72f7-46bf-4063-8d1f-918e3f160633} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 27323 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3900 -initialChannelId {6d2ed925-ca07-488f-a5fc-bbc0efe6ed3a} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27323 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {a78bee93-0a5b-4461-ab53-d2dc386d8b53} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3716 -prefsLen 34822 -prefMapHandle 2600 -prefMapSize 270279 -jsInitHandle 2780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3012 -initialChannelId {e4c76d5d-ce41-4cb4-84bc-ed1dbefb6b68} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4736 -prefsLen 34822 -prefMapHandle 4852 -prefMapSize 270279 -ipcHandle 4848 -initialChannelId {21b957df-f318-479c-81fd-562aaa551232} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1656 -prefsLen 32952 -prefMapHandle 1664 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2836 -initialChannelId {02350456-f477-494e-8369-5730002a828d} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32952 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {dd072745-6ccf-4f68-b8b3-df6c818d7492} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {bd8e341e-f429-4206-a86b-543aa603bea0} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3116 -prefsLen 33071 -prefMapHandle 3192 -prefMapSize 270279 -jsInitHandle 3236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6320 -initialChannelId {b16bd159-cae4-4090-830e-f8cc39f00f68} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4352 -prefsLen 36758 -prefMapHandle 4704 -prefMapSize 270279 -jsInitHandle 6648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6632 -initialChannelId {e2312ace-bf19-4d86-8e2f-fa69a1635e2e} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6760 -prefsLen 36758 -prefMapHandle 6756 -prefMapSize 270279 -jsInitHandle 6752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6808 -initialChannelId {fb995574-c5db-47a3-8a07-5e1975a24526} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6964 -prefsLen 39875 -prefMapHandle 6960 -prefMapSize 270279 -ipcHandle 7076 -initialChannelId {deae225a-fd39-48e5-8cef-95a4b53a34b8} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 7272 -prefsLen 39875 -prefMapHandle 7288 -prefMapSize 270279 -ipcHandle 7332 -initialChannelId {5c0c5aaf-a9eb-4f46-8f07-b22cea1745d9} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7492 -prefsLen 39915 -prefMapHandle 7504 -prefMapSize 270279 -jsInitHandle 7500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7496 -initialChannelId {857aec87-a47a-4d0e-a3fd-2399345f07c2} -parentPid 1940 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1940" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Ardsystems Updated Agreement.pdf
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fff822fc188,0x7fff822fc194,0x7fff822fc1a0
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,3407455076931141965,4677988651995036534,262144 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10661483394984984316,4662562322984821542,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,16617455145213732597,3790115563817325153,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,4974832732542441661,13517165052978207809,2097152 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,16047358742126382426,17923843565676968074,2097152 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4728,i,8792040026613025230,4644007289475705075,2097152 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5036,i,87390280809177766,8722260312349765738,2097152 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:15
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,10494269780690088834,478143843620822561,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,8355699186620144568,12941643488363694452,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,2189041418862286976,3635649044675466825,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,2189041418862286976,3635649044675466825,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:6204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8664210282257107376,10718706224764975526,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:6412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6004,i,15325336471897567369,1298992696673969613,2097152 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:6392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4544,i,6814242147919494751,2545435770602076016,2097152 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:6592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5072,i,9446017255520621686,4566950754479765374,2097152 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,12053478165641734251,12120137657018997035,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:6976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13385516663554998998,10812425885689802893,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
  2⤵
  PID:6988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,8027183713839277687,13353595184095631670,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:7044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,7553859076313403484,9459978391273471874,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,15193045189017016675,9665545457411193513,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,1930758469778242048,17043829141285725189,524288 --field-trial-handle=2148,i,6833132655228960417,16258714125647951666,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
  2⤵
  PID:6752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ed781fcb76bc71e968677668bef1928387f354b5c0a91db14e37c13fc239cdf3
MD5 cf1713f80866d10ccf9c51b807e9f761
SHA1 c25f2b6c555b6c50be662de8337eb46fa5836f3b
SHA512 8197b6a0b2510737e174d1e5e1e77f384ec326914e95b0011e1869a6d65b2c07416673ae4a1a34853aa686c6256c2901e48686e6d0b5b8f1d7f6a24a4214367a
TLSH
T178E02BA5D865D83B48F81B6C60649745FB6013572650884F3A3C420C8F75E37568681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 18f43510d81e50d1bb1e44ec31d607dd824921f8ac76450b543c0029e7589f4d
MD5 cfa6c394f52f85008b3bbc4dcfdc592f
SHA1 77d7b153f176506cff6eb1596f6cd3fc85f083f9
SHA512 68d837f65c411b9f884e36f0826b55d1d08592301e47a6fd94e577ecb10678e349d5c3d310a3388a679c607543d75c6689709d93fa3fe97005c283bab66a31c0
TLSH
T133714B942CBDA477F7E2097407E9249776B0DF9A02D70F1A17EC81BD8B1EB15C041C18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b43630e11f9eb4f263a8641c18bb124686d249078fba534ea9e0f2d68ffc4eb1
MD5 ac4775166107545a14837db32c8711ff
SHA1 9b976793f33dccd9aedce92ee39dafbf953d3cd2
SHA512 40d3f6d00b5d820bad22338e2b20633af73b78ddd017cdc05fcc7701616473166b52d4316b624d12b5745ba5b9932ab56a7163f3345baaad856413b7b59fb9e3
TLSH
T190714C946CBD7477F7E209740BE81483B6B0DFAA02D70F1A17EC91BD8A0EB1AC041C18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3843afea2870a8b124f9c42578ef28f133d84cbf5a13ce4373f7edbaa88b1cef
MD5 4fb5fbc5f0a18ff00b46b02ae3af828e
SHA1 38214c5fec3bf5274786442f3e690df305f988a5
SHA512 dbe05eb5c7254e093af9fd4a5adb97f93a6d078dde0883865a1bdbf3145e642687b90135242a91dcae5634ca745b7aa798dc080f4dcc3fe533ad960abe5d7ee1
TLSH
T13A31DFF3C3E8897E8A0085F0AA187F1BDE6D0910532C3D9EC5E0AE1B97E2875D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2e70406dd70753995af3289fbd1160ec1c170f824da148399a72d6bb845b702f
MD5 f8c1a529e88672bb7f1c01ac65affa91
SHA1 89ff020df0c131dca0bcd0b6a915154e4d4d2b7c
SHA512 a159f78367b72695fdead78da847023b98230c91f9d13f3680832bacc942c9faf77fc0f0da1db857fe1a67e2d10b7440c3a0900271b427532da245b66fb754b8
TLSH
T11631DFF3C3E8897E8A0085F0AA187F1BDE6D0910532C3D9EC5E0AE1B97E2875D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 06b2664a78f6dfebf79cf8554a30d2ac9ff465af74678037dc6499110579d307
MD5 eb06f479f1c60c2269e2cbadd633fac6
SHA1 3a51acae78be847a2661ae4eb7890ca6718dc18d
SHA512 0b50399ebaefff6c81da064dfc07bb2c6b8798687fa00e21216470d2a6b01cc97b7d64f45dcfd6002e6b78a7a7467c0f9848142dc16927fdaddcde5815a993ac
SSDEEP 192:sxZGRgyMqZ/K1Ml8MdS/fMsp++9P6BzodpEoy/W6+WNGY0tRUOw/6HIg5EzJ:sxZGh1S/fMsp+wP6q5y/bG5UORql
TLSH
T18972F905AA38697BCCD7D619BA45BF53D7F91523D1904E44AAFCCA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 82f0d7062d71bfcbdb0a671db6c623056fabd6c8d8baa2cb2207ff8207925f52
MD5 1b91aee4dfd293c2eddc0234549408f5
SHA1 acf225acc97d76439d33b5eafb9b5847e1d34e23
SHA512 37618e8e68dc486fe460cb746aed8d475c66d18e743f193669e2751191780fda17cf86ff6af9930d654eab31e6de63e22aba102f5ac4246b174de8fe9fe861d0
SSDEEP 192:sxZGRgyMqZ/K1Ml8McS/fMsR++9P6BzodpEoy/W6+WNGY0tRYOw/6HIgjzJ:sxZGh0S/fMsR+wP6q5y/bG5YORjl
TLSH
T1F762F915AA38697BCCD7D619BA45BF53D7F91523D1804E44AAFCCA0C04E6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1130274ba34bf1d0dc9e427bbb4e63df5d13bcb54461f0d4f924087b81c3b555
MD5 8b3ede9117e9d3900212842e50b2c4bc
SHA1 b6abb59671d41e0ee7658c396cb0a30af21074c8
SHA512 2462c8a26466f269e555279ffc24ad49bd60948a6854cea9fd77ab7ea5170ed2587eaac7fdcfc919af0f81476e1f57823ecc665bba5b0b4349dcfacbb9c716e7
SSDEEP 768:2DhVP8b320P7pLuL/mKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HWWlLlV:2DhVP8b320JE/mKWRmmeQReu1jaKHWWN
TLSH
T148031B3B280CCB7F4F844E9CEC27BE9A6DE8018B9698899447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eb0a55f1a57503c79ccab9632b4f09cb998aeb06f443bf762db97a56b668ac03
MD5 d408253696d1f7e6624c670dbde28773
SHA1 69ed5638c14798e28a2308580a2fde09ef129b27
SHA512 990f56b0ffb9a3ecf566af5be222d7241c6d53ead8baec82f18eb512faf61afa4deab054638e3e720caa670cce7a6c023b2a7c370e6fc8a8aeb4134ce334aa0e
SSDEEP 96:KcMgKNqmuzuK8AzGYK7CWiGMKrqkEYKR6kGfOKUMLXaKMg3CWIKnKYfeKQo++JmH:qD1rjvYZ5V8fO9ddTXkrno9BBFhH
TLSH
T1A7B25D11313B13903ABE754A9155B8AF42C271633114F87B7BB904AA4F6BE24DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 01709678ecdcaec8f034f3bec6ca0be29c398bd8280d3ec8ce01554983d6594f
MD5 b84ead977146ea72b60c7c8307791a40
SHA1 e8d971d7c1233e212d29f752185a8771108c1dc2
SHA512 df1ee93207eb94264b34865e4d1a9e68fdc5cfbcda59895b7f5267e0c72026c3b4534577c000de989c02bc36c0f4eaacde85f6dfe9ecee64c91d532754fe3c04
SSDEEP 384:naiFavqMg38Nm8TUNTUlIxBO2+4Or4LJ5jSOrfpYQKcMLl5kNjxEIRYV/Vw1mR56:RFayv3dwgO2Z5jHYQ0MFjRYk1m37Fc
TLSH
T10DC25C35EC54C9B7EDEA8FD9E70A7A07EEE00167D98C4AD8D6D81D1E00D719E230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e0a246926074684ae2cae152074832c66aa6910b83fc4192dcc4335347e935c4
MD5 e562ab945ae05e2a70cdcb6ba7253fb7
SHA1 4b7d397231a30d86934b44dcddbde9d2890c27cd
SHA512 1b2a57b5a9107a3d6822c4fe0fb60a1e7d8019257988119709b652fd7bc9bf93fb345681e5fc0969119b76b6b61f9718409587eed5fdd0d280bdf89ffd31c30e
SSDEEP 384:nCiFavqMP38Nq8TUNTUlIR+klO2+4Or4LI4TOrfpYQKcMLl5YXXBi0t1r55bS9Jb:JFays3NwgskM2ZZeYQ0YXI095bUn
TLSH
T199C25B31E868CEA7ECEA9FD5A34A7743DEE01167898C4AD8E6C85E0D009719D274FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3e6c1d4c2cc1c1c15b4aae26570915dbe1db0fb21b2e73bcb24115d4dafdc70e
MD5 d396dbf84106e61d3b0ad699044fc792
SHA1 1efc6cc602a91a42bd8881f65eb08da5bc54e5f0
SHA512 c06e2ae2ea52a5c0323aad7e718bfb14121d9fbb09f5212f3b3d3111c0b1e55f0144d6a682645b95edcb6295237b9bfa843477f75e56245adea72041772613c4
SSDEEP 384:ngiFavqMg38NG8TUNTUlIxBO2+4Or4L4ugOrfpYQKcMLl5YXXAi0RYV/Vw1mR57m:7Fayv3dwgO2ZXZYQ0YXn0RYk1m37Fc
TLSH
T1D4C27C35E855CD67EDDA8FD9E74A7A43EEE00167C98C4AD4E6D41E1E008709E270FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cbfd60f4257e2c726a3a315910df295850e7a21f453068bd86ebb04f22a72a29
MD5 96dde56073142d62eaab24cfea60deae
SHA1 d86ce95f6886fcff636de441f8f26e2774f7b210
SHA512 834c406efa4661566a5e82036629d6adc82e4edf78a4293480c5f1cf6649adc8d6537c29019b6f0f2e5d21652eca1e2f4f3a9211ecb56c8f398e7947cf0e9d5e
SSDEEP 384:neiFscXqnt8Nq8TUNTUlIRqypO2+4Or4LB4TOrfpYQKcMLl5YXX5i0t1r55bS9Js:1FutNwgsyQ2ZceYQ0YXA095bUQ
TLSH
T185D25B35E899CDABECEA8FC9A34A7743EEE01263898C4ED8D6C85D4D008759D174FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0412c28592357b9f70199b8c5357b68cd2b8ba07144abd2039ba7dabba1a049d
MD5 f9549addd3d8ae9850c68842cb1b76e9
SHA1 52320cf72c2d32c42219a5f7782b27727a2a4dc6
SHA512 0d653a9dfd15dcee958e83954e22a75e88135ad933604ce376579785e6e3cbe23d63c2a5ab23c5d26dc88c776f34de747472f52aa06cc04deddf27ae58fb5ea4
SSDEEP 384:nCiFrcXqnE38Nq8TUNTUlIR+ypO2+4Or4L54TOrfpYQKcMLl5YXXBi0t1r55bS92:JFzE3NwgsyQ2ZEeYQ0YXI095bUQ
TLSH
T1E8C24B35E898CDABECDA8FD9A34A7743EEE01163898C4AD8E6C85E4D008759D174FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d579a1793a5fc782bd814a22e1a11b8aed5ee00ef9f910b84544a8b00415e849
MD5 79a101fdd82cda1120d445d35076ad9e
SHA1 65cb9e7e838088b8a67cc8f190e6ec5b983b1a61
SHA512 7124ae7d99ddd5af908a133de89b5c78304af777fdad5ffdfdce4cce1b3e22241c68e5f5ed3865c401c8efa3d51f4a13f2d4166af2805f423cf499141a437bb9
SSDEEP 384:nCiFscXqnD38Nq8TUNTUlIRqypO2+4Or4LB4TOrfpYQKcMLl5YXX5i0t1r55bS92:JFuD3NwgsyQ2ZceYQ0YXA095bUQ
TLSH
T1F1D25B35E899CDABECEA8FC9A34A7743EEE01163898C4ED8D6C85D4D008759D174FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 09ff6ddd123b43daabff6cc9e5818b8c785dcc8f2e6e2b1048e286e5310c9ce9
MD5 1b54373b71ec86c0ea6973c3fad8921c
SHA1 888225d22014f41a19aa2a90bfed981f2abb8428
SHA512 ba9432edf544338dd9a9b38de04dc998a041a32a6c74aee4b41dfca942a1d48a95c28c95ca08acff6dd0af545f6c12840cead548dd4d2db98b066435e9577356
SSDEEP 384:HHMO0iO024YhFuhw+5EL1pPsac4j0lpDII+WfGfp:nrZYhFuK+5EB9sac4ID8LZ
TLSH
T1CF528E7EAF1138BA0A67D184DCBE6218CE04E6BBEFD2D06615043C45C684778B8F54DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\AlternateServices.bin
Size 27KB
SHA256 d552d16d1e25e07d8cd151b50262086ff4a0884a0754717535547849b10277c3
MD5 eed4ca913582b698b7ca65be33e83e22
SHA1 33193fc6500277007e81971275ceab27481d464b
SHA512 f7f135f0fd5cc486c4d9b1ae0bc7dd83bb2288682287f2b0a1a0604087551d0ce1895298c07d3826b9cc59ad1300b2e37a325161af54fac7e48293b6e2eeb264
SSDEEP 96:/M/pnr/YgbQzaBbj4OB3nI56XUyQE+Uo+i0oCRxX3bJBbKubeJ0BbSE/bHEbEHbr:/QL3vlwgtgsCu
TLSH
T17CC2C7F72BB5B422F2638FB0C09975CC9C3312351868D1A4CA64C0AB42D5796E17FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\AlternateServices.bin
Size 27KB
SHA256 4a409fff8ecc4e2685a5521a9dbc0053280b1f442f89e628519cceffc6a403c7
MD5 58ad7e89862fff291eec58ddde0b9c32
SHA1 ff9abe23ca17214f0d762d9beaba10326cf463dd
SHA512 127f6d7aa7e390f3fbbfad6a64c210f712c311ad6bea8bbc10ecebed95b8a600629ee56205e806683598764cc2a6f9117e054288bbfa756f93ae970755a12638
SSDEEP 96:/M/pnr/FgbQznbj4OB3nI56XUyQE+Uo+i0oCIxyYb+bpubeJNbCE/bHEbEjbh/bR:/QtwgRgsSu
TLSH
T1E5C2C8E71B75A462F7638FB0C09975CC9C33123518A8D194CB64C0AB42C5796D17FF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\AlternateServices.bin
Size 11KB
SHA256 7134cdd36ad2368417dc6ec31f7da14656aed7ac5b7d18bbafde81298ca978de
MD5 1fb38110e879324676b8c448dad6d90e
SHA1 4fb3ee1bbdc32e74d9b017eaffedfa740fb304d8
SHA512 5acfb1af0b477c7e363b2fd29b0e989fb170a2340348e37c43aa6e5f1b8200b9ce26eed850d4d6ebac97cc92e435255f344c295f96a4b9ed71ff6106ecf59f74
SSDEEP 24:juhMZw9y91iB9h9B3Y9xsx+lz3gn9VvDa5q9F55A5AFd9lry9Bb+:X8B9zpS2x43oBDII56AFX9g9+
TLSH
T19532A8F76B71A472F2A28FB08059758C8D372725196DA180C79490F742C5BE9D07FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\AlternateServices.bin
Size 16KB
SHA256 d3284d551c007a20174e58faf95784308721baee6d4a46506e5422ca293c88cf
MD5 f9129dc2ec06ff928cea395dcac244bb
SHA1 e6341754cbb0273cc8e86a164508261a2aafa54e
SHA512 333f79a1f320ace1881f636ab2a1391de5cd95990bf18bf21a8db7ad98c484468ef67efc69bc4f2c292f5dbc52497b9cd8fca3aea36389321ff2ad4589ea0fb7
SSDEEP 96:JM/p9ZlKKx4YBDII56AFX9gQ4u60kOaw:JQ
TLSH
T1BF72A6E73FB1A862F6628FB084AD709CDC331735186D9190C65490F343C5BA5D17EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\AlternateServices.bin
Size 23KB
SHA256 5855a39c43a7c53f5e46d0558b3ab9928d9abac56960db1901687c4634ed0913
MD5 d2788ca9c74ffadbfb2c5663e5edb2ad
SHA1 7a8c194425adf200ed233b82d3cc0b38c81dc6a7
SHA512 28b83a0f313fcad8384dfd2de7ee317e5eff31b269e7f133f2097a5053cf3c95e3b0e5cfe8eb3785cf82dfde82dc4ff3e06d4f6269fdb8c83a6d4f5a4ee46ad5
SSDEEP 96:JM/p9ZlYgbQzaBbj4OBDII56AFX9gQ4u60kOawRxX3bJBbKubeJ0BbSE/bHEbEH7:JQtfvlwgtgs
TLSH
T12CB2F9F72BB5B422F2628FB0849974CCCC331236186991A4CB6480E743C57A5D17FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0750befb92688c2adab91d7b17d7b39e9d4a6399ee49d1116e6b878c01137b37
MD5 a00f93a3c87e01de54612064af80fc2f
SHA1 7cb017011fcd63fa1004e644a5540711020c7e8f
SHA512 8a05c4916027a4eee3a943685a8475ef8138eff07dc4ef5983f7846b55014d30388b321f4bda2cf013649c8017ff46f057ca1429a0261fb64c4cec8ef376bb63
SSDEEP 192:o1d66Joz0dzgCl6mc0dIOv5zboVZ4myjxI:Cd66JozQzgC1jVboVZ4myjm
TLSH
T15FD1EE68F639863FC418427BCCA61B400F36389AD84F2F29359C600D2D972DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 65e08797162ea8c1a251ad8efc2f630eac8f9c141018ab60dc1f73171e306cba
MD5 96c43820d82a34dbc2a71d2a3315db3a
SHA1 8e196652f5f9302748ed3a02727a11edd4eb7998
SHA512 bade383c4cbeab16265f8abae5932356c617e41e88ac87a3802aa9471055f1d4ffbd10d094037fea015722f0b412c6da0d61563d12ff3fd424c923a716a5f9e2
SSDEEP 192:v1d66Joz0dzgCl6mc0d0Ov5zboHQZ4myjH6mQ:9d66JozQzgC1j9bowZ4myjaz
TLSH
T121E1FE64E628863FC418437BCDA61B400F39399AD84E2F19399D610C2D5B2DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d950d3165c4480aab810cea410f4501a9cc817c5b65043d6fc249d5e26b87f2a
MD5 eedcf91507477097ce3a9d190a070712
SHA1 4b86695e686202f56820cf2a544d45ccb6fbeec8
SHA512 cb321789317579c4dcd720be4aa4f6e6c8e9a73e8c7f79e5769b6d41007b692d4b941f70d7154209c03f7e5a9762db7b39ece56fbb4103620b56e5db247396ea
TLSH
T1BB216A9C39B88E6AAEDBE69CB481038E53558E0705C71C530D92DF8CCD99ADD316E438
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\events\events
Size 4KB
SHA256 7b298823ba063fd42d8f771c1a0606d9ff37201b9f180bfa037ba1a8a760a2ea
MD5 791dc35f79817f3b33e0ff0bdd57a970
SHA1 9993f167cb4ca5aaf5ba4079a12c6c5e607161d2
SHA512 4ffb9e079426cac5ea120cb94d863405588e162ad12584cd481a0c38ae4fd9d08e03f19068ee95dc5eea26329308ad4bc0762909613bcd3d20f7fa1e6a011bb3
SSDEEP 96:iWG4JJNmyXnB48tJU7ESH2iyvobS4TB14C:iWGsBwwSHlyuS4jL
TLSH
T176A1DE1D66A90CBE7EE7D2A8F441039E42C98702D4C71C874CEBCE49CD9AA9D325E439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c905441-92f5-4eae-83fd-dcef1b9de417

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\0c905441-92f5-4eae-83fd-dcef1b9de417
Size 16KB
SHA256 8d554413653f8a766ced94d4f3ddd06e8176b6a35cee472a58c7976002f4fbd7
MD5 40fc260a1981f61daaba1e7c18ee2205
SHA1 2176f58c934825e67876cc6d79259371cb2e9007
SHA512 5aec3bf296b26f037631eb233083d4f4ff3bbe91fb2ab482365c1e7b43cf05bd89d100f306a03a1618ebc6862c4d1de5569a3f38c0affc755ec8fa526c932271
SSDEEP 384:84m/H1W4PMETdYylzWn24o6x7XKFbplR7K:84sw6MIBlzWX0K
TLSH
T1E572C856282049BA8251E36894F8BFC3E6F528CF4C415FCE9BE47D085DDE0AE512798F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13a2a9be-fb86-4385-a9a7-e38839469005

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\13a2a9be-fb86-4385-a9a7-e38839469005
Size 883B
SHA256 da20db233c51fd210ea57e3d3320218056ba2946de314761b26cba0977afb5a5
MD5 6f4581ecfdbc142945717fafcac74f8b
SHA1 bb3d4aa8e630e13d5ac99596f8d5779b59c401b6
SHA512 9e91360d662ecd01b03c814584e008e39f4651c418a934adfd30a0e83dffc86c3b6cdc9a041ea59938259da2eb3f9dc6f59d365648d9b841a99f3bdb00607449
TLSH
T118110450A736B5F1CD28D28BCA91770547F43523C0C645183EB54A080EAE46ED77A70B
MD5 SHA1 SHA512 TLSH

