hxxps://cdn[.]discordapp[.]com/attachments/1511420843408883832/1511452943105396786/HoI_IV_creamapi[.]rar?ex=6a2081bf&is=6a1f303f&hm=9ce7014e6f7526336b456aac986d6b048f53ded37077b5a55d4026e534da9c4a&

Analysis

user interaction
yes
max time kernel
70s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1511420843408883832/1511452943105396786/HoI_IV_creamapi.rar?ex=6a2081bf&is=6a1f303f&hm=9ce7014e6f7526336b456aac986d6b048f53ded37077b5a55d4026e534da9c4a&
Sample260602-ybfepadt5z

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
872	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134249026014000466"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{069EE647-613E-4813-9363-BF2CE48A1065}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5948	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5268	firefox.exe
Token: SeDebugPrivilege	5268	firefox.exe
Token: SeDebugPrivilege	5268	firefox.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
5268	firefox.exe
5268	firefox.exe
5268	firefox.exe
5268	firefox.exe
5268	firefox.exe
5268	firefox.exe
5268	firefox.exe
5268	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5268	firefox.exe
5268	firefox.exe
5268	firefox.exe
5268	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 1768	4184	msedge.exe	86
PID 4184 wrote to memory of 872	4184	msedge.exe	87
PID 4184 wrote to memory of 1244	4184	msedge.exe	88
PID 4184 wrote to memory of 1244	4184	msedge.exe	88
PID 4184 wrote to memory of 1244	4184	msedge.exe	88
PID 4184 wrote to memory of 560	4184	msedge.exe	89
PID 4184 wrote to memory of 560	4184	msedge.exe	89
PID 4184 wrote to memory of 2072	4184	msedge.exe	90
PID 4184 wrote to memory of 2072	4184	msedge.exe	90
PID 4184 wrote to memory of 2072	4184	msedge.exe	90
PID 4184 wrote to memory of 2660	4184	msedge.exe	91
PID 4184 wrote to memory of 2660	4184	msedge.exe	91
PID 4184 wrote to memory of 2660	4184	msedge.exe	91
PID 4184 wrote to memory of 4520	4184	msedge.exe	93
PID 4184 wrote to memory of 2740	4184	msedge.exe	94
PID 4184 wrote to memory of 4520	4184	msedge.exe	93
PID 4184 wrote to memory of 4520	4184	msedge.exe	93
PID 4184 wrote to memory of 2740	4184	msedge.exe	94
PID 4184 wrote to memory of 2740	4184	msedge.exe	94
PID 4184 wrote to memory of 3704	4184	msedge.exe	97
PID 4184 wrote to memory of 3704	4184	msedge.exe	97
PID 4184 wrote to memory of 3304	4184	msedge.exe	98
PID 4184 wrote to memory of 3304	4184	msedge.exe	98
PID 4184 wrote to memory of 2840	4184	msedge.exe	100
PID 4184 wrote to memory of 3924	4184	msedge.exe	101
PID 4184 wrote to memory of 2840	4184	msedge.exe	100
PID 4184 wrote to memory of 3924	4184	msedge.exe	101
PID 4184 wrote to memory of 3924	4184	msedge.exe	101
PID 4184 wrote to memory of 4092	4184	msedge.exe	102
PID 4184 wrote to memory of 4092	4184	msedge.exe	102
PID 4184 wrote to memory of 1844	4184	msedge.exe	103
PID 4184 wrote to memory of 2984	4184	msedge.exe	105
PID 4184 wrote to memory of 2984	4184	msedge.exe	105
PID 4184 wrote to memory of 4056	4184	msedge.exe	107
PID 4184 wrote to memory of 4872	4184	msedge.exe	108
PID 4184 wrote to memory of 4872	4184	msedge.exe	108
PID 4184 wrote to memory of 2928	4184	msedge.exe	109
PID 4184 wrote to memory of 2928	4184	msedge.exe	109
PID 4184 wrote to memory of 4908	4184	msedge.exe	110
PID 4184 wrote to memory of 4908	4184	msedge.exe	110
PID 4184 wrote to memory of 1560	4184	msedge.exe	111
PID 4184 wrote to memory of 1560	4184	msedge.exe	111
PID 4184 wrote to memory of 2620	4184	msedge.exe	112
PID 4184 wrote to memory of 2620	4184	msedge.exe	112
PID 4184 wrote to memory of 6060	4184	msedge.exe	128
PID 4184 wrote to memory of 6068	4184	msedge.exe	129
PID 4184 wrote to memory of 6076	4184	msedge.exe	130
PID 5948 wrote to memory of 4384	5948	OpenWith.exe	131
PID 4384 wrote to memory of 5268	4384	firefox.exe	133
PID 4384 wrote to memory of 5268	4384	firefox.exe	133
PID 5268 wrote to memory of 4808	5268	firefox.exe	134
PID 5268 wrote to memory of 4808	5268	firefox.exe	134
