eab9593140f1d1e50044111bea5e92f7e3853f6fa20cd307d37f42476d4425ea

Analysis

user interaction
yes
max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
idm.exe
Size 5.8MB
Sample260706-bec3eagz2s
SHA256 eab9593140f1d1e50044111bea5e92f7e3853f6fa20cd307d37f42476d4425ea
MD5 18a3f50aaa83f10113af3efcec3a113b
SHA1 a552f3042eadfd3c7e6a442f2d6dadac5b6f59c5
SHA512 900c9b44a7e6d88cabcda24dcc9749877b31e91929fa232d1cd4aba5e5dda2d5c89f05df440220cddae5f7fb9cb654fb1ee8fb45f88508b3ad726c219ce13614
SSDEEP 98304:FS2nDZGG4BMGlczjP1P4I0K18frP3wbzWFimaI7dlog:11GtqGlAagbzWFimaI7dl
TLSH
T118569D52BF4C817AC95A11304B2DAF2A502EBD64773465D3B2B43E7EEC713C16C3A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence phishing spyware stealer trojan

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idm.exe /onboot"	idm.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	idm.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	idm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	idm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	idm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	idm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	idm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	idm.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6432_1629808961\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6432_1629808961\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6432_139006902\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6432_139006902\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idm.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2824	msedge.exe
5280	msedge.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	idm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	idm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	idm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	idm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "idm.exe"	idm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	idm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	idm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights	idm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	idm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "idm.exe"	idm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	idm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	idm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	idm.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277734354063486"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	idm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	idm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	idm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idm.exe"	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	idm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "186"	idm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	idm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	idm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	idm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	idm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	idm.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	idm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{193F689B-8C44-4C04-BB75-197CB96BA9F3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6432	msedge.exe
6432	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5156	idm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5156	idm.exe
Token: SeDebugPrivilege	6096	firefox.exe
Token: SeDebugPrivilege	6096	firefox.exe
Token: SeBackupPrivilege	5156	idm.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
6096	firefox.exe
6096	firefox.exe
6096	firefox.exe
6096	firefox.exe
6096	firefox.exe
6096	firefox.exe
5156	idm.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5156	idm.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5156	idm.exe
5156	idm.exe
5156	idm.exe
6096	firefox.exe
5156	idm.exe
5156	idm.exe
5156	idm.exe
5156	idm.exe
5156	idm.exe
5156	idm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 2844	5156	idm.exe	89
PID 5156 wrote to memory of 5484	5156	idm.exe	90
PID 5484 wrote to memory of 6096	5484	firefox.exe	91
PID 5484 wrote to memory of 6096	5484	firefox.exe	91
PID 6096 wrote to memory of 2080	6096	firefox.exe	92
PID 6096 wrote to memory of 2080	6096	firefox.exe	92
PID 6096 wrote to memory of 2080	6096	firefox.exe	92
PID 6096 wrote to memory of 1404	6096	firefox.exe	93
PID 6096 wrote to memory of 1404	6096	firefox.exe	93
PID 6096 wrote to memory of 1404	6096	firefox.exe	93
PID 6096 wrote to memory of 1404	6096	firefox.exe	93
PID 6096 wrote to memory of 6412	6096	firefox.exe	94
PID 6096 wrote to memory of 6412	6096	firefox.exe	94
PID 6096 wrote to memory of 6412	6096	firefox.exe	94
PID 6096 wrote to memory of 6412	6096	firefox.exe	94
PID 6096 wrote to memory of 2556	6096	firefox.exe	95
PID 6096 wrote to memory of 2556	6096	firefox.exe	95
PID 6096 wrote to memory of 2556	6096	firefox.exe	95
PID 6096 wrote to memory of 6848	6096	firefox.exe	96
PID 6096 wrote to memory of 6848	6096	firefox.exe	96
PID 6096 wrote to memory of 6848	6096	firefox.exe	96
PID 6096 wrote to memory of 6848	6096	firefox.exe	96
PID 6096 wrote to memory of 400	6096	firefox.exe	97
PID 6096 wrote to memory of 400	6096	firefox.exe	97
PID 6096 wrote to memory of 400	6096	firefox.exe	97
PID 6096 wrote to memory of 400	6096	firefox.exe	97
PID 6096 wrote to memory of 256	6096	firefox.exe	98
PID 6096 wrote to memory of 256	6096	firefox.exe	98
PID 6096 wrote to memory of 256	6096	firefox.exe	98
PID 6096 wrote to memory of 256	6096	firefox.exe	98
PID 6096 wrote to memory of 3460	6096	firefox.exe	99
PID 6096 wrote to memory of 3460	6096	firefox.exe	99
PID 6096 wrote to memory of 3460	6096	firefox.exe	99
PID 6096 wrote to memory of 3460	6096	firefox.exe	99
PID 6096 wrote to memory of 2308	6096	firefox.exe	100
PID 6096 wrote to memory of 2308	6096	firefox.exe	100
PID 6096 wrote to memory of 2308	6096	firefox.exe	100
PID 6096 wrote to memory of 2308	6096	firefox.exe	100
PID 6096 wrote to memory of 1160	6096	firefox.exe	101
PID 6096 wrote to memory of 1160	6096	firefox.exe	101
PID 6096 wrote to memory of 1160	6096	firefox.exe	101
PID 6096 wrote to memory of 1160	6096	firefox.exe	101
PID 5156 wrote to memory of 3760	5156	idm.exe	102
PID 5156 wrote to memory of 1640	5156	idm.exe	103
PID 5156 wrote to memory of 4664	5156	idm.exe	104
PID 5156 wrote to memory of 7096	5156	idm.exe	105
PID 5156 wrote to memory of 3232	5156	idm.exe	108
PID 3232 wrote to memory of 1864	3232	msedge.exe	109
PID 3232 wrote to memory of 6916	3232	msedge.exe	110
PID 3232 wrote to memory of 2824	3232	msedge.exe	111
PID 3232 wrote to memory of 6916	3232	msedge.exe	110
PID 3232 wrote to memory of 6916	3232	msedge.exe	110
PID 3232 wrote to memory of 4892	3232	msedge.exe	113
PID 3232 wrote to memory of 4892	3232	msedge.exe	113
PID 3232 wrote to memory of 1652	3232	msedge.exe	114
PID 3232 wrote to memory of 1652	3232	msedge.exe	114
PID 3232 wrote to memory of 1652	3232	msedge.exe	114
PID 3232 wrote to memory of 5944	3232	msedge.exe	115
PID 3232 wrote to memory of 5944	3232	msedge.exe	115
PID 3232 wrote to memory of 5944	3232	msedge.exe	115
PID 3232 wrote to memory of 6432	3232	msedge.exe	116
PID 6432 wrote to memory of 6264	6432	msedge.exe	117
PID 6432 wrote to memory of 5376	6432	msedge.exe	119
PID 6432 wrote to memory of 5280	6432	msedge.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\idm.exe
"C:\Users\Admin\AppData\Local\Temp\idm.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:2844
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {acf4cf61-e053-40c6-b67e-10406657efdf} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {088e31e3-80d4-4366-9b4b-25d27aa65bf0} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25164 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {58b572b1-4be9-4ea0-8e18-36501cc74d23} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:6412
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27274 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {58e018e9-5c08-45dc-8ebd-4e8c1ae1a34b} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3196 -prefsLen 34773 -prefMapHandle 3200 -prefMapSize 270279 -jsInitHandle 3284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2632 -initialChannelId {6966b23c-99f3-4d9e-b7a5-a0ace6e64255} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:6848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5084 -prefsLen 35010 -prefMapHandle 5088 -prefMapSize 270279 -ipcHandle 5096 -initialChannelId {c3e6feec-7132-4203-a623-0114d2a5b9b5} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32900 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {f141c6e4-8f0b-4ee1-ac7b-3c47c2a4568d} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1620 -prefsLen 32952 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {14c3e4fa-6761-422a-87d6-c127650336c1} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {3899fe8f-165e-4242-9951-46b8ba9a8056} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5868 -prefsLen 32952 -prefMapHandle 5872 -prefMapSize 270279 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5884 -initialChannelId {5f8acac4-bec5-47c2-9edc-681e3f37da77} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:1160
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3760
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b02
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffbc11ac188,0x7ffbc11ac194,0x7ffbc11ac1a0
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,1542396234007352642,13482256519159459406,262144 --field-trial-handle=2424,i,9345770945670204230,16054857463684973353,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
    3⤵
    PID:6916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,2605708103637104796,2275769481705459,524288 --field-trial-handle=2424,i,9345770945670204230,16054857463684973353,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,14209717292303574530,15865626406879532290,524288 --field-trial-handle=2424,i,9345770945670204230,16054857463684973353,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,5727369854794578855,5248349440121926081,2097152 --field-trial-handle=2424,i,9345770945670204230,16054857463684973353,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,14290517814862735719,2101879266629125390,2097152 --field-trial-handle=2424,i,9345770945670204230,16054857463684973353,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffbc11ac188,0x7ffbc11ac194,0x7ffbc11ac1a0
      4⤵
      PID:6264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,16740478626724869329,6636307986773624585,262144 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,16192644304273396549,2326919641525643148,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
      4⤵
      System Time Discovery
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,14915481289770002203,7395636454565085119,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:13
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,3371985260559445249,17005404186402405736,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,3371985260559445249,17005404186402405736,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,9435240116708371683,2985288767675811284,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,10276705261479403654,8541210147450390033,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,12468141707185159451,6566220081887116665,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,15151885284117849946,465403714210892452,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,4470127371865475636,12968226556765991304,524288 --field-trial-handle=2480,i,5855862721242725250,14243403561553293796,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7a5c451a-c080-41d8-ab87-883068080ff5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a5c451a-c080-41d8-ab87-883068080ff5.tmp
Size 26KB
SHA256 a08d4cefb2959c7a62eb7696a8f47f45bc9bd985626db6aab084213b01aad8f2
MD5 bcc9ce774b970627bca2e5ee9b749226
SHA1 9e82223307c23231100d638e9e76613138602457
SHA512 c866d69dfa966bb98517d5ef8dfc62a0756696983e9cf61143147cb9676ee83c4a2d059d8a232c2ccfe045f3ffd278b29b2421982b810503c3ba27d12e365a79
SSDEEP 384:n5iFKtNn/s3n9SJ8N38TUNTUlIR+B1KSvgstsfLGVdcLEAZD2Uexfrrizt9hgMFm:QFKj+9ASwg9wYGVGLEAA3xfrrqt9hgTv
TLSH
T1C4C2383ADC64CE7BDCEA6B85B70A3606DEE44277D59859D8DACC1F0C01A31DE930AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55b968461c3cac4c7effa8a6c28244f55447bc6d9425abffdc980dbcf8f66a56
MD5 0f2dd8d756f52925ee56edb716c271af
SHA1 5baaa4f814deacaf47060c8d09015a8db39ce0b5
SHA512 9f360c7252debebc7f5372dc3ef1b650a635a7874dcf1f582432193203c260b088889ed1445047bad1f96fda147db83e0ec8ddfccd1d60be7a75e2fa03873bb0
TLSH
T1A1D0C0E073697941C32134F278218700F35004B1682BCA41B0C4400C8D7504A53C620B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aebb6c70ab7a24d554d6f6ac0f891eea8d0143d763ae26afd14158a62471d32c
MD5 4df2b013f915bbf768a35e9c1e788fe1
SHA1 5f99dfa4310596930be8e393c0de83bb374a10f7
SHA512 5285653806cab96614917acfa4a3f6992cd581c9ad8eb14808de784b888ecfebb44f82a0a32c756a63c062605216d2535eed0d53eb14c4498ab3ae12d2d005b5
TLSH
T148D080E077697941C32534F274158740F7555471646BCA41B0D4D10C8D7555AA7C6257
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 089123ff83e1f919c44e51b2e4696d7cdb0853a88f08496fb618f7aeabf27508
MD5 b1b7f1959473d30071afb986dcc91ec6
SHA1 d3d3c3025b9e16c459ab875e1e2ff861e4c7d383
SHA512 20b6397e7fd306ed06b0a6ad5f46d9a9b0b8c2c027f7673f63a754ff7431fbbc2a362056094502f3dff437193404195dacdad84315ee5f83b6e2c40f2303570e
TLSH
T193D023607B7A7ED1C33534F364254700F55414B366678545B184D40CCD75087A6C6797
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1f8243265e796d2f2651ad963ab087b79c12afab83da4e18b391ff88c8eda21c
MD5 e038104cb30f853d4fb4c17d93d811bd
SHA1 fd60f18b9de22295125c43e8f69d0bb409d9e4e0
SHA512 80a02ea233087329d60395883bcea2f3da0ceeeb470966e0ea39af14d3eb10d17a1e1de9cb90f04c3b5a5aab52eae358823b9066867a21e71295bab997049157
TLSH
T1D6E02BAAC921AC2708FC6B6C70954641E650132627508D4F3A3D810CCFB2B7B426682C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6f1c037041b10af5a43a14ac4eaf502b5354ab5321247c351fd7625834772779
MD5 1d1c46b54d376b80eb292b8b990baa4e
SHA1 babbb13e91f71286d86af8337763acaf960729af
SHA512 28c8197361746b0bb6780209636d22d606ce9cbe82c6257d3038445da900d72e5e1875de580f63e94fa6ad7c64bd24636c20a1c7dcad30cb08bc5fc36d23290f
SSDEEP 384:fIXwQMmQmmPhTUCcT/2YDMKBlw2O6YQpi+wpR8n75O:AXT4hwV/28BlwMdiPig
TLSH
T1FA13E63E36419C66C6FB603E095FAF37ABB2D96CD5D62ED70772B96443123622C0E490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 93a5f75bcf914814bd31fae8779b31ad9b9ebf9173f974516c0e7e47b522775a
MD5 de5d2c7bceaea3bc79d8b33e53565f80
SHA1 bc9ada0f447859a9a417194cc849ce31b83da2e7
SHA512 c4c57591b1d147e007569a5da18969a1018eeb414b6e5f2b9df9c553fbec358fcb59086ff842612758254931ce28c01949ab9cef0e0643af42d7daddc8cefa5e
SSDEEP 1536:MfK1L/7uL/aFQ6oOhb3GOUALYo4L/2L/4sDL/sh2Kkh1LcLQprDDZioah:Mi1L/iL/YWZXzL/2L/7L/sp+ah
TLSH
T1B54471F71951A01BCFA802F5D2133E3DD177811D6CE1E9E9E6784C852826F32BABDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 8728ece04cbb1f5b7ca5eb6e0b2c4ba3c444aa5bf9d37fc498b65ca7b882d088
MD5 10cdbc29cc9fb42b86210f971aa7f3b9
SHA1 12b149eeea61f389fc03b2fabf6e163811fbeef0
SHA512 1cd87fba98b87f14dbb3dcef3b437828011c57f95585feaf01488e4768c19f9ceae22a4e4f4af5fb7fcca163f9fd8dcfd2e8fe7e2d4aead7923a3f2f020db5b9
SSDEEP 24576:CGHfcNxZKwh4DwfHVqX/cnTfJqZesSgl6fZFubNiBE+cZqsG3ph7:JexZJ4DSHYX/cTfDgIZFIEBVGqPph7
TLSH
T11D866CEDCA6858C3CD639A70B0F0E9477C7413C3F994C1D6889CC584426BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 85fc9d99d3bb44bb135348d8a20d8aacd444bd3ef1f8ea5aff1727e485d27b39
MD5 d2df41a214600f9347d2c8f7acaa2943
SHA1 93176fbf4457546ea256399921f3d272976722de
SHA512 4f208aa18c0c6f4002f98bb27da3c2bd0d4e5c6fd33ae05b35c677e7a480b7a866dbba2e89aa4805f81cfd9303e432300c21da577ef7fbd7996025ebf84780fc
TLSH
T16661FCD5331289E1D3FA7F7557F1929B3634E8560E4B7E40106192348A9B34CE171EE1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f75b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f75b.TMP
Size 3KB
SHA256 d46f2a6eb9032fa1f016535fb4714eaef5461710453ed1356c68913032014c0b
MD5 5f69ac9ea64a85bbe3773ac7cd9df602
SHA1 22ef1d8a15c1fc530f8b8dcfe4a4b8299aed3ad0
SHA512 9c12ce1277c99d44d2087069a49595ca1ac1254c18129372a051bef3d2fe4d5fe0fe2eba7f8b7de24c8bce16f1e3505f9f934a025381ad405a3e3e2765b127ea
TLSH
T14F61DBD5331249E1E3FA7F7557F1929B3634E8560E4BBE40106592348A9B34CE2B1ED1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 ca1e0fe14e77ce3b946d18798e43c9bc3e02247966ece6761611b4adcf542ded
MD5 ee6cc7e2b35c3d464a51c15c8a6d335b
SHA1 6fd1600377ce827adaffc36e2555d78d6a3fb1bd
SHA512 5406a25f6ab7fa26b0068c808b9b80e4a84c887c5b0d0f9ac08bd9e3ba78d77514e6af3988ff7d6e682fa8462b755f0f02e83576ef1d30298a7d7f25916b33b3
TLSH
T181E0D8B855C7C12D69503587D5A97B49C6C03893D6896E0B1705CCC97602005BB8169A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 7a072da0b21fc5c86aa61e0317a07c59b7e7cd6373fa10220701e6a20c88c659
MD5 72dc131ac10760d2a3fba66bd91d550f
SHA1 7c36e86950b7594c8044e6dd13aeffb85b7b4221
SHA512 299b349a0075d89fc606ae09ec4c760becdeeaa46fa4b5cf75d271c15b0454dce99c6e43bfa3b06c4f06064230826e9c9f88aa551a7f31b5e3d3027beba89d1a
TLSH
T150E0263815CAC12EA5646897C3ED730986D0B52AA288394B1B4EC8486101A42BBAE2E0
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 c363d4d90d3d4371c15918dde0d78b9a5ea07073358745e172f948e3816a3024
MD5 16c363ba2d62cac4ea24a04aeef80a1d
SHA1 31784da559ef8a58789a8a8739788575477e9bca
SHA512 3abae965e5991db6754f7142db5b1997491c378d1b691c462c3592ba2761546fa98f76b9031a4abd57ab398a49fd7ee4f046021c6b61326c5bbdb7c72d2fddd5
SSDEEP 24:LLBQJY90+mhh0GY/l1rWR1PmCx9fZjsBp6UwcECjzobXufANnbNb2TCJcw+olW1q:uzBmw6QU1PzobefI9Iw1cMIkEvw
TLSH
T10B92608B1A39B803DB4A1E7A221B45359E3BD22D9FE7DD85387054641CF8182D0396EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 134c9852a88e94cb287e41260423d72294c7706f94278fbe2b667880eac36106
MD5 89c59eb1a9f4ab889f0f5dec70b3cb15
SHA1 d9cdb9441a77bfbb56baae85f7701609491dc390
SHA512 92f89fe2b652b54a241b49fb9cd50d415d2b92eaf022a5180778b4036de09c4ed5d9f1fd7ca5bae2c9ad205274cb4720066d873398e2c354544f8e5ab99c45e3
SSDEEP 96:raatejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/prbbEOVpZf24JkMfXSFR+CFqrn:ralH+bF+UI3iWGVoWN3qL/BVVV63
TLSH
T1F0240F0E5F252712CDBD913668EA44A35C7DF03F8B1366DA6C6114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 2ddbe1ad302efeb5981117f83a7cbf206b3d408c80c62c19082dbecaaacc78f2
MD5 d2d15420672ae289e8998eb737c2742a
SHA1 74420ee6b0f359ab298c10260d96638a67784769
SHA512 05a1941eff2a550efd9a9a7df4d97256a42186aa527a55a091ead97686c3fd4221733847f018cc4c8ae04c4b6203a4cc87fde7afa5c8ce51b641e4251ef4cd2f
SSDEEP 3:Ul93lljq7A/mhWJFuQ30VkWUAbl/4dwenqFtjE9SFcTpL0WWaV1vGrV9RUIHn:8G7/Vkybt4d4FS99pLTB1eB1n
TLSH
T13F028C910A60D9B3EC58AB3EA2D740EC1F773E0D8992CC01C00CCC910E01BDC8288C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 b1dad3f8f9efc2dc6662f64a398f0c07b9888e286914725201d1eb2e7fe524aa
MD5 0eaecfef36667cf190092ae642d034ce
SHA1 f2085d4f144b01dfd7337cc24a4301d854198c53
SHA512 12683dc50ef40c05e1fc1f77d3bb6a33fae6cf0942aae3e633e20b3d9e90e4d8bdb00cd5ccd735eb2916f6352605b734ec0881448b0e0882d4b0d84ce3bc0039
TLSH
T14BE0DF706ACEC26A6604208B92E9770CE7E0341BE6882A4A5B0DD889B441008F79A2D6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 7c26faec98558f8649fc89656fc47c8741dfb520d18bfddc7fb279682d9d85ee
MD5 931604e6f5a09d2eaabd993ad4729000
SHA1 86e01c48b03d3fa72a6680037549ef56b15dc733
SHA512 da2c8e3db41b65a369c92ee7e2ec16b8ef969e15a14d968c0828b463ac7e44747bc3670c1fbec1bf1ca7064e6f501124e3fa521555d89bbb13b828c2990f176d
SSDEEP 48:TWt/LopFMaty423w/a9NUuTNAwGT/A2ohwvRD9syj:6DeMatha9vAH8onj
TLSH
T187B2510E0F306225D0F41B36EDD148233F7C210D83B36689996960F2CDA266BF50A4BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2779a6d9d8303f2df06c30c06385d1b5c744b77b60a0a405df828f8e44f866ad
MD5 da26e9fdf8388238fbdf770deaf6a0ee
SHA1 0f2124c34e7d93cea035387a206c1430c0987fb5
SHA512 773b05f0a50e788b2a7bd62870d13ca25cd1115fd062f8493d516baefadf43d4d7e08149f8ac6e526ee301c67b387cc9be3d05801f0b2a326a511602003a578b
TLSH
T1EE41D2F783F4856ECE1186F0AA186E1FCE2D0515432C7D9A85E09F1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8550f085eaf075ca0bf197addbcc43fb8bedc509c2d2b275e52970fb5324129b
MD5 0557f3d810f65f7c1b838e7e7a766ebf
SHA1 89913c4e34c201c49b5001e22476d9e675570331
SHA512 671d50392100791a2621cff26b4d8cf47339ada4332e76903cfcb7aadd862267c8b579b8d5754183bc59e671c8c8ad94610f52c1461b41a184e1659d50be3d87
TLSH
T17F41B0F783F4856D8D1196F0BA186E2BCE2D0515832C7D9A89E09F1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 ac66d750dcda67f3155e6a9e1f159e2174c28aab362c4cc6f1eedf45bd8a9780
MD5 d3a27910036721e1e97511602db07823
SHA1 49648371eae7f4b4397bdbf05f34f1ecaa82b879
SHA512 fce634009fbe19ca41962b6ab8cb4809c6f3bcfc06a072211988fc140f4ff03999984e97a67c64b2809cdb9e0b45f2c1fe044acaafb3c2a9458623cf6c3cabfe
SSDEEP 96:eIEumQv8m1ccnvS6i3FHjkacf6CnFIAvy4g:eIEumQv8m1ccnvS60TP
TLSH
T101F2CDFA07276206D99444B0E4009BCFBF1A010B47B6B7DC66D847E3F7A21E2B57935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 2e5371e308fbd2f44a9ba28d2f8138054f59fa79177e7eb760722c1ae8abedbe
MD5 7c274f7b0a17da002ac8b1b98264e3bf
SHA1 3b5ffa212088563e6286bb616372bed4bc4fcef1
SHA512 4847b02ab966d8f3d1847c4188dec1b0712079759524ff44255dd22c9329612da6e356c306dddab5590c21c4e7edfe9107d5b0bbcdfe1451b983f3c87b1d486d
TLSH
T1A9C0129682F9E4761024557D5984B8856A7AD478104058E4D9E5C37CA0910FF5F16929
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3ad3a62a225909f874aee5431e96da2f23eba8cae8a8a6b0a2d0f2c9d549009a
MD5 9a26c11e0e1e9f372803c933b272db31
SHA1 d9a480867715586a3bbeeea4619916bd888daf28
SHA512 d196f709fff8329eb18f11f08362d39b2a88effec44ac9c77466f2b3f92ceb375025a7d22b0c4d7c072cf2b00ba958298f15f46286a7f0d68741808d2e8ca1a8
SSDEEP 192:sxRxRbyMqZjK1Ml8Ac6/frsdyWpV9t1tZKOOZOwzoA8pPL/g6+WNlr3X/Y4gDTfV:sxRxk06/frs8Wv9nDeZ6T/5h/qfXjZ
TLSH
T13372D81669389D7BCCDBD219FA567F53D2F81523A1905E44AAFC8B0C01E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2c95c39bcd10e5dc8927656c5b5d2103305bcb6ff1e9e103a092ad6da7996075
MD5 093aefeaebd8dfbc83b4157433400726
SHA1 eebed92bca5dd4e2abc7631bbbbf0d15bc71958c
SHA512 ab7fc08d2db92d1b55afdb8de16b06381768b6a46d4b0616c02fccf95a3f8db725cf58aeb1679d19d98b5ff8939d8022aa95b343b1ba766382e6f6bb76f9fcbe
SSDEEP 768:DckYJT7pLuL7glWg1NfgB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfSVhHgurop/YS:DckYJFE7glWg1NfgBu1jawSVdglpX
TLSH
T1EBE2EB7B680CCB7F4F804A9CEC297D9A6DA801CF96D8C95447EA840C03C67EB551A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 24a0c4bc41bd9907770b89d4503511585febd3dfbd406b0998aef6bcb020f32a
MD5 e9fcf297cfbe3de97895feb945ebd539
SHA1 90684400f8347f72b3cc6134cc74534e4e457923
SHA512 88c038209f9bb07aa9ab4bdfb0d2b0c7dddde5bf6179f0bd96fb055c2aad10514fc486bbcfb81c419d98390691a404b1f36b10c9c4943a5390e2cffbd5e7d30a
TLSH
T1C0E020300BCCC17DB416308B41D9BB0C92ECB42BD3C83D091F49C8585143914BF5E1D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 f82b9834a955aa8de2d5f577a23303fdbe5aef1bdb28a64e37d4e086aa54a790
MD5 d476187259dd0f65dc84bdadb65ce365
SHA1 4590e9ad34765985bbb75b51174daf3e79b91220
SHA512 605f90fc0a6e07eea5cdedc111a916c7a70d02b9a294f0e6acb33f0698d0f003346e22ca043e56de610cbb78c719066a948bd6c9e9d9b5ccb29b5dc84b071285
TLSH
T104E0D8701FCDC62B7346309F8299FB08C2E2B463D6E82D192B4DA848624A544734B290
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 92f841b149dcc0fe3b8baac2cff61be164619b4589f6d51126dc123f5aa23f9b
MD5 1f1c240d6a87c7887dd0cf08d35c8b25
SHA1 93a565da34ad61fe200caad15345fbe7a93ff6a9
SHA512 4d18e206bc9e867e11d9a5da23977f07a34cdf2f602b9e27e4a8f7de20aeb627971a322a954876914332ac774f63c2db5a3263a965c833b8978bf00c6b90fe3b
TLSH
T1B6E086708BC9C639640470CBC6F9FB4E86F4B816F7D83E4E570D8458A101554B7AE5D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 c1e113d6211b047588588572a29df1bd715602b753061881aed6755c52de11b2
MD5 8a1bc78bfba6fcc75e98c7f174a1a4f1
SHA1 b632ced63bc20e6ac251eaf4480319a8ad8a87c4
SHA512 d919a09882ea9cc7a40110904ec379e29e6f9257b48c9da605ab66563cdfea0638a8898d0cb7656bed811e5c14b629e4e21717f1e30963e99c977fdde97cef76
SSDEEP 192:E61PhSGGXWL8MMLOi70MjSEJB3BPorbu/drtBZnZdXZ7uDSOowgBw1OOeTgMlmb:E+PKFT3JoPuVr/ZZdpt0
TLSH
T116B20410733E32D1397D39088194982F52C27463321AA96B7BBD64EA4F67E01DEFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 5af22ec34d5fdaeeaeec35c2153f804215d2be6d6f27ae788abbd759f4cc0eb4
MD5 df304bd4461a64f379de6b67f4c402f5
SHA1 9bfcb9761f0ac430d0dc502f6688c5fd3f9778b7
SHA512 d84bcbe2ecc3f80b82371f2d322f9e80986d70e68ccb78a2653702bd9743e123d5a71ab62651fb1990c545abea407a8c303dce1b901bdd476f25f5ed235653d4
SSDEEP 384:DNrRZyCSDnxTIC2MEhIKyll7svbFKfk7:xFZJSDnieyI1l7svbF9
TLSH
T13B44850A7B747001EDE6DD725CB080771E3C716E8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 b555e4fea9ed0e0d0623840b344ae398e58b78beb3895de8f23e6e5cb114eb04
MD5 25721f588f5718efbb326a42bc42d31c
SHA1 ae47061a7b0ad9b6aa5604bd5357619dcb0bfdaf
SHA512 2a28b0edcb0107c9f77afa59f7724893b7b20188262c580006db0476850119651a13257dfa711ce9f4d68fb9881a9fa6d3beda25f2e52972ffd0f9b72a80a15f
SSDEEP 96:rZvd89+BvgxZrFQgOXMZeDWXWY1lDzseC/AWVzlrMEvWWV8FEFsJ/1hBBBBBBB:/ibOSoAszlrMEusIAsJt
TLSH
T1AB221E652F139B33C20D4AF312F68B5103D6D0C64276A66EB661085D0EE677B87EC2F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 e58bd34a03a1b0abdc1cb712ecc76a50a81188f448677195ecc8084f1cc30c5e
MD5 0c73da62e1b93274dc8575072ee76667
SHA1 d87dd1dc3a50bb88f68b128d1d42f0831fa2c886
SHA512 4b0f8638489ce6d0321c8f85a09d79b32d091e46e1b88470cfa3c486b0300c3e7a6ab9f63dc1a6fd5006db7e7c5cb8c3de91c397e615ab972651d23e09224d89
TLSH
T17BE08670AACDC26FF41520CF41E9774896D97927EB98294E5F09C85CB102254BBAF1D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 1962cf5e473f577b6acafd7e3aec3ce16dfb2d365feb5a7fb44338ea3c71bf95
MD5 24e1bfd8406ff27ce2ea079a3b272c89
SHA1 47020fe4a0da21c20aaacd54a664081bcad27ed7
SHA512 8ccea901fdacce6a700ef12c4d2eb141af76e1bac276c752c7abc35b815d3b7a488fe54e477d20442a39add8de71d64639b0514b889ac0a24ad8691b6d654e9f
TLSH
T1B5213A55F321C418E14E827E946B9B351738E8569FBCDC0F857960366D72F440E8BBE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 2903436da709ab91a66204a3c3069470450997e057b9c2c681261e3cdfc82064
MD5 57d5616c7c2ada7f7743b9db9f57ffbb
SHA1 5e2da6eceae5c5714b7c6749a4078ca22fa2e0e6
SHA512 daafcd9bef2b6240838d4c3f5bbaa9b30e220228aa22e72aac0914b972db9035597fcbd9ce0dfb2412dce8cf8e68fdf23c9c15104241eb2637c66742621950e9
TLSH
T16DE0DF70B9C8C1AFA0102087C1F9B34983D53C22FA982E0A1F0BC84CA141145BB8E2D1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 83178605190d395326022b05ec95d28b2ba32f0587eb5558c4167db2d8c302a7
MD5 87023650f73262bf68f20296139a290e
SHA1 b495003f4c1b8573d6908683e30185399a5ddb34
SHA512 ddd8ae9981c9976991a9985a883cdca7d3b4d094ca38d2f5dae0d74ee55e1d6fe1edd56e84700d4cdabe1e8bf79464d72c56601d64bd07eb20ba47881bcea41d
SSDEEP 3:MsEllllkEthXllkl2zEZlxRK:/M/xT02zYR
TLSH
T1CF4404057FC00505C7003130C011C3740375D514071157C3745144137CC55C03C15003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 624fc700d48e48f7c0a46cd33acddd80e155e6f364c383c51f60f3d47bcb444b
MD5 ba0fed07cd5b77b83f54903ce53035c6
SHA1 b97226435215c27e465542ac69b07d75edfda0a9
SHA512 ed483d8548e02e10877477aa34d672043c01dcf6f806564728dd3316ed4bf274ac3d4ccfc83a36bd245c8d70c33938456e6f0b58f1417a530589b95bec089128
SSDEEP 3:MsEllllkEthXllkl2zEZl:/M/xT02z
TLSH
T1254404057FC00C07C5503130C011C3500374DF100711F743745114137CCD5401C17043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 177fde75a515fbf26a6a3d797408d13c5203d1faa14a9e75d98217b62fdac0b0
MD5 2689c55643813f068c4255e32a561419
SHA1 dca2be70fa253de910eb1bace7608e8edcc51daa
SHA512 c53e3a4bfabeb802e0ba07b832b2bfae7c64c95cd04d0c37738a57d86ea2f132bd46bd87d5c8fffa23544c28823431ae14f1c56d197de5465747ff75fb44a782
SSDEEP 384:nFiFKtNn/s3n9SJ8N38TUNTUlIR+B1KSvgstsfLGVdcLEAZD2Uexft+FqQeMF7IZ:MFKj+9ASwg9wYGVGLEAA3xfteqQeTv
TLSH
T114B23A32DC64CE67ECEB9BC9B70A7646DEE411A385885ED8D9D95E4C00C72DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 73c6a56b8f8d6c7aa06884b4d4a395d263603bb4c273c6da2f8e4ea4118989a6
MD5 139cabcf3407196b4502da44ad7a2599
SHA1 3f8ad96c0e6220d1cfd2b59dc72ed84c75b19f36
SHA512 c6f09ec8253eeeade78d61c19afdada5675b1fe066744427c14e1f86fee8668954a0b850893de4e72de20bdce6e731cb18998c80a152a2946037871bbca80536
SSDEEP 768:uFKj+9AowgvrqYGVGLEAA3xfteEOETa+49zke7:c9A0rCGLBePAEWXFka
TLSH
T134D2283EDC54CD7F88EE7B88634E2A5699E41173C5A88998E7C80F0C81B319DE74B824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c6089018bb021f5498283fd833b6273696f39d3cc444785125433575c9a7840f
MD5 7763a8a85f7f7e30756620e86f4a5972
SHA1 35afd4cd3cbc34ea2016f1d3799015fda9522282
SHA512 9615cbead5d2634f82953dd982243597680bb20626bc36e7d4407d2dfd1cff7e1bf2fcab43f2acfb3c8a19aaf9e95a6969378864fe9df7ec02cd8dbb83475f5c
SSDEEP 768:hF1j+9XHwgYJnGVGLEAA3xfhzmn12bfeG:g9XeGGLBeD0yV
TLSH
T1B7C23936D864CAA7EDE78FC9B709774AEEE441A3C1985AD8D9D85D4C01C32DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7c6fe2c7b0fb6be8d8d2f7d9e941704deed68b83db4d395aff0c362be9507fb0
MD5 3060a0356dc56db9914dd2ef42b2c679
SHA1 7dbd4ba4382f64da606cd55bbf4301bbc7ff1bd5
SHA512 1de7fcdf8110d1c1d072e899f5d252756273e229ec29aef9aa0923b494909e66ceb034411c41d8c744207523604056dc054b08da73a1123169ee605df5940fa5
SSDEEP 3:MsEllllkEthXllkl2zEZlJ:/M/xT02z
TLSH
T1F84404457FC40405C5543530C011C350077CD51007115743355515137CC55401C07503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

59fadf68-2c3b-4d91-9eb0-71aca02a6790.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\59fadf68-2c3b-4d91-9eb0-71aca02a6790.tmp
Size 1KB
SHA256 932465590b7a6ad4b1bbcd3f77e602f7a12fe11fb826065682b79430eeb2398a
MD5 c5591da3a08071fa12b940bf8a6f0f1b
SHA1 2c10da1dca7588e9827d69a3b9d6a2b88490e3bb
SHA512 ab753d4a776e0682434a0c9d36b05e169302c2a9431fc5035bdbc8d345a30089ffb348d17a7d7cf9067b469a377ca2b04f37d51fe6c110e179e344fed4414cb7
TLSH
T1BF2115E19D3C0AD1C4BE0DAFE05B25FC94D8D215F894743D6898FDA8962DA4A354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 08758f0b1d7e6f26577509cb1580231340d8c5b1291fd1e51ccca9f66fbf3658
MD5 7b2f9b3e8dbcf1980d2fb39480a43b1a
SHA1 915fc3937cd5628675c893a189e871815f34d2a7
SHA512 5ad3201fbc6a07a28e366ee9d452d60bc988f38d9d53308a2f154c85777e27fb815541313494f0c87cb4b19e8289a1da19f75696eccb2d47573f42c6d8026c22
TLSH
T1C83122E1993C0AD2C4BD4DBFA05B25FC94EC9616F49434392888EDA8962D649258043F
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 d88c93428a36e1ea273f43703d4806e3a75f05e701c6c9bf6f6b07eb5aa493c7
MD5 3b8946020853438403cfa4680d09d719
SHA1 095affc8dc6b0ab436316c57eed2c6154feb312d
SHA512 4cd1074dae443394a900a226be55c17a582604d496c19625d3a42be88fa1e7a3595ff02d462317d9186b0ebc6ab70eb23e8a1a382d1cd0e2e02cae8c49b6ed4f
SSDEEP 768:cyd1lGUuh2xYGcm+ueDPZLRjBcyPKb7bcbNb0LwM:7GUuh+UDPZLa9
TLSH
T123D2F144EB1E953FD41912BBDCA54B002F79B88A98092F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 02ba1f3a584885c2c5a066d0079a8982926250831a33e94b98b6cb2478ff8083
MD5 0b45be08ccab7cda90f4037af1b8f803
SHA1 25bf8f12b95f87f144c1cac695b2b5c333a2c7b8
SHA512 67c57d747e0d8369bd95f5057e33497e3a8519becc143f35749acadd63e9b8c1343def69d880b6da9c628a40330e1757ac1bf2898cabd514884d283adaba27a9
SSDEEP 768:cyd1vtMGUuh2xYGcm+ueDPZLRjBcyPKb7bcbNb0Z:AGUuh+UDPZLaZ
TLSH
T1CAD2F144EB1E953FD41912BBDCA54B002F79B88A98092F673A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 180de3c5cfb4c72c3805a491beea167737c4aa8ab62d433d07a585ca3f645055
MD5 a51a4506a9b4f072aa8abe0ad1a8b87c
SHA1 2c75559eebfd41454ea41b69c39f9aba8e79e756
SHA512 2f980f198e8c11aacda036ef450a0dcfae315c374afd42a1079b19eabb60c3b02805adcefb122b9436c63840ac5245bb452454084a5948367bb729b60b27396f
SSDEEP 768:WGUuh2xYGcm+ueDPZLRjBcyPKb7bcbNb0OiGyd1/:WGUuh+UDPZLaX
TLSH
T143D20244EB1E953FD41912BBDCA54B002F79B88A98092F673A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9c58bda008444711d0fa96ccc21ec90864da81138920b536f4a5b17296eadde9
MD5 6d9b8bb55b2ee6e21aa7a0f13c8b297c
SHA1 76acb6efb45c5393867cb35b796452d84aecf080
SHA512 e6b1837086af8922e8328f5392f0f48a3903295946179dd1e1583e1705665e18509f136184073840cc9958dc1ef531e11c1024c2d19ed208e4848cb5b7ff2c68
TLSH
T1F8115C5C39F54D2998CBE2AC7481068E93534A4715971C478D92EE8DCE81ADD327E83D
MD5 SHA1 SHA512 TLSH

Submit Download

4e7bc35e-f3b5-46f2-ad8e-f28de32ba8b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\4e7bc35e-f3b5-46f2-ad8e-f28de32ba8b0
Size 886B
SHA256 f7f5fe58b8ab6bd5d0015622d1d81c5486f1b4d001096986c73a458b366a43bc
MD5 24bc7e798f48a43fbafad76cfae99b24
SHA1 a1269f2b76a3928e6a48eaefeecb3957e33e7e53
SHA512 4065719b5b90808997ca701594f22eb3c00c5f885cf96e38c3be0b800dfd1d832328aa141e6dad0ad1c72e37bacdbbcc79088a234248a0e6353691a51cbbc70a
TLSH
T1AF1104A08725F5A2CC39D34FD5D57B829BD4763380CB58147DA49B188DFB12EE36620B
MD5 SHA1 SHA512 TLSH

Submit Download

7eb60fed-40b5-440e-bb7d-3d8ec698cc32

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\7eb60fed-40b5-440e-bb7d-3d8ec698cc32
Size 871B
SHA256 641524d202622890243ca867cc78be2c8df805ec93a451b9e46957f2f32681f3
MD5 71957cc0b02a6d04f72543d9f5e30e78
SHA1 30666c86b14ee529e034ca3209db9ca56e7b4739
SHA512 7750ce36f710915c373777db2ce2127c977ae15e5df637e996850a835d0e2423625a8d1e2d293eda5a5e8eceb7ebc909d99b2f3f75189af83893a1749d76cd5b
TLSH
T1041123918334F9A2CC29D34F89963B464BE47223C0CB54147DB46A088EBF15EE36A20B
MD5 SHA1 SHA512 TLSH

Submit Download

b3d87926-8e17-4dd5-a384-9d9babfab582

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\b3d87926-8e17-4dd5-a384-9d9babfab582
Size 6KB
SHA256 5bd82cb989a36badb3a92922d6ff6692e81199f5d6d2a33e99b69a65b6f3e3ff
MD5 9786002fd534b7aadef89c635dc44393
SHA1 16dee9e372461b19668389942d339face8f0b490
SHA512 8fc00191a20e3db9470acc655b159f4cee8d5102a3272545415374b1998fc4e4a9cca26c78bceabcf882466c2a1ee4fb816f017635f1072ecb08befe0c215496
SSDEEP 96:jWD5vnmNs4HUJLLxD9Pjw9TfhiNFfSn0/VHSkEw3REIXr6o/kAoEhUtbQaxMMaUB:jWNvnnSfIZgaYJ
TLSH
T18BD1BAFECD2250433A79F52DF4A9FEAB405A293149C9839D6BFC483A32D29B70517705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4ea22ab-3801-4dee-8be6-9bc3209a9ad0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\b4ea22ab-3801-4dee-8be6-9bc3209a9ad0
Size 2KB
SHA256 779c0bddda7593a3efcf08cf21e21af89a9744629cf64a67cf21c820ab1ca9f2
MD5 0491d92fcdd177d36a23bb666105d943
SHA1 a228d01e8a380191397b7ad93a9bee08c4fb53e0
SHA512 ac0225d57c92bfc32ba3353e9e1d6075c2b43a11a03dce928b3487b49a6496f5cbf55d5e0eaa73f90e6a4b3405527c90d6b7d69ef74532a831b9d82a60f55561
TLSH
T1DD41236C3EB89C779C86E15DD8C2268D57608A0310C72C436E91EF4DCE9669D336E42B
MD5 SHA1 SHA512 TLSH

Submit Download

e68204e4-42cc-4542-a3ed-88a8eb8c0af7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\e68204e4-42cc-4542-a3ed-88a8eb8c0af7
Size 235B
SHA256 633e4fef154f641fe6f79dee567f0c5e5f23c3cd4f6b76ead70b76bb9429855f
MD5 ce5cf1a49bd7e5e566e8a38d771ab708
SHA1 dad73c8650fbb65e838cbba622709727ebc1c2dc
SHA512 16f6c6d5abc83a55c09935b734fd5960d42c50ee928d60e77de20dd6db3002ad12f14cb3f32eab64257cbeb2c885b6b01e01f5b10be6cc0d286293aac1932f9a
TLSH
T1FDD097C4288877AF08244F16F0A0BDC630484C37A8B45C10D65084BC8AB9EC401D3E16
MD5 SHA1 SHA512 TLSH

Submit Download

ed55e38e-68d5-4b42-9c5e-e8d951df6f92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\ed55e38e-68d5-4b42-9c5e-e8d951df6f92
Size 235B
SHA256 e9731587090d00bb34c87022433f39afc096b6f2e232cb474aa884a86dc578bf
MD5 db87fe64b64dd82a2c5d7b09dbb8ae63
SHA1 29b8e1b3b37a8018349beb22311c3c6058cba147
SHA512 00828f7765c3e3947eb85b97fbbe1663b88db91ede83f92fbd916e302323d6f36f3fb3e3f17a8596c4463950d03ed7d527a70cb286e26885e4d561447b6819b2
TLSH
T1BFD0978024E8671D48084F06F0E02CC630488C332074A810DA96447899BDEC502A281B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs-1.js
Size 6KB
SHA256 ca61d64aa014d6f0d08adc9dbeebbce2d12dbdfc825ea526b46da586ce4aee1f
MD5 a004727b7bfd0538269d4a965ed32b87
SHA1 ff3e25a88ffeaf54cbacb9d9fd21d2b25a59afbb
SHA512 deafae5706c15c07e414dc2c0fb5d25b4dc8d28eb14a5ce7298562b743c6f4f5f37e862b8f9235c2b257903b537cbac3e76a0a7677d4ae636ff6d1ba4e48b9f1
SSDEEP 96:xH3UTUJ1qGqAjfNlM1zSNFSSlRdv9jdnFLHDyuBw88u8L4cnlEJZy:t2REfNlMmSSjzDJBw88Wy
TLSH
T138E110789408CF7F74B6766C6C6888716AB2013B7BBF28C750B95484055CF3845FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs-1.js
Size 6KB
SHA256 8af0d0a792200e4bd495e2e371ee3b6d820ca12e58f1dfda97c0d216f03ab4af
MD5 97af4b56dce6ed2ceb47f648c7d744f0
SHA1 7e71e2cb668d99cad302b57be87468677b3bd7c7
SHA512 0b82cf56f1dc40dc8222428f11765879381ed7d977fd9edb664b12667a6aa21abe9793af0a74125f6f75bca510a64def5f7b5bdab6c1b5f4fa1f9394bdf9b5e2
SSDEEP 96:xH3UTUJ1qGqAjfNlMObzSNFSSlRdv9jdnFLHDyuBw88u8L4cnlEJZy:t2REfNlMpSSjzDJBw88Wy
TLSH
T192E130789408CF7F74B6766C6C6888716AB2013B7BBF28C750B95484015CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs.js
Size 6KB
SHA256 2574896fd7e5207e488623fca2619cf6834bf22417a24cd4883e0c48a2880511
MD5 25bb73759c086d6731df8b20856d1675
SHA1 3f46e55f35ec806eeb76ffefbf351124df3ca55b
SHA512 18e429e4a25836cdaf2014f86030e3b9fbd740290ba6f81fa52e7e9b3e32208e06c205c16644abbc0b00e2e80779c9d2e71cd4aa703d40f195b44309d765c6a6
SSDEEP 96:xH3UTUJ1qGqAjfNba1zSiSSSlRdv9jbnFLHDyuBw88u8L4cnlEJZy:t2REfNba/SSS1zDJBw88Wy
TLSH
T1F0E12F789408CF7F74B6766C6C6888716AB2013B7BBF68C750B65884015CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download