Submit Download

5abdb8f3-9249-4c65-8ff9-687243e4470b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\5abdb8f3-9249-4c65-8ff9-687243e4470b
Size 235B
SHA256 20b32454f078f98bf10e68e169e6b6ae75b6f4a6962542a31351ffb03536f9fc
MD5 d9b21bfcd37bbbca6012fb4ae8da4a7a
SHA1 ee1c7fb1196727c66056c03192c8511d98a09201
SHA512 63d1d9515e880942aa8643f44075a4a4418fa0871c1c0be9c68fdcd37a820a95d30f23a36a42f7ff822d1ac8a0ac3ac34c96c9ae039b725ff39be4ce3ff0d6bd
TLSH
T10AD0979428D8276C48210F22B1F12DC230458C37246A9810E5B18178EABAAC84262817
MD5 SHA1 SHA512 TLSH

Submit Download

60b81fc2-bc2e-4142-970f-a2ecdc4d37eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\60b81fc2-bc2e-4142-970f-a2ecdc4d37eb
Size 235B
SHA256 3589092bbabe63263eed55238f13680cb48d22a0638581c26e886c376ebe0180
MD5 42c5e14c98055f8aac082e19edd330d7
SHA1 72286f81910a5061f4488341c1cb0930e33806bd
SHA512 b32cf81e7b5eae9ea5b55871c96ec24c5b10a8130855a0acef06d74271fd1bb68b120d8175157e31c11a4c0ea3fe38439cf09528d3be0f73524f8234e3b41a7b
TLSH
T1D1D0978074DC2BAC08002F06B0A03DC630884C3754B09C50DAA2463899FDDD8412280B
MD5 SHA1 SHA512 TLSH

Submit Download

ca54587b-b993-48ee-83d9-66ea6f7faf50

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\ca54587b-b993-48ee-83d9-66ea6f7faf50
Size 2KB
SHA256 d9027c599d60f9fb5638e2042afdef7c2a76879c0a1e320ed6b6a8c95f670a0f
MD5 8c1a60aa875983088bdd11172651de43
SHA1 7d88deefe11265742524c7218203087baa0fb21a
SHA512 b04c8dd303dea05eec392a0b73779933f12d319d4bcf0d84f689463e021bb7b8aef8855b7bcb9d4f6babe57ee05784c550c5e2ea33f5b8d2788ad226d5425249
TLSH
T17941102C35789DBB8CDAE29DD482338E53B0490340861D476E51DF0C8DCA6EE736E42A
MD5 SHA1 SHA512 TLSH

Submit Download

d9cfaa1a-f554-4ede-94d5-efbd1775cb39

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\d9cfaa1a-f554-4ede-94d5-efbd1775cb39
Size 886B
SHA256 cf093f661c7319eecb0086f2e26a559bbbba5a5de9e1cd3203b73621a18241b1
MD5 cff35187897ca150e462483b410df8d2
SHA1 8b442f55b4846fd8081141ef6b12c63d03feda11
SHA512 9f7dad6100ea451c4348e06f092b64b64ed38c78ba0ab8f19e102da161f2afef0dd4d6b3a7ca6e8afd3388a432af180888a8b27e1cc5706194d27aa62428deff
TLSH
T1D411D0519635B9F2CC28D2CAC591B74146A47423C0C60A0C3EA44A084EAF42ED36A70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\extensions.json
Size 16KB
SHA256 8c9d2d01df12bac3ceb096df661ac330e738eed98432bfdfdf057123fa0f5e47
MD5 8d3931816b7314520efff4b742d9a57e
SHA1 b6f39981712cbaa282e0b96a45935160bd4a44e7
SHA512 c882753c2a7b7bf69466f686b0ab72d915b5f9187f4134b1a08987dcda44e0956c9e2805dc48f794050c23eebece801daa5ea23ea37308cc7f20a47c4d2f4af3
SSDEEP 384:nkI4vrUmldv38dhW294zj96oAL4HNL4PwkL4HgtL4HtL4Hcy4hN:kI4TRfEXb4l6R4t4L484N4H4T
TLSH
T17A72421545049E78298F979AAA367E01C37D533B60845C78F4DD8FC842FB5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 12KB
SHA256 99d527944b5f1fe5108597d8fbd425ebae66bb85fb4f7a73a42573eb9d574783
MD5 2c238123dd5f7d5e9da66a307a58e484
SHA1 1d4a93394486dad9f708368d5f89972b15eadccd
SHA512 e26ada97b9432bbffce38f457e4f67e31591e49faf499f4e225effba3c9bbfcffa1bee91486077a7accf16b18e20dea153daaf0fff76fd87e8e146b045ac152d
SSDEEP 192:PjDeCRV9fL7JuhxSS5LRAQ5HKmBw88bDMPSDLR/:Xv9XEbRTHpwsC1
TLSH
T18342DC385440CB3F66B7367DAC254AB059A2422776FFBCD605FC8481844CF2941FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 8KB
SHA256 b369f47d9490865a21a31adda276bf59a915199881f6d835fbb22bfd3a5e020d
MD5 9dab443bf8091e2964d049e8e60652ad
SHA1 9a8157a480e9fad4f5a41e7827bb7343ce426b07
SHA512 c2a23483b12763aafd200ac0d20dddf1e8dedea5fa7b55ced6cbfed7b2c7c1ace157536b75bb29331ebd18e16a80245c54aace56ab0eff610e9847ffd908ad87
SSDEEP 96:xHtjNUhIEs7TUubqGqV9fL7JuhNbzSMSSlldv9jOncWRAatRL9I1nBw88bT0u8LP:PjD2RV9fL7JuhxSSmRAQ5+Bw88bu/
TLSH
T12C0210789104CB7F79B676BCAC6889705AB2013BB6BF68D710B94485414CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 6KB
SHA256 0b844fc220f6c29db9d00049a52cfcea4d18d4063f12f167c6d038d1d8ce8cbf
MD5 b70da0e7fb04aa18e666943553fd9a6d
SHA1 37e0dad430e8daa9af802af350a16c434649c6f2
SHA512 74aef5f58e84f05f10b0120f908140ad7ae75cf256b494af12795a97523f7890d6bb3ba857cec2db0be606dca8dc149ef6119a50d8ac1d5508b4f59a0dbe225c
SSDEEP 96:xHtjUTUubqGqV9fd7Juh1zSMSSlldv9jOncHJRL9I17Bw88H8L4cnfV+O:Pj+2RV9fd7JuhdSSXn5uBw88qT
TLSH
T135E110789548CB7F74B677ACAC6888315AB2013BB7BF68D750B94484054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 6KB
SHA256 3985a9c81f56cd73e755e8b38613d2511877338fdc4f3b9218d29b059bc106d7
MD5 3708b8cf004dcc6538ba1b0334694ec8
SHA1 a7c70a04097f3f9a3ff01a90fdc442c7946be3c2
SHA512 a7cdb4e183e62308b2ee94f92df7d22678c2519544bc9bbc48c691ed8f2c090cee364374034395bd4aabca4c7b9b51962e7289cb3063b126db91de3c677a434c
SSDEEP 96:xHtjUTUubqGqV9fdKjYnj+1zSLfwySSlldv9jyncHJRL9I17Bw88H8L4cnfV+O:Pj+2RV9fd7ycfwySSLn5uBw88qT
TLSH
T18AE120789548CB7F74B677AC6C6888315AB2013BB7BF68D750B95488050CF3481F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 7KB
SHA256 570172c83aaba0012e83c2ba2005601500e57a8d200e3443bf1e6e56e092190e
MD5 344aaa95bff9ff06b660cd961275d4e2
SHA1 a665399b752222797be23ca4ae16535db0e2ad39
SHA512 7301c425c9e34c68a82b100fad52138ba272b10be7bb80ca35b237975bf1eb8f2757e1d62221ddf83ae4f86dddc2ddb6f1feea76d97f3ef387ef5ae935a57c0f
SSDEEP 96:xHtjUTUubqGqV9fd7JuhNbzSMSSlldv9jOncHJRL9I17Bw88H8L4cnfV+3GS:Pj+2RV9fd7JuhxSSXn5uBw88qE
TLSH
T1E0E120789548CB7F79B677ACAC6888315AB2013BB6BF68C750B94484014CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionstore-backups\recovery.baklz4
Size 26KB
SHA256 dfe8881477a45d824d0af93b70549fa8a5bce2b8b9cbfccc19ae53e8c25c263d
MD5 385ff51479b1e1f134ffefe529060be8
SHA1 8155dba764e8a62e236d3c16149f41cafa32eca3
SHA512 c8cc8e61077af20fb907cc7ffdcb93bc02674094a72c7ad77d83bd2586890b67d078c36098b97f6f872ba71f57788c81321775c9b9a15a5e8044277f48ddb0a4
SSDEEP 768:qkHc81H9iDObBrBCaxBZJU9iWpzpN+YaQAty0i:xDkDmr9ZiVpzp1ctyD
TLSH
T1E2C2D0BAC923AD600B6E3146B4F53D9C3E661982CDBA8540D20974D30BB0B79F71E3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 97ac516794db3e1b44901ad78ae046264e5134de46e8294d3f46acc134ef2020
MD5 9739d1e2ef1cff9ef15d97a54535513c
SHA1 245b17fd29fdf4856c29e92ced5195911789be81
SHA512 9b57600cf645b0ee2b84d06923a729d5eaf14ad42ea3fe0924e017c1879149d10680e1f75687eed76543777a152208faf068f2961cd56e8e812a39174f750734
SSDEEP 96:h2AE0qjj9pi9JUNE4nyzSsfZx3mqFLCd01VrqM4EcZZi6rLKJI4HZ:hGFH/i9wEGyzDfZLi0v/4pG
TLSH
T1D5C19F671E05FE571C388560DCEE0F5C86A620189EFA819936B65527039890C171E76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionstore-backups\recovery.baklz4
Size 27KB
SHA256 cb95e9a9027c899bb08461559854c3b2bd69a794a3fbee0b37843213a2d7d009
MD5 f383146f6294dd9e39d59941eb03cfa5
SHA1 bc6e9c087b2c6b069a26d6cb663a899e0ec08bb4
SHA512 0992eb19749d79767cad41ddb24a44d258c166ad01388c2c70250903c68356164b2a693e0c29f3db99c667e9fbe7276ee022fe5f80520b319daea4042f4a2e22
SSDEEP 768:XkHc81H9iDObBrBCaxBZJU9iWpzpN+YaQAtyf:0DkDmr9ZiVpzp1ctyf
TLSH
T1B0C2C1BAC913AD600B6A3246B4F43E9D3E660993CDBA9540E10974934BB0B79F71F3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 81c9c99e871946639c6f6d2b7345e9217a9e618c2ddde8cfa8ea65d3197369cc
MD5 b58c54fb1c327750cef137dbac117666
SHA1 dded46c81a1cfc0aca6b065c4d987a6c924bd27b
SHA512 66e4b16f9b867d9d84caa573bf22d9e61fe46d6db857ec9ba98cd1918f6071faad50fb83191deb33e9a62b2cf41d07924dc18e56b26fb5f0f313d1128e2a84a7
TLSH
T172815C75CD1D6D82F8F996BE10D149D2EBBB600043F9D4A5E5440237858B6C633C6676
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionstore-backups\recovery.baklz4
Size 25KB
SHA256 c0840c24c9d84927b922206b05386756a39dfc1b9e643e6459906caa71687dec
MD5 2d887acb7f753323e96c1fb15cd428e8
SHA1 30648d3c64f73bae1cd89088144f04d5aa42c41f
SHA512 16fc81ed75f864b2e7b78bd907ba9ae4b68903cc2740e965001ce49a4ecec5e3ce5d0d1a48ea0f84a2584f90dbce27eb519151e245711eaaa7051385e00227fe
SSDEEP 768:kkHc81H9iDObBrBC3xBZJU9iWpzpN+YaQAtyB:zDkDmrOZiVpzp1ctyB
TLSH
T17EC2C0BAC923AD600B6A3146B4F43D9D3E670982CD7A8540E20934D34BB0B79FB1E3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 c75bcb55488eee91163d292c1fc0e1c96fca5a4b7f064469ece14282d47d62eb
MD5 b7eecd02e207bf6b8102a5c5304fd9c0
SHA1 67d46fc81d79933dc02303efd561b015631f8b72
SHA512 7d22466c3d7be276263bba0f0acc519e60f93b0ac9d4130593b17746569912cd6b8070d87ccb542cf57c4a09b9a10cdf05f736d1ba19ed8d0c40cd7823fc4a2a
TLSH
T1C121A353D8AF1EF23B61A1A9A4499FA1DA8D3032C57494E0D18C8B1756BA949B3C3239
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 c47cc3da62e8d7f0193aa7a76cb96b4a87b354870ca4ec14c7b9c0cc3151baeb
MD5 8cfdc005804869224876bea655570f23
SHA1 a518938d43ab368d0465aa05a25930300326eeec
SHA512 1b43c126ec9aaa6189b3f1f153f5ad5c056bf78202c4071ce10a6422853249f4a559782b1f64d858d75d15611f499afe1889de89b0db6d92f3832840323021e2
SSDEEP 24576:3CWk+tIYI0Lgrv63BDcYrVQpa9phH9E28lQyYH:3jv7L26pcYrVEa9pZ9E2+QyY
TLSH
T1C3F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.6MB
SHA256 68dfeeee5d077499c9ef69bc4c738daef1f9216caba679be582445f7208256f2
MD5 e5d542a63ff99068438965a093767ed7
SHA1 dcbeec0c9dc9e2a8f9eb1a8a1d440c42bc5ec395
SHA512 f7460ee51fe57455d4bfd85c0873d3a81c1a143f51a12f9eea0a5d9527230138218f6269d3d92b01747c6775b5f6929f6c5b7b9d719445f8c1fbce06f373baa1
SSDEEP 24576:RCW++tIdfnUaru63BDcYrVQpQ9nyq9P2elq6YhtHUQx:RjUvUp6pcYrVEQ9nf9P2M9YDr
TLSH
T190062AF860D1A243F3424073B64593EB21EFD00C6027DE0447A956E9A479CEF9E56BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.1MB
SHA256 3d9f9f68528f44786a173962ee310b6965cac4632261e6e61c039697aa01be98
MD5 b264eb03d2ccb5470701deeee272d1cb
SHA1 e83e82a685a8c4e3b01a35e659020e3c6c5c52ca
SHA512 11975372575b92e8750cad2c8394057db4407a6b48c20cd7c2aea7f5a28c7605531f3540671e8b17d7ba3e6603d0b9bd520d908b5395970ac8dd7bb4e3a829c4
SSDEEP 49152:5RxCoV9+cTvfkAAPN3J30ztKfKbw7YTCF/cjcodQmG4mQxDIaRqqUHR8aRtF66QB:rxCoVg4vMAAPN3J0xKV
TLSH
T129566CE420E2D252F38540B3719A53FB10EFC01C60768E44579896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HVQ7reTO.pdf.part

Path C:\Users\Admin\Downloads\HVQ7reTO.pdf.part
Size 375KB
SHA256 14958ee8bd933aa9e83df5233cf988b945ba5d0bfbad15809e2a7f57fbefdaed
MD5 04bf3bc199d4d80ad255d7af5b6c67b6
SHA1 25ca9c65b4ff02a944c14acee3b6bb0d86605e3a
SHA512 d3a31aec708f4c8ae3c14c245012fc10a903bd458fed63074c799066cfa0ba1ce62cfcd322243b4752daf5f7bf9d0a8f2834e5c603fef1c73ae537f7ec7bb4e4
SSDEEP 6144:DzpUHnE6e36mOuHV+yMhHU8Zx4Eqc9ONoGnzDpQ1M60UONvCqEfj9c7:D6nDeqmKhU8ZUc9ONoGniizNvClb9S
TLSH
T161842378925F531B566EB7FCC65006BB82C743E08C360A9EA513AC32613AE402F7B5F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1784-3-0x0000025604EF0000-0x0000025604F21000-memory.dmp

Download

memory/1784-2-0x0000025604EF0000-0x0000025604F21000-memory.dmp

Download

memory/2852-1-0x000001763B8C0000-0x000001763B8F1000-memory.dmp

Download

memory/4604-0-0x0000000001350000-0x0000000001381000-memory.dmp

Download

memory/6204-1340-0x000001BAA7ED0000-0x000001BAA7F01000-memory.dmp

Download

memory/6412-1216-0x0000019A95250000-0x0000019A95281000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads