hxxps://deal-z[.]sgp1[.]cdn[.]digitaloceanspaces[.]com/

Analysis

user interaction
yes
max time kernel
98s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20260513-ja
resource tags

arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
22/06/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://deal-z.sgp1.cdn.digitaloceanspaces.com/
Sample260622-fp34sshx5v

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3560	msedge.exe
5320	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265782492890022"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{7EFD1F5F-13AB-465C-AD51-546E23F9B7A3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3828	chrome.exe
3828	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
4996	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeDebugPrivilege	3804	firefox.exe
Token: SeDebugPrivilege	3804	firefox.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3804	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2160	4996	msedge.exe	85
PID 4996 wrote to memory of 3560	4996	msedge.exe	86
PID 4996 wrote to memory of 4376	4996	msedge.exe	87
PID 4996 wrote to memory of 4376	4996	msedge.exe	87
PID 4996 wrote to memory of 4376	4996	msedge.exe	87
PID 4996 wrote to memory of 1628	4996	msedge.exe	88
PID 4996 wrote to memory of 1628	4996	msedge.exe	88
PID 4996 wrote to memory of 1692	4996	msedge.exe	90
PID 4996 wrote to memory of 2616	4996	msedge.exe	91
PID 4996 wrote to memory of 1692	4996	msedge.exe	90
PID 4996 wrote to memory of 1692	4996	msedge.exe	90
PID 4996 wrote to memory of 2616	4996	msedge.exe	91
PID 4996 wrote to memory of 2616	4996	msedge.exe	91
PID 4996 wrote to memory of 1792	4996	msedge.exe	92
PID 4996 wrote to memory of 1792	4996	msedge.exe	92
PID 4996 wrote to memory of 1792	4996	msedge.exe	92
PID 4996 wrote to memory of 1564	4996	msedge.exe	93
PID 4996 wrote to memory of 1564	4996	msedge.exe	93
PID 4996 wrote to memory of 1564	4996	msedge.exe	93
PID 4996 wrote to memory of 1744	4996	msedge.exe	100
PID 4996 wrote to memory of 1744	4996	msedge.exe	100
PID 4996 wrote to memory of 2836	4996	msedge.exe	99
PID 4996 wrote to memory of 2836	4996	msedge.exe	99
PID 4996 wrote to memory of 4700	4996	msedge.exe	102
PID 4996 wrote to memory of 4976	4996	msedge.exe	109
PID 4996 wrote to memory of 4976	4996	msedge.exe	109
PID 4996 wrote to memory of 4976	4996	msedge.exe	109
PID 4996 wrote to memory of 2660	4996	msedge.exe	111
PID 4996 wrote to memory of 2660	4996	msedge.exe	111
PID 4996 wrote to memory of 2660	4996	msedge.exe	111
PID 4996 wrote to memory of 5108	4996	msedge.exe	115
PID 4996 wrote to memory of 808	4996	msedge.exe	116
PID 4996 wrote to memory of 4416	4996	msedge.exe	117
PID 3828 wrote to memory of 5124	3828	chrome.exe	121
PID 3828 wrote to memory of 5308	3828	chrome.exe	122
PID 3828 wrote to memory of 5308	3828	chrome.exe	122
PID 3828 wrote to memory of 5320	3828	chrome.exe	123
PID 3828 wrote to memory of 5420	3828	chrome.exe	124
PID 3828 wrote to memory of 5420	3828	chrome.exe	124
PID 3828 wrote to memory of 5536	3828	chrome.exe	126
PID 3828 wrote to memory of 5536	3828	chrome.exe	126
PID 3828 wrote to memory of 5544	3828	chrome.exe	127
PID 3828 wrote to memory of 5544	3828	chrome.exe	127
PID 3828 wrote to memory of 5584	3828	chrome.exe	128
PID 3828 wrote to memory of 5584	3828	chrome.exe	128
PID 3828 wrote to memory of 5712	3828	chrome.exe	129
PID 3828 wrote to memory of 5712	3828	chrome.exe	129
PID 3828 wrote to memory of 5816	3828	chrome.exe	130
PID 3828 wrote to memory of 5816	3828	chrome.exe	130
PID 3828 wrote to memory of 2824	3828	chrome.exe	131
PID 3828 wrote to memory of 2824	3828	chrome.exe	131
PID 3828 wrote to memory of 5992	3828	chrome.exe	132
PID 3828 wrote to memory of 5992	3828	chrome.exe	132
PID 3828 wrote to memory of 6068	3828	chrome.exe	133
PID 4996 wrote to memory of 5552	4996	msedge.exe	135
PID 4996 wrote to memory of 5552	4996	msedge.exe	135
PID 3844 wrote to memory of 3804	3844	firefox.exe	137
PID 3844 wrote to memory of 3804	3844	firefox.exe	137
PID 3804 wrote to memory of 5960	3804	firefox.exe	138
PID 3804 wrote to memory of 5960	3804	firefox.exe	138
PID 3804 wrote to memory of 5960	3804	firefox.exe	138
PID 3804 wrote to memory of 2220	3804	firefox.exe	139
PID 3804 wrote to memory of 2220	3804	firefox.exe	139
PID 3804 wrote to memory of 2220	3804	firefox.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://deal-z.sgp1.cdn.digitaloceanspaces.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb115fc188,0x7ffb115fc194,0x7ffb115fc1a0
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,14970212475668860786,4638235687830552056,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,11667613300285753328,4677582502222919010,262144 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,18143805252274305898,14979734943189580863,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,15202648358723098786,12324509675899615987,2097152 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14407487333571668934,6470867514439892092,2097152 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,12915804869416221526,4981051979239447135,2097152 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,8465966068899457182,14446744091943859787,2097152 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4111834570745777334,134165651888412002,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,6779197600177460494,13259324284541029166,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,14951945862762988584,17991889635115944694,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,14951945862762988584,17991889635115944694,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4176,i,13835148871701073672,13774171715227783657,2097152 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6192,i,15147957406829616338,2340379110398446518,2097152 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,18157157912595936861,15581276674727431628,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,9251519431913082320,15810577538446619578,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,2519159031439468782,7106633586119605388,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=ja --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,6318804386777848100,6871247599429180198,524288 --field-trial-handle=2328,i,15426736002102213072,1046271411273905309,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb0cd0c728,0x7ffb0cd0c734,0x7ffb0cd0c740
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1820,i,2420775900570249241,1460604035884797972,262144 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,10772162686070896987,5295976010256058721,524288 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2460,i,11249583014592076790,1001480477358062002,524288 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11559217095773533229,14747234239858709456,2097152 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,13859455555516373854,2740012988330420649,2097152 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,17016412452446128312,10413096729855586580,2097152 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4808,i,8965066271132573861,14037394125413129725,2097152 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,16920195649474947233,13013501282228474462,524288 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,10698280267358363116,1929011247242420047,524288 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5180,i,10933996768712684188,8961094634219215548,2097152 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,1434353142213001019,1130882389712662486,524288 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,16839048944620790755,3037129954600862099,524288 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:6596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,2529167667647332814,7268524108747159282,524288 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:6588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,14607099790881956994,12846506407074233511,524288 --field-trial-handle=2056,i,15033477662061665438,15271724512835772653,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:6580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {65305781-ce75-483a-bd51-8e5c576a59f0} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {490b3360-fc9e-40d1-a051-0c1322586625} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 27276 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3752 -initialChannelId {e71c982d-89bd-4c43-8c8b-761c9227cf83} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3904 -prefsLen 27276 -prefMapHandle 3908 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {9f047f4b-d041-45ae-89d7-ac891daf2faf} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3200 -prefsLen 34775 -prefMapHandle 3212 -prefMapSize 270279 -jsInitHandle 2988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1660 -initialChannelId {4372ded9-40da-40a3-8c83-44025852966b} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4908 -prefsLen 35012 -prefMapHandle 4912 -prefMapSize 270279 -ipcHandle 4920 -initialChannelId {d562901d-6e3d-482d-a620-6f4810c5fd6d} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:7140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2844 -initialChannelId {1cae712e-3ea7-4f59-87aa-94a582901f1a} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 32952 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {47ff29a3-9de3-4a78-b36a-b6540cd3f8b7} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32952 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {cd6b64df-e724-4124-8261-028ae1fe5a0d} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6124 -prefsLen 33031 -prefMapHandle 6116 -prefMapSize 270279 -jsInitHandle 6108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6184 -initialChannelId {b9229e69-d179-4800-82b1-7b3bfd121853} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a3c0c072a663fed5f1c9cd717c21ee868bb4f36d429d221419785c4b80d7416
MD5 880db5db5b6846eeae7d8dd81ccffecf
SHA1 ffaa2c93e839feb5c49b28902611a8970bf9cae8
SHA512 0fb8b9cb4a65b3d61aa5a4e6ae5d953845ad8948666190787d0264849adb2a5e49b7cfdd4b6a3205422202aa66f69d5b81ea4fb30e8f338e609cc3d576132b0d
TLSH
T1F9E02BBAC9209D2B08FD0728745C0746E654235B2B50855F3A3CC3098FB9A765996C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 155KB
SHA256 914aa607d80c320c67922499f38414cf8bf299482c8bad4ededaad3811a455c6
MD5 2c7c41b52981203b308c82d0c1878ca9
SHA1 e8c5a3dbf923d2d2be1e595e3703488e183eb1ab
SHA512 e1ba135eafc60767ed89f1beec2925d953d79179bd5ac31009ea9688cbf5ada7cfd6798b62c4004cf5f47333d14cc47126196543a6d8e69df61c3446276bdd18
SSDEEP 3072:yVoLHMQB8whdcx6evVue/i/fg5yoQ64VbSpDmsBAG1y340cGJws8nxQq:EooE8+dcrJg4EoQ6ubSRmsv1yNJlen
TLSH
T145F313C9A7A43A25D507D13DF28114E3A917C2186B15C72357283E4BDB30F29EBE82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 151KB
SHA256 56bb6dff4a50a3a165ab02d962aeb3233851e73c080b5b75e8fb94a98ccfdb61
MD5 af2a18de62244edf4d0f1170b20e96d0
SHA1 55fe33baa86f87018be0b162307671e483689269
SHA512 8f13e7d3c64cb678533088704e5eac9fbca40823914cab758d83928a0f9f3fd3dcc9b6da4af2e47faba86992c6db768ba4467bef085c2020b3a82af090be7aab
SSDEEP 3072:uEUK3V52F0owTvGj5YCIRgKU/n5lqU3t+v4TBuYDo3jguwlkjH64pDVfVYmC:JUgeF6TvwAgKGqU3t/Ieo3j31HphVg
TLSH
T113E323625D7695CBF087EAB0A4D0621BA5C4E39F9B337534526CEE5C8A2C1EFCC5248C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 40KB
SHA256 c491cc24469009a9360e7dee6112f316857118e2419ceab342cd2bbd2acf2aa5
MD5 ac1601fab83d6db979afca8c8054c797
SHA1 8bb2dddeb9195480ee04c1dbcebc2409313135bc
SHA512 5951bf6fde1146162dca8c803bc7684c873a988a76727edbaf65d33eb8d8ddfbbd05a3d6571c74157abaa1e7c30385f3be30afbaf1bd4b661599c9092c515462
SSDEEP 768:vYyL8AcKgGcAzlkJZnLmXsB849r/ZnRVkb2Stuywktbq2ZW4n:vXJ2ecLmXsB8UFnRVkbrq2R
TLSH
T19F03F138EB0B03C3FB35C8B51CB9A7E6B71E541B424C922848991F759A117CC0D8AB75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 35KB
SHA256 b6a8f9c0c38afc1437138c11a8efdcc51188e79d7e9504b7c174f40a126cc03e
MD5 745dd94b2b8a72352951e26099045f76
SHA1 fed78ba75907be0c4fe4ca34c60929cfdbbc85c3
SHA512 34231dc8621f9db7a5ee8ebf259b6027e728839a81232d39b02ff3d2de94180cee6c6f50c81c49b21af3f3810a26ba7eb870a198475535012c95d373b0f56356
SSDEEP 384:vYNg7QHpUwVufb0R77CEYsTLloOIIJf2rPaxnuL54OwNMvrL1ZKhgtgNf4xN+Evg:vYy4U6gAh7CEJN5oP2D9MTFS4D+EP0J
TLSH
T153F2F1D5DB69A102DFD68D30CC5A8BA44536BE8ED7930387371C852C61E70AEB669092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 65KB
SHA256 b30c4583714364bd1ff547d561bc1ded0c197fd76b03474073e34dd3362e29a0
MD5 d4cc7eb73f418e9b404a7ccded45ee68
SHA1 776b66ee0dc1a3278e6de4c451218776d627c699
SHA512 6081ca25b437a64dda72dda51ec9594a43c8fb57d90a5b9cab7d6a8892225cf3b3ca518499d8dc92e0718959a5cf1492e5a7c4490baa0bc25341f9b562daa7fb
SSDEEP 1536:OzJO/79xhUW/JxEGNFTHpeWMXJoo7UiGYsJ27BGcAtjtg5PmDI:O9O/7+MeD7XJoJNYSO9yRgmDI
TLSH
T1516302E47A77F9C0E8F5E1FCCEF66694B47B452DDDA3202E3051A53A408D50A82EF492
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 48KB
SHA256 773a1d019e526ec32731de8316b3ca7bf02078215f0e11a7c5a6ccabb5c5691f
MD5 f909e590b11c776cce88046ab2edc528
SHA1 38c7390a1da05459ac2171503268b8280be640da
SHA512 be5d58b2a6fae26989014c2dc5324a1ec99103dfc2f150663cc0838ff3e325837f0a559ed0fac9a51067c4fd018dbaedc78a2c2082c7aea2e9ff4249cd44fede
SSDEEP 1536:rfyyyI+P6GxCOzSjalmLInHI1cuS3XdO614HLLk1p:rayyLVFzMIno1cHdVK/Q
TLSH
T16133F23E687833CAE53CCF7997D0E8A93DBEBA0827C72D483814361949C05AD9CD55B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 130KB
SHA256 254aec42f465d342468eeab1d85bf83eb1d78e57a8cb797142592be469fbc1e6
MD5 03c7af2cbdd926942bd156122e85fe27
SHA1 c2b824ef7835faeacc06d2b44c66c52d319a6fd9
SHA512 b6abe7ccd5b5c398c3dfa0a4fa5674c3b244711feb1e647cfe612af7eb47ba0918a4fcb1b5f352a41d17430b525f0ebaf5b475b2409b64708093195db18679af
SSDEEP 3072:BoRGXo931dxVGAitBoMEiOdXPe+VCRFmQ5NV65y+RqUnMkgVWe46u6:BoRGUZ0AitBoiemFjr5NV6WNkgVWe46P
TLSH
T140D31272A0F81015E25C4536E52C1C3C6E307B149ACAE2CBBEB87D721BBD789E655F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 155KB
SHA256 0c7240a025fbcebd7b07143c9fb92b179f194039dd7f2a3ff3f2fc854122c2f5
MD5 22229e2c8b3995cd384b5c424b7bc02e
SHA1 78477939521e73c88465921664ec31e8e683a697
SHA512 ebe0487c8f99b30048eddea1f71abbcf26ba9f7ddf6ad3776188557f7fa2e72aa20fd0c84d38cfb3115aca41cfba2447ede1b6e207070842176221b168be8d3b
SSDEEP 3072:IW7FXXmbwk5tDmOxusnrskDpZldN9D1eUDXW0EiJuxc4Om7WW5LldbMY6ZYwin3:h7FHmbwiHusrskDLrR/XG4ux17LM5Pc3
TLSH
T1D1F312327FF8A9DCEE7114F650F1E90A0A54643F6B225660ABA50D65CE877C0403DAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 71KB
SHA256 d4986579c2b3360cbef9b0e19529dab589ebfa4659a86456ad6ea92f2d9d15c2
MD5 6c59696228f41c8f40ea70ce7a75733c
SHA1 385ee8f244f5c79c2e4890e3bed732146843c92d
SHA512 c0ffab44e60e7a98b2a202d8d5af45bcd90f09a406e62887225feec1d5a92b4a39e1b7cb613cf2411ad1a7fc5a534b6673b48a396367d031855d35e1b84619d0
SSDEEP 1536:191cAc9lZL5/uigZF64AzBiX1W8IqaVQqFFn/LZjDu9ylXg:1BILL5/uigZF64BW4qPtji9ylXg
TLSH
T1896302B1EABB718FDE4044BD91F1BD23B482C938DABE3F85795852B5BC0109C690E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 37KB
SHA256 8b0182382e71d2f1f6fc0da43fa0b188372fef188ad958b56ffabbb47edca93b
MD5 0cfc79638ef9ff3387c859517dd754c1
SHA1 30ac39a7163e40ca24e9682d7a3fc32dd661015d
SHA512 3ec223ea7219082af2795a8d0f098b59a42d3432bcb3a21c555ee8c70aa22d0f0c42f131495feac4e87cde5356494e2e737696f0d110e72d018a8711ed30b48d
SSDEEP 768:qYy58/2xmlOoe4rv58Rf5bF48vDlXq7+TmUJs5/nY7m1OOCG:qd8nlre8CU87lXG0T65Pim1
TLSH
T19203F2B8D658C94BD63687BC49AA75AA34E2B7C0C3387F1151401DAE6D024DAFF4F8D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 d9f02c399abf08d60b4ad29cd4e31faabe63b915c78ac34db90663b56bc00dce
MD5 cbf0fd669cc4cf89fc08be0f1ba0e432
SHA1 316a6fb2d5c7c21fb8457204983c7388ca4dac92
SHA512 9bf2df0442aa874b5b6d65ebec36f974b508c02750618a8d17ac6f9dc60e190fefe27ee1e182a540e677422e2a3747ab35cc09e7eb3c6ecfae6bacff0dd1a73e
TLSH
T1EBB01250E5D5050DCFCC1B71300504082B707B70017263238AD990E5BE221E14025062
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dfc303a4ec88de986e1887ee2b9aa017c410f21a6f8ee8daf5cdee61d3a605f2
MD5 a9b0321510ef57f4ed8ed0c19e2bb711
SHA1 e6b8f6d3d19164c6522213d7cc2ffd6cd10b1ba8
SHA512 887dc1bc2ffa3efa29b8f45f932782c26e9bdf50263f476851298fc3e6ce2fe0cab835bf29c59f97703c91645a37823713fbb173f9ef1b48c0966e138fe8ff78
SSDEEP 192:BRZ0lBCqL8WY1mv72ympAPRp2V095Hsb+WNnf8M5xI2rYea2iWBE29VyIsnAUgtK:BRZ03wOQUXV7wE7242iWBbL8
TLSH
T16742C82EB920657F6CDBD229FD667723E7F5106622942D44EAFC8B2C14E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 41ebd50870216c8a383c7e5b4839cf0616d535f96f4add4488838d40ba283b90
MD5 f4f2eab7bd077d82b178bf300b20a4a5
SHA1 13b213ee71a3b604f998bb77a7d7509448f40166
SHA512 1c83c5ed86021cfb8cbbf70a9006c1d0e18ec05a0d03ff2d2161afeebbfa324138ce46535a7c5548e9f186baea244c0369f4c74d39d4b617ba30188aa635521a
SSDEEP 192:BRZ0lBCqL8WXmv72ympAPRp2V895Hsb+WNnf8MSpWhYea2iWBE29VyIsnAUgraJ:BRZ03w5QUXJ7wEnWG2iWBbLe
TLSH
T1A252C62EB920657F6CDBD229FD527B23E7F5106622942D44EAFC8B2C14E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b2e4b42ff41b771d54a74415f61f5d0aab49396fca1f05b5bca63bb356516deb
MD5 3edd1c79c447109fbea46a54b7233831
SHA1 ebcfce7b3578308ac509a8ea55b15a6fad20229b
SHA512 04d1957e00afeaa3fa427680d1846b40d1cc550368612c464f56e28ac41e4b5ba9d7d74798926f2ae92150676f355b454afa33c1a5c645b66317cbf5e37e727f
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLdLc3jW3XODM3+ErU3o+sHuiqkkN4vO:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pO
TLSH
T170720A6B684C9A370F94C6CCDC16BB4FACB5025B65DD886493FA9C2503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f406fa19022bd45809abbceee90772aa20bbdff2dd9568d9b84b895d2a518118
MD5 43f2ca0c554fba2c76207e07a0efe8f5
SHA1 4874ccb39db13cbfdcdc47fbf4201cfd2218f6ed
SHA512 6b040a6e3a1d130a6bede7a75de09f5657ef6f4e506e839436e149b32416e6ff339b4b3ba856b1f6e1b564d460bb8e505c665bd02833e8f9918d026673abba75
TLSH
T16AB01240C4015101C80606F41A43148CB178EF30B74A172143E46933D8355508014151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592a23.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592a23.TMP
Size 96B
SHA256 f5c875e17f3dc8b9cc9a9fdcdde6c73d173a43d4b8e844e4a73d194d2699321d
MD5 62f8478a725340335b734b0b8eee9caa
SHA1 5f033667f6dbaec97dbff8192d949f2a75784f3d
SHA512 def07ed71303c6c623d6ea0ca2bfc5f2da98148c73751fd3f3d43de81eee20c2751949b7f471922e489fd405f81a6291e980add3696c6b85380e33bb6c088a14
TLSH
T111B02203C203A203C08203B02A8080C830E0CF32C383030BABE80A22CC203200038820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2c143bf6af676f11d61ab39b1044f17e9b031f8eb8d42ad491055ac2099d07a4
MD5 feb656a4aa41c7209736d8bcdfb59ce8
SHA1 30359fc40bc90eb075cd53123befa77ed89c6f21
SHA512 3886b2544a79a9ea0154dfb5f22efa37a37b58f04c1deb569ec2d1186bee339f53a73f0e2f7582378c035344c47ef292436481fb673491fea93b6b0fd8e46bdb
SSDEEP 1536:TxQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Qqfd7NtZL8cHQRZEQ6Spsk
TLSH
T12EC30237DBC21F339D92CF60B9530FD697B644A99034D301AAAD77AF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 65a773e2bf19b05d9f7488bda70e687ed54f20c6aaf55bd7b36afaab54bb8709
MD5 aee9bb22aaa7990b5d7d398f313b0657
SHA1 72b447b450f9d94f159352f971f10da6ad1a0956
SHA512 649e7fd27443ec6c0b809845fd5432e1b1a10f6ba721409680d6f3b8b7d948d0f77cb9cc210b3d16f46e6284ccb9d810a7359cdd69a6dbb16a02b6e074a86032
SSDEEP 3072:hFGcKjJHhcEoU71KOWHf1dNuFqe7Kjp3V7B7tzupMZnLpKqs52qfd7NtZL8cHQRn:hnEojpGqeGtHdupMZFKh52qZ/ZLW3Exg
TLSH
T1B1341333DFB71E714EC5CF207A730E9AA3B25ECDA83DC2465B4717EB558298086454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 fc54206c60aadc4418fe57f3ee6b64d95223d65ff6d6af8f99b7aa0e76bdb0ed
MD5 e12d96590cfb86fc7f054df1d7eec0ca
SHA1 24e943813d5fd9b175f4f40d34f492dcd2599620
SHA512 092efb3e3ff70c3be2bcb3e040f828133ebfacb2635a7481dce29f8938844ebe3883b28e8a814e20dee78267ada0637c59117ac6a6d537835f1292026f088961
SSDEEP 3072:IFGcKjJHhcEoU71KOWHf1dNuFqe7Kjp3V7B7tzupMZnLpKqs52qfd7NtZL8cHQRn:InEojpGqeGtHdupMZFKh52qZ/ZLW3Exg
TLSH
T1E3341333DFB71E718EC5CF207A730E9AA3B25ECDE83DC2465B4717EB558298086454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 2cf88f28de74a7f42a50c43d93286819376d5df457ed94feb58d9d14f6a385ba
MD5 2337726f0434e22f7c3ecab6f0286eeb
SHA1 974b138ecc4503f4e64ec1c3128942749d2fa934
SHA512 5b7620f96935214f5f295ced64a2a466722585a5a8c398fd6cbbc23d0b85a47ba5c9eabae91097664b574e185bfd008d90427635aae27580ba6fcd5d4e9aa6f9
SSDEEP 48:mdm6lRj8wy77UQvpWee5+WQq7062/XkBt6eKCpZVeqeEQKEcYi4QBWmtdnWPAAxI:CjF8ww7UQJe5xasBc9tEQPcY425XxU
TLSH
T1DEC1D57AD5D9806DFFA07A3068C2CC2833606176367E2FE6172098B16F1BAC104C2E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58da5d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58da5d.TMP
Size 3KB
SHA256 f02fea9f67f01e903bf0f0dcdd8665fab33f25e82ed2ff03c9f7f9be7525862c
MD5 6d80715e35637ae1b23d98964eebaa33
SHA1 847ee9174f0d8cc2f30277b77ec31d8e0f127622
SHA512 68d85568b00fccb530d38494b8ff0dbb1653cd88eebb9b689f93a2697860bf8dc59bf1ac66d0c93fe3ec98cefce1f9860868029b8fdc4b68bbe7f4f945bbbfcb
TLSH
T13B714D3812DD4460F7613531ACD1D63936708AB7397F6FEA13A098767E19B6042CAF36
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 3efb3b6b208e318f55bc3c3d810e3404baa0b3e2caa02a6730329acf3623f589
MD5 bd3e8a39b168eadf1819520439887a83
SHA1 573efc55c0311d5149251092630cf21064d5adea
SHA512 ceeb4f2dd389b7f338717c6c7653ea92ff7c5983e3dce66998df99abead57ca99e2f5d75949bfd0029919434d3fd6abe133724b733e28776d417ca98eb15884e
SSDEEP 1536:3fEEqxwWxMuGZqW3LIPDuV2rpBrMpv6Zsi7i23ERPq:crwxqEsDUk
TLSH
T15AB3642AD6A54C7B01F16264EC750382F315436F9286A82F3A7C9D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 23703999839f4c5d56de88917cfcf4604ddb675a220a1bfcc416b2dda5243356
MD5 f846487bf4252c8df80b2d9de1b8375e
SHA1 33834bf1704fd594eb69301a066d383ec18c82b6
SHA512 3b3530278b4a09ab63a98ee8c058549025cb04451b54c3b30062c56ce09c7e8fe2faba5077b7d445de76a66c00abe6a06c86ade786a74375750b72e835680de8
SSDEEP 96:D6j3fZj3f+S6j3f5WZMVnGj3fyj3fZpjcC1j3fyWxTcfj/Dj3fYM:D6jBj0jxWZMVnGjqjhpjcajqWxTcfj/L
TLSH
T1128126F5C3E9462DDD5255F0AA547E2BCE1D044543A83C4A88D4BF4F63F18B0E191B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5ddb686045740ff43f21e097919f609d46b38fb73c58b3ff9df57bc41b6f8aef
MD5 e5f3188d79d07eadfaa3e13db132c8f5
SHA1 5e6b7c439baf0a120921dca669ebc12f6ba105a2
SHA512 ee1b72fb74609c9fd48e741a3cbb031998fcc2ea476c2567eea225c1c6747bd7550a4012d98ef43cd87f535e3a4c1c8769e0a7770eca9337e967866094d48118
SSDEEP 192:sxZac/yfYKOMl8MknU/fH3s9WkqBIqpzJHW6+WNPm6/YHbiYbQIgrJ:sxZLaMU/fXsskYtHb3/z9
TLSH
T17142EB566A38997B8CCBD309F9557B53D6F50572A2900E48AEFCDA0C04E6ADD330782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 771390f0ec374ab48e45363230a66676e31583b4ff13b6f4ab2c0981c78b3b1d
MD5 7a1b5dde1202a39f739f442ec0b581eb
SHA1 422a01d29cbf04d9180a633590db0041ef250fb5
SHA512 f0c322afe86237552bbef8a7d6e45d657a8b9519654b7d2d8e691ba60608dd90a4c3142de582f34e9a91f034664414906015e5b5f7c92852e27765a0ade53cf5
SSDEEP 192:sxZbQUn5c/yfYKOMl8MknU/fH3s1WiV5fhbKQtdqpmumHW6+WNJesDsCi/YHiiYn:sxZvniaMU/fXs0iroQa6Hbzg/cq
TLSH
T14472FA126A24497FDCDBD219FD467B53D6F90462A7950E489AFCDA0C04F6ADD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2161d1c7505bca9040055e6c966bf5ddc838dc2fcbdbcede032a9dcc8a008e63
MD5 fc7734fda192aee795cc5ebbfa2a8173
SHA1 2d86f0402674827599c385ecf472943d7667c652
SHA512 84ca9af7ffcdb445f6839b41086503ef3cb9269973f8699806f9bbdaf3c4519a37445c6113eddea7fabfbc389d65818bf20dcb69ce21d30f15663c4757bee114
SSDEEP 768:UyUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RDroV+0T:UyUZYTMWvg0Pou1ja7eLZmRw/T
TLSH
T173D21B2F284CCB7E4F844E5DEC2A6F863DD801CB9A584D544BEA894C03CB6EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 96B
SHA256 7bc70face5f019d6a4ab09b3fb0e5f0a247d6297982328836241ad289f0cd85b
MD5 4113b43b7c49753c2ffd1e565a1d0de1
SHA1 48273af553a2b294a243c871e46d6c06857b5329
SHA512 c28bf4372fc2e9e048e1fc9c053d78b9c8b570e59a5bf17923241446141b7fe9dcbe723b242ff6998339543f45bc4de9746cad2eb337ac194f17fb9a789833b3
TLSH
T15FB001364E84444AC44A5BF026962693A325AE944313279794A0859AC950A4F6EA224D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 96B
SHA256 8bdef06b3e4464cab0588b5faf42fb99ae866e55eb2040e9cb43366403e0e84c
MD5 6bbfa602ace857838231eed13a9e081a
SHA1 7ecf89cc27b8ff600d9d51b07072d11da3ee37a9
SHA512 71e31142bbe9c8a80fabec4b644d0261f903a6572b1523caca0f95e8dfa60745c988ef953fa21725a293bc2bc6b25f5500f4cd554eebdb8251d6c701bd7977fb
TLSH
T113B0023486D0044BD82662B517D313D23734ED617F26538744A211BADC52BCA4F8201E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 fe00c8d3c240c03d66143d6fccc74f817b1695d06ffe5b2afc2c724d53a340b0
MD5 8e06c092be56a00bad8cc0a0259889ac
SHA1 f30ffeaca15711dee4922dabd8f5a4bc9ca35e60
SHA512 efb118b2971f4782eae897ebcaf81d6f21700bb68fb04c88a0c548d486f82ce5a41eb27b65e85a1fddd673e3a87ddcbd5aad80a0708dc2dc22cd9b993786dbe5
TLSH
T1BA210E8D4EA0899FF8A181B611B2E5A4777098DC4B16B3235C3C32316E2335E2A5B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 73257f403f4d6f03d779ff399ad2e238560a86c7ade11490a1c876356f42c27a
MD5 21293d969af666bbd74f385a66dbe999
SHA1 ec8ba6374606e43e241fbf452dc23eb79a3590aa
SHA512 7e7b9eee40d483b9b74778349d1004f954719eb4f04036fe7acc2c839059b20bd9cd450ec51b906f8a8cb6804728ca192395e0993c0b147cd912015d2d005445
TLSH
T19D51E79D9C47271BDD7C227264F60884377179DC2B684A0335FC913CAD83A3919E9B5D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586eb3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe586eb3.TMP
Size 1KB
SHA256 0935ed65bfe6dc25c5a9e711fd525992ede6d683cda035e52fcb749d016d4543
MD5 bd73c0dc931b9dc3cd969248d9408547
SHA1 e09a19f09ecc4fa96538f5cd9172fc1c4461c9ba
SHA512 1629eb579335bf0d38871b0e2f9072357986d3d1ad142b0ca0d07cfe87ded7090520354faae0f4f841849de06cef22a456bea2ffbd3cd149b66970121d02045a
TLSH
T12421108A4AD18A0FF8C4507B0AA3B8F8737188005726B3D3693C62795D21B9E1B4F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e77ab0855b8376b2da46a14c526afb363e88cd9feaaf92f419ed7c7935f2fa01
MD5 2087abf8dd339e55f93df25fbcdbfd9b
SHA1 f296fbc372500a8ad170dc196b50f4f44c0e0415
SHA512 2570170c56cfadff579f27f16ea0df8ef92e913add216d156097e4d13eefc5bae0930952837d477f748f6bea9958680ce17f8001d66ca9739c47c88c05ec0653
TLSH
T1EAE020F77DFB1814AD7FC7D75471A4A405027CB8C64DAD8E01AAA3A310B23552906D72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 934c5c8753d9bc3f8942f9befa3bf45c98d7011f30600bc57873e3316bf28a41
MD5 2f80e81faa6ded544fe0b0fc4332d99b
SHA1 823515fb5ffe8ac7395ec4297a90d06159f0f181
SHA512 1e9e6f4f9dbc1e22aa5958a6a74fd47e85d2e69b4ab497c50754878129d0ab0106328454565a58e60d59089209f3a4f4fdf3ebf37f9c0f8905f187215d3a90ae
TLSH
T194A002138194004DC80512B4B06906846352C9902F563225C5E4D154B9512408176104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c203.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c203.TMP
Size 48B
SHA256 81f043e9c22a6d7e094088f1d87c7d54de8a63224baa257e67132cf69e9a68be
MD5 98fffb8cd7ba845522570eddbd755735
SHA1 8fe91902337e58c982af599f0a9b56f1c165ffde
SHA512 7711ea2ea4384ef2414bcaf68d1ac299345b82495dc5e8833266d4ca4d612da217d5cbeb2ff88ee26612463d3b64447b4116d987298700d441077e3a3c032c21
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4b55ce049400de59754608983510d4cea4582dd17475f20393c4009cbfe4bcdb
MD5 a1dab56671c0644bcf8c187aa014295f
SHA1 dd03f85ec855a3d40b4a15fd39f5cb587d59cf20
SHA512 30437e7d3a0ce0613135e833bc97806d4cd17eadae74734e400a8c751a5d607391448cee13040685ba98dd458a525e41808827b7ec40b2639154a35dc2d94a0e
SSDEEP 96:KA1eK2AwxyKywieNiptLzj2VzA9jt2KbTjX2nlNYHNnqCsKjCL:EE5eNiptLzjEzAtt9TjXwlNYHNnnY
TLSH
T1D1B1391276BA42423C7E7A4593959B7B0A4271673018E43B7B7904B2CD2BE605EFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51d30b7d-b9b9-4eb3-a642-206f442d3361.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\51d30b7d-b9b9-4eb3-a642-206f442d3361.tmp
Size 22KB
SHA256 ca3573f877bb4aef5680546f2c45bbc734e3831cc2ee148aafc8bfe09c32599a
MD5 9e57500c8c6118762ce5732bb0a05521
SHA1 5062e65b25f7222d142630bcded42727675190d3
SHA512 438fef1055b6b271840b1e63575474a9b8e82debcf33dd239cee8598bda4d7cba11d4f930c440f0e90b9c7981037dad2bcf7539f7938ac5126bfb6cffb8548b9
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uF:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAI
TLSH
T1AAA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 167d60f98c8d6f11c6ffb1aad6d7a17b3fd5f98c1422cd29640cee6c2eb11d78
MD5 7a66b9b98ef099360ea390acadb87c2d
SHA1 d59fc4e47edc9a5985e9b0bbf28ef95c2fd0c574
SHA512 01a20dbbcebd626d973d519c28828d1b0702b3a076b2b55a8d71848a258e52e688fc7d4786d67cd08a11709b9c12ac0ab9af55802ca9316acb5ff1d6dd1a79a1
SSDEEP 384:itNn/s3n9SfsN5wqnsrsz9zX5od+S8yBpXXTd+9S82MbdbJojx96:ij+9Uyz1OflpkSixiv6
TLSH
T1A1927D326424AC2B5EE3A189F84B36174FB4907796852F84D5FC6F0D01CB6EC535BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 9174e4d328b43ac3883b2c001db3d6871ad72eb7545fbb7d8da8c6b2e984433b
MD5 bbc003146c955e4ef73248af377d0f9e
SHA1 eba42ca52e88e25b714a0ba586e0049d5061ee68
SHA512 85920c8b9aa9640101ebbb18e8de200899ea0ca1345022bd333bb89f4e4b5ed9dc70fdc4641184cd07fdca65d824dd42494c7676e398c016bfd84db4d024ed2c
SSDEEP 384:UmbFStNn/s3n9SH4sNb8TUNTUlIlkuTunshRzm2zX5od+S8yBpXXTd+DS82MbdbF:USFSj+9fGwgXzmqOflpUSixiv6
TLSH
T1BCA26C339854DC2F9EE39A88F94A32178EB45067D6856F84E2EC6F0D01DB5EC134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 17e62b1e9522969f5535f171e21f792df4b33325fff3845f922909c04f6d4c2e
MD5 cb33f785d4a8e64d5ce2cf8aecdbff2e
SHA1 25c6dde5d23a430fc8f4a7057b7be45227af6ccd
SHA512 eb7bf273c5e2f2aa95d02ab5f34b4855452e1ad5c90d9f1060c7c353a9f2f7253eee76271397c992973e6d248d8c24b188b6237042b92f3c35e8928ebf336d5e
SSDEEP 192:yON+61VWQmiUyZ0gGX5Obd+jCjzoryBpaelX/aW3aYU6:yON+6WbgGX5od+S8yBpwzYU6
TLSH
T1EC02C935A8686CB78EE2BE49B48737135FD52067E6942F84D6E81B1C00D769C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 08babee1f99e7ebd352d443cf1000ec4d94436d945b7bb04a02be19076ce43e5
MD5 c1bcf64ba5a717df722d74e255810adf
SHA1 b5397fe6a8aff6e75168b7ded4e4d43ca07d61b0
SHA512 13b48113f3212ac6f86f4e73be7492f9b062e413810528638aa7f49698df08981c8add42f151d9ff490db0252704c908d55f89d3bcee0589979226aacbb20c3c
SSDEEP 384:HtNn/s3n9SfsN54uTunshRzm2zX5od+S8yBpXXTd+9S82MbdbJojx96:Hj+9UwzmqOflpkSixiv6
TLSH
T145928D32A424AC2B5DE3A189F84B37174FB49067A6852F84E5FC6F0D01CB6EC575BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 16bfe0afd894722b011d06ac480a0bd5ecb28243f36b06c724e7f7d0a033b89a
MD5 2eeee07fa75d6ed67362e6f573559667
SHA1 ece71e12bbff68bf72b123dab6c099e68d9a6baa
SHA512 74af35f363b2327d2677a433b98414bce6b08c2848609709eb5e2cf44dbaf11d8d0493b8e4ef4f8b66950ee8595e32b22aba37099c075454b71e11ce77275904
SSDEEP 192:TONc61KWQmiUyb07GX5Obd+jCjzoryBpaellXHdFd+nwjJhq7U6:TONc6jT7GX5od+S8yBpXXTd+ISU6
TLSH
T1F512F936A468AC7B5DE2B585B88732135EE55127EB887F84D6EC1B1C00DF9DC134AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eed76fb1764f802e070aafbe564e39af09729ac4cd16578860739bac412b663e
MD5 a8ee1a00a66aeae16a2a034e8e492859
SHA1 31287a013c689363bfca4f7b6add10051e36b2ab
SHA512 978b07effd4954784c4f8165be17410008e97c569a328c756c41676c613d2063636b0ecb7044d1a43d178efb7a6bed241f7dc4961fd9a996dbe17b93428e8d02
TLSH
T172E00213530445FFC43C037511871B203BF3913403E203050D20127C0C663103E30E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588047.TMP
Size 392B
SHA256 9944637e1525148d7c00d5ec3bd39c4468b29973b0d8b0b7dddc1636b398fb95
MD5 44568962b3fc7237f52b863d9fd72244
SHA1 2091107aa2da47cfb7bc2f3d52fd64f89580689a
SHA512 0117445947b8d4480dcfbdc7ba743ce7222f561068f6e9b26708510c43f3a501bb5bea3c46dd901496a6f76396424679760ae2a8f1006965b9cdb67b92b3ba8b
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 765c2016028d5116b5b10fefd5177bfec2f2bc2c808697312ce07915e5aed936
MD5 55800fb97894cef08eef95a0a5ff479b
SHA1 647643774aae3aa187692f4698152de9d7d7f8c7
SHA512 435f6e020b00e30b223ba6a0d970b814e738f0bdfeb793a3980acf469021508fa4bbae8db74707ca56cbe1ca3a92501894d1b842305fc4ff1b99fd0d97c56ce0
TLSH
T182418D5CB6ED1148B3B37F6AABF6A5AE487A7D332E06C05D10010E4F4A22B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

362F0ABC75693A411E156690AB5BD3C68B9C0BDE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\362F0ABC75693A411E156690AB5BD3C68B9C0BDE
Size 46KB
SHA256 95abdc38896ce5b2ae3eacb656c716c81ff487bf7beb131dd34d957b59fa71f7
MD5 70c0436ee7cffa135ed9682c694da6a2
SHA1 df9c15aa7a6f4075e6c65680940f94fe343ec097
SHA512 3187afd1e53664a3183458ccbfd42ee1b6c7890bed75124f969f8914de0da3b5d6582a0912d17dcd76cf749c038c69f07792856388e2a49e5c4fdca7605ebad7
SSDEEP 768:zYyZrfFnal7ZNXmzCdgYFfxgPmqs8ewiszd/EeE0CwsBRU3qkB5V+0ko9uqqdq2:zQP2zC2Y1xes8vZ/VE0CpkgC2
TLSH
T1E423E2771774080BCD604379EA5AFAD90DE7A3137691D39B740C7781C280B8AB55FD8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7855C8BAC6A34118E24D694E4210264FC8549B17

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\7855C8BAC6A34118E24D694E4210264FC8549B17
Size 95KB
SHA256 339222f39afbccf948b98be2842e4b4a6b3add5536672f6670aa282faeaf3413
MD5 454900c3272334942e38d792a9025389
SHA1 bad2b57a7481aba37f06704db1e5606180d59861
SHA512 8be2726eac4f6c4a3f8ca5023fece470108a187c25b61602fe87f1dfe2bd388f24885c3553a0655fa0c9c06aa5a415a570a501e978a805113f9e9f54d9389722
SSDEEP 1536:hUBz73o+84Ho/uRbZ3Oqhp9knZN00G+CvJJxxi7TJ7QrcEj3aKtL8EqPb6x46y+b:hU174+zoi93anZNohJe7TJ7Q4I39t7dt
TLSH
T1749302FB6FB47682EE26153FC08A82CA1E529603A5D2E07FD51C9544C140DCBE58B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B015250BC4AE4036C67A04B2DE4188E1579B5FB3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\B015250BC4AE4036C67A04B2DE4188E1579B5FB3
Size 79KB
SHA256 2f1cca69bc3d12339ad7f4b7de6c8b405eb2baf9399724cb6ef9bc6275527468
MD5 ec3d83de5f98867d47ccea6b8bf62f86
SHA1 6978a6c35c9d1b1055878a9ebb5c7d66dc83115e
SHA512 9c4e17eb6a11b92dee969172fa6c8b319b883002d8619b04acc0375f78cb352e201d5b8a4ed75ebf930d5d38d216e526108c71ebd35dbdbcc979a9180a8e9839
SSDEEP 1536:ID/sMqK1LnmNeRUPoO+/yIhSy3+P21o12/yj1dkgCn:IDxqKENgUAn/ySAP4o8/u1yDn
TLSH
T17083027B23AE668ACC71B974CD572B4A0CB3BB17C2A0EC79BC116459D140780E85E9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E623874A6259CCB36B7C3B4F8444FAB7DF9729CE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\E623874A6259CCB36B7C3B4F8444FAB7DF9729CE
Size 88KB
SHA256 b7df05e08908a3ba6cdd7e1cd0425b208c2e2ede0efba9de14231842df1e2c21
MD5 32d109daa759ed4dc999c49ca9e0384f
SHA1 0cb6e420d35f047ac8b4e17979bdc7f68580ceb2
SHA512 d38d85faf764de3b32884b0cf21814678ff3ec2429a80a7b684112dfbde25012f62207a41f76a788243756fd12bcd97edb3a67f998f5dcafbbb07598d7679df0
SSDEEP 1536:fHWi8Tg+shYG6aBEaDefqSu9VlYrw2OhpxN/JQUI+ArOVCjzWJ1uUhfsnfhLkgC+:fHwzGFWgefqS0Gc28RArRjKJ1/D+
TLSH
T1019302376838238BD2642630CF895EBD1C9373A3959DB5617D1C6803D6C0A86BC89EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0c1be5c00eeea53e95052e333b150ea164b92319561f04b5ab19ab87bb0c1ac7
MD5 931d32fe44e1dae446c9cfda575a6678
SHA1 1c3f78004ee517ab453ff32d3939ef48ba0649ce
SHA512 b47ee59ea66a3a209117526de088c4f88b0f624803a3f0260e1a6ce78bd121252746b03165f2d2b372fc724a5a5517c47bcb95a28301f8c5d842abd59a800652
SSDEEP 192:EOv5zbowZ+fyjmRb/y1d66JozGzgCl6mc0d:HbowZ+fyjKod66JozGzgC1j
TLSH
T141E1ED68EA29963FC408137BCCA61F414F39395A984F3F15319C60582C5B6DE369E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c757bda4d1d836bc26214dee6c4cd09c12afdaeae06a023107e43144cbb8053d
MD5 38bd7029959866ab9d73bdd1cf541320
SHA1 20f0f8dd624a9c223e596ce3441b6706aeaf98ea
SHA512 9ad1e984069cbfcf2c2a4e4c42f1ca4ecfce6a1e88bc959ed1add80034effe6d4f4be375973d906e9e70bd1cac04e21771b2c9e61b47b55e7d7a9a95cdbd676a
TLSH
T1F7213B5C7DB84D2A5CCBE2ACB9C1018E53958E0705871D434D52EF8DCE91ADA326E47D
MD5 SHA1 SHA512 TLSH

Submit Download

49e1cde0-48ed-4dbc-8a75-f272d7877ce0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\49e1cde0-48ed-4dbc-8a75-f272d7877ce0
Size 886B
SHA256 dce88aacf66ba01454fb284606ec1f8884e2e8795ecd3b458695a0bf4b425a44
MD5 c7f8ff979875beda79519e060c94864d
SHA1 4f650746a5330b699e777da7f0895f331abf2e51
SHA512 0961ac5ba8e88a245decbb6c6f0fc867195327e70f80ad7e042e0f898fad31e306581285d80d7ad2c0c7e8fb4ecb6a9c37fa7d395d3f7a24b0aea594f85fbe31
TLSH
T18611E3549AB5F9B38C2C938B86D177838BE47123C4CB15147D60AA284DBE52E77A3707
MD5 SHA1 SHA512 TLSH

Submit Download

643c0e6a-fb6b-4dbc-9c52-bfc22cc11119

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\643c0e6a-fb6b-4dbc-9c52-bfc22cc11119
Size 2KB
SHA256 be84aa732401dff56ef4bacbb2c0c6f4228a70f1b7e7ea178ebda966f4c4b51d
MD5 1ada498f309e96bec6e2a9334364967a
SHA1 4115eb01591f9024f2f578c225ecd538a856a7c3
SHA512 f404d7aea0e6d205b4a054aa0298c276fb46e0520329fe5d5f8786a2598e8c0b5d6f6f9550083c4c69ff8f2c9276dfc7de32d6c7115d94762db5156a0500510a
TLSH
T16341216C36B85CB74CDAF18DD5C2238E57648A5380C628531D61EF8CCC9A6A9376A43A
MD5 SHA1 SHA512 TLSH

Submit Download

87fcac35-68a7-409b-8533-bb3d1fe1bca5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\87fcac35-68a7-409b-8533-bb3d1fe1bca5
Size 15KB
SHA256 eb60253ba9a32b4b60f49c3e8fe7b1b13e4ccf7462bfdc71b741e2f820e061f8
MD5 3174cd4a4774ff06f42af1db2798e212
SHA1 6705fab9563576e40c3eeca25d3f09ce96060f5a
SHA512 2a5fa5c940a70888b478f6b2db788215b03f3f40d16374ca429c3ab22a79a9ddd036bee9b951d7d3350b857fcb3e48e7ab5c996b7a53fc6d40a06894d8cd07f5
SSDEEP 192:b0ErWz3bDzrloAdLoXkgfPj4IUID/rR1Yl7pucDzjUR7i0+jME8+Bj/9g1m/urxs:vrWza7gEcDPUR7i0+A+Fp2rxNm
TLSH
T1AE72E956643044BA8291E3A8D4E8BFC3E5F538CF4C415FCADBE4BD086DEA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

964b6b0a-e980-469a-8d05-9bdb7dee6a5f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\964b6b0a-e980-469a-8d05-9bdb7dee6a5f
Size 235B
SHA256 f8d9ac12e8e86b838bad9bb382f9fc86c05293b594ffe0bd869d4b4608d82d04
MD5 0c66a84b3b76cf024ad428203ae9645d
SHA1 b1689a354db1fe0762c634ce38131c9500f8e133
SHA512 c42198b17b08fa02ae35249ff043fa6343801f8cf214ccdbb928e7538f0acf9575f811d2f8de6d534479c0920c2c2cb5518db6b09101411f782262065a767358
TLSH
T1DED09780289C636C0E004F17F1A028C232D88C3314696810C6A20178AAB9EC44122807
MD5 SHA1 SHA512 TLSH

Submit Download

ac97e8b1-3612-43f3-817e-f1a3f9773a99

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\ac97e8b1-3612-43f3-817e-f1a3f9773a99
Size 883B
SHA256 380448c802fd3405d208aab74bd009ef06ddf45bc0d4caa825cf4280be78f8f1
MD5 ca049887fdd37a857cf28d64ef5398ff
SHA1 f502ddf8a0386500f495f344a01fef1ff931963f
SHA512 b50c81a390570ae3b0b5c53a63fdf769222e66dd0a9e49e67ce41b68e409ee498e40288ca66b016df6cc1e4f385fe3fb72ee145a9baadd3cfe64077ec6ce7007
TLSH
T137112741E670F4B3CC2C824F8A4137528FE4722384CB44143D705D280C3F51D736660B
MD5 SHA1 SHA512 TLSH

Submit Download

d40f6333-7a7a-49e1-8bd3-7dbf16a04b94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\d40f6333-7a7a-49e1-8bd3-7dbf16a04b94
Size 235B
SHA256 d9aeb7e6672b2b8445a63b876610b776f8aea53eacde26e749b1564b6e2cda6e
MD5 8078818ae0a6b05f60fbdacd63fbaa8b
SHA1 402d1258fdff4a9ea8dc2236919f2548ff573d5f
SHA512 3b4a0dc10cdf899adce5abe044dfcbbb44f2c6978a0071f1c9dd021aa932b6b887684e7cca8371685c6f083662e3763d9f3b243ed1d6214e8926c8550aca9501
TLSH
T102D097A134EC676E2C200F1BF0F16AC630848C335460A830AA900134E9FAFC44231C26
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 a494b0510458893363ab09f011dadfecc67532955756abb61ebd22b7d135605c
MD5 7419eb0755881bbc1ed1551fd7fd0536
SHA1 ecf04f143cee900f7514ffcfa5d057ed2e8eb8e4
SHA512 e19269ce997d3117fa7fea700ac24df7228490d6edd0b0b7fb41d4012f76d786173f08a4be976479cbc0d336574e3cebfb939d51c0374ab2f7cf7aa60c5858c7
SSDEEP 96:xHrUTUmqGq6fzUL1zSoNSSlfdv9j5npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULJNSS59NWBrODBw88Jr
TLSH
T166E130789508CB6F74B677ACAC6488716AB2013BB7BF68C750B594C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 b93e47fbbedd6fe399fde71ed6991ebe36023b5a0fee9eab7477a6273f639c7a
MD5 6f46d36ac702498c5a0cf3f193378043
SHA1 340e3f45df7e185b58f85949a6ac233901d901b6
SHA512 3abeb1bb2e786d8e3a6ae17115de6968d07e555f44731467e557aaae4544a6ba17cdf61056881a58908a895a8e6433081d494a77fed84d0940184667e41a0cdd
SSDEEP 96:xHrUTUmqGq6fzJM1zSiHlSSlfdv9jQnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzJMLFSSa9NWBrODBw88Jr
TLSH
T1FFE12F789508CB6F74B677ACAC6488716AB2013BB7BF68D310B594C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 ed1390877cc1bda8cf9a1e1361cc2bffffec01cf908b45ff6232fc1069253591
MD5 1d7c7b7ff05ee645d9d6517b2dd4d7ee
SHA1 745684228f2cee4b1b2d37a9c2c99174c3071f45
SHA512 5eebff64c3adc5a1bb106a6f6186685545fc83f4fe7856acd7b387bdff65fc4e0679bc2e32e33381e867a89e7a1811f75122e4b68c4697f3128c4b7540ca8aee
SSDEEP 49152:f7l3Q9jg9SieDJY4uA+QXZaW3seb0b/uEwzG:zl3Q9jg9g+QXYW39bs/czG
TLSH
T1D3163AF824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download