e4b6294b3edb902c667da70c0144381bd4850c0fee8bda1c211ceb87bed64bad

Analysis

user interaction
yes
max time kernel
88s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ransomware_clr_unhook_fixed.exe
Size 949KB
Sample260620-btnsfsdy8s
SHA256 e4b6294b3edb902c667da70c0144381bd4850c0fee8bda1c211ceb87bed64bad
MD5 8b3b66c1717ca521a86b18e7055b4506
SHA1 529f9a7f2042748d1b188414a0b6eb4a8e89f17e
SHA512 7bf5c3fef31fa05d547597b5648f8311b1a71eb88a36a881083b509cf134c7da5a000b4026f8cd0e2dcecdda64fef813752c4e0baa83c39c7d0eb61865734db2
SSDEEP 12288:Jo6RHFgfvYOLQlmGw1HnDXY/repKW4QsBZ8KMjBmDJBX:JvRHSvNLQlmGw1HDXY/rP3Mj6B
TLSH
T1E2252B1BE2A345E8C52FD0748796D772BE70B86A01347D6F1DA4E7321F20E609F5AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ransomware_clr_unhook_fixed.exe

Renames multiple (3383) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ransomware_clr_unhook_fixed.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	ransomware_clr_unhook_fixed.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	ransomware_clr_unhook_fixed.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\System32\\svchost.exe"	ransomware_clr_unhook_fixed.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2937465464-4167303362-2236413517-1000\desktop.ini	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\desktop.ini	ransomware_clr_unhook_fixed.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationUI.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ReachFramework.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationTypes.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\te_MASCULINE.pak	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XDocument.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.TypeConverter.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv.pak	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Console.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr_FEMININE.pak	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Json.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Xaml.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pl.pak	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationCore.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.Primitives.resources.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll	ransomware_clr_unhook_fixed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll	ransomware_clr_unhook_fixed.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5360	msedge.exe
2500	msedge.exe
5744	msedge.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263924589796635"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{20B6AEB9-81E0-4BA6-A0C4-F17F1AB16331}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{951755FA-EB3E-4F3D-BDB7-3F6FBFA38570}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5476	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3804	ransomware_clr_unhook_fixed.exe
3804	ransomware_clr_unhook_fixed.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5476	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeDebugPrivilege	2448	firefox.exe
Token: SeBackupPrivilege	5184	svchost.exe
Token: SeRestorePrivilege	5184	svchost.exe
Token: SeSecurityPrivilege	5184	svchost.exe
Token: SeTakeOwnershipPrivilege	5184	svchost.exe
Token: 35	5184	svchost.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe
5476	vlc.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
2448	firefox.exe
4940	OpenWith.exe
5476	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2448	1400	firefox.exe	101
PID 1400 wrote to memory of 2448	1400	firefox.exe	101
PID 2448 wrote to memory of 2536	2448	firefox.exe	102
PID 2448 wrote to memory of 2536	2448	firefox.exe	102
PID 2448 wrote to memory of 2536	2448	firefox.exe	102
PID 2448 wrote to memory of 2880	2448	firefox.exe	103
PID 2448 wrote to memory of 2880	2448	firefox.exe	103
PID 2448 wrote to memory of 2880	2448	firefox.exe	103
PID 2448 wrote to memory of 2880	2448	firefox.exe	103
PID 2448 wrote to memory of 4360	2448	firefox.exe	105
PID 2448 wrote to memory of 4360	2448	firefox.exe	105
PID 2448 wrote to memory of 4360	2448	firefox.exe	105
PID 2448 wrote to memory of 4360	2448	firefox.exe	105
PID 2448 wrote to memory of 5088	2448	firefox.exe	106
PID 2448 wrote to memory of 5088	2448	firefox.exe	106
PID 2448 wrote to memory of 5088	2448	firefox.exe	106
PID 2448 wrote to memory of 896	2448	firefox.exe	107
PID 2448 wrote to memory of 896	2448	firefox.exe	107
PID 2448 wrote to memory of 896	2448	firefox.exe	107
PID 2448 wrote to memory of 896	2448	firefox.exe	107
PID 2448 wrote to memory of 5652	2448	firefox.exe	108
PID 2448 wrote to memory of 5652	2448	firefox.exe	108
PID 2448 wrote to memory of 5652	2448	firefox.exe	108
PID 2448 wrote to memory of 5652	2448	firefox.exe	108
PID 2448 wrote to memory of 5812	2448	firefox.exe	109
PID 2448 wrote to memory of 5812	2448	firefox.exe	109
PID 2448 wrote to memory of 5812	2448	firefox.exe	109
PID 2448 wrote to memory of 5812	2448	firefox.exe	109
PID 2448 wrote to memory of 5916	2448	firefox.exe	110
PID 2448 wrote to memory of 5916	2448	firefox.exe	110
PID 2448 wrote to memory of 5916	2448	firefox.exe	110
PID 2448 wrote to memory of 5916	2448	firefox.exe	110
PID 2448 wrote to memory of 5924	2448	firefox.exe	111
PID 2448 wrote to memory of 5924	2448	firefox.exe	111
PID 2448 wrote to memory of 5924	2448	firefox.exe	111
PID 2448 wrote to memory of 5924	2448	firefox.exe	111
PID 2448 wrote to memory of 5472	2448	firefox.exe	115
PID 2448 wrote to memory of 5472	2448	firefox.exe	115
PID 2448 wrote to memory of 5472	2448	firefox.exe	115
PID 2448 wrote to memory of 5472	2448	firefox.exe	115
PID 956 wrote to memory of 3408	956	msedge.exe	118
PID 3408 wrote to memory of 4220	3408	msedge.exe	119
PID 3408 wrote to memory of 5360	3408	msedge.exe	120
PID 3408 wrote to memory of 5368	3408	msedge.exe	121
PID 3408 wrote to memory of 5368	3408	msedge.exe	121
PID 3408 wrote to memory of 5368	3408	msedge.exe	121
PID 3408 wrote to memory of 5448	3408	msedge.exe	122
PID 3408 wrote to memory of 5448	3408	msedge.exe	122
PID 3408 wrote to memory of 5876	3408	msedge.exe	123
PID 3408 wrote to memory of 5140	3408	msedge.exe	124
PID 3408 wrote to memory of 5876	3408	msedge.exe	123
PID 3408 wrote to memory of 5876	3408	msedge.exe	123
PID 3408 wrote to memory of 5140	3408	msedge.exe	124
PID 3408 wrote to memory of 5140	3408	msedge.exe	124
PID 3408 wrote to memory of 1264	3408	msedge.exe	126
PID 3408 wrote to memory of 1264	3408	msedge.exe	126
PID 3408 wrote to memory of 1264	3408	msedge.exe	126
PID 3408 wrote to memory of 5848	3408	msedge.exe	127
PID 3408 wrote to memory of 5848	3408	msedge.exe	127
PID 3408 wrote to memory of 5848	3408	msedge.exe	127
PID 3408 wrote to memory of 3988	3408	msedge.exe	128
PID 3408 wrote to memory of 3988	3408	msedge.exe	128
PID 3408 wrote to memory of 3988	3408	msedge.exe	128
PID 3408 wrote to memory of 6004	3408	msedge.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ransomware_clr_unhook_fixed.exe
"C:\Users\Admin\AppData\Local\Temp\ransomware_clr_unhook_fixed.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
1⤵
PID:736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {512fe527-dc51-4636-9cab-948039c6255d} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27135 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {0a1c1944-51c9-4aa7-b707-3aa90fea0bde} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27276 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {4305b5ba-fad7-439f-86f6-18bfb928b063} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3980 -prefsLen 27276 -prefMapHandle 3984 -prefMapSize 270279 -ipcHandle 3788 -initialChannelId {6980e251-5e4b-40dc-8b3c-ba28df1e1047} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2648 -prefsLen 34775 -prefMapHandle 2840 -prefMapSize 270279 -jsInitHandle 3224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2932 -initialChannelId {e98e1640-72c0-4192-bcc2-b2126abdab5b} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 35012 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 4972 -initialChannelId {b4d86173-0b4d-488c-bb70-944d9f62a8eb} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5216 -prefsLen 32900 -prefMapHandle 5220 -prefMapSize 270279 -jsInitHandle 5224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5232 -initialChannelId {012dd330-42da-45ad-ab0b-f4e5c62ca250} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 32952 -prefMapHandle 3176 -prefMapSize 270279 -jsInitHandle 5132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5432 -initialChannelId {21b305c2-fa7c-4d41-9787-5d72b10a077d} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2800 -prefsLen 32952 -prefMapHandle 5448 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5424 -initialChannelId {6f31ae32-4580-49b4-b64c-c28fb6a5d8a9} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6368 -prefsLen 33071 -prefMapHandle 6372 -prefMapSize 270279 -jsInitHandle 6376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {9040c396-21ce-46d3-a7e7-88f1e85d3ad9} -parentPid 2448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\MountMerge.mhtml
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\MountMerge.mhtml
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffbf385c188,0x7ffbf385c194,0x7ffbf385c1a0
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,9710246328643120792,13248565462805377290,524288 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,441607747234896685,15040680926072502294,262144 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,11025025256878082167,5501667000770866983,524288 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,6589031188894134617,12903905870143619782,2097152 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,11988892981154032353,4417009973820461452,2097152 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,6198690107646443485,9958334559618396591,2097152 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,8183722635024893966,13180776241862740333,2097152 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4624,i,1430457154301777509,9606267987688239378,2097152 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,2328285423342797292,15387646523086858260,524288 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,13443507068870382614,11658888125874301133,524288 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,15627016943348517129,8544146613552558063,524288 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,13801294713555970035,10881949928273608436,524288 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11056865761788227406,10443245424924255437,524288 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11056865761788227406,10443245424924255437,524288 --field-trial-handle=2092,i,12460994743918623412,13312683621556627371,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:5720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5896

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WaitSync.mpa"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5476

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\PublishExit.xlsx"
1⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\MountMerge.mhtml
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffbf385c188,0x7ffbf385c194,0x7ffbf385c1a0
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,1590586856759188491,15220131738560442883,524288 --field-trial-handle=2272,i,4509274566809028595,13326181858130803706,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,7652302419517933192,15911683149500867563,262144 --field-trial-handle=2272,i,4509274566809028595,13326181858130803706,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,8221702848838780757,8926929395857288647,524288 --field-trial-handle=2272,i,4509274566809028595,13326181858130803706,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,12520360117985054069,10482077652784327630,2097152 --field-trial-handle=2272,i,4509274566809028595,13326181858130803706,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,7276339353863188095,11812442678419019053,2097152 --field-trial-handle=2272,i,4509274566809028595,13326181858130803706,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4860,i,8644898899637793728,8874914276714770412,2097152 --field-trial-handle=2272,i,4509274566809028595,13326181858130803706,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,8838784409773888701,13376764813650115108,524288 --field-trial-handle=2272,i,4509274566809028595,13326181858130803706,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,13657199882473977936,16545737030266376764,524288 --field-trial-handle=2272,i,4509274566809028595,13326181858130803706,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf385c188,0x7ffbf385c194,0x7ffbf385c1a0
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,3048753498466727073,10284500141224835357,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,11167365803885177773,6708664125092180163,262144 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,13035024393736908059,2012586977737449589,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,6608338249183638834,8164868574534272334,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,6608338249183638834,8164868574534272334,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,13300088213531120222,5827585976959519097,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,8293487548828745056,8277291656239588830,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,11667270941889277159,13101030561334833005,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,2682987936843181577,15959305466671274641,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,11091189340379772671,8946718448691687746,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,4903871631079889669,8404706118852976140,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,16897180718485249329,1560849180506043533,524288 --field-trial-handle=2280,i,4628264217928201904,13537072660932148865,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
    3⤵
    PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-2937465464-4167303362-2236413517-1000\desktop.ini
Size 129B
SHA256 25a279f17436714951e12caecd154eb81e678b5854c082c5a2150ea36f6d278d
MD5 28e6b2df97b7ac445b4bf6d81a7095a9
SHA1 73f3c0f03e634d855288871a1cd8dfbe4dd2edfa
SHA512 ae8952332f4cb221db48941345ef4d9a84663f8b2f75aa9b1ef9d58cb05be1480b920d39021f6eedd287d42b7635bbd92adde796dddc3b9a56f3d228ce17d681
TLSH
T1A5B02B455A24BA2C20041800DC2290B7D0B001838040E879800935080053A138814E59
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b6d8c64d8e97ecfc76342a3c858f5bb749da32c4c28cfeabd0d866e02582b875
MD5 9c1591e231acaefe40ac175eacdf5efa
SHA1 653d18a9990449023b8cf9d11120b95cfc5a9d28
SHA512 e658c4736f654bef65921f316c59107b6592a2fb2fd0c812f8d34fb673313044a7b9d369b87fb8df539d5b46e8aa6f1001979795f05697c08e57ee56c204a6e9
TLSH
T1CCD08020795CF4C1D214017592104F403B2955923157920EF2154C1D9CB40C197D5FC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e747f5142dae1693cda55d8da95926955e848729b03326d61639849a3b95977
MD5 e79da88006327dbda754451669155362
SHA1 9e29516bb1aec594bdd68e878921be59512c066f
SHA512 dcbddbf3c936fc58f7e59699cd8be681f0cc9824d956d7eeb21e14af6dbe3d60d6c85bf9437346bc629c377371718f4221762b7610f9a3b1b9794684ca085897
TLSH
T14BD080207D5CF4C1D2140175D6104F403B2955D23157920EF2154C1D9CB40C197D5FC2
MD5 SHA1 SHA512 TLSH

Submit Download

485b77fa-0dee-4ac6-9a28-847f885402c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\485b77fa-0dee-4ac6-9a28-847f885402c6.tmp
Size 414B
SHA256 d7c34d2c3ba40ad74f2a467aab286e9991164415956aa9e69b8a1d1dc5dd1420
MD5 6d895ad0a16e9168896f306912a2bbfc
SHA1 7af1fd87d38be4ef3f935d1112fc616bd35922c1
SHA512 464db9869e40d8f4f635b172e9c89737d94f0f3085932ddd1932c384883af466fd8ce514e57ee4b481a242758f1294abd074e0a296df7e20b388d2de646af308
TLSH
T1B5E02B99CE759C3708FD0B1D65648749EA1113573B408E5F3A3C92088F7563E0685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e21c3c3bea9de620238265e806e422e7573d9388c870662b79908ba9e147246c
MD5 f6dc918b541e7a5215664fdd1611e6ce
SHA1 41099ba0ab0d50760fec63554ed2b33246bb405f
SHA512 19c8543cc3983808d54d3d2d8ef77962573214d671d19c750758a279644b8885619ba62bb143b8680aa878453dec77069500bdab578e6982f86573988e5f00e0
SSDEEP 384:nWKO1V+H3BuSnn6sOPWnu8mtgS5qXWMA:nWKO1V+XBueOPoVgg+KWR
TLSH
T1E113923E36180D2BDAF6467DC8AB1AB11738D2A5D4C02F0B3332358D5A1E71AF97E105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bc11558ab9fd0cc48d3796125b11bbf03e03650a64c2ec0c73393f8f10f95682
MD5 c4c14da0e15d2ca1f8337514c23f5c63
SHA1 66a78480223c458e5e5af5bb2b4328f484ec1c86
SHA512 16a4f21ff1cae2cc04069b1bc0d9aeb334a44a15e902f90361b10f3628f1ab011c7cbcd20050fa76d89f916d283bd7d8889613e69bc31a44ab66742c856ee76b
SSDEEP 1536:jtknzXvYJRL/9SJL/KsuLS73k3UV5L/VL/p:jlRL/6L/n7+GL/VL/
TLSH
T179440CF70941A01BCFA812F5E2133E3DD17B465D6CD1F9E9E2784CC52825B22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 54bc9fd963815e9a6166d57a2845dffa162e3ed5058ff9f87772c76d84c32fcc
MD5 90856e6d30bae5077dda32c9f1584357
SHA1 6b86ff5f7664cad75318f51e6952d58f15512f9e
SHA512 ad96e7981b1eca222e2c0a16711ef025664e59ed7dbc34da83ebb24121139ee78fb38a84e32dfdd9499f6fd918e7d838f42ecd9e08bb678a4a550981114f3b07
SSDEEP 24576:AyoolcYM1qMG7u0E/H2UTox9Xcsn+06UguO7s/TJMDQTVNkoOz9:A9Y6FG7uUxSsn+KzKs/ThTPkoOz
TLSH
T16A167DEDCA6898C3CD639970B0F0E9477C7413C3F5A5C1D68898C684026B7C5BBAB769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 715a69a29570804362e1dabf547f030e622361a285f3444bbba4583bc7c8425a
MD5 767df0d44ef64a58d173d8555a3f5828
SHA1 a40bed0ad84524a14ac42f10317fabd0e47362d8
SHA512 046b2dcae8803aa2bb973d16bc9c3efcf7574e949a9902c9cd8ce30f29a23f918ef36eb17fa742cd4db81462591242519fcbe30739d3d05c782aa002b272debb
TLSH
T10561F7408E4A4501FF211237D4D21314F87042B93A936EEA426E8BBF440EB65FD3FA0B
MD5 SHA1 SHA512 TLSH

Submit Download

d09f103c-42d2-4ff8-ad62-c06908a95492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d09f103c-42d2-4ff8-ad62-c06908a95492.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e2e205d65774e36bc017fd0c3151f4095e33fad4535ac3893298548ce090f5e8
MD5 8bebf4dcb1dd0ccd16197ace0fe43adc
SHA1 e7226c0d7e52f1e36b709fcd1b0791cef8566efd
SHA512 a12bc40b58ff39da00aef9b3db4abf132eb75424c77cdd28e195388af7ef084441c4302b02fc7f644e028f2dde8c84117cb5591a504f368dc4ffb5e9fedae31d
TLSH
T114E07DA455CCE339D01C68B7C76CC70D87F0380AFA883E4E174E98447101341F2C6290
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 1255edd4e28e6a475fd81b9e00f5f6746e85d468e3743768a6db5ae2dd30e541
MD5 eb30c7a8f8e5ca5f689e09167fc605ce
SHA1 a102854425a6e34e81408979dbd2ae20fc59ee37
SHA512 1b2eac37943844274aecd06ffc7ee84a473cd4dce161e60d1e2d767493aff8ab77b0cf956a60807783659824eb327ae7ee546f6b7d50a67350f794f9f7544dec
SSDEEP 96:ncIU+bGz83uy3+u4tgp4DLjGQLBze9z38jBHMsDEuspU0wbtqrOQpPfR4J+MCXkW:ncf+G83uy3Ct7XBBKYH7DXspU3iV
TLSH
T18D14220E4F243721CDBD917669E744B35D7CF03FCB5266DA686104B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 1657014a1151466f32704d1049920afda7ee4e181b77bd93d28aaa0f22c257bd
MD5 578daeb4472342fe7cfcaadb2cf1e246
SHA1 4212efb1c9513f7aec72089514c93bbfd6a50165
SHA512 a25227c570dd258c41fecaa92be36edea90173b5ad1b82dbf7599b1aedeefae2d2dd89ff2a32f1e4b7725069faae83b0f117ac5939699094c9738540eb9a5577
TLSH
T1CFE020B099DDF27D92496047422D6B0CC7B0340ED6893E451B0DB8C5B001104E7D11D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 a303a75fa74b0faa70bd62a83e152d8baae83ab317b81a0b490c3e41ac7c4bc3
MD5 5c34557f63a89d5ec2f145f11fae4f5f
SHA1 72c76d2e0acee609867fab2d5df86234b603a094
SHA512 b0d8b426805ff5de99f24fe6611f8ab55b7ca850453f18b343f9dddf753e30dfae7a5c7a68c38509e752a426256746dfb4419db2f72d058e733044cb51e6418a
SSDEEP 48:TtLopFMatSaw/auUOt8BMo0wAccpnIgneHp8IbAwH:9eMatUaAKyhFnehbAA
TLSH
T173920C4E5F346222D0B44B76EDD485A32E7C212CC3633A599E5860F3CE9299BB5060AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c587e25385e5b627ac898a837208019dbc5b63841b308b704b30b7852a49895f
MD5 849aca6323bc224a1e43ee732275d803
SHA1 c3edd83843cfa10dc24e020e1e90d6065f21d0a7
SHA512 01705277efbdd8e893c43c4d2ae250c2c62ba397a789716310449cc70d4323bb9c64057e889351030682a6d86ac5aed6a43fc87594f5ecb184bcfa881706aa0d
TLSH
T1C72168F7C2E88A7D891156F4BB146F1BCE2D096553293C1AD5E8AF1F93E2860A14085E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 458920ba86f695846a41cdeb07f125bf898e6125af82702dbed9f38495a2cdb7
MD5 8649019235760e050b864e70f18a669c
SHA1 57ac1cabaa028d8b8bcfe8b13253bf11fb486ad4
SHA512 ccb7d7e77c5cdbcd6580a58d5e16c8ec5457b40263c96165866a4380eb1131b8ed849ab7e16ab197708ee8ea320645ef491d0ecad74b8fb77cc1a4a0a4e0b682
TLSH
T1712168F7C2E88A7D890156F4BB146F1BCE2E095453293D1BD5E8AF1F93E2860E14085E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 5a81e01453836371b184a2b3b9e16be7f350c9b8b64fd13d25287b188feb1417
MD5 ca3dc9814240459f1e50eaf1ddc872e7
SHA1 846e64f2df6fe207759c6d5b56fb4d923ac49cce
SHA512 a5166719899cea3d9b19e7fbd0515a65a46b06c7ce66bf28bb0f71684d1eed5120c0af46dd6a966a2effa862d7c6f0e3ae26e8b38e792bb7d533a9c6f3cd64fd
SSDEEP 96:OIEumQv8m1ccnvSmfYMkGf5nFXPMEKx4g:OIEumQv8m1ccnvSao
TLSH
T14FF2DDFB07236106D99444B0E400AFCEAF16010B47B6B6EC76D447E3F7A21E2B5B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 a60275cab1fe7f23f069947df5e2290cc3a28a7d898891744e5169a9eabceda4
MD5 d9661255ff445bc7c39d139383052605
SHA1 98c4a222bdc8318193ebdfc172bb77d6a74c3356
SHA512 f8e64a795b51298904f19efedc6da72d60c910be5e4828d6b1ca956e3e4d47677e8f8209eabe702de3a579cc84d98d3b15a08b8d83d7dece55f89a5ce49a31b7
TLSH
T1C6C0221A80F9F0372034163D5DC07882AA38D830001264E0C8D7933CB0901FB6B0602A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b7bd4d5d9eda3ec8e7142baeb6477875f776b7ccded49f546b88b92539ea8fe8
MD5 871298984cca31d8eb81730424b420d6
SHA1 0f0568efbf1e12d9d48354ac4a62eb6ddcfe3f89
SHA512 17cc8f80a3e2e562e82c9a4bec412caf7af479d7f20877515aa10ddb167f4fac5578a54c2bb419e961075c31d5118464d57dd969c3fa594aff57f1315320b70c
SSDEEP 192:sxZJRDjr/fIsvWpV0lAEdpd9HW6+WNGYLO9kIgEJ:sxZJVr/fIsvWv0lHrHbGII
TLSH
T16222A6526E38683B8CC7D21DFB65BF13E6F91022A1951E58A6FC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 29eed811688316242e9874a3a88d3748ea03e62067080d057c584776912b2669
MD5 4f4f219f2dd401d16c8fedefeb0d156b
SHA1 a932caa4e83ecc4d84279755d122a38c301f2cfc
SHA512 e6fe75a00556e1abf2e6c911d5de1de8cc5bfb24b80d0911e9f7d2d51a2a8ee4aef23a4326834ff7719e723fe7fdf48e21340ce641fd110a46a41176939374bc
SSDEEP 192:sxZJRrjr/fIspWpVWqAzkdpduHW6+WNGYLcUrkIgEJ:sxZJ9r/fIspWvWqN8HbGA0I
TLSH
T1E932A7126E38A83B8CC7D61DFB65BF53E6F91032A1951E58A6FC861C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5e805ae9aa3719df2509c45e1b5a5bd39e0821a9e8a89c0071c72fc1079e4ae7
MD5 49dae77a78c759e8c0402b7176200a40
SHA1 6511ebc009e6a1fa459d5f58b69c4590c7a005f8
SHA512 7af07baa63d19eb1d7f5b80c1fb3b8dc45eebb0bc47f9d107beb1dd93b53710a29d76b16a32384f1656d73dd5ef2c2afcb307ae7640612b6a140571296ac80cd
SSDEEP 192:sxZJRrjr/fIsCWpVWjPnU6nzkdpduHW6+WNGYLfeveIgyJ:sxZJ9r/fIsCWvWj/U6A8HbGzeO
TLSH
T13632D9156E38983B8CC7D61DFB65BF53E6F9102261951E48A6FC861C05EBADD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 076e50feb626fe2f11d2363a4fda4403d6b401a85314f2acf9400fffff80dd73
MD5 3ab3f297f80b82cd7acdf014e1c7afd6
SHA1 bd82b173a3382b10fc9060b42ee353cb7d533134
SHA512 2ad1550d6c8973ae7b44301eee393c859ca5c59e29de921ac891659927644b52ba304407ef78d8e35db14c5b314c652acffa9876a20961f6089df898fe9048bd
SSDEEP 768:tEEuO6fE1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5ILlWwJvEMroDG:KNO6fE1Wvxz3ju1jaOILIsvuDG
TLSH
T117C2E83B244DCB7E4F801A9D9C5A6F973E9802C7AB588D8487FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 a31e93c5710f07d022162b221eefa28621be558ff8407918b0847ff904756e64
MD5 81c7cc5eda3c9ab1b78ed38c8fb8d7e9
SHA1 a56ee75bc18e385add5be467171067369f6c1f7d
SHA512 6cf800e306c9d04a5a87b7c8ce45c5472f72255522d64a559178849cdebdecc14c4a3f7fa5dca648ce1bcad1af84105d87a96b691355154ca2edfe9f898e1491
TLSH
T1C6E026E055E8D27EA11970430634C70CC3F4B40FDFCA3D472F8DD8846142A08F1E2190
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 523B
SHA256 066911d93f53eed74dc1d0e006ae9665a0d74f515c400de108821febce6970c0
MD5 c9e7055971a91d0a5e8e10e56a6a6f0f
SHA1 ad64acac94b6e1fb528f137396cffd284b1fba99
SHA512 a0eec8e8bbd106f00da9e4a46bd510b68fc203fabd254806929275e7d6a29452c452c15cae2af78d3d7ebce35cc05d044c82d93a1f5e1f4d7b6c474e91f0412b
TLSH
T120F05CE75B09D454CD8EC5B0088237E1A7F3D2CC0784CDCA470E44A74D026317A1309B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 e3af2d2c20d884fa4476cd98ec3c0b381e3854838470e653b4e6cc6aa76a1f13
MD5 cbefb8812122a58f34c31a1818c6c163
SHA1 be27b1d2c30f24d4f60f4d790c12886b4d343c73
SHA512 fc64631cbe04619d1aaf413d93fd7db05da38005e5a423cdf00b14a50aea39a68429722170b56d3332d1332feba40ee28ab020e5d96a7bbeea99dd2aae78be3a
TLSH
T1FCE026F49DC8D23E9212A457023A530CC3F1740AE3882D4A170AD8947201205F3E21A1
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13426392441771614

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13426392441771614
Size 897B
SHA256 a7b10e40446bfacf336dcf81158ca08bb817c2f566e409e9c86b5547567a56f0
MD5 94930487b893f11df428293e1e004dfa
SHA1 4c48efefbfcd3f673da5a0350b10df2c9609a7a1
SHA512 e7c1be61b1f58450f80486b6715704904eee1e543032556d087237c14424fc9a1b7ada6ffab9244dec1512597e80b26602e1bae37047d6d8356b77235527e51c
TLSH
T131118B5AC4A612BFC27E803EE0F744FBA930BD257B404C0780B27F000826BA26E65D89
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 bb2d723831d1d5dd4198ae4404256209beead83006b7451694378df6ed6a8c87
MD5 b778c5efabaab858818ad29b7c83c8a4
SHA1 ccfe1252a835bc4763d430162b5ff06f5406ca4e
SHA512 c3aa4cd504d81078d49f3ac28c40d215e4bb66e18e684a89c626857fd84952e04dede30a5392c72459b29ad8427f7a2e5b2cb227bbfa6d072a3635ffdacaa36d
TLSH
T111E020B065CACB3FE14530C74274E30DC1F2F40AD6C929576F0DE4547206A44FAD3150
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 404e1e6928ee81307c44d325bde8efb7cc93f22df7ede8d91fe47a2f7ad9b430
MD5 200af96c391718fc0807dfba47097144
SHA1 b6e51cba122cf7fdb7f964fc73b7c80523d87c5d
SHA512 104f732224749c4eedc9ce35f041323f699ab2b567668f0958968c0c30fb896297378e62f7147919bb8797150a0413a41f11e2d1f3ab32e7a97f01e7c938dffc
TLSH
T1E4E086B096E9D739950474834678970E86F1B80ED7C93B8B570C5444E146A44F6F7690
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7440c415642131fc692821d458e0fc7781c378f87b47c02e10684cccb2021b02
MD5 87651df4699dbf292a526e3f55e0a28a
SHA1 fb7a1951283cdb46c943733d9cba81a393e5d066
SHA512 22d69e9f62f6b1ac6c2173b697807962b8f7f764614b5d1bda164f4c7685dd354ffea0ce4037f43d195fad29c94bc41eb7cbb50e2f931616fea29d78a90a6af0
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyZSI/KL6AXypGIPKTy0PyBsIXKZ28w:KUAAKtePKSsKL6C6GQKTyWSs4KZ2L
TLSH
T124C1161336BA03026D3E29089655D7279E467563702DA42B7FEE40B21DA7E208EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 021b17802607d1919449d35bc31748d6cb16cc9de071957f9194aa167aa8086a
MD5 f30da380e4e52d28eeec60a2ce212c90
SHA1 ade237a2056d797de9db22144d314ed6ea60dc74
SHA512 d00d6173979560429a6bd66c54341647cf1ac02a9e150ad50b93460346c9dac3e3e4083b7bd736199c855a4afaf9447690097a47ad9d5092452415e0e024a677
SSDEEP 192:/+5WWEsGafT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:W5t8afQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T11F24630A7B747001EDE6DD725CB080771A3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 88KB
SHA256 afc23de21a9227a05bc9bbfee76d03ec56032750896f1cfd57ed4cb313b130d5
MD5 e6baf59e4de4490ce8ce4069aa5f1d55
SHA1 bfa2587c0fdc36076318843ca08fb72f1fab936b
SHA512 f43f72e20c237ce29729e435bf5f26e278416c74aea397d0f6d10b39357190b56a5dca3b17977ad17993c01f0ce85307b5e98108807f09869397b58939eff243
SSDEEP 768:VUcSdwT2jYHUHqVILOZM+tOQzHtqabz3+acIAUAbE07hmUXMxazGQjb9NXHMMmql:4GYmSjv7zylUk4WRHDo
TLSH
T1BF930DF7AC0E91AACECD91B9D41BEF48447316618620D8E5E93C08C33B7960BBD765C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 78be8d006be59f2934e84a62dbe0aec503ef978ff319edb05b10917d04f90a51
MD5 310a624027fa85d62984a78cf9d001b6
SHA1 bfc59dd580aefefacce874cf74066db0f61911d4
SHA512 5dbeb0c7685254caf659efdb7ffac543f67046f015a477d0c2e23fcdcbc65bfbf8baa6e35342b53ce1655b8915901a17ed6a2c6c73c61c4a23c6130183bcc16b
SSDEEP 192:qQXIIImbGMIMslYcY3MOm3iAs0lrw6ss7Z:qQXIIImbGMIMuBmm3bsews
TLSH
T13B42836A1A052B7FE59E6F761252C5485ED88C814970226D31A12C0F8DF3FA783E63F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 7f8ff03b490f1621784df35ba5c7e278f9b5a2b2018d623434a61d767ea19f25
MD5 3ba58bc8cdcfc60cfcd59d04b6525938
SHA1 bbd7fcaf3108dbce3d8690e2120cb6e9dfc03101
SHA512 0e9e70f7f882d49e931553f7803ed0e05eaaefdaff26e47350cffebcc21dfc2a6a2805d07f2eca49a04ecf4116d1207fed518a7c2ceefa10d61df87a8b22130b
TLSH
T1DEE026E4FAC8C27EE15424871A25430CC3A03C0FEA9A2E8B1F09C48CB402200F6CB191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 05f4d8f225aa7e60d151ed337e97a9a05104a5dd987046e85419c53e1e1e164f
MD5 29872438cc700ad1c27e7e811031e759
SHA1 66511a0fe28cf4cc4d547b06bb33ecc73981779e
SHA512 3ef5cdea6df5fbaf6de3ffc905d84d09bfcc4a2729ba55410d9811ea32e68565808ca9c00cb7dac201807a8c2ac34a7fb824844afee7e52a15a31872243f3e91
TLSH
T16121F566F338C149D2458A3A243EAB251334E8128FFCED1F017620242E73A450E4B2EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 7bcbe29d49c99c8adbee30497aa9b13d6ff16057ce265482b88edc8017a6b7c3
MD5 bd5d1e178294dcbae9a41bcb6b2731ee
SHA1 596e3efb9297844ba5535f174659269b41416514
SHA512 95617c0b07b4e38eb5ec81db349859a13d0a93fa89df9647217d83352e2e9a4e893a4d1a508ed3141e40f11982cbe8c54f967ff99389c0d15f328a6a55c2ad16
TLSH
T11AE026A0FCC8EABFD01920870164E74C82E1BC0FEE882E4E1F09CD48B101289F6CE191
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 b125771c47c52729cb34006b7ff53f5017e23314987352c6d5d9077709625ff7
MD5 27eac2bba4f84a08ed141d73ded363b2
SHA1 20be5a6256109a838c0f7a73dcd3344ed6cf01a0
SHA512 df7eb70e24766fd5c7a1c38f3d2b43bb95e00401860c63338e5f39da08393cb789fb644c955b54e058082f787cff03fbe22fc16d703c4254b746b27682267d4b
SSDEEP 384:zG3sNTL3A/foboa95O0MWv/EyL7iA8+Lo4yK6m3k9JiZrF7IzX:y3+A6x/OOv/XLp87jK6m3k9J1
TLSH
T1FD722970A8A88CFB48D6E5C9B586E6536EB40077C98D1E4CD5F8BA3D309F6F81357806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6e311b627110f04ca4c08abfe3ca1b59aa3683c776331240eb4f5a0c89f4a9a3
MD5 9f6f87bddff08010a6309b9de1362934
SHA1 653fd7c2a410fd8efdeb5f6644e34fdd45148d08
SHA512 1372e024abfc8032853c9377522e59f4ce5a45ebb0e199da6f07d875baf1f7b522e1dfcc291b53c9304e0822c4bd9d2668447681b48f9fc393b6bcafc69a7937
SSDEEP 192:qONY6O7+3hQmiUyS2Gttb0UO2rh26gGuuSU6:qONY61EGt95O0M8IU6
TLSH
T12502E8356C386CB79EF3AE45B68727275FA5112BE9952F40D6E81F0C00DB65C2346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 55b6f556ed3e078743cdea348cd6b1bb25290f5affcbd70e92729fb680d659a0
MD5 150f60909e2be1c8e1d91720165970a8
SHA1 fafa3914a5e215509503aab7b88fb3f5c9f86199
SHA512 4abf75d4dba85bf60fdbf5316651e7f75518eb07525f3a3e540f6fdb353de45798e656d9a2dad9309b55a295819c1f82c7730e25cc0c7a33b0446188ffa48c4c
SSDEEP 384:nMtNn/s3n9Sb3sN+j3A/fo6oa95O0MWv/E0kJiZrF7Iz51x9E:Mj+9m31A5x/OOv/ZkJr1vE
TLSH
T1DB725B312D38ADA799E39D4AFA8B6B175FB400AB95C52E84D9E85F0D00CB79C1347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 30a7215129b767e468d1606e20246b1f92a1f320e1506978636122dcedd6ae2a
MD5 8d9c529382449f8b8cbd9b36e7e29427
SHA1 1c6f3fe4a88e2f6d0807b50bd49dfeb6935ecb49
SHA512 24d08af47cb0bf694f133c738f920f241e8de674d8c758c0c3f00fcb630b89d42bd99609f04aaf45b126e5d0d38b8580d000efc8c5d73552a416f377c6af4c96
SSDEEP 384:zGsNT03A/5Moroa95O0MWv/E53BJiZrF7Izg:aHAvx/OOv/8BJa
TLSH
T1E15229326C789CA75DE3A545FA8B26035EB540679A892E84C5EC6F0C01EB7DC234BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 f9e49b4d001cb00656566d0783aeed2d1136ca52034e09bbe2608f66c82b5da5
MD5 fdf881869858ed1150e2d03921bf2b09
SHA1 1528656d7ac1d77b19a845aba2fb7d8ab6ea3e61
SHA512 bc5485188645efbabe434dd7b3f7841792cf5e1cc27cee3ceac40745887cb466f0b13ec6248bbc8a2c3ef7b87c94524d4a11834858639df417ebb2a1214175ea
SSDEEP 384:zGsNi03A/5Mpnoa95O0MWv/E5NP3A8t6IfoHyK6m3khhJiZB:ayAax/OOv/GI84SK6m3khhJ8
TLSH
T11D720771E8A89CFB48A2E5C5A986E5036E744077D98D2E4CC5F9BA3C30DF6F81356C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f547bac55442c6f94a6f62ed7e6729197616cfcf5f03ccb760f6400779046a0d
MD5 4ffb30d6258d255511da0101cd38c1a0
SHA1 78ef5602e093c2669be980e940e2366e6f097682
SHA512 983904b9e074c9925fcfe8519e7273e007a165de89b4f0f0f5ee661083dee3d5f286971929af91425e84565e38c653daa480bf993fb4a66c8c492f269074d40f
SSDEEP 192:IONz6O7+3MQmiUymS2Yttb0UO2rh2Wv8EsZPcNPq/KU6:IONz6SnbYt95O0MWv/EMdU6
TLSH
T1F312EA3268789C775EE3A545F98736175FA54127EA8A2F80D5DC2E0C01EF69C234AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 e014800e91c970da2e03243597770270a7ac41168eed47c7c32b02524ab0d204
MD5 8ff045c5a15da438d5ca79c041bdffa5
SHA1 08a7b4d642a9a0025b68555249c9cf458b7caaa5
SHA512 31f494d037bc99fa465daaff5e058d000e67af4f48d4c154816a20b2530963a64c5d57cb6a9c8ee5d5f34421a10082d9c42fd8c17e5bb38773d1d6f4d0a57eeb
SSDEEP 384:zGsNi03A/5Monoa95O0MWv/E5NP3A8t6IfoHyK6m3khhJiZB:ayAzx/OOv/GI84SK6m3khhJ8
TLSH
T19C720771E8A89CFB48A2E5C5A986E1136E744077D98D2E4CC5F8BA3C30DF6F81356C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 fadd5c965ee06073a49c2f17e2020532292807ce4c72634b67baf9d6fdc9794b
MD5 ef5605c65684b9c2a392c83c327f27fe
SHA1 72b604e6820399e2d45cf103783fe2123bec0313
SHA512 e1b1fd4f31d0ceae2637a077c0f4d3cb05dd5771488f4cd5a3b6e0f33b0f30c20788ee98cce152547b110aa0ce6e7dd1403138988bf1722cbd722a8b3ed00796
SSDEEP 384:zG3sN+L3A/fo2oa95O0MWv/E0kJiZrF7IzX:y3hA3x/OOv/ZkJ1
TLSH
T11E5229316C389CA799E3AE46FA8B26135FB4006799951E54D9D85F0D00CB7D82347C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

d741ee4f-eb2a-4d39-8903-7f8c85ccfe1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d741ee4f-eb2a-4d39-8903-7f8c85ccfe1a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e04475d96a647d7e917036305ecf8310fe3205ca035ec1019b487116fec302b
MD5 f7c5b63c80f0cbfa54ec7a3fab4bc773
SHA1 72d37501c83bb5812c76c0b5673f6dfb5bfa2f01
SHA512 fb49c1abad743b11dcd629b3b4d26f96bc60b71ec53134d4970dcd032616313d679ed0d6fb099e53124cea23e57a6cd78a8fd73e0a26ea24b42f261da3328cfa
TLSH
T11C416C98B6F91148F3B76E5A5BF6686D487F7D372E0AD45D00110E4E4A62B40C861733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 5aff08caf218d3656c45bb284385e8449c5f5074447c05b15f6369b975f14493
MD5 f10f6edc78e547e340cbb0f02d98a728
SHA1 ab85a5533b65ad6217912f35e529727e2e12c0bf
SHA512 148447104199ea5ce1afcfb3e1dade44a5db764614654aa926a23b1cd376d47ed43b2002c688da7a383413caaa9bed448ac4857a9e87027410ddc3e3a3c10d96
TLSH
T183512D5C69EA11597373AF56ABFAB46E487BBC372E07945E10110E0F4A23B40D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

07218d98-3b55-4f44-adbb-3cfb18e560ab.tmp

Path C:\Users\Admin\AppData\Local\Temp\07218d98-3b55-4f44-adbb-3cfb18e560ab.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6431ac3-136d-4578-a7a6-33c09aa432bc.tmp

Path C:\Users\Admin\AppData\Local\Temp\c6431ac3-136d-4578-a7a6-33c09aa432bc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

aa5977c1-8a3e-4f9b-baea-f2abea0cc638.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3408_1438394082\aa5977c1-8a3e-4f9b-baea-f2abea0cc638.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3744_627170765\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
Size 10KB
SHA256 acd4a2c93f68469aad3148ad9cdff6ccab54a68a3b413893b0d2160534108713
MD5 df6d24d0ea0724454d06e5a901eb428a
SHA1 00b1c6c1389416e21403a1a17447c105cd6a7e3d
SHA512 812246f7f3aa2dcaef6452749fb16d806cb6985c998f7f2c7e7c47c4ce79d087888abf1db29799b252ed6904dadc5c12501b964bdfeaf332b4bf91b00aa2ce63
SSDEEP 24:7MuhMZAyxP91V/2O9xp/k79BtpOV89Vv/pOj55q9F55A5UpO5f89FbpOX69lHpO:hkH/Tn/Yz8kB/8LI56U8098I58
TLSH
T1492272E76BB5A476F0A28FB05068718C9C730329557EF584C65490FB02D2ED9913FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
Size 11KB
SHA256 12446bebab6d4dd810ed7e4414dffdbbb6f1ac41e27ca0398fc0aca01007e194
MD5 e905342c97ff4a6b38d342856d65ccfd
SHA1 a80e0cbf42046bf0ac05b490dd11f494d22f8108
SHA512 9603cefc3369ee0f343375294366103ce7cfa8c88509259f17c6012832835705ffde1a293f225d47205b1412a03dc49f8a38d5069f875d4f913480f8b086761b
SSDEEP 24:mMuhMZitP917t6O9xvtnx79BTtg89Vvdti55q9F55A5mtQ89Fptm69lFtmy9BbHt:E7FtXltn7htJBdtAI56mtFjt9/tn9Ht
TLSH
T1683253E36B72A46AF0A2CFB05068714C8CB30325197DB5C8C68580F702D5AE9953FBF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 d9b215991322bfce05d79ab7c9cde620a34b6083a5004c236b155cd291c0706a
MD5 38f1cfa2376f90cde4ced73b34181b10
SHA1 9a41e957a8d36cdaeeff82a278b91cbf74176d1a
SHA512 60f711e311dd7d5781d6f94f86705babf5c5899a1e07a82115204b1d27730606894cdeb0fa3b77b03937b902677a792b2a3b5a594d4213d1f5e4430d34b5b312
SSDEEP 384:QbowZOcyj+ed66JozGzgC1j+FCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3b:Y5zEQFpoGcmhuTsRptLiuFbybTbEbr
TLSH
T181D20184EB2E953FD41812BBDCA507042F79BC8959192FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 e270950eb3b3f5148b51f7026dd8b5c27aad7d5a5061a099e47f303179545238
MD5 e847197ac0f507ffaba9e8ac25f32604
SHA1 4e46b5d9ab3449ffdf5d5150aadcdd7518c4f9fe
SHA512 36d281fc14e0da3349da4d22bfa15abb0b1f1a3f62f24df48a54719ca5373c21b5c93acb882f3c35e80625fe94f276a59ec5baeb1ef8e3f0d2b307657c8ce5a0
SSDEEP 384:xbowbOcyj3FCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3bOed66JozGzgC1jd:BfwFpoGcmhuTsRptLiuFbybTbEbrSE/
TLSH
T122D20284EB1E953FD41852BBDCA507002F79BC8A59192F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 e13c872b5c972bb3697419353b95b398543fd50cea12318472782d5ae7d73017
MD5 f2e4a6ead2dba5cdb56cb2d6b74d7cb3
SHA1 41ebf40987e19a309473a9bf475593fea0bacb81
SHA512 358f7dcf5d465b2e6e72f1196a1a9ed5e65e48a1516bf3493df157793abb2cbed9282190f77b3c88678ece86133c8293bf61ed7be32372364c0ea90ca7a91551
SSDEEP 384:e4/66JozGzgC1j+FCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3bqbomOcyj0:KEQFpoGcmhuTsRptLiuFbybTbEbr+n3
TLSH
T1A6D2F184EB1A953FD41812BBDCA507042F79BC8A59192F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 d1a3dbb18cfdeb4c98293865f3b3c929c0827d5499b5e03e3c6927dd307f4718
MD5 f9202455d897eee150aec9cd32aea739
SHA1 beb8339e5abd20feb5aff9dd091df87e6b3f1736
SHA512 fc9ebac238177467c4239fdf68922e781a29cd9effd8c0f93832a9cf4c6204722e3f4ca6032f2d465bc56487e51ea3eeb8fbc34559bacbad43da7625660bde6d
SSDEEP 384:XFCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3bqbobZOcyj+ed66JozGzgC1jd:XFpoGcmhuTsRptLiuFbybTbEbr+EzE/
TLSH
T1B3D2F184EB2E953FD42812BBDCA507041F79BC8999192F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 7b566d7580f4ae79c41cd95095adc8c5c818de3338335de5160782f7793904df
MD5 43fa28acd6b9908231ff80029c1985ac
SHA1 de6711d7aca3254703b88fe47206226e232a205a
SHA512 bf16dee92988e52de88e4ea9e5297bd44a1b5cd852202caca09b61d0704f67fb2a7f9499a1dde21a11ae61d2e9e3da13935e27d696babcc0b37875cc643e1886
SSDEEP 384:4Ad66JozGzgC1jWbo+Ocyj3FCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3b:GEk7wFpoGcmhuTsRptLiuFbybTbEbr
TLSH
T104D20184EB2E953FD41812BBDCA50B041F79B88999192F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5db6f9612ee4d5cc30bfb7116e4bc2fd73a2e23d3bf50eb00159d31db6580e75
MD5 2cda9563b44722a8f5a3a83b5c4ca530
SHA1 c179ce32800eebe9e02d576ed61a65a3edf4f675
SHA512 8e68f5934235007b4a855b357b5d495c9dada1b7cb58f68a6c4e6bca8ad8d92eef3c56dff6fca9d59e3b27f69ca7d275bc5eaee5097b5a4b5220e96b923d43aa
TLSH
T12E214C5C39B88D6E58C7E29C7850018E53654E0704973D4B4E93EF8DCE91AE9327F43A
MD5 SHA1 SHA512 TLSH

Submit Download

0a45b382-05c5-49db-9c8f-2d1c448f6749

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\0a45b382-05c5-49db-9c8f-2d1c448f6749
Size 886B
SHA256 e4f2dbd3f9e2dbee756e15832e2b4c6b09eaf83432e5dc3a2dd08fdb72f584f2
MD5 4da6825dd9b918fe1c35d169760f92cb
SHA1 9ac24a5b24b12acc826759a8f152fd56ea29a1c4
SHA512 8a52449f5d01ca4eb21cf0172d308d79b018d4cc1cf4b5a04884c959e83b1df6319554ec7881e96827c8e07aea3db7a7e7c516cc4c7967e62829fe8f3f9aac8c
TLSH
T1001123D09A39B5B2CC7CE28BD5917B4A4FE47423C0CA59047E54AE180DAF12FD3E660B
MD5 SHA1 SHA512 TLSH

Submit Download

15fb4577-b192-4b46-a6db-028d018c97ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\15fb4577-b192-4b46-a6db-028d018c97ea
Size 235B
SHA256 243cb9780cab0a37fd380e1f32e14d6a59de1cc60736d1bbf56d9fe492a7fe71
MD5 e3bca29b54e2b345ee600479309a6961
SHA1 a3b545b3376a6e55478d2901d83a6b7e8013eb63
SHA512 389c3c75ad929b42dd84f3d728cf63a7d80d0e822c53c08b27efdc6c53c3641ab3674d5f7a424491fdd59d4904332c7af0990c73ed909a1dbe1c4d21bf166771
TLSH
T128D023C838887BBD08184F03F0E078C330448C3B58B45811CA9104F4CFFDEC452A281B
MD5 SHA1 SHA512 TLSH

Submit Download

1c92c26c-e792-439c-8ef1-1810cda2f59c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\1c92c26c-e792-439c-8ef1-1810cda2f59c
Size 2KB
SHA256 789bd18665f9f4292130eb101ba556c8e7fe5324917e6cec3426ae741e8b4efc
MD5 bd2e005c6f05cfd2f10652c9117113da
SHA1 cd50428c0ad1b7090407ea3f4bb1570ec4a83510
SHA512 c0fa9417f769801827821e481c3e35215eb399861516b8a55bffbd6f9ac4be15b7adc258be3f7a2a7efd0c0a7fec8e754c2888127a50289bd31e812535b697b2
TLSH
T19C41235C35789CB78C9AF58DD442334D87A58B1700C61C432E51EF4C8C9979A73AA43B
MD5 SHA1 SHA512 TLSH

Submit Download

6cd1ae0d-5f29-4627-a092-ff39953bb93c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\6cd1ae0d-5f29-4627-a092-ff39953bb93c
Size 235B
SHA256 4dfa11538a3f471bc07f52012801180d7e3a0537bc68ffdcfb0b18e3cb8cfef9
MD5 cdd07ca5301e34f38b3d22a9c708b3bd
SHA1 f6c7d49c83e4b55ff69982940dccb87d5d27eb47
SHA512 62f8fba34e150a5fbf2dccbe16769f37d1a2f9a54a6eb231c96784a8dac73530f34714897bf1c4e3515cfabc300c4e30028f8cbf98feb411fbeb69f498bec989
TLSH
T10CD0978814D83BAD48040F26F0A269C630444C3310B4D810A6A08278DDF8DC80221917
MD5 SHA1 SHA512 TLSH

Submit Download

9de58e7e-16ee-4d08-86a5-928920315414

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\9de58e7e-16ee-4d08-86a5-928920315414
Size 871B
SHA256 2d3769ed303784e62c55e27ff68a7d2702a44864299a762476da5490628264da
MD5 99a096fcce45e2717803ef29977521c4
SHA1 20832150eabb3e79af18fb5a19a84cd865850026
SHA512 4559ac3fdbd93caf7676e34fb1d318fbdd85f0edfa67d6ab9699dd285f85f3caa3d4f384d62b102ec832b41e9e0bdd5d5cf968669d4a9608c5594528a281a6e2
TLSH
T19411E391A63CB5E28C7CD34B89557B068FE5342380C994043E909D144DBE61BE7EA70B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 6KB
SHA256 c5dfd94073b8d45e7a0a1ca14cc4e1289ddf7d64fd75e1ad3f352639e4b06320
MD5 b0b75c9464846ef573e722bc7fbff958
SHA1 3581529e664c462942941f0fa3a64b45bbfdf7ea
SHA512 902e4bda65e3ae3529cc5bef7bc2d627348437e51a8fc5cb72d7cea5e5365fa818dc439f1c6499b8b7c5bda7c9f1eb72f8b2144411d835bfe88bee7b045cdf5d
SSDEEP 96:xHiUTUMqGq/fSI4kzSSUSSlmdv9jxnytHlAsO7HjvsBw88n8L4cn2dU1jGS:U/R/fSI4kUSS/xisIHzsBw88w
TLSH
T1F5E13F789008CF6F64B676ACAC6888316AB2013BB7BF68D750B594C4015CF3445FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 6KB
SHA256 cd07c252aefd327ef413d9dea9b7a59266dd110f95fcac83f04067b496361e0c
MD5 731f1da0d0d064e9d778ab042b555024
SHA1 a3f775dbc535177b5236311341f46bad458253e2
SHA512 6b9fd618a84651ea1bb15ebbd5f9b9f890ee0866777cd50955b5a3b78869fb0b24107838a6bd9e8457303f12ee992af45153efd510db7189579b90f6d7304c24
SSDEEP 96:xHiUTUMqGq/fSI41zSSUSSlmdv9jxnytHlAsO7HjvsBw88n8L4cn23U1jGS:U/R/fSI4TUSS/xisIHzsBw88C
TLSH
T144E130789008CF6F64B677ACAC6888715AB2013BB7BF68D750B594C4015CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 24f7816308a9be2a63e7cffccaa99e5b426af2c735011514b928fa6a1566e220
MD5 165ab6fc380107fe813187aec2b7ab4c
SHA1 1630e62b1362da8eea2baeea1be503788ef063b8
SHA512 0aa76e6c817e7d39739e0b43d49e9e9703bc7b12cb0edfa0560f749d60172a8e6470dc803d35946fe7012dc5770eaffdd76e222ee21e278def4f51128944844b
SSDEEP 49152:WBl3Q9jg9SieDEYTuB+JXZaW3seb02/uEwwG:gl3Q9jg9T+JXYW39b9/cwG
TLSH
T1AB163AF824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3804-6770-0x00007FF6E2EC0000-0x00007FF6E2FB3000-memory.dmp

Download

memory/3804-4273-0x00007FF6E2EC0000-0x00007FF6E2FB3000-memory.dmp

Download

memory/3804-0-0x00007FFC11B50000-0x00007FFC11D45000-memory.dmp

Download

memory/5476-7517-0x00007FF6A2550000-0x00007FF6A2648000-memory.dmp

Download

memory/5476-7518-0x00007FFBF4000000-0x00007FFBF4034000-memory.dmp

Download

memory/5476-7519-0x00007FFBF3210000-0x00007FFBF34C6000-memory.dmp

Download