PID 5268 wrote to memory of 4808	5268	firefox.exe	134
PID 5268 wrote to memory of 3500	5268	firefox.exe	135
PID 5268 wrote to memory of 3500	5268	firefox.exe	135
PID 5268 wrote to memory of 3500	5268	firefox.exe	135
PID 5268 wrote to memory of 3500	5268	firefox.exe	135
PID 5268 wrote to memory of 2712	5268	firefox.exe	137
PID 5268 wrote to memory of 2712	5268	firefox.exe	137
PID 5268 wrote to memory of 2712	5268	firefox.exe	137
PID 5268 wrote to memory of 2712	5268	firefox.exe	137
PID 5268 wrote to memory of 5620	5268	firefox.exe	138
PID 5268 wrote to memory of 5620	5268	firefox.exe	138
PID 5268 wrote to memory of 5620	5268	firefox.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1511420843408883832/1511452943105396786/HoI_IV_creamapi.rar?ex=6a2081bf&is=6a1f303f&hm=9ce7014e6f7526336b456aac986d6b048f53ded37077b5a55d4026e534da9c4a&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff8afe6c188,0x7ff8afe6c194,0x7ff8afe6c1a0
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,17542797708484589554,16705147741143044830,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - System Time Discovery
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,4712571037852380456,17520831611672253697,262144 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,1302542785287850795,9148194940178308377,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,8329408091190628987,10090527750696102470,2097152 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,7965138620821365688,13676872331173470940,2097152 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,5903649669537264611,4188199731625240988,2097152 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,3535579209570473832,11929017674640479005,2097152 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,4489163115848971505,5960362510219706063,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,11222648266772802192,7882178648325593877,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,13181745743991635455,4390676526293587171,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5640,i,10438512071656373296,4415024575543318225,2097152 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,11540899277156827817,9596278582964701456,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9684405356254074500,11882956711469361662,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,17385354226000523375,14640079489614280986,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,16506307974643796451,9047887154208412698,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,16506307974643796451,9047887154208412698,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,10665929167570093780,5596405120060342896,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,8486460751355677348,7906427614747805331,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,9502671414144504447,7237283982166423813,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,3629463444345012858,5606879986780504565,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,339484200719472754,12153731832858874056,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,2728896605308113077,1980855597084216467,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,8508971794955904228,18421540517142990184,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,18367170081473210786,16672171105433754132,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,12518840428585998147,4683110013923168557,524288 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5332,i,3854766243840870706,13728152940247755146,2097152 --field-trial-handle=2336,i,836739665340255480,5481676752407187478,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:6580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\HoI IV creamapi.rar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\HoI IV creamapi.rar"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {940a05c7-ff88-4dfa-b70d-25fa0b143408} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {4d81e12b-7075-4e90-8112-5bb742182ce2} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:3500
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27276 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {7c6c77a5-bb14-4723-b820-6e652e870607} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27276 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {ee892c64-1770-498a-8150-19d383fadecc} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 34775 -prefMapHandle 4352 -prefMapSize 270279 -jsInitHandle 4356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {3a0bbaec-b4e9-42d1-8b34-02842f98dfee} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5316 -prefsLen 35012 -prefMapHandle 5320 -prefMapSize 270279 -ipcHandle 2864 -initialChannelId {03468733-f3ea-4483-a936-f75824c43ceb} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32952 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {18364db3-5ffc-4ff2-a737-c1eec25b5e07} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 32952 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {ca371ba4-2a35-4ad9-9662-b46048e71c18} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32952 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {2ee48a83-5428-4bfd-a2d6-a447d419d7be} -parentPid 5268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 17KB
SHA256 417defc9efc396be248eece710fb9f5e1dd571f7a603a371fe56a65a6109f735
MD5 d678b605957841070460f6d387657daa
SHA1 1b1b7a617145b3da0fbe9e6e8b7e4852315187e6
SHA512 72ceeeca239f795d8d50540a017800cf1b529c0136ecf38eb182e1ad6274c4864a7119910fad7bf9b73576b7793a1753ebb0a00ed98c38aec8f454d3cf8077da
SSDEEP 384:RCmISQprdHKZke7zw1kECc5FKB1tA4U5XP+U0olRq0uaHp0bj:RvIScEye781J58jA4UdWUxq0obj
TLSH
T12482D0E445506A03D606E3212CFBC492925AB8FB53E791F3ADDE8ECB81936C1738AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 16KB
SHA256 5333864ecc3ca714e93deb11b85fd39d5ba952743871852a3c8b99390aee9c1f
MD5 878a1009ca77cb290f78a4321430b354
SHA1 a664c6d43477a601e1aac114188c2ed1aff17776
SHA512 9e72deff07d1385647e6ba5202d5d5dea516923685f5c0d742e37dad89e5a4957f8dc085c9495276ce14eb7c47fb65ff6cd8ec2bd7a289392247430dadcd9aff
SSDEEP 384:g0s9EJmbRs7oY7Px8xf5JbP2xx0wCg+cq6fRFlZ1od:JyV4o2yKHb+cpFlfG
TLSH
T14D72E1812BCFF27F837C3964280817CD12AED65FEA9630D48062D2B6ED7898B6951C14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 36KB
SHA256 6ae45aea02e1f02970ef2cdf3c3b6ac5a40529f33be62c379be58bc608b18d47
MD5 e00820614f384f3693189e3d365aa724
SHA1 e3149eddeac762d43166086fee1a777d87253351
SHA512 ea27d402c5f43a5488f93c3d17db1146c4c9261f6b282ee6b27492a500497635c7bf9241b3ca67c949d66b8fbc938cbbaf2f7ceaa1dae888a7fcfaaf2088a139
SSDEEP 768:uTPJN29XSiReGMz/o+hYscocKCjl0S0HYJd/tnj6ZcWyuA0C:IJwXkA+Ks1/6e54J7j6ZrC
TLSH
T159F2F1E0BB56861ADD8BFFC2B3B0D454F4CE3C8C4CB4576D509322352A6A90799DD1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 222c7cc211f63f7e26398a628811ab9c230cc9db3b83db68b4aea238a694417f
MD5 eb7bec54d34d665a7ca56c45f27e41cb
SHA1 380f02700d26c982f9ca5bdf15c116662c63daf6
SHA512 db4fbd704a83839392b3ea65c868e400154a773cef6d9be72a8e06b5ae501baf45c4376c4a6a06dc21507e2dcdf71bcb084e1b0d92e03fb5a8893ab1d66daff3
TLSH
T12561B468CE524B95E7A00333DCE21A9435B184D40E5F8E5111BDAFFD6910B68FD76409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 141c4e67f7e49738046cd13610da88e97b6529d17daf65292ad761805c341429
MD5 3ecb070bad2329675fb3a7e9e0b58fb3
SHA1 4c78b2a243d0acca3ce1fb80f9b13fea4e70a3b9
SHA512 e70ea2b07e600c4a95c26af7b1d4dad29ad56f63696be877d4ab8b478e53acdbaa89d7e8f0367e018fc068d4ffca3a951b0b6d6e02abf7209e92624324e3066c
SSDEEP 192:sxZGRDyM/jK1Ml8M95/fNsT+7FtqNIdpJHW6+WNGYHfLcIg4J:sxZGD15/fNsT+7FbJHbGvc
TLSH
T1C252D6166A749977CCDBD209FA557F53DAF90472A2900E44A9FCDB0C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d25f964f0b88ac5ce047ed81b54cabc7146519a48870aa1db1d2fb0510959d95
MD5 cad4ac766a5ae677b957bdb03668604f
SHA1 6f05b38c5d4773d68f5cc9bfaafb2b82a58c6bc1
SHA512 b1e210a03ef42d649c9ee102d111c5d0fe88b17991dc32dba0649034051cf7fb9f82dada29312ac4ab6ceb4a1a45cefb910933a5b55ad4368c557b9388ac73f7
SSDEEP 768:C5UZYQz7pLuLXgMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfg7eLlPZ4Rpros:C5UZYQlEXgMWvg0Pou1jaeg7eLZmRClO
TLSH
T199F20A3B7C0CCB7E4F844E9DED2A7E8A6DE8028B5A98895447F9844C03C66EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 01c514c2fbc934d8340840d633364da3ac99a3a5574ad00ba64a9773d2ddbbc0
MD5 a1c44366534d31f14adb31c32ef6a5d1
SHA1 780af99004f2328932bccc9621a273c45c31f290
SHA512 45380de3e710c1d311c1e9365469acda9f06d512f522d1ce11711b1ddd9fb2d1d473fc4e7cb1f481a79b393a6930e1b8dd685e57ff734be4fd02cfd342a1d11b
SSDEEP 96:KA1eK2AseUKXqlmd+KuARvmK0UyiQAKligfMbf5BZ:EWE1r9nA
TLSH
T1D1D1D41671BA13113C7D2A0C86B59B668E41B563702DA52B7FED00B54E26E209FFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59335b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59335b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fe75a0b1a390888e88e9cdde79c6b211abe3f0e3e0163c597857c64a1391e6ce
MD5 ec8db656a91d4bdd359f8b90c1f9734f
SHA1 d0010ef797e3ee012f3a208eaa175926d8fe0c2a
SHA512 61406a0c2607fd7a4a9cd448db9b2731a5a04a948ad7823ed58d5ba55e9938d4c2794d97dafa7c20e9a61966771ed5720bd75d81a5ea628354c97176f031ef6c
SSDEEP 384:yUtNnNnb9+sNdhMwSNWd8zX5od+2d6/Id+2CLqbpy8jZALEnGAF:pjZbE+rSq0Ov3lCLq1y6CAF
TLSH
T18B926D3158396CB79EE6A956F44B32435FB841B79AC43BC4DAECDB0D01D71AC2306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ae505c55abd2d1e9316fab96d25b149f4db3e8a3bba91156aed2575ea4c8432a
MD5 fc09937db10c10978802aef443ef1c6a
SHA1 da7a8b4f3986c4e6b7e330d86e7283df58db8b5e
SHA512 65294910e386c803f9a4c8f586537a78f4dc70d95fee35a306f257a94141cca27d2234a9cb378e257a873e14a19248dece898a9e0cbf324a04aa1718a3923d86
SSDEEP 384:yeiFKtNnNnb9GlsNn8TUNTUlIlKQTsSNJxN22Df06X5od+2d6/Id+2CL0bpy8jZp:cFKjZb6uwg4ZSVN2iOv3lCL01y6CAF
TLSH
T106C21936D8A5DE7BADE69B96F60B72479FE401A385C82AC4DADC9F4C00C71AC1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9f73637bc66cff187342023b2f520cb40ab0d31fea26b70843b6c0a2abaa5f84
MD5 49c0e53800f3a79d00aec4e8461b9e8a
SHA1 235eb59266568ee082a1fdbe51151685866817bf
SHA512 77187b48f2824d58243b410b64ef593bc7b310f65e142fbf62f7b75dd2fb439713e708cd3904a942007f7526d44893e8d4e7cd7329ecd139269860e2a7eda026
SSDEEP 192:yONI61VWQmiUypOgGX5Obd+j1+FdgX/t/af3PXU6:yONI6WBgGX5od+2d6/wXXU6
TLSH
T18002B73568686C6B8EE2BD49F48B77135FA41067EA952B84DAEC1B1C00D765C2346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 81d3c8f583f0c96ba78d1009b2e898e021b7a11f60bc237a0a88e8c5dd4de759
MD5 4d101f0807bfe5660abf23c62474f5f9
SHA1 d4f46cbe4aea1450864025fc5f55dea0e31388e3
SHA512 adaa924c3e4d8328585f6c598f731874e6423179c852b10b17057c0f60194eaa2f95b0e5b08424547446f11132bb074f74ade71a6adb8d22ca8298b00daf1fbc
SSDEEP 384:yNtNnNnb9ZsNdKMwSNzd8zX5od+2d6/Id+2CLqbpy8jZALEnGAF:ejZbffrSD0Ov3lCLq1y6CAF
TLSH
T157926D3158396DB78AE6A956F44B32435FB841B79AC43FC4DAEC9F0D01D729C2306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b2d893d52cb400a6b84eab24e67ca186fbfcbbd0a15f06489eb04c649026fe40
MD5 27db7194874dbd52a583b8f0b5bb2f73
SHA1 90e8f4707907b8a99e3daaab173e336c58234bf6
SHA512 c6752868a8bc81f5b053635af1619a0ab8f45e4180f6c50af1d789a351a539e76453ce7f4c0900c6dc0c73163f96f06395c7bd0dec61748f433ee6a83bd221da
SSDEEP 192:yONg61ZWQmiUyXOsGX5Obd+j1+FdgX/oxFd+2CL8jJoQqOpyU6:yONg6alsGX5od+2d6/Id+2CLUbpyU6
TLSH
T18812E83168686C678EE2BD16F48B76535FE4117BEA952F80DAEC5B1C00C76AC2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44d06046-46ce-4be6-93ce-ec1a07a0519c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\44d06046-46ce-4be6-93ce-ec1a07a0519c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a70981d0aef44709aa55e544e4b45b787389995a58f718aac864e7ff013be2f3
MD5 bc951b1c5724d5b4a71e7ab5b9fcb83c
SHA1 a88bb1df3a1e0f137908ff97eae83f0bdffa879d
SHA512 d0274b4e4affcdb96709fea8350fcc17952df3d12c15c609eb0de974bece285bdc7009f25393467c69e8a487e9dad7706e5e1f3a4631093eb72d69c7b903f353
TLSH
T1EB418A58A6FE1149B3B32E5AABF2A86D487FBD372A07D45D10110E4E0627A40C861733
MD5 SHA1 SHA512 TLSH

Submit Download

1af7479b-e23d-4a14-92d0-9d01aade0391.tmp

Path C:\Users\Admin\AppData\Local\Temp\1af7479b-e23d-4a14-92d0-9d01aade0391.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d85b6e8-32fa-4dc6-932f-5d6ab91d37df.tmp

Path C:\Users\Admin\AppData\Local\Temp\8d85b6e8-32fa-4dc6-932f-5d6ab91d37df.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

795b33d0-541f-4e69-befe-8922cfcc389e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4184_1077014790\795b33d0-541f-4e69-befe-8922cfcc389e.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4184_856275963\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8703c428108422274746aa0e2b3e953d1c5b019a1f0330bf4c05ca7031cdcb32
MD5 1c400d6893a622043f0f3d3b683f7682
SHA1 e2bd3ebd5b13f9e191535ae8b18ac65db9c2878f
SHA512 0b4b636e41b30c5ae036a9a227d52a8301df77afa42d06ebd7f1746f566951ca5f070ba22daa46793ba0811af39c647e03f65c35f85b0def02017b526c9ba3be
SSDEEP 192:r1d66JozGzgCl6mc0duOv5zbowZ+fyjmxI:pd66JozGzgC1jPbowZ+fyj5
TLSH
T1AAD1EA28E729923BC408023BCCA61F510F35398A988F3F1572AC741C2D572DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 38d52de54ec8709eead1a404d6794056914e3198bcb78045fa5c40545486c7bf
MD5 8bc5bf8f775bfed216ac18a38d58f1de
SHA1 e4a08c4dff4f2dfd51f2bd3050a0a61c6dc81ddf
SHA512 c899ad440d486012cfe606e6891998070a0f7eb66cfd25753253ccbae4a48d4d503d22af2a34cde97a0ce8a7a45ee6ac9a38c4d9fdb971ee6ad0757f63bc917c
TLSH
T1B661A66CF228863FE049423ACC965B421F347456A8AF7F2A35AC614D1E4B2CD76CD17E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bf64ce70c43e85901dd7df4455a5135845325a49fff3f785c8c7e479052841e0
MD5 e2612594cc62079773169e185a8a1b62
SHA1 0b4f162ceb6704069e639f40260f05bf6037791f
SHA512 8ce02d03cbb59b1ae0b1621c41d9e743836b1da1dea54f9d8e2eca77795e9c8c33fe890753d68aaa16ea01900762b6525cc5a49b885cdab6a1db4feee8907154
SSDEEP 192:3Ov5zboeZ+fyjqPI1d66JozGzgCl6mc0d:IboeZ+fyjBd66JozGzgC1j
TLSH
T111E11D68E628923FC408037BCCA61F454F39399A984E3F1876AC741C2D572DE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 634eec78c1110804d3c54148262051d6d81c6001a9274e127e48400b3561e4fa
MD5 7c87eae45621f11042e52e721dcfcf57
SHA1 e6cd33623742c1aa3ffbe8e7f49c4386a60b0a39
SHA512 9fcec2266b347666a81983c30e7cee46827a1b96a6890e910c050b110345dafb9386fe0f7162ea95cca59c0528b36136be46b09dd3f813681df691b5ca92267e
TLSH
T10C21795D3DB98D2AAE8BF26C744102CEA3558E1604871D430D02EF8DDED1ADA716A43D
MD5 SHA1 SHA512 TLSH

Submit Download

05ee5ffb-ae97-44a6-ad4d-693ff199db14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\05ee5ffb-ae97-44a6-ad4d-693ff199db14
Size 886B
SHA256 228f513cadbf4a3518b84bd640e393121e4cf8ec4f062000b8f009914422826e
MD5 77e9fe18be8f388145d6a6ab6f0af6a6
SHA1 40169da9fab212f7e1e670901ef10b0b17b9ceb0
SHA512 547dd86593731287891fcea78c25db56d1a1913106b7a84004b75da2bc0475e18ccf4757d7eb94a2b81689db6ba39576fb8aaf18d16bc760aef122910699962a
TLSH
T18F1100548AB4B4B2CC38938BC991374387E0722380C659147E606E284DBB51EB7A231B
MD5 SHA1 SHA512 TLSH

Submit Download

233c22f0-5d62-4933-9ca8-1856821ee39c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\233c22f0-5d62-4933-9ca8-1856821ee39c
Size 235B
SHA256 be6d30ccabd9a5d82c1ff7e67ead89df24534cf31e89d405ef47390f0fa3dc7f
MD5 cf890eb77f7bbd8b58508ee3a5b04e2a
SHA1 4c856f710871782daa7c8acc61f965b621aeee09
SHA512 40f562375e4e378aacc9ccba92d90f6967d145176a1dd327757a6b2f6398eec1fa11ac2bf22315f759a8c32aff5ea6484649c0caff5a6be5159ea86efd6a771f
TLSH
T162D097801C886F1C18240F17B0A038D634898C3318B66C10CAB904B8AABDDC62212817
MD5 SHA1 SHA512 TLSH

Submit Download

44fc3676-e9e4-4812-9c84-c31efeb308d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\44fc3676-e9e4-4812-9c84-c31efeb308d0
Size 235B
SHA256 29e7a62d4cebe4730517ac3ff243e54033bf3b789716be893eca1402d3ef69c0
MD5 04e28ef2be1e3cfd59bb87029248b7ec
SHA1 9468c6796c37b931d3af2e0e30144ab462d2f9e6
SHA512 bce2b06cb7e6875f0f6a5bc5e9004cfdc933795d61a066c889798f19faca8f1bdbb663472925a03edaf03ba3c0e4fb52236f8cf49a57b23159da22eabbdcf6d7
TLSH
T13ED0978064A8671C48040F02B0E028C230864C3328B59814E9514138EBFD9C442A1C17
MD5 SHA1 SHA512 TLSH

Submit Download

60b9369d-ea0e-4823-ad62-2c584ee1e2f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\60b9369d-ea0e-4823-ad62-2c584ee1e2f0
Size 2KB
SHA256 31b9acbe843afa7b3a08f5bc00251060b966da4424bb353fd22fb8d09fcb39d2
MD5 670024d63c029f831d1a9cd306ce1104
SHA1 b40948eaf30fe60ad14cad7181d0df7470c02e82
SHA512 94fb2ea019201679df126e2efca8d52f143257c54a82ee29f9cfc13861f24ca5ddd8d8c16ad26f9eaeed5fc4d0f9fba076ca63aeaa0c1e83f0fd6416d5ec80a7
TLSH
T1B141865C39B85CB75DDAF68CD483234E9364471300C628432E54EF0CCC9679D336A57A
MD5 SHA1 SHA512 TLSH

Submit Download

868e5a93-0cfe-47bf-b834-025ed2d4263e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\868e5a93-0cfe-47bf-b834-025ed2d4263e
Size 15KB
SHA256 2e880cdfdc231e2f4bc81ac4adf504f895a8186c7b74a23692d5b512d3aab426
MD5 bf0ac05a13dcac793f22b73c94f05c5b
SHA1 fdadec7c13b6d55a12148b7ee3819f350b213c7a
SHA512 6969e3144f4652fc928d0796ad4bae5f2b5642e10450b6ceb707dab7aa531407e3d79183a90558a810793b33bb8ee21428b84cf0c442fb6036deed18fc45efa4
SSDEEP 192:F42iV21hB3GGCObUz90SRyVQWgYsNGLY/OhltwzRyYRSoWVVpXHzgvRA+AjxcRvp:FLU69E90YusNqY/GltwdyYRS28o
TLSH
T19372C956642045BA8251E3A8D4ECBFC3E5F528CF4C415FCADBE4BD086DEE06E112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd0c123e-a30e-4d41-964b-9540974b87ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\fd0c123e-a30e-4d41-964b-9540974b87ca
Size 883B
SHA256 1b849e02a7f7d2dd6013af55d44fc9139f9a05e6cfc21178d6964a2e80324c75
MD5 99055c3be130604d167680c6519e6ba4
SHA1 b8546f8a90d3fb51591c29b22382b8e8a0db632d
SHA512 dc0bb681d9ea4b07d93da65e3d274ee7cb8611b0d80dc166e0d8f264f9b2b61eb84dd5d506128b09f6ea914584eca49aa7d4993e8da2b9a0e182c3ce0213a5df
TLSH
T1E8110044A668B9F3CC6CD24B8A9537028BE4761384CA44143DA19A380D7F62EA3A630B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 16bbaf5fc099007517b197d5e1ea56d4b9efdcd63c53d5baf96970fc8cd27b42
MD5 571df9ec9738e3a208e9a2adeccad49e
SHA1 bda21150b1632bcaf9e1f14762a6f32fdc1cf66e
SHA512 6fea1b78c49a91b3a9053c715a39dfdf2889e27e45a1a742e04c2b06c5bdab435998a4232e27843407ced7863607553fc00be7e37d37d4778272385131b91d31
SSDEEP 96:xHrUTUZPqGq6fzHkObzSw33SSlfdv9jcnpRHNWyS9JODBw88n8L4cnuFRbj:1JCR6fzHkS33SSe9NWBrODBw88Jz3
TLSH
T1FEE12F789508CF6F74B676ACAC6488716AB2013BB6BF68D710B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 9f69d260ac1dcc2a2fd24e1365ebe4edf08ef9175b0e6888e98dc45a053dfdd9
MD5 f2b4bc1d7f995c694b7775f9af2db71e
SHA1 2a6b5ccdf80d3e2bd5e752b20d22f175400b53ff
SHA512 634592e746b27368e22b119f601f3a8f721b251f9f124b23f9dd5ed0683e00fcf7d811e9b0abc38bbd42e8c0f45657aae1e899f3c3f7e06a56d9d985e66668a3
SSDEEP 96:xHrUTUmqGq6fzHk1zSw33SSlfdv9j1npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzHkd33SS59NWBrODBw88Jr
TLSH
T190E12E789508CB6F74B676ACAC6888716AB2013BB7BF68D710B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 5c2f0229cd0cae63b3d3b82b934a6b05955100efc709205a1833fc154af4a73d
MD5 a0efabc6c12b5376eac9bc8f293a7a8c
SHA1 54930206eab8091e0243cded84e5e760b21719b7
SHA512 bec7ed8e0f5e6c163e88b85611d2c601a7328409d461bdd9ebe9c360da0f0e9d5d1a3a8df68835937531e38e646412680e0748ad59b6877d0e6b596bb82b36e4
SSDEEP 96:xHrUTUmqGq6fzUL1zSWSSlfdv9j1npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULDSS59NWBrODBw88Jr
TLSH
T175E13F789508CB6F74B677ACAC6888716AB2013BB7BF68D750B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

HoI IV creamapi.rar.crdownload

Path C:\Users\Admin\Downloads\HoI IV creamapi.rar.crdownload
Size 329KB
SHA256 ee342567c20fe73b74f2a958e71979aaddfe9772b141d813d110ee672803748d
MD5 8fed6cc376edfddfcad738bc54ae4fa2
SHA1 778672360543f0ba86caff077f47a02dc7a2d7ba
SHA512 835b1a45d2d005acaab2a5692c709789785b79d8641e2e7c1ab75d9e3be3c3608e3feada9a0cd1bac2c12f890bce106385e1e115c244f694b03fe573f97fd008
SSDEEP 6144:OfW47wnEyeZ+3yL0W49BQjI3mjNG8xZCoXZ11GDjybM0cUkP5vmFicIBBkaxigLR:Ou4wEbYiL0Wmy/jFX5GCbHcU6mFicIBb
TLSH
T1DC7423C34944E4231FD0A773E4AF1F315B0FB15DA1876534B26FD63229AEB1288A7CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads