hxxps://vsthemes[.]org/en/dnew/75139[.]html

Analysis

user interaction
yes
max time kernel
93s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vsthemes.org/en/dnew/75139.html
Sample260604-s8stdsh19w

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\uz\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_1001154161\_locales\az\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3272	msedge.exe
5192	msedge.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250617017864002"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{528D3553-A5FF-40D1-8E2B-970541093DC7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{64184066-64AD-499B-BC48-3B1CE838D138}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4104	firefox.exe
Token: SeDebugPrivilege	4104	firefox.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
4104	firefox.exe
4104	firefox.exe
4104	firefox.exe
4104	firefox.exe
4104	firefox.exe
4104	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4104	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 5932	484	msedge.exe	80
PID 484 wrote to memory of 5192	484	msedge.exe	81
PID 484 wrote to memory of 2280	484	msedge.exe	82
PID 484 wrote to memory of 2280	484	msedge.exe	82
PID 484 wrote to memory of 2280	484	msedge.exe	82
PID 484 wrote to memory of 4296	484	msedge.exe	83
PID 484 wrote to memory of 4296	484	msedge.exe	83
PID 484 wrote to memory of 5176	484	msedge.exe	86
PID 484 wrote to memory of 5176	484	msedge.exe	86
PID 484 wrote to memory of 5176	484	msedge.exe	86
PID 484 wrote to memory of 3312	484	msedge.exe	87
PID 484 wrote to memory of 3312	484	msedge.exe	87
PID 484 wrote to memory of 3312	484	msedge.exe	87
PID 484 wrote to memory of 2128	484	msedge.exe	88
PID 484 wrote to memory of 2128	484	msedge.exe	88
PID 484 wrote to memory of 4388	484	msedge.exe	89
PID 484 wrote to memory of 1792	484	msedge.exe	90
PID 484 wrote to memory of 4388	484	msedge.exe	89
PID 484 wrote to memory of 1792	484	msedge.exe	90
PID 484 wrote to memory of 6124	484	msedge.exe	91
PID 484 wrote to memory of 4716	484	msedge.exe	93
PID 6124 wrote to memory of 1800	6124	msedge.exe	94
PID 484 wrote to memory of 5116	484	msedge.exe	97
PID 484 wrote to memory of 3484	484	msedge.exe	98
PID 484 wrote to memory of 3584	484	msedge.exe	99
PID 484 wrote to memory of 1144	484	msedge.exe	100
PID 484 wrote to memory of 1144	484	msedge.exe	100
PID 484 wrote to memory of 5560	484	msedge.exe	101
PID 484 wrote to memory of 5560	484	msedge.exe	101
PID 484 wrote to memory of 776	484	msedge.exe	102
PID 484 wrote to memory of 776	484	msedge.exe	102
PID 484 wrote to memory of 776	484	msedge.exe	102
PID 484 wrote to memory of 1892	484	msedge.exe	103
PID 484 wrote to memory of 1892	484	msedge.exe	103
PID 484 wrote to memory of 1892	484	msedge.exe	103
PID 484 wrote to memory of 4380	484	msedge.exe	104
PID 4380 wrote to memory of 6028	4380	msedge.exe	105
PID 4380 wrote to memory of 3272	4380	msedge.exe	106
PID 4380 wrote to memory of 3248	4380	msedge.exe	107
PID 4380 wrote to memory of 3340	4380	msedge.exe	108
PID 4380 wrote to memory of 3248	4380	msedge.exe	107
PID 4380 wrote to memory of 3248	4380	msedge.exe	107
PID 4380 wrote to memory of 3340	4380	msedge.exe	108
PID 4380 wrote to memory of 2972	4380	msedge.exe	111
PID 4380 wrote to memory of 4456	4380	msedge.exe	112
PID 4380 wrote to memory of 4388	4380	msedge.exe	113
PID 4380 wrote to memory of 5688	4380	msedge.exe	114
PID 2516 wrote to memory of 4104	2516	firefox.exe	116
PID 2516 wrote to memory of 4104	2516	firefox.exe	116
PID 4104 wrote to memory of 5312	4104	firefox.exe	117
PID 4104 wrote to memory of 5312	4104	firefox.exe	117
PID 4104 wrote to memory of 5312	4104	firefox.exe	117
PID 4104 wrote to memory of 5816	4104	firefox.exe	118
PID 4104 wrote to memory of 5816	4104	firefox.exe	118
PID 4104 wrote to memory of 5816	4104	firefox.exe	118
PID 4104 wrote to memory of 5816	4104	firefox.exe	118
PID 4104 wrote to memory of 3464	4104	firefox.exe	119
PID 4104 wrote to memory of 3464	4104	firefox.exe	119
PID 4104 wrote to memory of 3464	4104	firefox.exe	119
PID 4104 wrote to memory of 3464	4104	firefox.exe	119
PID 4104 wrote to memory of 912	4104	firefox.exe	120
PID 4104 wrote to memory of 912	4104	firefox.exe	120
PID 4104 wrote to memory of 912	4104	firefox.exe	120
PID 4104 wrote to memory of 4740	4104	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vsthemes.org/en/dnew/75139.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ffcacefc188,0x7ffcacefc194,0x7ffcacefc1a0
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,12238081373953650884,14610562170557545694,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5395285693665169980,436457525074682779,262144 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,4011605305656668166,9381675979134995654,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:13
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,1692479182704955209,17938761184283405290,2097152 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,14999878338719281981,14393509424540580610,2097152 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,1665236577740462584,16232550735837972239,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,7250291306281119822,5287370449819284493,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,7698954990953506522,15029468529532664928,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,2074505810426177654,14493799893339101229,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,7374459406964803526,16990635731364401016,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,7374459406964803526,16990635731364401016,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,1937488325363150089,3821777158897380209,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,11698561011689355430,6221906907062581690,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,10445622843487707521,11646608384119434321,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,16300868060491544098,6445667386148671896,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,12880765825094459313,7358056209409841500,524288 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5732,i,6257592286505268223,6641636817973588694,2097152 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3584,i,2436337032017522236,13893132605765555233,2097152 --field-trial-handle=2132,i,6049520618484682772,17023315670164638230,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffcacefc188,0x7ffcacefc194,0x7ffcacefc1a0
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12195731838893056314,16221341772409151851,524288 --field-trial-handle=2568,i,14285109682985383387,16685419409879179406,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,2781853584613987387,17987929314263151442,262144 --field-trial-handle=2568,i,14285109682985383387,16685419409879179406,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,17002407881582843105,11011300155765690275,524288 --field-trial-handle=2568,i,14285109682985383387,16685419409879179406,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,12011957693709464342,6761199801113382388,524288 --field-trial-handle=2568,i,14285109682985383387,16685419409879179406,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,12011957693709464342,6761199801113382388,524288 --field-trial-handle=2568,i,14285109682985383387,16685419409879179406,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,11160429686548078583,3609550943737999845,524288 --field-trial-handle=2568,i,14285109682985383387,16685419409879179406,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,12109694013984558759,9905485071371868966,524288 --field-trial-handle=2568,i,14285109682985383387,16685419409879179406,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,12825791288087573288,1927068596092830938,524288 --field-trial-handle=2568,i,14285109682985383387,16685419409879179406,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
    3⤵
    PID:5688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {e3b3a902-4a76-4fc8-915b-c28b3275046c} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {b904767a-5e88-4ee8-8e11-afb7ef91f0a8} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3716 -prefsLen 27323 -prefMapHandle 3720 -prefMapSize 270279 -jsInitHandle 3724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3732 -initialChannelId {e2e209a9-661a-4b28-9148-fb0b6a4d3bcf} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3880 -prefsLen 27323 -prefMapHandle 3884 -prefMapSize 270279 -ipcHandle 3908 -initialChannelId {d9b8c229-fc75-4513-a490-33474f5d635c} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2904 -prefsLen 34822 -prefMapHandle 3092 -prefMapSize 270279 -jsInitHandle 3096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {3a0e1946-eb49-4ed0-ad90-b690022dfe04} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3336 -prefsLen 34903 -prefMapHandle 904 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {c2e08060-d04a-4d92-870f-eeab2ec9c06e} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3036 -prefsLen 32952 -prefMapHandle 4944 -prefMapSize 270279 -jsInitHandle 4948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4952 -initialChannelId {4516a3c8-7b36-448f-9957-d48479a7a29d} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {e8603106-f7ef-4c5c-8d86-e952a5e2d8f6} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 32952 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5792 -initialChannelId {0bf6fb48-8c39-401d-a8d9-2dd90be62a0a} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b4aca2d7691757d37aa2edf531137cab5cb14b3bb29e673fb828062306cebf2
MD5 150f03c8c65bf9c0a61d2e9a6735499b
SHA1 2865afaf1171ae0384a3c5cf1c918824d9a7cfda
SHA512 16484fbb7d2c10cd4294a7d143a8d62f7ce7f9662fd1dbcbef6991180713dc7b4cdda1855a0fb896b2599e2a6832d5b5f5ad3f2d20991e09f4ff6f8c86e0818e
TLSH
T191D0A769234FA4E6F7B8E57F2A278287179E885161434202D60A4D098EAA55500C10C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b6a8ee893d756f15f0d6277f3236c0618825ecee58ea6ece00bef75eb622ec90
MD5 0e9e4947e8c9bce62c5ec2a7443dba5f
SHA1 4ba6108a1d828221166b5a776bd9a911ecec121a
SHA512 1f66aef55fb8bf53728b13f44f3370a59cec45e90f9f631125f5cb06b58aa77a47002f23355977831a9bb927b2c6cb703998f4d8ac6901f92954b37358ca7cc8
TLSH
T1CFD0A7B5670EA4E1D5B4F53B5A2BC1D357AA849060031216930D4C48CDE9A9500C5499
MD5 SHA1 SHA512 TLSH

Submit Download

086e2275-b844-4a91-ad77-05983b49ba4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\086e2275-b844-4a91-ad77-05983b49ba4f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 cb0dd6760b74bcf1ecbd6f7daa0561b41dd5c9cf6a791a86d5afe5f740d66b2c
MD5 5882e43920cc2af39b7baed1db65874a
SHA1 b9e11aaba13a79dac856dae4f50f4e9471724bb5
SHA512 8cbdd24b6431c6fc4da0f1b480a9a40d8ac1af8a726bc0d4c1f5de19900de5886e80987c47d2e8f777d4fe2aa1d8facb32eeceee74b56161caef3287c2511e8a
TLSH
T1DFF0A9BAC921AC3718FD1B2960A55746F75523572B41495F3A3C920C8FB163F854586C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 25507323593931cdf87eda68951aaa245ac72eea98d4b07d978ebf7b9f2f8377
MD5 f330fb202028daf30964b46326059650
SHA1 5c8bd7a39eab714f572a68c6f1ecd21e27b24afe
SHA512 09705da0b22c9ac9780bab6c92cc844250e44c7bc1087831d3be9afdecad0e3e0b5f60f0f6dc3c0cdb80dbfeca219baf61537cc844f080d04eeedf1720f6b194
SSDEEP 384:RRDcrhTPf+CzdpRXvQO9hT91rRnkE5wlJnUsgQ0gob8z4F36IuHN:RRDctWCxpRX4O9hT9RNb5w8sp07Izv
TLSH
T1111372BE3B552E16FACAD8FC140B5AB2637DF829C1D09F037BF5781A5239396291E110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e04b7d90a3e0e05d6f1a49fbd069d094e7e942513de5a5cde8a71a7bbb232ca3
MD5 20b8368eefd72d1e601ac139fcb06803
SHA1 612da5bcf45c9774dd0dd3c97615ddd43d6a3023
SHA512 54aa89c161f37919272feb458ed98476b192b7bf364bd27b67846d2868158cf65b6cf6642f8ce663e10d06096131f5d2f317a6e83550b4a77c6e99b59d3932fc
SSDEEP 3072:p7FEGYGKo5dP4L/pL/L1X9L/dL/7FPwZgV:p7FEGYGKo5dP4L/pL/L1NL/dL/GS
TLSH
T149444EF70951A01BCFA842F5E2033E3DD17B455D2CE1E9E9E6B84C912C35B21B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 4c48ae91014a7b9b4f2db0c8859478c129d1f222c410bb360249f9fd256fb471
MD5 e8ee16aa24bc53c6ce754751c60de6f8
SHA1 2c6fa101b7bd0228d7005ba0a68d1c8da27b147f
SHA512 14668556a0838f5aca23c4b4b65eb4a1466efa5ce3f2c1051abfc8040f1d46045f1ce6c5ba330ca8d3a8fc410e1b099f70e7ce82cd2f48b40c3650bd9d0f2df3
SSDEEP 24576:7PeOpE8ol4YdCuxII+zaSLANUus8KJZxoOKiKCCiJP+eLsz1CuaEnN:7meYdCu9mFAiusDZxoOKi7Ci0eL3x8
TLSH
T188867DEDCA6898C3CD639970B0F0ED477C7413C3F595C1D68898C684026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 af2d6bfe00cf9f177c72a3814c041557550b2a516b32ba81ecdf620d726b0b14
MD5 eb1772e4f4e279a0e78c8a4905648cb7
SHA1 ce87f410fb012b6563012f3778e3543c9b45fb16
SHA512 873f2d07dfe01a15d8ef916e9e3467b8beddf7cd70e8b0b955c3c7479a85dc320ba8a4dc4216b53d472871d9b7c94c35e239d30311a873d1028d7ac11c3cb65b
TLSH
T113711C3DC2520B42D3710DF3ABD9570332B075A7CA2F1E4B49988577590DBD039E9038
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 cc009d9b0086b269cd707f9db7e9c75666ea1d13f93a008842f1208d90c0638b
MD5 61c2d7369ebff9ff7f3aea513c098f8b
SHA1 8f8c0523ab4f41571a0b22703689b763feaa0627
SHA512 f8def48249a15111cea6c47eb76b9c30407e286b1c36ba63f2192919cb03c45a414c23fc339b9a8ef64d57e42660f5772c6afa6cac62752e5ee580570ba7b27d
SSDEEP 3:MsEllllkEthXllkl2zEklml:/M/xT02znS
TLSH
T11D4404347FC00405C70031344411C3700370F45017115F4334570513DCC5D401C40005
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 dcd56ed9440e9eae2987f1873520f05af56f7765dcfbfa6da6b8e52e506d5c59
MD5 d9dd35bd19a728dc2a4d98796a85b4b3
SHA1 8c769b4486cc8e2c3671dd3c763f5c447cd72386
SHA512 af91b56c38856aa15d13bd14e5b6b2ecd52879e0c864952e93535ba2ae5718bc04bbe049929590d25d10450705b38f461d748ad03f1f53867a184737a59027cc
TLSH
T1F1E0D89496D6C1ED751434C742346F18C5C5348ADA867D471F20C8CC7A42402B25E56A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 021697c3f2eb8889179cb2b3bbd2f1b41207b99d0f75258c37236398af13b077
MD5 eafb1c40f86f65a2d580efb19017293a
SHA1 6823d95ee642421bfa59f0d369a277b35e6f585b
SHA512 f22b2999f0fe79d918d43ea865103a8cd61010323ce98961054c80af20f13c18d4f284e1c8d66f19c83453b576c30d08a2f776d9032bd26b8d767cc3687971a9
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+j1rW5LXzK5fKFtINsqYp8:Tyi+7f+UZD4jJ/B5rWxXzCKFONsTp8
TLSH
T1CEE2114C3B11F911C8FC773DA1C2C5F05EBC686C4B4D7271513868768C52AA2F4AE11E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 513B
SHA256 388c5c95f0f54f32b499c03a37aabfa5e0a31030ec70d0956a239942544b0eea
MD5 c92eabb217d45c77f8d52725ad3758f0
SHA1 43b422ac002bb445e2e9b2c27d74c27cd70c9975
SHA512 dfd5d1c614f0ebff97f354dfc23266655c336b9b7112781d7579057814b4503d4b63ab1263258bda3358e5ee9457429c1a2451b22261a1f1e2d8657f31240d3c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 01635fe33a1f55813d0f25ef753455f0a3505a1122c31ed18b66f19107c0dad2
MD5 01d5fd28525a511d6bf411d1c21881ae
SHA1 2473dc47ed121e802c90e3ddee9885ff759cd457
SHA512 c5e4b03f7fb46c79b81514cf5e7a86ec570af22c2b85b6381ebcb7465a38784fc15595e76de17cd7b055049de65167b90b49b03d76e0dc302d24217f5e66d3ea
TLSH
T1D7E0260808C8F1BDA45468E38278A70CD7D0348FB38A39061B2E9C847182A49E2AF2A0
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 2df960764e2230df5fc616b17c54e8013ca0244a156b870e2aadc0c44944cb99
MD5 d811416956bee878093cbafccc445808
SHA1 c18f28e0fbb23a2a879ac03f512ceaeaca4284c3
SHA512 91253e932764a8f6bb138d69257cd37a53c56b061ac0fef30da3be699abaa40c6966a2706296477bb214dc28e3b6249762da495bf808e968086fe72510a5724d
SSDEEP 96:xDnCQkQWBVHU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jjY7oEbjB2:xa7X0+G83uxXBBK31GkSJwEJH7DNspUy
TLSH
T1FE14344F5F302311CDBD813669E754A35DBDF03F8B526AC9686114B1CEE3B52A06C8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 c235f492630ae4e49b88961c7a84690074498fab07bd2d4543815d703dd9cdee
MD5 93196e53c1a8abd80e95f4d566bcc354
SHA1 306f158fdd4dd3a01f7c06900644faef2de40e7c
SHA512 849c01724f1dadf251799e64539884945d4cb1534983cb3266d48a372d74a711d565b8cd96e02518824269115053fb5403d4063c5de4d7c650f49781bcf6d50e
TLSH
T15BE0D8B045CDD1A97515209B4269770CD7E0755FD68A3A069F18B848B101404A2DB5E1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 ea27aaeb695a931e13545d2cb837a61b9f3c5cc59e665cfb6e4fe7d8002825c6
MD5 7e3b24963b35b4173e054bc0d302022c
SHA1 182a7c38f66f478ac96935dfe2d7fefdcb57d89f
SHA512 f7ff029ae1ecaa4918ff307cafe07c2f15ddd8de9f7f5546a23fb2c1cd76dfe88b1925a60db16a990df2be63e2f6ea168ffc57a580959aa6243c0db5d25e31a2
SSDEEP 48:T2SLopFMatSaw/auUOt8BMoOwGCDiL1BAwH:iSeMatUaAK8GDU1BAA
TLSH
T16592410E1F346121D0F49B7AEDD184272F7C202D87633649EE0920F3AD925ABF1051BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9e713bb854da871b477cd0f472fd5178081a283230ac7d1f10987b080b04e8ce
MD5 f16533aaf3037ddda0ec9c6d7debda86
SHA1 46e6f17e0be1fd26cb5beb645b65835c0d3ba055
SHA512 509eadf5c19c850bdcc76c092ef0f4cb6c0dfca74dc9f748a74c79a285d36ad8766e9ac6c4a241d9f11fa6ca78402e5b5152fc8c8d237d9045df4385b0d0686e
TLSH
T1C751CEF3C2E8866DC90156F0BB18BE2BDE2D0914832C3D5A88E4EF5B93E3471D14165E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 68c68ca953c9b1e98b1c5ceeeb5a4c4d7a357fe1fa29d2ec3d6cdbafbf5dae5b
MD5 04139520c92e8f6ba196327676bae33c
SHA1 e50538f03630717f8e0bfa863a648232daa946f3
SHA512 749deb24adb430aa983496d1c4ad42543c2a04030060aa47f1586aa2ec803b5e2f1182cd55dc93fe19cbd37f486d6fd6aab721ab00b0b0292f6722038e550c72
TLSH
T191C01267E4FEF4B6606459791E88A881A6BAD439005294F2D995A33CA1A00F76A11439
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bf6ee8e9299218852394b356c59f38a19160a2458e5fda09ead33844b27a91df
MD5 41192052fb7a6e20ea0292a3e3dd3917
SHA1 f3ed0fa835200169e00a8ecb3172d97cd1437e9e
SHA512 6e379ae987a60b35db1ad5ef73147b2d557b7c7b4ef99afb8cee4b0253d79f2d1e43b3877200a00f6a5b36e13dfd08b5bbeee252509d38140a379717801fb369
SSDEEP 192:sxZXRvyMqZjK1Ml8xo4/frsffWpVW+KTG5GN2swKzodpBv/W6+WNGY0FoW5rVIgQ:sxZXU34/frsHWvW+Uei2Zh/bG5Z5t9XG
TLSH
T19472E816AA74597BCCDBD219FA557F53D6F9152292904E48AAFCCB0C04E67EC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c792a1fefad446a7b65a26635a1a536964a35d0b3cbe76bca2608d7a9c8f2376
MD5 fdc006079e9d33bf8af1ff33106edeac
SHA1 63c3befb8c88e315a5df4b514bb188815163855d
SHA512 14a53bd58dfc963413438361e9d3c70e7b88771d4253f9b826b77e9afbc7d6f536756ecf260b51c9c5fddcaedb43a39330c8417c2d522990188ade642fe5fb3b
SSDEEP 192:sxZXRvyMqZjK1Ml8Mo4/frsBTLKTG5GN2swKzodpW/W6+WNGY0hJW+fIgj+pJ:sxZXUQ4/frstLUei2ZW/bG5Sij+T
TLSH
T11262E7166A64597BCCDBD319FA457B53D6F9157292904E48AAFCCB0C04E6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 98500491e72ac24eee8088fb1dd1fa57bfdd691cd78b96957018de7470dab7d0
MD5 f34959cfbcf82bc9dfd957f89a447ca5
SHA1 8bdbcf624def465f581a9174653d5d82f84fbb21
SHA512 b32c49a3dce825066fc1f6341f343b6ccac734c3ae043843fd59b6892ce528ed311bbda2d960e6d23358f7c296f3bb174db12de408d104c9c0bb6d2ce87d87d2
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3+zx4Llv:wQAKq8y02yqEnjbWRmj1QWTu1jaK+zxo
TLSH
T164030A3B680CCB7E4FC04E9CED267E8A6DE8028BA698CD5447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 c29d04a3f638f8c5b0c26e02afb1c0f21f750727f18263d7ca87471472dc979d
MD5 bdd1226147813f26558d1a9909962b35
SHA1 608b2fdfc56547eb787841ebd138862b10ebca00
SHA512 d354b8f37779ea96940f61e61b388bd4d07acf741667e71b2bc13354fdd9953e1c308196d613d73d8fee1f05d14133e97baafb9577d56aef14ba4a4384059471
SSDEEP 768:wQAKq8y02Cc7pLuLXobWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Lzx4LlO:wQAKq8y02CAEXobWRmj1QWTu1jaKLzxV
TLSH
T1B803FA3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 ca8e2ad4a9053642f308587bb7341c5f9d087807f5a9aaec58f9c387861a32be
MD5 17c84375c051f54e2f4e8789df0cdd78
SHA1 00e2c3203955cfca0b8ee08a2bdda2260b9d5635
SHA512 46c81cccd0a2c5045b1e8b799303f7b1bee8f46e3df7d3835d63fe62abe6de224d1f3e02e4267cebf5ba554b75b79186aeb840bc83409a698aab8536a263d62f
TLSH
T1DBE0269405CCE1FDB11620A303F8A348A2F9B56FD2C83D072F20DC447143904B1BB2E0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 57a04979a2addada42e4329ec63e347e4d5bdd976ebd23c98b1b73b105be3b14
MD5 7d4b4432ad340a28b5ff57ac085b84de
SHA1 3506a87f3fc14170338d7b117633e6a33197b6de
SHA512 e2ba70d3486d5d2764d61403d53a2412bdba34a57c244faf49b0aab7da4319d26cfa119414bddaa759d30dcbc873bafd1550b35b3b0298c6c8cd874ae2d5a8ff
TLSH
T113B0124477004135C0CA0A711558C7805374F0032910498B98BCEF104C04AB93F038E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2e6dd693b7b55ad00e9067bbe0277cf9d4e8c0699f7e0d52d08ba5b636d546c3
MD5 3103bec685ae771662b8bf9174b846ed
SHA1 8663e7c6f5fc1a5998d97afebb6a0cfccb937077
SHA512 118ef15acd0ad2486c3ba36fa666a062ea423939391b82b0a1c0bc99c541506148f61761d25df579158c6e8d7bc04d9b36ee2d30bb4e26f26bef94c6478dc6d2
TLSH
T1B9E0D83819C9D6FA718520D74264F308E2F2B48BD7DE79256F18A4CB7206140729B560
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 5ca588455ee3f79f795a75a05741e8b33aef444ed27ae9583dcc2c28ca864f8e
MD5 f0e0052debc80d3ea1ddeae218a5a743
SHA1 f1cea3262507586309b1960e5b201ca39c0afdc1
SHA512 9a52bc846a0d50f0e7f8de3c4f4c9775222ae9a97d01a4ee883bf1163c10bb8773a6b13c5b879ec912d2cf540ba825b34545e1afc256f4b132d730f62cf53a11
TLSH
T157E0DF7449C8E6BDB04060E243B4F719D2F8B84F93893A0B5B1C5884B101500B2BE1E0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 50cc8860f8fad2d9a4855de63fa8004409365be2ea4fb51de9a893cfdf7f1bf6
MD5 a308d6461910b3e0dddbd7b0ea2c0f09
SHA1 ae2716ab5b0384c3b57a0c045c86086b527fc6cd
SHA512 4ab69d286a269dc653b2c235fe90c3f9c867788b1dbd63bb07ce4bf16f955e91201a687ce1df2facbc361c6c50207da86f86d20a0fc246ea39bb0eb4901c272f
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5c:GZLVDJjEDPV0/ZdwPj
TLSH
T150A27A1232BA02423C7D391C92969B274A82F5633069ED7F7BB900B54E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 5938c8971443330c06bf964d9c2ae1efea12e8f703c7d18bc2077939f3f1eb16
MD5 4c68b1f71d62d8105c608844192fdf72
SHA1 3a553e52c6d216f3f8fc3a99531513da6c029222
SHA512 8c765e78303bf684841ded82773fd2f437c33709395b58adf1ee54afc0b4d94d18822812b87ce7756c82f3f4ae857c835ca1637f6489608f194a665c97db42f2
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F57:GZLVDJjEDPV0/ZdwPqrD
TLSH
T118C2780232BA12423C7D391C92928B275A42F5633029ED7F7BB950B64E67E124DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 32a9112f95304e7200f768019f0242bd25313a2b87d58053fc46e440805d074e
MD5 cd6fc18d50c82a6e898b80589c90d31d
SHA1 c066c5d609931dfa671d7847f262f7d40af80181
SHA512 39702cbb72da1e36165a34a4cfe63bb5a9ceaf0d8bf817491557ea048f45d421b29de69b22edabb6345bc9f7b312f06df2e48a9eebecc43fdba5d4de2aa47c42
SSDEEP 192:FvoWNxfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a4fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T17A24540A7B747001DDE7E9725CB080771A3CB16DCF22A6915DB264698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 fb6ae7572edc3eeb6c1813fc6bf8a645b83840a4303938d76b13694263585c57
MD5 30a23c4d84e9616eabec1f4e3d02f7f6
SHA1 08b22665953730b4f0e2924db1e16d029f78fa16
SHA512 e9c92c608326f0d36688593f4f4ac821fadd0b3f967e9c4e081eb8718242253d3aba9727d0a0b41eccf750a37a5fb0a22882b8dfc4db7e711754f4287b24150f
TLSH
T1AA51B8C093A520D57F89A981C31A5603B9E1BE5B270F6CB2232E94F49F84C154F6FD25
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 62defe730dd4f672587d392c147a51422b573862d0f915dc258552ce4c77d82b
MD5 9c9320a93f76393b9551d371e63c542e
SHA1 360b047e501950a44833be7886a487f6e6114187
SHA512 03b2b51b74afe70fbadfaaac1ce2b723470cb66af853ffeffbea652a36804723e8ce3bfcbbc30bfc8df93ee258279371d4fb5bd6aa7f3637b49c97bd9f0e0fdb
SSDEEP 192:6+y5Oq5AsylrQEus0tL0BahQHIIImbWMIMQRYcYN:62qasIgs0fQHIIImbWMIMyBq
TLSH
T19E52722A37051B3BD86E1FB7036A8BD41FD898410273226D7162184F8DF3A6787C52FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 52ddaaea9a4343e022e5a2ab964bc8af3699223e27ee851d2bcdf3f15482ec56
MD5 5af10af6bd7696b2c0b8105d89aed9d9
SHA1 fac05a5c30c5a32464fec045738104d0bac53e9f
SHA512 ec333090959d21fcde49acb365bc0babc780802e5975cbca434bff7c1f8f4d724d775e317d4876cbf477a960adc26488a30056d8d12f719a270d6537c78a6393
TLSH
T17AE0DFA0A8C8E1FEB05470D701249329E2C4B84BFB883D0A1F20888CB042500B6AE2A1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 fc77cd497c54626abab83b4e1670efe36747a6d91ca49b7ef0a49838f3d72115
MD5 7f2c5d6fd33093edf249ca59ef788651
SHA1 ab3c68e6db2cf37e3127fc543ac8ced447302c8e
SHA512 a427247439ccbaaa83e5077267bcd1855d0a9b8a0acabec0d7f2d57885f78545dcf97e7d2c52de4cace801f84d8d35a2b3d3fb70ba7102a44bd4992fb9935b2a
TLSH
T127216056F320C148E59E863D642B9B661338E8429FBCEC4F507970256E71E001E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 a74ae3426e8ab2b73c066f87be2f8e9de6f6c60a7da22353e05e7c094063e212
MD5 04062cdabdf90b62d5d46c3b058ce1db
SHA1 a158287d561d3123d6d4b7f356788ac0b4ddaadf
SHA512 d5fa8bbaad557e14ce4aea78904f7f3be6e2f15b764cdb948bcb23efbc2025779ee3123317b761dfffac1359c3d4fd3e35b89851e53b5487afeab315d70732ad
TLSH
T152E0DF14A8C8E1EFA05120E34174E34CE2D9388BFB983E0A1F288C88A142541B2AF1A1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b71dda7b8f2a95c036f5dc0c3268fcc0b2c51ccd2abf88b4351cbb2778121b83
MD5 33d5a47b1de24276fcaa1db6d3bfcf9a
SHA1 7ac6c365cf745fce56e5e74ff36f2c67977498e7
SHA512 b0826312ff5cae67fc8d49ccdef36dec7a793eb1666473a82e79a8c9b85184cc8d89d2eea4228328c69745cb0fc5d38456357407641725ec7a290e836e2f4390
SSDEEP 3:MsEllllkEthXllkl2zEelXgutl:/M/xT02zNLX
TLSH
T11044041CFFC45447D53430304015D3740770FCD015135743345104375CC7F405C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f289898c9bbf6f5c9935c2321261851b9e89146235e81c1ec453621940108a25
MD5 55845fd143401c9199ab34799f1b9850
SHA1 2b715bd80c6577478e71efc2fb56cff22c27cb39
SHA512 0ab33398a6ac9e1fc7709dddd0e87bf9a51d9b2745c38e9a0caf115857f2db3f5a9ad9d3807cb6d3ee07d41cc2f2104221c42b9d881ea5e2c75ce4894b477f39
SSDEEP 384:nMiF9CcmyWCs38NF8TUNTUlIxBPm3ek32nn9BLQes4JfbgGGkp3sUqsj/vMe4KV8:3Fccps3WwgPKekmTpsGLVDNvMI8p0o
TLSH
T120C25A36E868CABBECE64F99F74E6612DEE05267958889D8DAD81D0D00971DC134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 37387480a4bac75949e1630d861f0ef72e7a18613b1ec42e8c7cb23e67ee1ea6
MD5 240752785e27ae354fd2afe25daa15dd
SHA1 422762930fcdd5589ed5cf09478ea28988f9b62c
SHA512 db9d51bb6db71cee21441569ae007e28e83db7e00363a722b5432170784821236b29e0ea158207b3954b6dd461684db2cf931706f0f703b27a1a7e67eab2954a
SSDEEP 384:nGiF9CcmyWCJ38Nf8TUNTUlIRHPm3ek32nn9zd54JfbgGGkp3sUqsjn2sNTIty/s:tFccpJ3kwgRKekmjTGLVDzNTS
TLSH
T1BBB24936E864DABBE8E74ED9F75E7653DEE04163968889D8DAD90D1C00871CD134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f54a77fe6efe734477e1cf40cdd7c73f242a8354d776ea358e6de0b4cd8f8d73
MD5 7d4f02a1bde8de9e0065d78f251823c5
SHA1 317d82b2869176c69f92a6b2c600cf1b1f72faf2
SHA512 b09e85e433c5b4766cd2f3ef5a01b2f5d45ed2676b69437d4ee2b2a7a45ffd18034e9844db3a012aea10e844dc839ef6ba78cdbb39a6d685055816013df39b9e
SSDEEP 384:nAiF1tNnNnb9238Nf8TUNTUlIRfPm3ek32nn98v54JfbgGGkp3sUqsjn2TNFbhyS:bF1jZbU3kwgpKekmETGLVDeNBhtz
TLSH
T12CD26B36E865DEA7ECE64E99E71A7613EFE0116399885ED8DDCC0D0D00D71CD034B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4eb21160921ced18c8d2422951c7c34357e65600e05dc035039c88ec9109de01
MD5 b13dfdaa8f9872b8c13b847c322c9ade
SHA1 052bb23804ac99a502d5b2cd5049710c1514da9a
SHA512 e5a85b460832156b7ba872b108f549e2064fcb251e5286a4f7988054979aaf9f88c58a807bb486854d16a3ea8904b55f711664a1a401b840908d8383b4005ec2
SSDEEP 768:bFnjZbXkwgpKekmoTGLVDes1Th4tfEBhtz:n7GkIHFmpEvtz
TLSH
T1F9F2183E9C659DBF88EE6B48A75E652699E01137D67849D8E7C80F0C80B718CF347922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 63fc1b36870528525895e47a545c393d6ec2b3e9c47adaa36465b2d53b61210a
MD5 1287336b37e9c02c96e4c23866f02381
SHA1 ab02e484b0ff7224c0d4a9c9f7270b3e61e1ebc8
SHA512 f64ed91395a7e1e8ab6072f0916416ad4d25d2b7d9130664dd4e81ed15fab050a42a696b201c26bc901c9e1f935a90d21507215638301b3df26a48c9d382ca73
SSDEEP 384:nGiF1tNnNnb9238Nf8TUNTUlIRfPm3ek32nn98d54JfbgGGkp3sUqsjn2TNFbhyS:tF1jZbU3kwgpKekmqTGLVDeNBhtz
TLSH
T1A0D26B32E865DEA7ECE64E99E71A7613EFE0116399885ED8DDCC0D0D00D71CD034B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 22cc030cd211c85ce27e9b8474dc9aa9a975c0b94185aea6b28f42570750cc23
MD5 991cd4cddb8aabd01922166f515694a4
SHA1 a76ef573d8583fdae099f4b1aea1ffd42867a2f4
SHA512 5af2e1de2ab4a659cba1eb578a9e086f8a3457596d263ad02c02d58a241a18294871679b08ce00b64bb4afa10fe2a2cae3e0d12db651f675bbde77eb9695afc0
SSDEEP 768:bFnjZbXkwgpKekmHTGLVDes1Th4tfEBhtz:n7GkVHFmpEvtz
TLSH
T1EAF2283E9C659DBF88EE6B48A75E752699E01137D67849D8E7C80F0C80B718CF347922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b50ca4489cd807fbd1b257e49e8b07ee9dfe8808e7660d2665e5a70f46c6ad57
MD5 0860e68a59757c76c6235cd79399fcfc
SHA1 ad787797779a125f9bf5b897392d14f6e37f2598
SHA512 1d3619e65ba850e9986e797430c812f5e8a788996fe0c533e779378870faeffc51c05789caf4f88749603edde87bb3989ee1536f7cd9f87eb9a58d5e2f6a70d4
SSDEEP 3:MsEllllkEthXllkl2zEelBaHql:/M/xT02zNs+
TLSH
T15544040C7FD51445C51430304011C3701370FC5105715743345144135CD7D401C00101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 dd00843f1b6b38684e6a8bea06f4d4e3e80d86f678fd743486ff0570a03bef93
MD5 4a912a7475cca3117612f77f096e74d6
SHA1 4dcf06efb2828426b907f387ba3fffac0085b1a2
SHA512 ceb128fb0dbdd9a8e8b349979a53a1d0e286311ef519a85c808c16fcd79019b840ce2b84e06cadab9eab05a3534ac27054805f8368d0298cb96526c4db2bc7c1
SSDEEP 192:4wX1d66Joz0dzgCl6mc0dXoOv5zboHzZJgyjE:4ed66JozQzgC1jRTboTZJgyj
TLSH
T156D1FB58F628923BC418023BDDA61B410F36389A988F3F2531AC744D3D572CE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7ceb41379ad43a353953a6b594c96cb9f8f29c37b376a04aa998948dee808aa1
MD5 b8bbe5b3be7a615a3bf66cd3d810b915
SHA1 8321ca8627581c89777f2c5502dec9be9f3e5e0a
SHA512 35a429d3ff748fe306f97fe4b6e648c042309c4363f5026ad390113eae2826c9f91bb6cd99c81d1647f6ca2411b4d639cd34e1c2a4f630087e8c5dcc0d893648
SSDEEP 192:qoOv5zboobJgyjESwX1d66Joz0dzgCl6mc0dR:qTboobJgyjVed66JozQzgC1jX
TLSH
T1CBD10B54F628563FC448423BCDA61B410E72389B989E3F2531AC640D3C9B2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2424d6c0263fa032a5dc37212f5c0e1aba61207a7a3758d8712aa9627cf415fc
MD5 1885e88c5070684e3fd776f6c8e7c0bb
SHA1 86a43393299021d13dd95802306348f549cf3dee
SHA512 58e524b1429c7c90123f638e3e8120202098ca75c062f94126e958549409d75199d0af1ebc511e07a726bbc5c2db97084bb30d88f9de0b5fd52adda8aaa84b2d
TLSH
T1F021796D39BD8D2A69C7F29C744482CE53198A0304871D474D82FF8DCE86AD932BE43D
MD5 SHA1 SHA512 TLSH

Submit Download

0ea8c84d-4850-40a6-ae40-41ed0e557672

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\0ea8c84d-4850-40a6-ae40-41ed0e557672
Size 2KB
SHA256 d1efbefc67aacc38697d3dc33dee7e7a383ea3d1f4930306c5fcb9baf98b926e
MD5 fdae56192d1e70faf064c3f4c56da67a
SHA1 640f094b27b5b970d0170f6ad2a0878e6bbd4ba4
SHA512 8c35da6995f5c218e07d5012f54ebd5b151054d08c2dc37a7bda7bedd025fc6c3187d215da4bd9084eb918cb4aa98aca71d91f4750f013e49b0cf1989da80843
TLSH
T19C51A7695020D87EC87DA31BD9213B838FF2140B408F194E9EDCAF0B257FD5E5355649
MD5 SHA1 SHA512 TLSH

Submit Download

225e4605-0e3e-4bc7-bded-47cfc562c5c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\225e4605-0e3e-4bc7-bded-47cfc562c5c6
Size 235B
SHA256 8fd66fb461989957fdd42e644bd4bf256a66c4c5e386b3d5be3eb2145ea8aa60
MD5 0f6dd7938bd271b13d20e729f72feb7c
SHA1 9a786416737a26620eaf0e4e4b85afccaac789ac
SHA512 72aa8a41cc3fdc054f1f4ea0c863c94f62ed0a45b3ad4e3b57103bfee727d1d21490975f39b91d1ca869882dd5b6e889f9c8d08c2e296d99ffd19ce22ff049eb
TLSH
T160D0A79468986B5E4C144F16F1F0AAC630888C3754649860E5D159749ABDDC551A285E
MD5 SHA1 SHA512 TLSH

Submit Download

2d39fee4-3111-4a21-82c3-e2cd8e0aebac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\2d39fee4-3111-4a21-82c3-e2cd8e0aebac
Size 886B
SHA256 deb3fe42585234c78652319c7e8e7535eef7517bd38f26578a3462b88b426921
MD5 e790fe08ca5bcad13a1d26b68f61e426
SHA1 9ed94aec2e4af2c226189d20fe2bd929c6dcbc68
SHA512 9778f962ad9212cc52593b6371bee393584414ce4451a16a60d64ab8f96ec8a7614c82782cd0f5b0e25d60c2a1a3517e61879841b51d017b590ce61d2e88d64e
TLSH
T18E1140809930B2F28C78C14BD5E23B078BF4B123C0CA19203C609B0C1DBA10E679720F
MD5 SHA1 SHA512 TLSH

Submit Download

8ecd069d-cbaf-4d36-a1f6-bc1244ddbc5c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\8ecd069d-cbaf-4d36-a1f6-bc1244ddbc5c
Size 2KB
SHA256 2e21a0ea047cb3554ef578d7f35699b04f51c8ad0f1d087cede24e131365efbe
MD5 e5b88f0ab931eaa02a20a988dd77c2ba
SHA1 5471d5afd631c8cc113e3b46ef4971620e85bc71
SHA512 6fd73ec4bcbe87041d46fa7da6ff60f9427d77d10eb2044240b8e9b56b29119a1f12500699f35335ada87fb74b2c96cca127d4976e2d412e0b0e6ff74ec223f1
TLSH
T18A41106835789CB69CEAE19DD983228E57B08B0340C61C432D61EF0C8DDA69D376A56F
MD5 SHA1 SHA512 TLSH

Submit Download

e88b275c-57c4-4ef7-ab49-abe04eff94dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\e88b275c-57c4-4ef7-ab49-abe04eff94dd
Size 235B
SHA256 b8a1238fda0a759208a42cec41425284509812adf1ef6feb88cf48e62d9c1e9b
MD5 5dd8cfdbe42e7c5a12cfb25f6eccfd17
SHA1 f07ac6678d5c18c357d5fe1aa0f726cb30ff0a6d
SHA512 8a11ba83d6fbef7d1afc247488ec86e202bd6e7ea3a4fbf35aff09ce347053f6bb2d183a2649fd7b5cc483896f508673e132c450ea14c0b252a326744be7c794
TLSH
T117D09784149C276C0C184F06B0E02AC631684C3728B4685089508474CAFF9C84111966
MD5 SHA1 SHA512 TLSH

Submit Download

fe93dd10-6905-40eb-b04d-324b3f91f0c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\fe93dd10-6905-40eb-b04d-324b3f91f0c7
Size 883B
SHA256 03bcb2ff7db86387f2e00fd748d73048a837f280ee85d97429d3c224aa1e8480
MD5 32cf5c16ba2c11586bd9852d8ab23423
SHA1 7bfb84af09649ebc278da89585367a4bb17a26fa
SHA512 3a54a5017fa9c54cfaff9ae6d4cbe8d4b9ae604cafafa74b66b95c040c0e41a22920cc0abd22816e07eddcaf741851c6e8652dc9b1c6835186eb1d05aaa33b9c
TLSH
T132119C81A534B6F28C68C24BCA963B438AF4B523C0CA45103D615A181D7B51DA79674F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 6KB
SHA256 b4232815df7436a474b58bd3380927b47867b54db7718fc12e547101005d12e4
MD5 ae84405779e50b4afe439123ea84a3ce
SHA1 0023e0a672552b3d9c052087d3af8ff43fa1d3f2
SHA512 da0949cdfeefb4af447a52dac23cdf41b733a7ac4af31455e930c9b16e5b6cac712ec835bc55ababbd32ab4797ce8db7c3e23ba21e72b4856be0683bd16e3042
SSDEEP 96:xHPu5UTURy4qGqjyfDfsX41zSASSlQdv9j0jFntH+xiIgBw88H8L4cnKV1HBm:1u5hyTR2frg4BSStz+xi/Bw88vk
TLSH
T190E10E789508CB7F74B676ACAC688C716AB2013BB7BF68D610B95484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 6KB
SHA256 1ef602582753b8da0af813c80ed3cb2b69e20ab51601e1d1bf1f80bb62c7c58f
MD5 0e1ca21d747a70a3a8cbca61e22d5812
SHA1 2e6ce0f1c2a611b26f2824521370d28f17365bf0
SHA512 b25f675aea7182d856662b34aac1306f3f154b6b554f9336e1f3a187767ed106edaa429ef18d806939ac5f1fc0b47b2e0e798b0c3af47263ba6364a31f9fe34d
SSDEEP 96:xHPu5UTURy4qGqjyfDf4X1zSwcASSlQdv9j0jFntH+xiIgBw88H8L4cnKV1HBm:1u5hyTR2fr4XdcASStz+xi/Bw88vk
TLSH
T1B3E11D789508CB7F74B6776CAC688C716AB2013BBBBF68D210B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2972-711-0x0000023EA1540000-0x0000023EA2540000-memory.dmp

Download

memory/4716-166-0x000001DA04A70000-0x000001DA05A70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads