formbook | b79c727f89493db2a49f96e02a19bb20e4cc35eea630472455c013fc1cb604d8

Resubmissions

22/07/2026, 17:49

260722-wdz6rs1bmd10

22/07/2026, 16:50

260722-vcdqpshf4510

Analysis

user interaction
yes
max time kernel
997s
max time network
1000s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pago Ofix Gabar $5,217.70.tar
Size 1.2MB
Sample260722-vcdqpshf45
SHA256 b79c727f89493db2a49f96e02a19bb20e4cc35eea630472455c013fc1cb604d8
MD5 752330699219dabbc9128f112f86803f
SHA1 27994f3c909c833960e5a9df3f27a695fb7c398a
SHA512 7e0bf30c511f2ac77a9d1eeb5ef29ec4011d0d5d14dfbb9a1aee29b6015c7415abd7816f059522125e61e9846e602f8e882c06819961638bf8c0abdd17a5c217
SSDEEP 192:gea8cnSZZRXmbMeDCIqUl8C0/s/05KCW/HW/eh8cnWOWcInOWcD8CJOriZpnWJxq:YCD/s/V8C0d0x
TLSH
T1494554AC3F2465F6D5C7A6E36484C5510AFB0074BDF3BE722D1B08D4E7968B2909AE43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral3/memory/1756-30-0x0000000000A40000-0x0000000000A86000-memory.dmp	family_formbook
behavioral3/memory/2552-32-0x0000000001260000-0x00000000012A3000-memory.dmp	family_formbook

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	3008	powershell.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	3008	powershell.exe	104
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	3008	powershell.exe	104

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
59	3512	powershell.exe
60	1796	powershell.exe
62	1796	powershell.exe
63	3512	powershell.exe
67	5000	powershell.exe
68	5000	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	runas.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
2760	WScript.exe
4948	WScript.exe
1484	WScript.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3512 set thread context of 1756	3512	powershell.exe	110
PID 1756 set thread context of 3360	1756	AddInProcess32.exe	85
PID 1756 set thread context of 2552	1756	AddInProcess32.exe	111
PID 2552 set thread context of 3360	2552	runas.exe	85
PID 5000 set thread context of 4216	5000	powershell.exe	119
PID 2552 set thread context of 3304	2552	runas.exe	56
PID 2552 set thread context of 4980	2552	runas.exe	138
PID 2552 set thread context of 3416	2552	runas.exe	141

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1599005022\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1599005022\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_242431249\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_863967766\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_2090706410\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_223240415\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_223240415\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_223240415\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_863967766\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_2090706410\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_2090706410\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_223240415\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_223240415\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1513791184\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_2090706410\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_223240415\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1513791184\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1513791184\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_2014388798\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_242431249\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_863967766\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_863967766\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1513791184\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1796	powershell.exe
3512	powershell.exe
5000	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runas.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	msedge.exe
3856	chrome.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	runas.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292136048072387"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{44D99066-1AB6-4E91-B6D6-A751482072B1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3360	7zFM.exe
3360	7zFM.exe
3360	7zFM.exe
3360	7zFM.exe
3360	7zFM.exe
3360	7zFM.exe
1796	powershell.exe
3512	powershell.exe
1796	powershell.exe
3512	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3360	7zFM.exe
3304	Explorer.EXE
1948	chrome.exe
2584	msedge.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
1756	AddInProcess32.exe
3360	7zFM.exe
3360	7zFM.exe
2552	runas.exe
2552	runas.exe
2552	runas.exe
2552	runas.exe
2552	runas.exe
2552	runas.exe
2552	runas.exe
2552	runas.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3360	7zFM.exe
Token: 35	3360	7zFM.exe
Token: SeSecurityPrivilege	3360	7zFM.exe
Token: SeSecurityPrivilege	3360	7zFM.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeSecurityPrivilege	3360	7zFM.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2580	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3360	7zFM.exe
3360	7zFM.exe
3360	7zFM.exe
3360	7zFM.exe
3360	7zFM.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
2720	msedge.exe
2720	msedge.exe
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
2720	msedge.exe
2720	msedge.exe

Suspicious use of SendNotifyMessage 57 IoCs

pid	Process
2548	firefox.exe
2548	firefox.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2548	firefox.exe
2580	firefox.exe
2580	firefox.exe
2580	firefox.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3304	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 2760	3360	7zFM.exe	101
PID 3360 wrote to memory of 4948	3360	7zFM.exe	102
PID 3512 wrote to memory of 3032	3512	powershell.exe	109
PID 3512 wrote to memory of 1756	3512	powershell.exe	110
PID 3512 wrote to memory of 1756	3512	powershell.exe	110
PID 3512 wrote to memory of 1756	3512	powershell.exe	110
PID 3360 wrote to memory of 2552	3360	7zFM.exe	111
PID 5000 wrote to memory of 956	5000	powershell.exe	118
PID 5000 wrote to memory of 4216	5000	powershell.exe	119
PID 5000 wrote to memory of 4216	5000	powershell.exe	119
PID 5000 wrote to memory of 4216	5000	powershell.exe	119
PID 1040 wrote to memory of 2548	1040	firefox.exe	123
PID 1040 wrote to memory of 2548	1040	firefox.exe	123
PID 2548 wrote to memory of 2880	2548	firefox.exe	124
PID 2548 wrote to memory of 2880	2548	firefox.exe	124
PID 2548 wrote to memory of 2880	2548	firefox.exe	124
PID 2548 wrote to memory of 4516	2548	firefox.exe	125
PID 2548 wrote to memory of 4516	2548	firefox.exe	125
PID 2548 wrote to memory of 4516	2548	firefox.exe	125
PID 2548 wrote to memory of 4516	2548	firefox.exe	125
PID 2548 wrote to memory of 1108	2548	firefox.exe	127
PID 2548 wrote to memory of 1108	2548	firefox.exe	127
PID 2548 wrote to memory of 1108	2548	firefox.exe	127
PID 2548 wrote to memory of 1108	2548	firefox.exe	127
PID 2548 wrote to memory of 2664	2548	firefox.exe	128
PID 2548 wrote to memory of 2664	2548	firefox.exe	128
PID 2548 wrote to memory of 2664	2548	firefox.exe	128
PID 2548 wrote to memory of 4052	2548	firefox.exe	129
PID 2548 wrote to memory of 4052	2548	firefox.exe	129
PID 2548 wrote to memory of 4052	2548	firefox.exe	129
PID 2548 wrote to memory of 4052	2548	firefox.exe	129
PID 2548 wrote to memory of 4988	2548	firefox.exe	130
PID 2548 wrote to memory of 4988	2548	firefox.exe	130
PID 2548 wrote to memory of 4988	2548	firefox.exe	130
PID 2548 wrote to memory of 4988	2548	firefox.exe	130
PID 2548 wrote to memory of 3888	2548	firefox.exe	131
PID 2548 wrote to memory of 3888	2548	firefox.exe	131
PID 2548 wrote to memory of 3888	2548	firefox.exe	131
PID 2548 wrote to memory of 3888	2548	firefox.exe	131
PID 2548 wrote to memory of 3088	2548	firefox.exe	132
PID 2548 wrote to memory of 3088	2548	firefox.exe	132
PID 2548 wrote to memory of 3088	2548	firefox.exe	132
PID 2548 wrote to memory of 3088	2548	firefox.exe	132
PID 2548 wrote to memory of 1048	2548	firefox.exe	133
PID 2548 wrote to memory of 1048	2548	firefox.exe	133
PID 2548 wrote to memory of 1048	2548	firefox.exe	133
PID 2548 wrote to memory of 1048	2548	firefox.exe	133
PID 2548 wrote to memory of 5056	2548	firefox.exe	134
PID 2548 wrote to memory of 5056	2548	firefox.exe	134
PID 2548 wrote to memory of 5056	2548	firefox.exe	134
PID 2548 wrote to memory of 5056	2548	firefox.exe	134
PID 2548 wrote to memory of 5024	2548	firefox.exe	135
PID 2548 wrote to memory of 5024	2548	firefox.exe	135
PID 2548 wrote to memory of 5024	2548	firefox.exe	135
PID 2548 wrote to memory of 5024	2548	firefox.exe	135
PID 2548 wrote to memory of 2620	2548	firefox.exe	136
PID 2548 wrote to memory of 2620	2548	firefox.exe	136
PID 2548 wrote to memory of 2620	2548	firefox.exe	136
PID 2548 wrote to memory of 2620	2548	firefox.exe	136
PID 2548 wrote to memory of 2580	2548	firefox.exe	137
PID 2552 wrote to memory of 4980	2552	runas.exe	138
PID 2552 wrote to memory of 3416	2552	runas.exe	141
PID 3304 wrote to memory of 2636	3304	Explorer.EXE	142
PID 2636 wrote to memory of 3280	2636	chrome.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	runas.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Pago Ofix Gabar $5,217.70.tar"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zO02D00FAC\Pago Ofix Gabar $5,217.70.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2760
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zO02D6FDAC\Pago Ofix Gabar $5,217.70.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4948
- - C:\Windows\SysWOW64\runas.exe
    "C:\Windows\SysWOW64\runas.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    PID:2552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4980
  - - C:\Program Files\Mozilla Firefox\Firefox.exe
      "C:\Program Files\Mozilla Firefox\Firefox.exe"
      4⤵
      PID:3416
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Pago Ofix Gabar $5,217.70.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1484
- C:\Windows\System32\Notepad.exe
  "C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\Pago Ofix Gabar $5,217.70.vbs
  2⤵
  PID:4800
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {196d382d-b02d-4381-b8dc-7e64d372c041} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {5b8d8c34-7f4b-48ab-99bf-edbd30cffc21} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:4516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3684 -prefsLen 27276 -prefMapHandle 3688 -prefMapSize 270279 -jsInitHandle 3692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3700 -initialChannelId {13f9280a-8994-4389-9426-c1433c9cd34f} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3864 -prefsLen 27276 -prefMapHandle 3868 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {e6c98875-3e6a-4879-b2dc-464b981bf583} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2744 -prefsLen 34775 -prefMapHandle 4376 -prefMapSize 270279 -jsInitHandle 4392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4432 -initialChannelId {5220336b-b2ff-4e70-985a-344a7d03f4e8} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4848 -prefsLen 34931 -prefMapHandle 4856 -prefMapSize 270279 -ipcHandle 4888 -initialChannelId {d32a9a1a-2f50-4d8a-9306-1f37163ead6d} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32952 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {05ad7522-b528-4fe0-9f01-5ef2931fb130} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2860 -prefsLen 32952 -prefMapHandle 3192 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {e6a87a3c-b4aa-48e0-b989-1db34a432431} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32952 -prefMapHandle 5556 -prefMapSize 270279 -jsInitHandle 5560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {a35ebfcd-4126-4a5e-ab46-dbac8a40b99d} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1048
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6216 -prefsLen 33031 -prefMapHandle 6196 -prefMapSize 270279 -jsInitHandle 6360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6336 -initialChannelId {64e3aec7-02a2-48d0-a1d9-d23378203fac} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6448 -prefsLen 33031 -prefMapHandle 6452 -prefMapSize 270279 -jsInitHandle 6456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6464 -initialChannelId {6b096e8a-a9f9-4d07-ab28-b2df657e495e} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:5024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6676 -prefsLen 33031 -prefMapHandle 6680 -prefMapSize 270279 -jsInitHandle 6684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6692 -initialChannelId {02a9a7a9-a2ae-4c9a-9a4a-df0ec791181e} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      Checks processor information in registry
      PID:2620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 6148 -prefsLen 35160 -prefMapHandle 6724 -prefMapSize 270279 -ipcHandle 6680 -initialChannelId {eddabc15-d195-4d29-ac61-d16b3501b0b8} -parentPid 2548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2548" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ff9c004c728,0x7ff9c004c734,0x7ff9c004c740
    3⤵
    PID:3280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,10228548923896602002,9275320798133468262,262144 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:3440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,12719802270095646263,496959001388657158,524288 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,8623173941806593267,17979435494868954670,524288 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,16386933244842324614,4457256153781277183,2097152 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,3572464940886499252,10391827986913912347,2097152 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:2820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,18192358077450734583,13700413494795389059,2097152 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:2
    3⤵
    PID:4224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,13333431204139409925,598248046784079167,2097152 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4632 /prefetch:1
    3⤵
    PID:412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,17647748951073180475,10368968950900055717,524288 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
    3⤵
    PID:3104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,1278657684899277999,12291264961155747887,2097152 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:1556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4760,i,9473693391033044869,10203105014567606613,2097152 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
    3⤵
    PID:3848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3288,i,37925986567623335,8677868527603583166,2097152 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,5733200933427158189,7476537191014974984,524288 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,580447623054959820,3290467078495790996,524288 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3708 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,2589856483975674002,6141510770516038,524288 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:8
    3⤵
    PID:2712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3704,i,15944905451144274635,6271928937858421743,524288 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:8
    3⤵
    PID:2544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,13527443115430547778,12040331268564673157,524288 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:8
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4336,i,4618279192153363875,8378643470419808415,262144 --field-trial-handle=2084,i,2638461016337564002,11451782265312786428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ff9bf22c188,0x7ff9bf22c194,0x7ff9bf22c1a0
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,3386700191739534292,14548810583342841999,262144 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,10942534440250786357,8601180596048515956,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
      4⤵
      System Time Discovery
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,7319588400802263288,12177426765596633718,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,5487860228334617145,2217405086156759144,2097152 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,14114031245164723213,10293678784371424746,2097152 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,14122323774093655863,11417898822797662064,2097152 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,14243151077642768685,12058533871973126952,2097152 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:2
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,13282071888315020685,1618159244394971407,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,13970546893730708628,11509565988137642268,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,8707665571155157644,1996776583074244892,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
      4⤵
      PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,771952452864748333,2781887203699921908,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7580793193807812130,6437055885820044440,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7580793193807812130,6437055885820044440,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,5784291981988532624,9023076783097826861,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,11182226642748307403,17746137700425859913,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,844827943399980803,1251099031297448075,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,2047291769959562690,1581366254804024174,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,6262744649277012638,4544721877697842743,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,610121248675748160,9874899031291716769,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6572,i,5420452598318293902,1952630618006895838,2097152 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6896,i,18077839292684822866,2405219156514777719,2097152 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4624,i,9257566737094737993,14185897783256083767,2097152 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,3671353697163515329,9751298249457693990,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6240808397409111281,531015327059616555,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,1867550211400188070,13962933756635100796,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      PID:520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,11694471642741446792,3942011712575683797,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,14152591055420560640,16649153807738256301,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,10208311735138167615,4945213651649075415,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2092330680801664959,10595793612628658293,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,17237398243631256963,8138838959368000299,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5604,i,11145007515510283313,11247029700384391528,262144 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,3767315428123538969,7848245835887032448,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3418273382762957971,7227348347843966254,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,3811870671064077021,8342180690310190852,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,5114559130235191492,2820339543577234329,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,14194174411596136253,5709779301608419347,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,245728128770712575,293813597581230524,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,11466448430621733414,10989476995154376835,524288 --field-trial-handle=2268,i,2918867993592984595,12299525320756363400,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
      4⤵
      PID:4252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:magpie"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:magpie"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:1756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:magpie"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1513791184\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1513791184\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2720_1599005022\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2720_2014388798\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2720_2090706410\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2720_223240415\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2720_242431249\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2720_863967766\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

4fa976bb-a96a-4c12-b954-832d820f1a4d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4fa976bb-a96a-4c12-b954-832d820f1a4d.tmp
Size 236KB
SHA256 416c276efa9bc839beb14cfa141e175a871d9d3b769b6efc83038d833fbc229e
MD5 7e1835df4cf01a6cfe51e8879e996b90
SHA1 5d82d15735aca2bdd194d24acfe4a94466fb7920
SHA512 5b9e86175a7f6d9532be2b44d93132cc77c0a55a38481c8aa4f90886bc25be41f76d0b8295f51201a72dc352407388ea5d242810aeacf1b6a07f3fee3b56e51a
SSDEEP 6144:nPIdXPwAqLSYe4NJHm7Rkm1tYpBeh2BAox:AdXPwzDfA9oBGcAox
TLSH
T12C34133BACA4A97788B8F70790092B3F4CF1AB65CD25D995DCD89F0077BD9840A45B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6cdb42f58c9dabeae65400805637bf8e42d4257489fe0eff114b3c3e17d4d8b3
MD5 ee4e50dd3dc3ed84f25cf5c803c121ce
SHA1 1546ca011bfc79aea196fc93ec1a8e7a8ce9e979
SHA512 2483d5178474dc5a0bbc9299b61018ad0916b63ed8750ffb7e9430070683d3c435e2697e2cad3e7220f2d584afba9d31b7e07de84ca1252b4a1b27b5f4d53dd0
TLSH
T14CE02B9AC922EC270DFD476DA0904A46EA6123571B60845B3B3C82188FF06AB03C5D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 41KB
SHA256 f6c3fba12e2d15468a38b654eb229406d9ec73536ffaccaab041dec3cd95f823
MD5 5772c855740b74dac40bc9f5be06e4b0
SHA1 e8468919f7fe58bb9c76aeea3c0e8c80801ee075
SHA512 f083e31bef2828377575eaa1ca1547206576ba2fc504f604d9e182975d4e5604dd2b98f52735c0ac44e01bcd483579fb7a092a1fb78fe4e1217d01cf8b28f5e7
SSDEEP 768:zQjU6BjWNV4Dz6KVdCRb2ixjljLTaklB2edEeutBKL3JDC/cI8zcVMnvF6++w16u:zQjUoKXsZVdI2i1lHlUP/GzcVMnvFVwu
TLSH
T18D13021F1F280E555319881F70AE46898C9CFB86A3662F197B5E53CA042DB7CC204BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 51KB
SHA256 d17aaf11a0a356c77f2f0dd08cc92988c2adbfe18b49c221f778c65dd6f4efdb
MD5 0cf06a8ca33571f7d6980112659ea62e
SHA1 554218e74443395b7dfac65824b23e21d10862f3
SHA512 f81f441d5be22dfde10a39e27f35aef6de4acf0d53dd91236c0c310e29fe5b11b656a8169806d2e40e50770bd711d24744517b8ee5e2e21ea25e5c745fad2cde
SSDEEP 1536:3n/CMZOQz8/kwwQtM5VmRNkFsm5/RaVmcC/X19+djnoL:3qx7/z1M5MRNkFs+/RaVPFCL
TLSH
T148330212FD444DDDDE6F8C1AB572D392DAE6AE34AB4702D1F88DD699637F4C10C824A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 babd7f042700b73716534f33088134a35e211351a20e54cb977109f1041b96f1
MD5 7128b33d79c09ec57672d39ed581ed8a
SHA1 8719fb4f81997ae2b4888880e9d7f279046269af
SHA512 8947aa4c9c78f08681fd18b9c9db303009a9f02412df4796855ab982db8dd1f1c788f12859103a3a7def7d1b97973cb81ace1bcad3ecb80c39ad4c70a7ae911e
TLSH
T1B9F026405CC955C7CF6409B30BEC1880BA2E0728035F6F03C56856BC51E2BE2D20A90F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 772710dfc6cb2769aae6aca43b54d62ad904491cec604290dd038e72890eef44
MD5 35a42c9fe34f2b71e501f31665a2c62e
SHA1 8758bfd3505e5bab3dcb071d7da166c867bf60cb
SHA512 299faf438771d9357099bdd9c6dbbca3526a02927ce57a2c52ca6828390791d301da5a608d621c6386ec6bd42f625776a0262e54a231568e11f6a501b5598937
TLSH
T1D1F0DF555CC45587CF1409730FFD5980BA2A036C036F6F03E5A856BC21E2BE2D20684F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 3c93a3863e5e85e3abcac4b62b0f64af92301cd04582cb02243fdfe50f7bc514
MD5 e02f7ecee0f65e1286e1e9244b925272
SHA1 e696a6ae9f3d10a4dcf303237cb587c0c994cec1
SHA512 609838a8d8d4d85c48ec3cab500b9a849f99a32244ddba4d786552209a418f73b149bf51da55a534c379ac294a79cbb153e6d1b82cce5399679e48d25a76269e
SSDEEP 3:MsEllllkEthXllkl2zEgltTlX:/M/xT02zjn
TLSH
T1CE440415FFC05415C5043070C533C3503370D4544515574334F50417DDC75C04C70001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9313870c41d8f65a2ec407b1ce5957dc4b66d2adb5b17aa5132212c993dd0c09
MD5 bedc97db5438c64cc21d19b3835d1ffb
SHA1 56f0cf2f0e36e552fa1ba66466698d09fca7accc
SHA512 3f289aa18975d926b7824f0605ac923aab615af11eaf24954b782dcdb7dc3ae995cdcbd41ba785d1cca1935cca7f21c9799948bada91c8b340212564286c069f
SSDEEP 192:DpwtWoxl6xaRcaIkTmvR7++qLhV2V9xb+dJQgV+2Z:DpwtWoxl6xaRcaIkTmvR7++qLhVg9xb0
TLSH
T177F16CF3C3E49A3DC80172F59F247E1BCE2D096462683D67C9E5EE8A53E6472D24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 83058957f65c4b97060b280176f36709430be1d4c1f08b563fe5fedd77d87cde
MD5 80a8dfe30f0a8c17a85a25a027c82d6e
SHA1 dc4e276da3accca29c0328f9874d3018ea57818d
SHA512 3e05fd052940a1fb8a61d0d478e4b21769f0dc9a7b9b8954494d9c4ecafeb9f4a848c0ac1ef59e1e53f42c8f81e77f42ebd0d12567f655d8110f70abdf163b84
SSDEEP 192:DpwtWoxl6xaRgo8aIkTmvR7+gLhV2V9xbcVDJS22OiMubAnPaD6R:DpwtWoxl6xaRgo8aIkTmvR7+gLhVg9x2
TLSH
T1A6126DF3C3E48A3DC81172F59F287E1BCD2D092462683D67C9E5EE8A53E5472E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 fafb69adcc62f4933b852dadfdf456731b38c8aeb9b8d0505be347d823d1a69a
MD5 05ea7990c575b381c1c0e3928c40bbec
SHA1 ae55c615d0c269cd62944e8c28618448cf1ec0ea
SHA512 e4eee48e2ab8785f92ed7c408884ca92c5023633ce7715c1622cdc3a7cc048ef8746b6a6dfec48d4b31617583cfdad9ed1dd1b90df80affcf4d5f7e908984694
SSDEEP 192:DpwtWoxl6xaRg0aIkTmvR7+gLhV2V9xbcVDlGuSHbmAjPPZ:DpwtWoxl6xaRg0aIkTmvR7+gLhVg9xbX
TLSH
T135025DF3C3E48A3DC80172F59F287E1BCD2D092462683D67C9E5EE8A53E5472E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 4ee57d2556c478e958cf9bae4ade81790cb17902dd49c90956598d2c16226b80
MD5 4d0712ecf5b73b5ad8a8023db74da8f7
SHA1 cdb9b55f1d814751cb10fb40765c5818fc86b152
SHA512 d8739be95a93906c243f9c7237b6d81df7e0bd96bf2cce0214bae3a8daafe93b26dadeceba7780ff27877ea49e8a0bf5d3d28173ea0aa865b33c09b94c4076eb
TLSH
T12A213AA786BFB497503D59BB1E04BC0B697BB8351192B8F0DA6E40ACB0D49A35B02457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6ea89ce1b2b9f108afea63bae934992e1f655b99496f0daf7544fe484e422567
MD5 12ef980530878acc802e02c2924cff24
SHA1 fdc780e84abd3b2d3c8fa2a6cb63bacb02b70f60
SHA512 e768179c01e1585ef1acd18382f608a1e8838c2f707ef55ecfa26b85ff68d33990193a14a63a386c7118c6fdf90d9d323e6814dc152ed347cb772f9d7e910145
SSDEEP 192:qRf+yLa8Cz8v7ApAPRp2XQP9qHsb+WNnOjOHmb20jvOY6M3VyIsnAUgtaJ:qRf+XokUXFkwgb2s98
TLSH
T11D52D92EEA10697B9CDBC229FA527B17D7F2103561942EC4D6FC8A2C15D76CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e93eef86f842f5b7cf4b3a378e5c2f67667cff8b36dcb7b3e4d05e299e029dca
MD5 d3e16c9ba985aa48846052dbf12f1891
SHA1 596d1098899ca406b30acd66ecdeef2591fb976d
SHA512 6c438bed4067fd05e99c29e3f4e00cf0c51726ce686a95872653baf906790ce589e2919ac525fc36a023d389dd62b498ef7d61a8d76ab8f76c9ffef174c27496
SSDEEP 192:qRf+yLa8Cz5v7ApvPRpXXQP9qHsb+WNnOjOn8mqvOY6MhVyIsnAUgraJ:qRf+XZktXWkwgxmQDe
TLSH
T13652D82EE910697B9CDBD229FA527B17E7F1103561942EC4E6FC8A2C15D76CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bee1bd9b2ad7270c4d84cde51b14167f53420672f67569f56a4fe9d4fbfc3175
MD5 b215f1c7c5e49efe96d0d0b24957215a
SHA1 544e5765800bc42503897a622ac8121522ad888e
SHA512 002c1321d0c94cc6e38db2d5b9623ab1f1b13763ba51b657d59f8484736a001c6ab80092bec912b4120219e82f88e26fdac6060a146d3b7ddf0e63ed09616756
SSDEEP 192:qRf+yLa8Czvv7ApvPRpXXQP9qHsb+WNnOjOWlE7vOY6MhVyIsnAUgraJ:qRf+XnktXWkwg9ETDe
TLSH
T12E52D72EE910697B9CDBD229FA527B17E7F1103561942EC4E6FC8A2C15D76CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2a6ba3e9d4f1591eefb6785af0bd612da714162ffd6e24f5f86dd5e8e4ef92e8
MD5 002cf62b4310bd6d4ca90ed5d3aa3704
SHA1 42c320461196010d0c941611444c58fc2e29915e
SHA512 4ec1a91b2ac3d1796a2ce050e584a7dd49d5a747f006869dad7c92221d0ec3c1af3e057d49923c8c0808fd774ce9e03570ebf672d9cde0e8afeda22108de39bd
SSDEEP 192:qRf+yLa8CzRv7ApvPRpXXQP9qHsb+WNnOjOUTeVvOY6MhVyIsnAUgraJ:qRf+XBktXWkwg1edDe
TLSH
T10B52D72EE910697B9CDBD229FA527B17E7F1103561942EC4E6FC8A2C15E76CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b078ecf5d17a057fa22987e8c7d3f41bcbf6246773a81d2d014b6d23293d58b1
MD5 508bd139096de7464dc61719b9f43e49
SHA1 84c60d0a4909d3f92059ad96662553e7f9d7c87a
SHA512 95c9c2586b49fe77bccad3f7e4cc58d80c371ad8e6efdbaac2d5430840aaaecb61a8d97994e7c35bfefbc84b41976750fd3ff626d38824c13855e753b078aa70
SSDEEP 192:qRf+yLa8CzjYv7ApAPRp2XQP9qHsb+WNnOjOPQeBvOY6MlVyIsnAUgraJ:qRf+XokUXFkwgve5ve
TLSH
T15052D82EEA10697B9CDBD229FA527B17E7F2103561942EC4D6FC8A2C15D76CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bae4af7745fadde0ccac21271aefa1020c61542f0b0fd0306e518a03bae5f0d0
MD5 22b077f67874f22b49cbdf6f518e7c36
SHA1 9355fce956b95e39defa8a6d0cf93ed825152319
SHA512 e8eb260a3af02baafd1e3172f71e9ab2b70b46594bf5e2ed1e64371b9f76738d9dde0c9bf33132decc8f8c2324cc019c56259cc28edd3ace0cd905e6563e148b
SSDEEP 192:qRf+yLa8Czfv7ApvPRpXXQP9qHsb+WNnOjO+VyrvOY6MhVyIsnAUgraJ:qRf+X3ktXWkwg5yjDe
TLSH
T13352D82EE910697B9CDBD229FA527B17E7F1103561942EC4E6FC8A2C15E76CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b25ead7261e92eb9bda99c107730f05eb7a682580af63336f407182c061cfbf5
MD5 f1ae6d9de876e13838e39b352d0857da
SHA1 dd223e9d1b4cf076e2fa910c13a1ddcec2a72384
SHA512 c235342f107c383a35f10f7a44de64d103104dc9f356776ba9891158d6a4ac679bf010322235a22c1bd4119c6687d5b7f4d596413733ce16fd6e6d8490b1e718
SSDEEP 192:qRf+yLa8CzOv7ApvPRpXXQP9qHsb+WNVzOjOczUkvOY6MCPyIsnAUgraJ:qRf+XqktXWkwSRUiwe
TLSH
T10B52C72FA910697B9CDBC269FA527B17E7F1103561942EC4E6FC8A2C15E76CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 d287531b6aab9564be327c9deebb05fc51052e551d536ea8a681dc179fe08999
MD5 76f44e9fc690b90209ff719219859bfa
SHA1 7a32f0b1642e35fbdbca77a60f738a974302349d
SHA512 efd73be01e6e22d7a316d7bf5c25dfdbbc0090acd0999ae0b45b24a1dd0d82cc9938a16acf1d86824c1cd97890376dc6994ddfc92377751611021ac8d6b248b5
TLSH
T1E7C01282C503B121C04603FD108BA89C7128DF25DA0F137CC7E8BB6AFC34220C0152E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe61a25a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe61a25a.TMP
Size 96B
SHA256 20292216bdf5603aacf3d02f7c3bdfe6e354efd2275409b5106d4660172c3624
MD5 34fffc5550aabf56b426a567486e9e6b
SHA1 64ea6602438dc01411f9b5d5a2e3ac36350931f6
SHA512 598e5fbfb6c789cb650c0638f42565cfdb1f6cc566f21200e43aea76cea6db65edbebaca0611be51cb3d22b852305ff43b08fcca65617f641eb5a03f6b33cf5e
TLSH
T1F7B0025AC2426312C84343B07EA5E9DCF260DF25C6432327D3E41AAEDD26660C5257A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 707d715655f7a47a66337ba061f1602bc8a4ac604093ff9dd9ae63e8babfed1f
MD5 04362dd1b12566ef6aee56b1c826bf18
SHA1 1e550aa8aeecf2acf635cfa606d251acfd8b3f65
SHA512 8afa7622e0c00f29fe6187d3ed52889ada720c5c9740d870087f08f1c66163a843e728aa9d6c3389dd42056facbd1781c1b28ac01b1c9589b681e8e5316c8d97
SSDEEP 6144:WLIdXPwAqLSYe4NJHm7Rkm1tYpBeh2BAox:pdXPwzDfA9oBGcAox
TLSH
T1A134133BACA4997788B9F707900A2B3F4CF19BA5CD25D996CCD89F0077BD9840A45B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 cfc2b956bcb506ce66af27937a142729caa65f35c5552fc6078ebb770ed4d4c4
MD5 182f21ce12cfe1d3d464f21fd1aba83f
SHA1 1aa132f893f5051927954cc4b17685129dd8a628
SHA512 294542ea2028df9901cd6260ec97c10d2eae9c227b97558b6717df2d986e1aeb3663ffae167c71f111788da9d04482a49c3ab1fa914bf7bae74ccb111ef8aede
SSDEEP 6144:pIdXPwAqLSYe4NJHm7Rkm1tYpBeh2BAox:SdXPwzDfA9oBGcAox
TLSH
T1DA34132B9CA8A53B44BCF307A00E1B3F55F19BA5CD25D596CDD89B006BB8EC80749B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 790fc43e279928c53ea86a484781652e4b36ccaaa078badfc125fbcbb0adc547
MD5 82128c10b40ec0075bed11d15681d524
SHA1 dd844c6ce2e9f7e6c820c7e28a5b68c4fcfde5a9
SHA512 3814050e411dbd32b09492b81ddae6b2005aa850eef9480b4d95a8d7be829323d7291c21203d8a25bf274cd0f1a0926a2f72c19354f5a643479ecb10d95f8b99
SSDEEP 6144:KH66IdXPwAqLSYe4NJHm7Rkm1tYpBeh2BAox:XdXPwzDfA9oBGcAox
TLSH
T18044133BAC64A93748FCF70B90091A3E4CF19B69C835D896DCD8AF0076BD9840949E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 0acd34a69a54b609887884034983bd5274ef781e619b575f7c58d3fddaef539b
MD5 4aa6d8bc1ff713ee646085ff6775b148
SHA1 4940f37886f0afa5bc1d5dedf2deb3877cba662f
SHA512 8a0f72c4bc69e90d2e81c6b75a2294bf1628aafcd491065805adab5e0d37239fec7c6b094ef97350c115d3ff3e0fd4688505e315a1d82568d61697c0f3a93a7c
SSDEEP 6144:kIdXPwAqLSYe4NJHm7Rkm1tYpBeh2BAox:7dXPwzDfA9oBGcAox
TLSH
T16734132B9CA8A53B44BCF707A00E1B3F55F19BA5CD25D596CDD89B006BB8EC80749B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cc966ca4cba21817414470ce70976f60f01c2047765d13ef5d141275f27b0255
MD5 6e7a789e7ebb873e06b057c5deb4d1cb
SHA1 0f3383a7bfca4426feabe10d9c77340125e87d95
SHA512 46bf50ad00f46138612b9875f165e4eb295266f92471bc3493403649d98fde0663b9092587394c022ab06111180719f14834d625f0751eb9e1a86a802fc07ea7
SSDEEP 3072:AcGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Am7Rkm1tYpBeh2BAog
TLSH
T1AEC3023B5D75EC3B5CB5A74EB08E0B1E2EF149A6C930DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
MD5 f41839a3fe2888c8b3050197bc9a0a05
SHA1 0798941aaf7a53a11ea9ed589752890aee069729
SHA512 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
TLSH
T11161EE323275B1D8C9167F071E28198053BF4396EAA4AF0CB298625EDD2601B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 127KB
SHA256 28ede68469dd63617234463a868cdaf4c7978ada9f78453c4621926130a89999
MD5 55c8d1d8c5f317295c9ebb6382090f40
SHA1 779d30ff95d4775c1f559fa4067e172a58b7937d
SHA512 67ed5bde0a89420123ede221b3e9e81bd1af357ad7106c525fb9f071741fbfa693d00084e571ff9a5d965753bf20c9c79aa1e3b6b22966cd81b31e0cddc751f4
SSDEEP 3072:DfnEGoSrCbIgbScl6KK6gdodWx5RT6RAaB4NgCSVe68lDfUG:DfEbkgWcoXnRT6RNB4NgCYe6kDf
TLSH
T1C3D3127120324C8B7914A97BF33259DF01A71AD23F38A36D8DC969B7B634B176D88781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 130KB
SHA256 c8026b445daa0fb4a92529b172f5e7a3f52db11bcce90bd3b8d54c125909c214
MD5 ba088a129c941676b866bf20a70bfdd6
SHA1 75e042bf00d68260d2e4cfba3c4c8e9aede2c9d0
SHA512 0142b4356e8d615cabf79d158f58e4bb722236ee34348cf36134f06b0072ff5690a4b7ae18feff72bddd4fcda3f3f0191cc09f06668ca3441b0b83bf60cb23a2
SSDEEP 3072:fzAQaijTntxTqzPDbNvf/Cd5q3YorweL3sGdJALwxB1HapZzb:bAjiXTTqrDb92qtLx+g7HapZ/
TLSH
T14DD312CB4280CC39ADC87971CD0638BC866D3D5CC2976A87B7F211ACBD109D6EA89D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 627KB
SHA256 7e54eb94659e398fb824c490e338e9aea8fb6edf232b2e65fe9082fff1623717
MD5 34192fb2e5c2d968f3de9e6e9b2bea5e
SHA1 c6127dd5eb846da925e988309129f3e00274cf2f
SHA512 43d402f3a72805e74c88d174f7d757a8e9d7609dea331809bf5d62a692885dc46de20e68598c9ce90429ed1f1d59482b9fa2901a62cd93c34a9da93c05c0f7c9
SSDEEP 12288:4Q79Wcp36ie9ci4chEI6upkfRCfp0XNGrsaOBN8UVZuPYMnPi:4Q79Pt6iAc6hEAaem0ri8UYrnPi
TLSH
T121D423B74F49EC7B1F50F330E04F50EB8B64464A6BE28E31F26B408A030557976E6A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 168KB
SHA256 dd7f4537dd2f53a6b708c00c828a1c898d42cd93aae9187970907feb4308d010
MD5 7c3b40d471a2af7af465a06e18eacc91
SHA1 762acba51e5a8bcc7924ac91bc87940df24fccc3
SHA512 d8ea9cf4758d503b8427c24caf542aedfb26b9cd7daac08e407fcc7639ccc6aec4b9b4192ad8073cf8298b949209c56c366aaf36cbb6da551e444cfeb0c1d05d
SSDEEP 3072:oXq7qS/80MIKY0fkVqhc1oclAp66MQZ+pqaJ7xiRfLUy0pWMyVU+XGL:o6MIt0cfpCSAKbglUEJVnq
TLSH
T1D6F312F802B6B14B731868A8A8BF0D5944924422674DC37585D36FF3B61B593CFBCAB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 75KB
SHA256 111d73e83114d674034136d09ca01116f0cde1a14a5b45c3030c0dfe1fde2f91
MD5 5ca0edefb06e305cc1590df923ee6231
SHA1 cbcb3f420e64bdc0c6ba6c4e32569c7c373aeb86
SHA512 ed14456c8035b9d713193ca17be47f4a17c31e2df13a4edd1589732fd7eb918f25921c2156507894bafc695b40b5eac508179b9ae7c7d82de2a5aac7b997eefd
SSDEEP 1536:vfuXhGxXj1GNYEnW37TyUmtptsc328HRZaGOPuQDXVIMMuHBsK0WgTJElLT2b2Sl:HtxT1GNje6UigckPPDXVfLP6K6IZJMB
TLSH
T11A7302F5FE362171C77C72CB4EAD06B54C7DF7C9BD6AA8283264326416A91F0F1A1046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 20KB
SHA256 eed0567ac419cfb71b2ec9a4cb1f5771c57966d962dee1fa417732339e8526fa
MD5 43c7e69631f9b6049332e2789a88be1f
SHA1 c5d2c3822c66b44d766f0beed0c3c554e174aa0e
SHA512 823f1f59332cdd745d9fc4b4c41ccfcc6656bed3e2bf753e090ddaddd438c282442b2c69e9640bc13a61a08db3737873f927e9b09be4edd4e13b9a0663af59c6
SSDEEP 384:Go0BQuh+/Bg85jMGfCuMvo7zufc6m7qqFvBWCvKE0mO/mtF:7kCjDf5Mvo7zwctW+pWCvKE0mbtF
TLSH
T18592C04A8155445CC1E4EEB365BD26F7A671ECE9381643A8760C8B01E80CE86ADBB1D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 125KB
SHA256 8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
MD5 53436aca8627a49f4deaaa44dc9e3c05
SHA1 0bc0c675480d94ec7e8609dda6227f88c5d08d2c
SHA512 6655e0426eb0c78a7cb4d4216a3af7a6edd50aba8c92316608b1f79b8fc15f895cba9314beb7a35400228786e2a78a33e8c03322da04e0da94c2f109241547e8
SSDEEP 3072:b4XkN5u3RbAR2r4lJ8FBnP7fNblbKBRvqy:fGdA8FBP7fNb5y
TLSH
T191C3231EFC32AF9A2E1724EC288521809C1E92FBE0B3512CF565F437E76517D999CA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 26KB
SHA256 13130fbc1dfffea35c9984210c07766a1cee42740a1a94d86f4b03352f6ab5af
MD5 990318740f813f0e573fa737c925d677
SHA1 793ea3d0e1e9eb10dc359ff78de65770d496db01
SHA512 6b640abb759a4e5671310204276b1e0f0d51a8aab80d603c8bd3ce9194ba230bf7ff27c769d3bb9390ac25acd88501403ebb3d083a48a37ebe1c21456232d482
SSDEEP 768:84+GNcmKB9XYkm/CJBgj5hmRe/42u4bBYt:/L49o6oj5J/4+Nu
TLSH
T14DC2E1AC34FE912ACF582806F290115FCE8B9DD5CDA11F0B1248EE72DE5DC11E6974A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 ce749141d6e146af9b07029a4a6af5fb052ed40f065681049911ad36adb3c1bc
MD5 d16b5688067bad6eec6fd6df23cc3ed6
SHA1 664d07248fa00049c49e17e8c05ffc1eda3ce2c0
SHA512 57feb962bac2a4d22a33d65e9d527389b6838b13b29a35a0f9484e9ef8c0f0af5ff7a55c0f1eead6d60b09709add19ace6f4a0821cfa5ddf669ae04dfe929ce3
SSDEEP 192:zxUAH4naAzkARlR6OAqC5+3ryoa3Sd+RFfV1L+YKJvqiIta6I9qG4:SamRsPAbsFJ8UtNL
TLSH
T161E11C7889A1427BCBAA15B247DCBC0C3172A6FAF7DFAE46700B64362507BC0C5653E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 34d5774f6c0f011f112615cd60c1f93b3728bd2ac04ab865cd399d68ca1eca53
MD5 b83765f0d53cde83f4dbbde6dd54c718
SHA1 f95645f3076d26dbcd71e9a4d1043fec68e36ff8
SHA512 40964be96ca91a23131012fcc1c735a2934b319e2d7de5af4c51e136c1b855d6fec7cb197a33f00dfb6c788557d3c2532d67c4d98b95a3f71c54de57dc7eb40c
SSDEEP 192:e3xUAH4naAzyA9ZRzOAqC5+FryfSd+1l+V1XY4JvquII6ImqGS:eeagRFPAthoCgTC
TLSH
T15AD1E87885A29377CBA904B647EC780C31329AEAF7DFAF46704BA93665037C0C1653A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 9b7b0a4d84c7dd51d7d56cd1359390324f856ffe5304e3430a3fe994b467a39f
MD5 37ca37f5d35f6e649c4848399c30ef9c
SHA1 0eb43930d2939bb6d119659931e1a3747bbbca33
SHA512 1c952f5ac77f0c978f0df5c01865ad7e5a6f41fac5074dcad31b8edc9de6d50b9d898dd7abb4cf60adb13636326de8d54f6a6d9bbb9d2cd398b27cf242f51339
SSDEEP 192:JxUAx4naqzyA9CRmOAqU5+6rybSy+3l+V1jYqhMquIW6ImXGJ:2axR4JAmeEU9pc
TLSH
T1F4D10A3849929377CBA904B647EC780C31325AEAFB9FAF4A704B297765037C0D1647E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 65bc4746e186af431a8356c6564b291d92bbad7fe67e5b9e4a0eb6d51d99bdb9
MD5 b87102ed6de00f5e23e313c71b287489
SHA1 839c2ec4da7f51d92191a8a7cdd082d1ed813903
SHA512 e782b655fe417a86b825cfdebd4dc181833d7b9523f3b410b6a8622337a7255a104a0ab4713c370d432329f9986dc82843475e78220e18a25ec2cdb13354ad86
SSDEEP 192:DD+8ocDBH+s5MsfYtH8Rsra757cZKQUZR/NzGO6gyim+YhV4xbobAYQ4PGz9nU5Y:DD+8ocDBH+s5MsfYtcRAa757cZKQyR/F
TLSH
T15D229EF7C3E4862DC81172F59F287E1BCE2D096452683D5B89E4EF8B63E1472E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a9827ff5c0bf60ed8f4434cf1fa3628ba6989f5ac538865b420ca0303a0975c3
MD5 65b2242d898ef75cb621601a73eee609
SHA1 6ae14212f90126237ffee5732a76d8725231e78d
SHA512 bd575f062f9b3c0a21ef8a516031d8384c1ed0d710ebd306b188961396e0b3c5647b8e89f24e78ebd0f6a42c032fd47767ad83a56b4d292ded5bd56c04dd8c07
SSDEEP 192:sxZQQUnmRgWO2/f+sSUydW6bMLZ9YOVzdpm7HW6+WNBM0YZ/YzgkMSXIg4J:sxZWnmXO2/f+sSUbr/oHbKpZ/Foc
TLSH
T1A352F8566E24583B9CC7E259BF267B53D6F91032D5D01E88E6FC861C04FAACE230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fdc836f48c37d39e28f09e840ad48f81961a620adc8138541a4c5843b27f1bb2
MD5 6d561985a62046aab205dc2bb532e478
SHA1 87ba25f46de292a5f104078c9cb6b7bc85a95b50
SHA512 2db53e74796035d969305d0e325e08229d88e62d98f0d7ff1ef4e3a9bfe42d82ee6d9c0a4361dc6b91f8c4c3fe7153ba3853897129d7ecca019b16bc4e9c1953
SSDEEP 192:sxZQDUnZRgWO2/f+syUydW6bMLZDYOVzdpm7HW6+WNBBGXYzRMSXIg58FfqhxHh:sxZZnZXO2/f+syUbR/oHbuXu8ExB
TLSH
T14962D5566A24C8779CC7D619AF367F53D6F90022DD910E8CA6FCC61C04EA6EE231781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 7af451c320a3986ba85ed2317e5135e320b694aa37c212324f84b9da32be8772
MD5 e356d0aeaf906a8ba8c190dd4aebcda0
SHA1 489eb024fe47601c1ed2fbfe4164f119c8ab75d1
SHA512 0a87406bbed8f44e891277bd550ceaacdd77800d83ba5a20a4a978ad7ffd5b7e849c2707ca446ad8f723367ec22f30c3e3ec9de20837654ee4259d80813f814c
SSDEEP 192:sxZQDUndRgk2/f+sydydW6bwLZDYOVzdpUqP4HW6+WNUkBGsmL/z0L/VI7k6BT+b:sxZZnd12/f+sydlR/aHbUJ/y/VRqExB
TLSH
T1AB82D757692488779CC7D569BA35BF13D6F90022DD910E8CEAFCCA1C01EA6EE2317817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0055b679b100fdad16765856a59c9c89f10528070ef8e7c2dddb2d48bb0fd9e2
MD5 98e17cb65e8f18eefb5d479e46ac9316
SHA1 7a00452b67f4a5d4a45831eec1a8f52702a27228
SHA512 8d4a6663c2731ae7ee9d71e835b07b2c3cd41241157cd68319ccd04e1766e9474452130849d2de2e988537095442ccc531125d624190283f1ec0a58c44673d4a
SSDEEP 768:GIk7uIJ7pLuLfg0WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvEi5LlWYSBIroF:GIk7uIfEfg0WvqiEau1jaKEi5LA3Bzdv
TLSH
T127E2FB7B780CCA7E4F800E9CED1A7F9B6EA802DB9698C94047F9945C02C76EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 2KB
SHA256 caaf944501878652e6b8f71875f91c4c4432785805cd2c748f09debdff2e1ac3
MD5 7f2fdd6a9c019139020477066529a188
SHA1 a6f97a15d310f2ab7b1b659a45616c8e3c32b60c
SHA512 6d8ed44ac3361b89c3f99a271f631628efc4a389574d94c62fbfebdffb941ef9eee759ad8bb158ae42895ba0cb455d04606da5518175a7801f7ad263a804d6b7
TLSH
T11451C54E0D4F2F27CDAC217328BA0085373938DE0AD44E0775ACB6B47DC73296E98949
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 600B
SHA256 d93443a165b13236c0653cbe6f6c96843d9aa3309a25849fff7bd3d0a55328d4
MD5 cccd0f7dab8b17cd468cf3d743c965ff
SHA1 52913c271df46729151f3849887ee3c146ed6082
SHA512 9d5e1e91f423e2e2d40e2c089e371ad998e1c9831bfb761dfffbf14f98f6379d2ec66868b70d0f1e306a3bd3b3955e59f06dfeb5a953eb96bf47ed17548d7cf1
TLSH
T199F05C244FA1482ADB54017729F791E4B3716DEDA231C8BB581C2D7A3D57388711B2CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe63b329.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe63b329.TMP
Size 600B
SHA256 7436acd148db747855d6949ba1a3e9c95106c0b8d666c056576dc7814e01dcac
MD5 e32e3c457e0dc4e770a59be59b0d9e74
SHA1 0f042cd6fbd0be013a22b3b03affa5d3c3300a56
SHA512 6fd935c0b57bb846a8e43715248c97c0b5b51bcb5df7dd96a68dd6fb38d05dd71a364c88b51cfe6127cb3f00042452dc201340d2f7405d481c6e359a3ec4aade
TLSH
T102F0AB6ACBD18D16EA44067B2EFA94B8F3300C50A221F9E7252C697E6C727C996161CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 e858da089cbcce936c5eb5d71bd945ca53427b6736f9cfc81b6d4be3ec2670b1
MD5 75c75779479e38b24cb98d4e272c23d7
SHA1 077d4297ea1d5e7baa7d09baf938fbcf94a7f804
SHA512 4b258536808ee525b474ce1e8fff59838b16b0ea0abb5719bb51b1e2131f3df0943af74cb5e38d59732e6755d288653a8c30b99a72af5358b8979816fec5cfb4
TLSH
T1B0A0022443865009C8376AB51D5603591700CF103102935784958085CC565C45D4604C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 51a306391a42e5d3dc255a83d8f948797419aa49eea8046b91c478fc9594b807
MD5 3e3e116c291deca7cce8fc61af77fcda
SHA1 623e45119b6486f1aa302e1b47fd520284dc6338
SHA512 33acc40c8a27d2649acd11753b41201a4ac8a6bf361f232f9a256aeed533dd5812b9436f5d85afdc6ad4e8b25a9c79494a182ccf09868af4c4dd5d65ff90c801
TLSH
T108A0021416D55043D00232B536E6116132158914B642230551F00349DC905A5CD4300C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7299de2176cddfd73226b0f1d3b05174645040fcfdffbc4e8757de6aef7e7b7d
MD5 94fc37d9ac750cbbff741cefc36da40e
SHA1 a349a6a7528d44ac5141434dd20d5132fab4959a
SHA512 178700c13c8a650a6ff797cd3b299f773a3e243463443c0e06421825ec65f3a8685e22e141a2212a2669e7994f53bec4bba07e30be02ecf8000d42e2272e67f5
TLSH
T1ABE068BB2DFB1824AC6F87C238B065B0818538588500EC0E3027A28770F2361380AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 53fc51f72357c81e6dbe15c2c688e4a66a9fd0703dba3a70dac32b73a4df962f
MD5 3628f61b558f837713d51565e614f6da
SHA1 50aa8c0abc5ae76e69bdc0f88c94c08e62f34c3a
SHA512 fa9dbf4bb2a147646abd2eb997083be55c1cbe910378d6bcc0c978d6d06b6161cc074698b6171f16d623cd395d8b747ae42efa3b99f17e3a0827c1cd427a0c76
TLSH
T1BBB002EA74DDB85BC46A1BB8E0DA54C9322C0DD6032775218DECF0B9889A345E6E3216
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe64565e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe64565e.TMP
Size 48B
SHA256 64fc2a7a4f8278c0e3bd69d05c45fdec5f9cb29bbc440d2395516ffcd95a6c92
MD5 ac6692ac4221f89edcc0d6edcf799437
SHA1 8ad86c6cd3f3a070c22c162262c0286e77213a5b
SHA512 52938d616e65223f8fced7441d37b21203b51bd49b8e7035d7cd56ffc921110613ee3c34257c309018457255c32ba371269e2f55164b581aec58bbb429be0225
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b93f18b1559cb2ae24be3c496904c8ce9cd91700ee065f9d78756cb4b5a2397e
MD5 627bbbae4ab4e782bc08eec1c87970bc
SHA1 cc43d9f6117a31a136961af90c346ab582702750
SHA512 e169ef1233f6202db192def042a0dc2f02a0e7944cf2a595b425691d933ebc6ca769ec3cffb5443e78398746220e395de531a5a097dee447d0ad63a84e95f09f
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT//I9KA8QCy9dIBKeEMKiI/K3KEPyD:KIbCKc//iKA83GdaKeEViYK3KWg
TLSH
T101A15256317B0652387F2D18A25689269E8235A33418F57F7BB810B60F6BE510EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c11d16c3-d632-4f72-a665-5a568070f621.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c11d16c3-d632-4f72-a665-5a568070f621.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 827fffdd94cb308b80540206792bba559b0765f68aad756190694d84ddb0f76d
MD5 e37cafb36877756f6b80e42522734f21
SHA1 3df262f81c0cc98e2a637819b31d157d836c1810
SHA512 9a4a5253ec5394f787925b7ca97f9ac7ad5a71abe4338542ace1d3adf9eed97b478f2c1e8677cf478f9d47813a8d426e3864dc6fff13228e825dcccbeaed6d02
SSDEEP 384:nutNn/s3n9SfsNu+TORDQbYEnNrdPsq55AScjmwX:uj+9UV+cKdn5A1jr
TLSH
T15E928D365C75AD17AEE29181F54736075FB84173D6C02F84E9EDAF1C02EA3BC1326926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 086cf8d08b0304270f1184037af532772ff5fbbe5767530b1830558feba1f6dc
MD5 b9ba9fbe29992e19e080cbf1f0e44b18
SHA1 7396a5d10f796977fe1ad5ab1c231097144e1101
SHA512 de2a427e5c3a026ff0e4918ddd3709b6328c03649c4d6c31d5b7d38faeb24e5c445c11a3c0a44f2ed80e98f94e16b10ae1129746c70f7bc954b1532cbbe47908
SSDEEP 384:nutNn/s3n9StsNu+TORDQbYE1NrdPsq55AScjmwX:uj+9GV+c8dn5A1jr
TLSH
T19D927D365C75AD27ADE29181F54736074FB44173D6C42F84E9EDAF1C02EA3BC1326926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f64950faa6775e0c812a744e4839ae08288aa0f8dbec5ad0dbe4ee624aa90d34
MD5 c540763f6e7dfc1c78cbc1e929c4a9bb
SHA1 bfcb738e2f4b5730ebeca01ef141cdfbe30db2f4
SHA512 51b368cda6d313cb36d407b67bf0629ba7271c20dbf8868ead6c0f7e8104355b1d0116c440b668910b5b00aa748d8d16b63072de402e8a88ca3e71a65cf8d82b
SSDEEP 192:MONg64BAQmiUyV10W5GBPK1B+FdGw5caDOmCU6:MONg6eAqiWUdPTqU6
TLSH
T133021A396C786C6B9EB2AE45F58737175FE8103BEA846B44EAE85B0C01D765C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 df7cabac30e85221043ebee13ba45bedae4b96814a2d84614d4d82507c149c8d
MD5 f27564d01bedf623413b66bf3f6e748f
SHA1 67dd711e0a525aedbe6876de4809aa3818621252
SHA512 7230b4137b21b2fd5e04e8e152ee04eec629f3c4a677e4c7c122b055ce15ce6c32dd055c3ad344de3fd724b789e0d2749823a714490a9ac8e7e35a102efe1b16
SSDEEP 384:n+tNn/s3n9StsNuZTORDQbrE1NrdPsqQ5AScjmwX:+j+9GS+X8dW5A1jr
TLSH
T13F928D365C75AD27ADE29081F54736079FB44173D6C41F84EAECAF1C02EA3AC1317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b01d667313229f3327543b1baa5ec91ecf14d19f304cbf715ae019627f966f0b
MD5 ba421d475f1ac40dab701710e53de4e2
SHA1 a22f43ee5a3aefa99f7eb5b15f7063f9227c7776
SHA512 d8d77c5b69b7fd11d265bd015f3c47120ebf228145e13e88ecd3e30dd8a5f23bfa75d25da5b387088dc106c4efbbf16c4778d0aa0957ee42b6d0b50e24e4fe6d
SSDEEP 192:PONP64B8QmiUyM0P5GBPK1B+FdGw5LGPNqOWwMrqvE/U6:PONP6eMaPUdPsqM5AU6
TLSH
T106122B36AC78AC2B6EA2B541F48736075EA44137EBC56F44F6EC6B1C02EF66C2316417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 de5f1fffa5a16d9f1140e280914ce3bcefbf880112d84de20b3f2ac14fb6a276
MD5 e2b038ac5a27149b5271e505ba481ccc
SHA1 df92c551004ddfbff9fc3d21c22b04a9cb93e407
SHA512 b94bcd61b5753c8611b9e9fee2446896620bd14addbb7e04fac8a81603c14fe8d72c46273d97105987e1f97b2b2df392ba97a4057c5d98ecdc87bca347ce56c2
SSDEEP 384:nfiFKtNn/s3n9SyJsN+8TUNTUlIlZTORDQbrEgNZDfQ/dPsq15AScjmwX:qFKj+9Djwg++X18/H5A1jr
TLSH
T110D2E7F698D38A37E9AE4383A73E6D468EBCC163B5841980B7D85D0CCD861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5564668a4f2031fcdaf25477657c863087b2b79f471aebadd64c0d5e3b986800
MD5 18055c1726d0272e83ee9d53b89aa93b
SHA1 b92dc8d8d2bd944a4697e3ecb1761a7a6e08357b
SHA512 e864fd91f45f9ad5a0d7618c990761dc6092356a6ad7e5e09342009611cc531937fad93e3b1e38a33588d2d641aa5c565242aa393eadd5b96d33fae949271735
TLSH
T197E00201D204015AC42803310087566027E1C06052E30706C51401647C123101E71A90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9633b1a7d4d99ce8b7d94129d27dc492f65607a3a997bf924f8cd31b758251c9
MD5 58ed47e9590e824f84f121a7f121a071
SHA1 ed4646b0c3d46b53ac1dd97e4d53a6d19898537f
SHA512 011f94650dcadf3f6aa0c6fa0ce9fca64b5c7476946256aeca170c3e93260c06dc039888c86f7119cea8f421a6b8275eb94295e6d0c4b8d8646facfb7351e370
TLSH
T1EDE00201D204016BC42C033110C79F603FB1C06053E30706C734017C7C323103E71E90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe6483a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe6483a8.TMP
Size 392B
SHA256 5ed9a07d7d29dd9a9e8db153b4584d72974c0feb2b3e0fbe52c73439850dcf0b
MD5 4bbbc8875905c07f65660cbfbf5d8f11
SHA1 b067f2c47d15e3d9b8980334c294cdc0ec820c63
SHA512 c279e8c49d50a2e18cc7d134a96c1f6537a136a7628e05da8bb324a8f25e1b668a65960fb9c6af11e1c4f6bc5691d33fad7213a407640b7bd37373afb8cae7f3
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

45fc0d0d-a49d-4650-a17b-41b365b990b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\45fc0d0d-a49d-4650-a17b-41b365b990b9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8f0d5a43c5321322de8d0546ff8a314316e92340a5999448aea980083b9ce460
MD5 fc6b129ee511a99d60ab40c7742d383d
SHA1 532a10ee78f6036b153a09c47f42be15f894f8e6
SHA512 101664967d2b09e259984f0d82269a1657c15e8a9acfd03a6c468d50a4edca2ad23483d5e6c81a9fb46e72edbc924e6828e5fd8ffdb3bb8074eea4c3e6d16660
TLSH
T1A4411C9CB7E91148B3B76F5A9BF6A86D457EBC372E06D49D10110D8F0623740C961737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 06c09761880cf4d086e200c4d457ee12c50a099f149f5b0a02c56da1460d31fc
MD5 1649f9cfad4122b88fa919d6af7d2bc2
SHA1 9b72af376fa90421963b3faa0556e2787d77a3b8
SHA512 a8c1901c5c9a0a8f21b455069e703f54583c280bfc1308d8d2a35d78a8da85e27c6729e5d8532b0d86f86343100990d453e3157ccf6c02926a3736f48acbd2e8
TLSH
T14811B623F38CC920CC86123A409EAC1136B283CB41AECF9F6FC0D214A07F984CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

1A75047EAD1A37E2797B62711D13CABDC4253B3A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\1A75047EAD1A37E2797B62711D13CABDC4253B3A
Size 382KB
SHA256 f8b8f6ad0b06f88ce3c951eb340addab3000475e58d62148ca20519691a05f4a
MD5 07d84eb7c4df40b30a7cd5172bfa7edb
SHA1 24f6ee13992ea0eb2111d18dd83f1408a704ba3a
SHA512 6f98d82f808440a3f0e8e508669d5fca824628b877f043c3a38af09a9b678310e10c1aa577daa4598951a8a6358a5d8b322ec6ecc7b16e766d526b7bd4111497
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8Es6:C8tg599lGDBskZP58B67znOwGQ8Es6
TLSH
T18484233D8D3E39006B0292B05FC6C75E4FF40A46A6C0E4C59154A283F9A7FBAF567279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 0e7848a72081e8c596c4183c89ae944d42b1c338ea224431602741cd5664ec35
MD5 694529de623775ec5d31738ea988a4c9
SHA1 27bef63fe8407e92b36b7892c23d836d01905280
SHA512 46d05d7f7de2e1a751891fc24158fb4974ab8d9838e5e9e51b9b32aeb3b26613683b2e90154474d6dec4c317a7508b38138e437dd7507c150bcbd13a6636da08
SSDEEP 384:HwCe7iO024Yrdcs3hk2nhfdDE2Ba/rIVy8eai+ui+o:QqZYrdv3hk2nhfS2sDIVy8S+b+o
TLSH
T161729EBFDF512C5D1917D985C8AD976ADD05F9ABCFF6C1A60820304AC784326B0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 7b21a104c7d6116a232caf756fc93cd95454ad85a4eb75f5d075e64f292c0980
MD5 39ed40b9a273ec244da5aa66045c7730
SHA1 6e9e905b18c10c2c643a48cd7c8cbb174372b4e3
SHA512 67db8c5d29a3bf84afaab29f88e6b3083f89f584ce0ee22cba7c8c04ad0c31876098af97b4f14996c8f5c8db931291244391ff3030d2d98c9c4f4ffc76c42805
SSDEEP 384:H9XghOiO024YOdcs3hk2nhfdDE2Ba/rIVy8eEglgj:dX+ZYOdv3hk2nhfS2sDIVy8p
TLSH
T124729DBBDF117C591967D585C8AD8369DD15F9BBCBF680A618203489C78432AF0FA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70eb6e5e-7eef-4ba1-bfd9-48f3f9b61231.zip

Path C:\Users\Admin\AppData\Local\Temp\70eb6e5e-7eef-4ba1-bfd9-48f3f9b61231.zip
Size 3.7MB
SHA256 9174664eae8a4dfc6b9a979d3806a8cfb2b1f190b4ff593cd6a9f0dac982de5a
MD5 b3292c00eec8e6afc680c31ed1b34098
SHA1 1101b4667096155117f4b2b49cd77a9435365a3e
SHA512 1499e1a4504683113095c4b61cb8724e10c535989f414a5dbe8fbd6dc0c4e4ce6da701d0008b293fda15dd223222758e968b881d86b04e199c17c6d974be4cbf
SSDEEP 49152:MMtss2HgPnuvfv67p+w0+w0vdChZlaeBDy6hEEy/W4JWwSlRHcS6/2W9a6OtiDI/:Xssh7rmgChHd7y/WSWwcckxoDIG76
TLSH
T1E706F135F25FD60BC9CF83BA850C2FC29C4C4FA680D4E56B6A6A95715CAF1E2DB44843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7892d082-b62c-4dfc-ab60-cd5cfc987f71.tmp

Path C:\Users\Admin\AppData\Local\Temp\7892d082-b62c-4dfc-ab60-cd5cfc987f71.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pago Ofix Gabar $5,217.70.vbs

Path C:\Users\Admin\AppData\Local\Temp\7zO02D00FAC\Pago Ofix Gabar $5,217.70.vbs
Size 1.2MB
SHA256 14635bbca8f3850c1b1287abd3908e513033580e727e73aa2e51874d5a426f75
MD5 b853f9182389e21e8e850329eb292eeb
SHA1 26ad3886cf5c1ee6c653af5d2dc8e87cecefa3c4
SHA512 a06436d8c9caa8039068f91dab79e061ef001b13cfb3735434f03376278e9e98d61184a61ba6a1121dfac8e04bfee728a67263ebb5fa62c22bcc25c605d35f5a
SSDEEP 192:Oa8cnSZZRXmbMeDCIqUl8C0/s/05KCW/HW/eh8cnWOWcInOWcD8CJOriZpnWJxt1:lCD/s/V8C0d0xI
TLSH
T19D4553AC3F2465F6D5C7A6D36484C5510AFB0074BDF3BE722D1B08D4E7968B2A09AE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

811c37a6-dab6-42f7-a692-9c04f7f0e77b.tmp

Path C:\Users\Admin\AppData\Local\Temp\811c37a6-dab6-42f7-a692-9c04f7f0e77b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_pkfpunlj.aee.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pkfpunlj.aee.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

18b9a983-084b-40b6-a639-b79a4ce3ceb0.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2720_115124946\18b9a983-084b-40b6-a639-b79a4ce3ceb0.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2720_1267466030\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 7KB
SHA256 b2a5dfd4d26ff4576ed57161f4207582e43ce5a1170c39d408401f977661d928
MD5 24572d537cb0c2e1cfb06127454f6ba6
SHA1 2ec51bb13f0781df8ef3adadd834edba3645b720
SHA512 768580d82f829de3a631d0c3f5c33d55e80e6d39eedcf4f9c7eaff8ebf8cd3e45e8b4e2adbc084121c44e19befe1f1912f15b2ce53178b2c57cfb093ee32368c
SSDEEP 48:rvyqXyPR5VOdJpnLJvSuzPk/J/uvy0FJYuFAXadRBQbZT1tXJsuhqlJBu1:mvvOv5tDkR+HnPdRSRjZ6H
TLSH
T1AAE142A11C447D37F0405532DF27DA4AAB70BD2A8B1548CBF0A4B3C81EB6A15B18A738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 10KB
SHA256 7cddcf548fc19046479e6480602523ede8365eef23dafef2b8986d799f7aea7e
MD5 7ab2be40d524172598231e6eaaf116dd
SHA1 1f9db36d923d88408e4cefa061ae4fdc05e42815
SHA512 5eaa20dd4bd2dabd722c1601145c11eff63fc7d79ca73d7960e56fafc891917bfc61bf1e0b3261b98832c6f65e49441c3144e6f92f291c6da8f7bf83c6eb6139
SSDEEP 24:LuhMZZf1u9DfhmlMNflklMF7lfxA7O0lMaGqflGGjGNGflmhqfFezN:vQjsmxWmfwmaG+QGjGNikh+UzN
TLSH
T16B2272F7177AB875E0E34FB0609DF558CD33062B9A69D5C48A44D0EA06C169CD03EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 15KB
SHA256 a1a1d4f933ef7827265401f22d3fcd7dd0af756212f3619592a575c3004ca906
MD5 26ddbadfb6f607d81bafc63d0f5f385a
SHA1 f1c078a90aa35cdd6a1b7906af6f50d981819a8f
SHA512 d11d46f3856588ccc9a6ada9d997a2c8c7be791cfc6f137ef837936432b90d403fc2d8b5e63c19d2183ef676b32d855dbd94842643fbe510546b6bf417f1d6ba
SSDEEP 24:6uhMZtfljOGqflGGjG0e1qfFez0eRtlfhKYfhY+lz:UpOG+QGjGd1+UzdRtZYYfhY4
TLSH
T1CB62D8FB127A7471E0A25FB15098B854CC331A2B4E69E4C85A14D0EA02C1A9DD0BFF55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 15KB
SHA256 a318cae459f52c4111caf6f0ab5c0b4fc1498ac6b79ae5d203f2b3d589f4cb1e
MD5 6d2b8b1390930306a922d4dcd9582fcc
SHA1 1bd7f1afc17a6cb6e5a1c3677789fd1746d0b740
SHA512 590dedf00cfc0c514401e4cbc97e6813e320e827756ede13f79e2352618799bdc90af72fcd68fbd4618b104e0f0a31e220d0c8681efe1e7431882f87f3135568
SSDEEP 96:rsPrNp3nOG+QGjGdyQ1+UzdGKYua3CvZYYhqs4:6uY
TLSH
T1C162D1F7037AB475E1A25FB0509CF858CD33062B9A2DD4C88A44D0EB02C1A9CD07EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1f43e0348da35dbc2454ef09c76143b2ae6fcd44e3c0b8c7915c0420ecf2d0fd
MD5 9ab8edd58d61e86898d8b0127d944e33
SHA1 ca709ad4aaba88d9ca97edc82be5f9720700932a
SHA512 06a18a3e8f4b4971dedd47fe3b769d56a698ab5fd0010ee7f4992c727fe3d9f15708e3ae204c6172e421be87c42ee22dbdf5f4f3ec837c484a003ee6b2ff8e2c
SSDEEP 192:M21d66JozGzgCl6mc0dzPOv5zbowZqmyjVx:MQd66JozGzgC1jhgbowZqmyj
TLSH
T18FD1DF68F629463BC409023BCDA61F900E36399AD84E3F26319C741D2D963DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 76KB
SHA256 d24d955361191f140903f48221f9d19efe69f89e54762d89aadd6928ed4ff86c
MD5 472d92e9ca55cde66a6ea989c036652b
SHA1 89af555765d42c20a876431029c6b48e13999e56
SHA512 294350034146ad2c6b4bca8d237148fcd40b8bb28b78a444e7c44a4b6b7af4f6f48cef7074a00cb2d0d596d240c7d6d9f5f01bb23534e6a8879a7d2d0eff2580
SSDEEP 1536:7pk1wvOtPUD+J1JTAoOTw2aFNL71C2rzYY0bJyk:7aiOtZJHmTeX/AwNIJyk
TLSH
T132732280EB1A403FE82802BBADD617143B39F8554A192B5B3B5C54792DC73EE3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 76KB
SHA256 a1c1533a80ab2d3592322722971ff2f49b4a7d612dcf566077fb7b546e1d1977
MD5 f30d4fc2982337e3163eb56eaeb00730
SHA1 9c0325b6b58a9bf65a968bba4dc2be0dd1ef515d
SHA512 22795d1661b8ae7fc90ba0c25870e2f9894f44264a3e45623600f29cd292d08001c93ff9e028ceecd5ff0072dcebc6958abdd3ba9fdcb636f3ea99b9ff77cae7
SSDEEP 1536:/pk1wvOtPUD+J1JTAoOTw2aFNL71C2rzYY0bJyk:/aiOtZJHmTeX/AwNIJyk
TLSH
T176732280EB1A403FE82802BBADD617143B39F8554A192B5B3B5C54792DC73EE3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 68KB
SHA256 89e9714dc82ab1f52085c6a7449f2085f5aef94854633cfde77764aec6f0e9f2
MD5 6090c56362cf98e24dbdaead6d6d83c9
SHA1 e16a05c7d0631f7a3a63d80a31ce2c165130eb0c
SHA512 6e3c3cf590768f36fd33d7c9f538624a640c7caea2b56f1f4ac90da13757060e2cf41dd8b1c325c19fa814533e5059a7b478733dbd7146bf82ec17f8eeea787a
SSDEEP 1536:lpkpwvFtQMvGXF1tTQROGkgaFNL71C2rzYY0b5:laeFmZFvLGMX/AwNI5
TLSH
T163632344EB1A553FD82802BA9DD21B007F79F8895A1A2BA7371C64786C873DC3D4E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 33b8c822307050dce5172953bbaefe0ea09ac96bb62fe647ae4af66c9e9004a0
MD5 b19a183b76d31787cc7fa0eaa506ae9d
SHA1 c9459faaabb29cce1a1e1f92c4c32cd4135b00e5
SHA512 24da3bc4a21777db0bcefa3632f352a8816f4fbcb149452fab6811656d044fab52a649f4a658c3575e7574bdd96e5dc2a8b60c2f3551801a3b36257f5a929389
TLSH
T183219DAC3DB84D3A9CC7F2AC7440258E57158E02085B1C431D12FF8DCED1AD9312A83A
MD5 SHA1 SHA512 TLSH

Submit Download

1cd182cc-a8a9-46f9-bbb4-0258bda9c629

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\1cd182cc-a8a9-46f9-bbb4-0258bda9c629
Size 2KB
SHA256 6c9fc55cb0f113512929f5ebf42e858df7e49c5d2c2fc8781452c4481eb83aa1
MD5 408d8257f29f2a57ed9a87f0269c4851
SHA1 bd0f5e127416a08c40a53554de25802deef98586
SHA512 e375826d0e246f36f402a51f827824d197b1d1520f5ba440f8b237357eec87b8bf2284d75b6db711992d9e0e0a70658644848d5bc8ef09be486f9e527dbbfdc7
TLSH
T1904133A875744C7B8CEBE19DD181238E57A58E2300C61DD33E91EF4C8C9A669336E53B
MD5 SHA1 SHA512 TLSH

Submit Download

2100fbe1-8a72-4325-ae83-0ff235bd5d8e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\2100fbe1-8a72-4325-ae83-0ff235bd5d8e
Size 4KB
SHA256 c4d0a3f2d056b1ddc1cd8036d7582ed09d1079e5532c9226fc183c085f98916d
MD5 0278498c9089709c173f5114b6a83107
SHA1 c002ec7b30f67b8ccd1a256e3af6e7f862e8fe14
SHA512 4b32fcfb6ecf88bc6f9f858372c8b17a480a9a8b70506fac8f01a4c06f1abed986cfd98edd375d1bf4175409d5bd7f93bd8cf439246760732fb0d88b754155ab
SSDEEP 96:y9vqNEUOJ5QDY9hyqhPM2fyuN7CawOb3m2zcIbNSo2E9fu7yYL/xhyYJfjGZYxXM:evH84dBx9Fhq7QqaNcZy9wwp
TLSH
T1A1A1C4FADA22415A3D25C50F73EAD56A30970932498CC58E7DFC043A0ADAA3F1667339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66b66986-9af7-4354-b890-ccdaecb755dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\66b66986-9af7-4354-b890-ccdaecb755dc
Size 883B
SHA256 df69eb74dc92897dc1b0ac1898ddfcb3878963250f1ca6a955ca1a54ed440ca1
MD5 0844bf54505559966bcd40f0a21c5d5b
SHA1 c1bc6bc77bb1831b2845ab4556fc7a12c6b9681b
SHA512 67397434d5056a272a18d83e2f1ac6b3a5dd0e094a9db3d3b49c3ee804da9e415cc9ffc653dd86b59c8e1216d757abd66d8b786d1e342e4aa874ff6e39e885a2
TLSH
T10F110092963175B38CAC8247D79177528FE46633C0CA54603EE16E280DAA91E976E607
MD5 SHA1 SHA512 TLSH

Submit Download

97a52c4e-f265-499c-8b8e-b734cb606ae0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\97a52c4e-f265-499c-8b8e-b734cb606ae0
Size 235B
SHA256 75767c38c11135304f99d36d69100b481d6af1c252d272f11ccad0b6c3693489
MD5 d9c4a8d634dc71d7ac949a1fbc3990fc
SHA1 fc8e4fe2f3c9d54bbca3177fb8fa7a86885a0cff
SHA512 70dee641d98a8b1bf608b8ac22c17ff59e10432eeb1e270a76540c4212efa73cc4cef25032f35bb62df1158bae5cfef2ccac4c8973367b57b9cdce9f5f3f2f85
TLSH
T1FFD097E124A8276C08241F0EF0E22AC230844C332474A8149AD04278AAF8AC401A1C46
MD5 SHA1 SHA512 TLSH

Submit Download

cb7e2db2-ec6c-47aa-9401-2f356fe635c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\cb7e2db2-ec6c-47aa-9401-2f356fe635c8
Size 16KB
SHA256 2d47e301e71f76b371a68d6ca37c36efd3ae6a9dd0d5cdae5268aff14e66798c
MD5 d3a6170c667334f6a83f1a041fdf42f4
SHA1 091abd364bf3cc0cdb3b8c7adc1974e5767b0140
SHA512 9228c869c0e455c691d4fc5062491b1352e9faad8baab5ca65e5e1ddaabac7babbf803faf672a91bfdc16bc7f34b6c1f63d7c9541dea62476b0b6199768ce5fb
SSDEEP 384:tXYMU1jSKyl++INBpJ+y+G9HbCXzyHeFl:t4B71x2Xzy+Fl
TLSH
T18972D856686045BA8251E36898FCBFC3E6F638CF4C419FCADBE47D081DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd0a141d-b102-400c-a9f1-d6ce440a6f81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\cd0a141d-b102-400c-a9f1-d6ce440a6f81
Size 886B
SHA256 c03bb702eb02d65aca07eb1ad22a7d2b3a36756c42a3f457f53e35cac81ce9df
MD5 8284da3c6bcd8c4fd6dc6e7a9ca0b64b
SHA1 59bb8f6528e6fff19c085bbf25b70a69d4a915f4
SHA512 0b0f70368f9c0be61845cb40d5cdde802c3a4daa45e7f0a6522b96878319ef2c267f408542416229e7cd4a1f885fd42710194747315a8ad8cbebdc6e8e4591f9
TLSH
T1331163D189317972CC6DC247D6E077528AD47133C0CE58103EA16A380DAA11F57AAA07
MD5 SHA1 SHA512 TLSH

Submit Download

ceed55c8-c068-44da-af10-f220ec6d34a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ceed55c8-c068-44da-af10-f220ec6d34a9
Size 235B
SHA256 ccdc154848c4c1cb55d3f3df1424d6654c1202b150cebb7a33cca1eeec111309
MD5 65349b719dc376a5609186e7a5dea410
SHA1 ba40f2f86670ec2b29178549dd4d9205d0446f9a
SHA512 2ed918b10088e29ad1a80284d909e1764e5f76481a9479e01d38659a61a8cb1d3c6522f08d1d2ef6780996b4f67143e79dcc5c9a475beb119e0f9f3678029e1f
TLSH
T135D0238C3498277C1C204F07F0F0B8C630844C3320BCAC20D6520275D9FDDD842E186B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 d605b5ecf4677578e710af64df56350e63268e2d553bfc362b5f8a70fd795ff8
MD5 7929db054850589d119b67e3adda4cf8
SHA1 c69059c876f7674a7df4489960ad8a077a8c70f5
SHA512 7d8fbe9de9fb30f7e677b73fe1df783222835f755f28409c867f4a244bf0f3c66a27838c7057ce8659c9960ddc1a0e29ffbcbb3a4d508a100a3a100152aacbe7
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4H904hv:ujI4VRfOXN4e60434L474f424d
TLSH
T1A572531545049EB8294FA79BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\places.sqlite
Size 5.0MB
SHA256 ad32644cbe4c04fe09afecc5352f3a867a0e6750228e4edff0e3ef59d68ff647
MD5 9ce4bd889bf194743e29ed3a678fb110
SHA1 c992935f0d508653957aad8eff3559a9301c649d
SHA512 16bbfc4494d1f8c428d94851cd6e204b398bbc02010ab57de8eeda104b9513d2f228a8861958cf8de3e0433aff613f8fd339cf9a9ab033e3a4603dae94f0abe3
SSDEEP 192:M8rJQaXoMXp0VW9FxW1AtfsL4MYVFd5eCeC6m:M8r54w0VW3xW1AtfsE
TLSH
T13636641F7A246054C4DA9232ADF26F29183F71028AB7769339E4656D4DD0723B92CCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 12KB
SHA256 5e6d9aedadbc51586d4eb6470892e03b71974b34f4ae4af593d21aa727b1104d
MD5 ef7c86577698f2621445a62f42377f78
SHA1 7b10c1e37620f205587fcb743d3a763424e4bb7f
SHA512 0718cd014fbceb3162c1ae693d624a5e6ff76d669e08b1ea322ee37744baa95fcaacbfd5423911b076737759813b76b44d39a93f812d81370bad25456f2ed440
SSDEEP 96:xHYpTUuqGqdfdZfObzSXSSlDdv9jznERpwoDRpnBO+yl70clOBw88o/KC2bET2KW:GkRdfdZfNSS6XLRmd0YOBw88ov2bETcd
TLSH
T1D742CC7C50408F3F24B3367DAC255DB059A14627BABFBCD305BCA492045CF2895E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 435e9ce5b76f5829f6c9cc3aa81e7b5b2d82baafd9392e4b0384df66651786c4
MD5 3be95acd3d414053ce4d16c06095d303
SHA1 061fd95a63dfc4cccfadfcc1d5cffc3aaa998425
SHA512 bb7c57f75aaefefd37fc886eb9aeed6f152ebd71b7e144dea366119414b7bc7569a9b3f9f573745c57a5aecd835c947e8b183314c3fcd21c1583a0b132f6afbc
SSDEEP 96:xHcUTUuqGqdf2oE1zSXSSlDdv9jRnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEWSS49A1Bw88+w
TLSH
T12CE13F7894088F7F64B6766CAC6888716AB2013BB7BF68C750B554C5010CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 32537fa94b0da026d781da0d8a5030cceec5be92236a096440d624c639af191a
MD5 51714cab7434d2255a1fb09186e4f198
SHA1 866099dc93e21044bc1d86be1f6155e57758c7dc
SHA512 ede33700469013a5e50575f4bce5d731337a40d54bda36c2c1f4ea05d32214d968839cc6bbf96edda2a3923ebb74f2c7bc1e04afe9bf6b43edfdf75507d20d66
SSDEEP 96:xHcUTUuqGqdf2Zf1zSXSSlDdv9jznERH9O+y1Bw88n8L4cnrzBHK:65Rdf2ZfWSS69A1Bw88+w
TLSH
T1B1E11E7894088B7F64B6766CAC6888716AB2413BBBBF68C750B554C5050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 8KB
SHA256 65ce397b4fe82883cc98b072baa0b322b34fec3310d5d37bcc0e3504a49aafac
MD5 f82de1bfbd15f340ba5d931f3ad4c48f
SHA1 90b31a0ce3d945559b9406c5efbba68591be64b1
SHA512 dae157bd51f7622a34381850fdffad1b3e576f756c62a2d83fd205c16927c9369dcc595788818eaff6e5fdd7dddc949fee5a1e7f50b5fe5e6f5cd3871fc2a94c
SSDEEP 96:xHcpTUuqGqdfdZfObzSXSSlDdv9jznERWRpnBO+y7Bw88y5Fj8L4cnrzBHjGS:6kRdfdZfNSS68Rm7Bw88SiX
TLSH
T1EE020E785004CF7F64B2367CAC648D705AB2063BBABF68D750B95485051CF3846FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 d17573abc0ca092be790c5ef0545180d26a02bd37e7d20259f7a320d91cbd288
MD5 5cdf40f887247afe7b3046ff6a4c9ca1
SHA1 491b3886ca098f9b2417e856c6cb10dc3b756068
SHA512 cb4c9447c86b914c465fa9bf66cd099b243f0ed436f8ef1042ba69399c3ccc38b179d835d4142142340ecc063572cb9c7e0153ba63ad33e9fa34c214e0501353
SSDEEP 96:xHcUTUuqGqdf2oE1zS3SSlDdv9jRnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEiSS49A1Bw88+w
TLSH
T113E1307894088F6F74B6766CAC6888716AB2413BB7BF68C750B554C5050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 7KB
SHA256 2613ae8cc405e0bd670984a7e725bfb3698ebfe180fe1f97502f6cc55d639a37
MD5 4838e6a3e33ba80fc263f523d95c5304
SHA1 b15bad57d417833f41e7d17ca9d7deec31c5dfd3
SHA512 f3881acf892b8b98d595e88becc5cc5950b0da32d6ea787c89960b28372e910a483d87373f7e159b5c50cce8e6994e520ed1e9387b1db322f49583b22db2c2c9
SSDEEP 96:xHcUTUuqGqdf2ZfObzSXSSlDdv9jznERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2ZfNSS69A1Bw88+X
TLSH
T106E12E7894088F7F64B6767CAC6888716AB2413BBBBF68C750B554C5011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 aee266acdf189ad08743d1529ca568be4a731ffa7ca75d4c91030c3532a229f4
MD5 2313dc561ae3633b2cedbf2e45b9f438
SHA1 5cf1c557a047e8c3c2b48bb473bc60dc2c4e2b29
SHA512 0843150d25b865ba770ebda5586ce2b97fcdc12c84a66810c0d0d6853eb78c9b12352bcde291114a0794b59e82d3f97311a0abeb753d2125a7c321c5da358519
TLSH
T19E21AA5268BB1FF53B359015E48A4FF986463422C63518D0915DBB56519D49E324A12C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 c40c3fa0b1ed03cd31adb51ed8215d3dd6bd54b2b0df72b58b1c49d63a9efafe
MD5 033bed155814dfc2abab6af88ab8ea57
SHA1 c402b3c5345e9be20705896a2e6dc0e8fb96904c
SHA512 5068fa220776d2ea8ff91e1186c907d303387b8dcbb8bada63864883b960a6fd2f4cea37956fb56267b53a0a6f73b48c8e473ead7082f77e17649112e02ac2ee
SSDEEP 96:V2oMH5ANZLiPj5+zN9lBL/Lf65iMcu+IS8zvjKkJ1t4J7hAFXz0GPF9zvzB8:VHMZyT/765iL2zvjZXOUDPzvzi
TLSH
T161917CA37B2F2A7D5F06E0522496276481F4B836A52AF0D0BDD82B20419479F1DCF643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 33e737bd2fbd45d9146fe6ef4eb420e860201d5929b2e14768aa19c0666f0d49
MD5 16afb9c612980888bd360bf9d93a1a6a
SHA1 cb70a84536c0db740e6473623fda6a8985369b21
SHA512 eeeeb3e9076ebf2a8a5e42248da12acde9ca733298ccee59c5faa1d9c58b1846edec81f895972581e8e257e6a2dcdef20a34ef3ab12c3900f6c1b839a9cc1cca
TLSH
T10631C985BD4B39A92964C04BC0CD2BEC46A790224314ACD1DE5EA3414584B5B369FBE7
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 5b3faffc2f58a265c20437523291810282a024a0dd30e0cda44fd536c42848a9
MD5 9e34f6ba1104f901a655a1b25fda7141
SHA1 df129c0bf8dc7ade6ce82d1dc418c410b4494a4f
SHA512 33744eb6c19bf89ccdc641cbe3a2ff94886f2b871b10f0ae3e205ba9c213dbe22ea297b684f21a81759a780fc555970cb13f082d0a580118bf459758317f0a64
TLSH
T135312B93BF13397D2650E04B28875B52C5E64053D74A94D0FE1C6A10029874FB54F357
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 4b373e0fa9e8a99928e039100cc5b1aa632bbe9af02380c7ed751b811627aba5
MD5 b8d1456143b2d204cedb53ea8fc09c3e
SHA1 090cf9f46e181ad0b47559f661e04b2f3a6d016a
SHA512 650e2daff2ab1b2a81c317ce614037ff39816ea201e85a9c339e2e3566fb53f86690ba604e87443aa10831c62e4f30e22e0d750eb822ae074938516ac96ff7cc
SSDEEP 96:C2oMH5ANZLiPR5+zN9lBL/Lf65iMcu+IS8zvjKkJ1t4J7hA9v+z0GPdL9vlV6M:CHMZMT/765iL2zvjZXOjDPDvlgM
TLSH
T1C1916CD37F2F267D5E15E092149A272881E47836AA2BE1E0F9982B20055875F1C8E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 a378bacd04c8933da744cce2c962d5b26bc4495d50d55a8cab6833777db33529
MD5 d92fe30dc8fb8576df0e52036ac5d76a
SHA1 a57b67130bb77c303ec997547099e5e722c56274
SHA512 e585d3d77844cbd1e5a6a7beaf1e7ac1be496c3685b279a71692aaccbe5100874a723add5d642455a128065d20d903fdd08a1cdb6399b5d8bc7ee7256d26d841
SSDEEP 96:C2oMH5ANZLiPW5+zN9lBL/Lf65iMcu+IS8zvjKkJ1t4J7hA9v+z0GPdL9vlV62:CHMZ9T/765iL2zvjZXOjDPDvlg2
TLSH
T1EA917DD37B2F267D5E15E092148A276881F47836AA2BE1E0FDDC2B20055875F1CCF653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{72d8a104-189d-4e7b-a53f-98e8d660f288}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\default\https+++www.virustotal.com\cache\morgue\136\{72d8a104-189d-4e7b-a53f-98e8d660f288}.final
Size 72KB
SHA256 394bb116fbb2f04a5994133f9aad783142722d466a9d48313e5ece09e6c0783d
MD5 662cc08b4a0e815767efda03b198247e
SHA1 fcc66a40e79fb9a126b0b4bf6703955463aacc69
SHA512 0ad6bc0fda99aa3d1c06cd3f6f15d5cd541d6a419bb0104665172da111898d7ddc608c35d0710bf7a87970ecc027d963de68bfb263746d3868f7c5151a2d0708
SSDEEP 1536:vd8f0gFVig5/HqrMEAIrv4D6oUSDZCtHPCi99DxyzMqjfnOmmV03zTA6:vd8f/FVHcn3EbUYYPCo9DxBqjOZS/A6
TLSH
T14873E1B57B20AED7393A02EBF5896CD8B3583F42B28FA044D2657AE414763B5FF14049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 06a812e39c15106316cdafd814b62ae97ba469f3e1d7227d8c8909526098ef45
MD5 3f3fb606a08b632b8930024b0d9553ef
SHA1 dfb84203ac0075edcb398d9cc2440186dc0520f5
SHA512 782e687ebb7bd78075f1133cbeadabc14b3f99008692ab5124178aaa5d08e4b6f04413427b0eceb283afaa55a6a95d00d02e0404eb8efe72bafcccbb9d3e6abf
SSDEEP 49152:xDmgBuOjA5lUT2loNcNeaKvgmRBbFOYTg/:xmYuO856T2KOeaKvgmc/
TLSH
T1AD1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 12.1MB
SHA256 cd951c8f00c30a03259f8e03ac40ef5d22c420742e305df4e157df1c996f568c
MD5 7d602c32fcc4242781854c916a09c21c
SHA1 6872066700f4b711e0e2ba924ec5daabaa97bb34
SHA512 f670127bbe89f5286b64fcc3c668551a3533af2de71ce0958713418134ce5b24dabcac0d78e0566444f893462d306bf0c94ddee46361022a70398fd96c74aacf
SSDEEP 49152:YL9LyHaeUT6QC5zYYy0IJ5V0GlFeuXSXNE2fsvdZzTo4Xi4PAxHBFS144Svuw23v:30XNAxHBFS144ZXdtV
TLSH
T18ED6499270E1CA92DB0085F2B31F43DB357FC1DC20E589941AB8B96C991729BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\profiles\ho495kqa.default-release\cert9.db
Size 224KB
SHA256 399feed1002030b054c54519d65769e586ac337d0f7575f3896ebf6ab3c50dc0
MD5 7cfbb25a5bfe164bce1d5f80a208f837
SHA1 6439a106f32fb5a17726dad19c58f0319b98882f
SHA512 b39a226ba83dcef0b8c1e95fddc9ca94bfe1f0308b26a5d01056fa75193d52503b6fe916ea94844e6992a8c669b3d15e40dfafd0d60010c1e008a2aed163208d
SSDEEP 192:zOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vgIHaRPNnKoP70+q+:K1zkVmvQhyn+Zoz67icPVPQQ
TLSH
T1252421C3F824745ADF8A6D31B662DCF23D7227410385A422CE289D3F1D64A1F67A68DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1756-30-0x0000000000A40000-0x0000000000A86000-memory.dmp

Download

memory/1756-27-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1796-25-0x000002A2ED2A0000-0x000002A2ED34A000-memory.dmp

Download

memory/1796-26-0x000002A2ECF40000-0x000002A2ECF4A000-memory.dmp

Download

memory/1796-16-0x000002A2ECDB0000-0x000002A2ECDD2000-memory.dmp

Download

memory/2552-31-0x0000000001260000-0x00000000012A3000-memory.dmp

Download

memory/2552-32-0x0000000001260000-0x00000000012A3000-memory.dmp

Download

memory/3304-1824-0x00000000085D0000-0x0000000008691000-memory.dmp

Download

memory/3360-36-0x0000020A3E680000-0x0000020A3E796000-memory.dmp

Download

memory/3416-4711-0x00000247243E0000-0x00000247244B5000-memory.dmp

Download

memory/4980-4696-0x000001B76B690000-0x000001B76B77C000-memory.dmp

Download