hxxps://haxpc[.]net/

Analysis

user interaction
yes
max time kernel
199s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://haxpc.net/
Sample260802-npklfssapd

Score

6^/10

discovery persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
127	href.li
128	href.li
130	href.li
545	href.li

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2728	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301440740535423"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{75431D68-D923-413C-AFF9-4F5B15E4C42C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
748	OpenWith.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	firefox.exe
Token: SeDebugPrivilege	4804	firefox.exe
Token: SeDebugPrivilege	4804	firefox.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
748	OpenWith.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe
4804	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 5012	3428	msedge.exe	88
PID 3428 wrote to memory of 2728	3428	msedge.exe	89
PID 3428 wrote to memory of 3432	3428	msedge.exe	90
PID 3428 wrote to memory of 3432	3428	msedge.exe	90
PID 3428 wrote to memory of 1428	3428	msedge.exe	91
PID 3428 wrote to memory of 3432	3428	msedge.exe	90
PID 3428 wrote to memory of 1428	3428	msedge.exe	91
PID 3428 wrote to memory of 4840	3428	msedge.exe	93
PID 3428 wrote to memory of 4840	3428	msedge.exe	93
PID 3428 wrote to memory of 4840	3428	msedge.exe	93
PID 3428 wrote to memory of 2688	3428	msedge.exe	94
PID 3428 wrote to memory of 2688	3428	msedge.exe	94
PID 3428 wrote to memory of 2688	3428	msedge.exe	94
PID 3428 wrote to memory of 1128	3428	msedge.exe	95
PID 3428 wrote to memory of 1128	3428	msedge.exe	95
PID 3428 wrote to memory of 1128	3428	msedge.exe	95
PID 3428 wrote to memory of 2920	3428	msedge.exe	96
PID 3428 wrote to memory of 2920	3428	msedge.exe	96
PID 3428 wrote to memory of 2920	3428	msedge.exe	96
PID 3428 wrote to memory of 1892	3428	msedge.exe	100
PID 3428 wrote to memory of 5100	3428	msedge.exe	101
PID 3428 wrote to memory of 1892	3428	msedge.exe	100
PID 3428 wrote to memory of 5100	3428	msedge.exe	101
PID 3428 wrote to memory of 412	3428	msedge.exe	103
PID 3428 wrote to memory of 3632	3428	msedge.exe	116
PID 3428 wrote to memory of 4364	3428	msedge.exe	117
PID 3428 wrote to memory of 4716	3428	msedge.exe	118
PID 3428 wrote to memory of 3212	3428	msedge.exe	119
PID 3428 wrote to memory of 3212	3428	msedge.exe	119
PID 3428 wrote to memory of 3376	3428	msedge.exe	121
PID 3428 wrote to memory of 1752	3428	msedge.exe	122
PID 3428 wrote to memory of 1752	3428	msedge.exe	122
PID 3428 wrote to memory of 1752	3428	msedge.exe	122
PID 3428 wrote to memory of 3764	3428	msedge.exe	123
PID 3428 wrote to memory of 3764	3428	msedge.exe	123
PID 3428 wrote to memory of 3764	3428	msedge.exe	123
PID 3428 wrote to memory of 2836	3428	msedge.exe	124
PID 3428 wrote to memory of 2836	3428	msedge.exe	124
PID 3428 wrote to memory of 2836	3428	msedge.exe	124
PID 3428 wrote to memory of 1844	3428	msedge.exe	125
PID 3428 wrote to memory of 1844	3428	msedge.exe	125
PID 3428 wrote to memory of 1844	3428	msedge.exe	125
PID 3428 wrote to memory of 1624	3428	msedge.exe	126
PID 3428 wrote to memory of 1624	3428	msedge.exe	126
PID 3428 wrote to memory of 1624	3428	msedge.exe	126
PID 3428 wrote to memory of 4340	3428	msedge.exe	127
PID 3428 wrote to memory of 4340	3428	msedge.exe	127
PID 3428 wrote to memory of 4340	3428	msedge.exe	127
PID 3428 wrote to memory of 3940	3428	msedge.exe	128
PID 3428 wrote to memory of 3940	3428	msedge.exe	128
PID 3428 wrote to memory of 3940	3428	msedge.exe	128
PID 3428 wrote to memory of 3644	3428	msedge.exe	130
PID 3428 wrote to memory of 3644	3428	msedge.exe	130
PID 3428 wrote to memory of 3644	3428	msedge.exe	130
PID 3428 wrote to memory of 4816	3428	msedge.exe	131
PID 3428 wrote to memory of 4816	3428	msedge.exe	131
PID 3428 wrote to memory of 4816	3428	msedge.exe	131
PID 3428 wrote to memory of 4680	3428	msedge.exe	132
PID 3428 wrote to memory of 4680	3428	msedge.exe	132
PID 3428 wrote to memory of 4680	3428	msedge.exe	132
PID 3428 wrote to memory of 4884	3428	msedge.exe	133
PID 3428 wrote to memory of 4884	3428	msedge.exe	133
PID 3428 wrote to memory of 4884	3428	msedge.exe	133
PID 3428 wrote to memory of 4720	3428	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://haxpc.net/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffe1c8c188,0x7fffe1c8c194,0x7fffe1c8c1a0
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,1919566890363592455,15743103913716678371,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,6202595344176224154,3113468140823637343,262144 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,9693439712830860295,14488572743304499914,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6810394467375723351,16342259292226201876,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,719788800305847385,9863222215741776200,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,1449809747707516428,10753733757296353390,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,2724761545046865924,2563516188737484143,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,3536074785370421406,10692479224395017032,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,3200910311213752677,7078613262494136215,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,16660800004456208582,16703612422502180426,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,16660800004456208582,16703612422502180426,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,8981957918320694632,3038446313011467571,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,3835497299783485171,11225018918849771243,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,18217551920246990374,2452618315498916943,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,9547579297435164446,9662736764988760488,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,17174810688664443757,17397284322262986424,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,17174810688664443757,17397284322262986424,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5668,i,13730103807905782055,3072506356188554711,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4180,i,12318807709501499194,14066725194823412406,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6432,i,8901258516323619423,13197451118022165323,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6480,i,18395673883027996736,9594783950127332157,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6780,i,13774816140307586332,3821718332523860556,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4408,i,13598174216384324670,171315926868331289,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6912,i,1297227182878420890,6345463536476675085,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6968,i,14349053012899767379,11628186320160224294,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6672,i,2443070519325895871,6143889530580518233,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6960,i,12811045621772035609,9601313158136211322,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7308,i,11518930717468450533,18039550703837671833,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7240,i,4419198432347334341,9636731687292651754,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6996,i,2856444193046677462,15183299366796567724,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6644,i,16164028147298486514,6665810516987749495,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7652,i,7787401908602234124,250639864024166278,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7656,i,14964131895579765609,16024734760651521390,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7816,i,14905359048545602278,8060209131820547624,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8224,i,3862981980192326694,10255059752385420578,262144 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7740,i,14883597718842797416,17918011169233351057,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8076,i,5230354389326061927,5183103365298760634,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7692,i,390580238773603914,5268142646159809480,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,9825273881736884561,18025929708677875784,524288 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8620,i,16514082016343991348,13435775690307683314,2097152 --field-trial-handle=2928,i,16268739464223494254,10701427738496845111,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:1
  2⤵
  PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:748
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\«YursFileReady_PassWÖrdIŜ__««1111»»__».7z"
  2⤵
  PID:2428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\«YursFileReady_PassWÖrdIŜ__««1111»»__».7z
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {c91e7428-ce0d-48a9-8ca4-dcebb5d83772} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {b5278023-61db-49cd-ae12-60e0345ff686} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3660 -prefsLen 27276 -prefMapHandle 3664 -prefMapSize 270279 -jsInitHandle 3668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3676 -initialChannelId {848bfcbf-69cc-41ee-aa8a-cabe96bb471a} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3824 -prefsLen 27276 -prefMapHandle 3828 -prefMapSize 270279 -ipcHandle 3892 -initialChannelId {86e46c18-2924-40c8-8fdc-e87fb9499135} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4344 -prefsLen 34775 -prefMapHandle 4348 -prefMapSize 270279 -jsInitHandle 4352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4360 -initialChannelId {a5a46351-80fa-4fb3-863f-5982fb26d3d0} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5168 -prefsLen 35012 -prefMapHandle 5172 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {92f3d50d-9487-4253-a932-5fd816d83bc3} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 32952 -prefMapHandle 5308 -prefMapSize 270279 -jsInitHandle 5312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {32cf36b3-e2ff-4fb7-a0ef-5484bb29b70e} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 32952 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {3f72c9f8-c613-4a73-93d8-9f33d1121d9b} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {13563b40-ad76-4aab-ad2f-b95839d83acf} -parentPid 4804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\«YursFileReady_PassWÖrdIŜ__««1111»»__»(1).7z"
1⤵
PID:6080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\«YursFileReady_PassWÖrdIŜ__««1111»»__»(1).7z
  2⤵
  - Checks processor information in registry
  PID:6096

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\«YursFileReady_PassWÖrdIŜ__««1111»»__»(1).7z"
1⤵
PID:5016
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\«YursFileReady_PassWÖrdIŜ__««1111»»__»(1).7z
  2⤵
  - Checks processor information in registry
  PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 194d4416a7c8b92f6f6c2ce229b68043b2eca25b80274f4a9b289ef167d39f8b
MD5 491fdd599885f1ab973aaf31c2f7699c
SHA1 deba351eda8cc8e25fed5d3e73b81814d824b893
SHA512 73fb6acb53894901f47179dadb8bc75976d30797a3fce97c8ee4118feb1aace4fd7bf512d2a4cc531a1e0529093bac953cd7b5be370046c5f4df09b67125804d
TLSH
T1027161340F8641A4FBA20371A7D1C252747D86E7FC53DE55D3B049F44BF57228A1974A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e6b9bc34ee10b9b00cff4dee6d10b488759f10fdb8888ba72e8109a96c690220
MD5 380f89844aeca9e95495f80a710d6a97
SHA1 95a5882901b255befb134aa75d1a54987a3e8531
SHA512 125661bf65d2078e2ee20bac0b98abc2da4af789fde330c208d48b801962b4ca0c6f3d6682e34222e9fde8e3d73dc76aa021f048876d3a93b7fa741d4217269a
TLSH
T1207182380F8601A4FBA20371A7D1D252B47D86E7FC93DE96D3B049F44BF57228A1974A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 862826fbb61f9dfc4df2065c169bdb2d5aa6eaceb073dcbcfc224f0dab33ae6f
MD5 21614c28d5587d027b628ef6a36662f1
SHA1 be508ca5a7c96cb1f04dbd16bf1848449da34052
SHA512 bf6dd7008bba789f5e9f2e01f310450e2d037241d827ffa66689c887e8e9c2ead47b0673d7bd261892a02adbc17e26a052aec14e5be327cf6e869dcbcfcd5ccf
SSDEEP 96:f2G6i0mkm1ppyFcQbEWpBTnrtEozKaHCJFeOoJx:OG6jmbUFcKrDTn9PHCDedJx
TLSH
T16CC1C9301F812860FB5103B037F58955387C81E6FC5BDED5EBA089F0D7BA74689C965A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bddc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bddc.TMP
Size 3KB
SHA256 516551f78e41db1c678f61dd854da48b2aa8e2316805175f4783c6a22fe8762e
MD5 f541ff003716cc19ad2911928960a1ae
SHA1 62a3cdfb90e0feeeb95ddf13e9b6ed1a7b9d4787
SHA512 88df6ec7ae68c1289e76f291b4a4f884c904a172b6f4074f27266a621c3edaab7f9d6b98e0c1d00f818d0df04bc0f4c9d6ead9425f904a81b7c8936375f90422
TLSH
T1C16171380F4605A4FB62037157D1C252B47D86E7FC93DE56D3B009F44BF57228A5974A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b9c56bae8654301eb16286d41cd864c4a535b97a8d0f11bf220cac733bc7b27f
MD5 4d41ce661e1e043961ae650fb89b99ce
SHA1 653dec436f117a6c6c8ea1a0578f00070a344b8e
SHA512 987611667ae4c2c199a617647af049f8fc4c24b95d9cb710deec7c2de2e4597a14dbad0e1b1bc1ce99e1000aa4b43857d690900267acbb69aadbd2a61147cede
TLSH
T14A416AB3C3E5866EC95156F09624AE2BCF1D0A1583283D69C9D8EF1BD3E3062E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 31KB
SHA256 6bd0e87ad9f984802aa20bb0ea210530f0635a29356db044769d9f7ea439c0e1
MD5 709f8bce89a69b3a3cfab6cfbf621b35
SHA1 86f9560bb126d5c8cd4b542ca2486c137aa9e6d9
SHA512 167caa2f39123f266fc7050c242648cc16934c661a3f94f9a000f69fe8558f858f4dc313c98d8e2ce7605b2f03170a218a3bd0f2aa96b57e9e91091236b0c491
SSDEEP 384:Dz4lYCOi6nz2AJyTxluASdnPUejBYje6aYKxIJcJe/eKqCwX7gJq61k2o/fQ/ZNX:kCF2SLHIAYbWfQkC/PDPWDs
TLSH
T167E2AAF383E5D62E891157F496146E1BCF1D1629432C3C2A88D5EE8BE3E3072E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 adea24107e0a1e72a0276024f15b5f792247e4fff6664533d813d7bd5cc28a2e
MD5 393442e4d35940fbdda19314ba1159cb
SHA1 320231052af83d65a32cbc26010c75b8537f3be9
SHA512 97d5c7514faa446717a37e1324d8aa113f1b8d7bf4e8ab4540cc31342b0ec779be3ddb57dbf4719331f00125a818bd47ebc7bc926e1fa0b058876ac09c65c6e3
SSDEEP 192:sxZlRkyM/jK1Ml8MkF/f9sfGQwIdpivHW6+WNRI3/YzAEF2ZIgrJ:sxZl2MF/f9sfG6AHbG/b9
TLSH
T14142D8126A34A97BCCCBD209B955BF53D6F5046292940E54AAFCDA1C40E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ad2e061cc4a8c8b656411d8f8a757369130e6f5ab11042959efc8f97aa34bc64
MD5 f310a47f5d87676753968def31e3ae99
SHA1 56cd274557043f6dba64f4b205b1536b1e4f93b7
SHA512 e47c492f0173d377dee157f4a73e7b9448b35023ab2524c5e09b7944bdfef18694f77509c7f0cbe0ed3a3e807da968736a14a279f192d4d4a55fb8343320eef6
SSDEEP 192:sxZlRkyM/jK1Ml8UQif6F/f9s/kEwIdpnC7MpkkjDTy6HW6+WN9zu94be/Mj3D/S:sxZl2qW6F/f9s/k+DHbn3/lI
TLSH
T10172E552AA3059BBCDDBD61DF901BB57E2F5146292900E54BAFCDE1C00E6BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 fbf9219bf95f2dd7e619767d4fda8d1a161f56240f1a491ec538fc6177abc514
MD5 b9a410f47e1ec25ce86b580af07df407
SHA1 a302d4cf1e542e956340d8a759d8847c7564bb56
SHA512 928756ad697ef618b34ea7559bc9d7bbacc51afa4b89cd78c935fda2e28b5026496ff3bc2d5491dfa15e7baf0997e7db46c0be203dbbdcf16990049219dc9518
SSDEEP 192:sxZlRkyM/jK1Ml8UQJdF/f9sEWpVRkPwIdpnC7MpkkjDTy6HW6+WN9zu9dtTyO4V:sxZl2qrF/f9sEWvRk5DHbO3/92
TLSH
T1A082B452A53059BBCDEBD61DFA01BB57D2F4246692910E54AEFCDE1C00E6BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b2d4edd98c656d4501c3936c4d63fb22a083ac752f96c8843399491f496c7ae9
MD5 bd139457c5bfbd0f9748152f97b25928
SHA1 15466cc1219405283b11ffc0acc95469705c219b
SHA512 4190fba8f25de23de44a935c24281ba27b2a86149510ed60b2657b6e63675eea30793f248401c9a5f92c52e576c2eadcdda8cae0da98dae2e18712c75f05d6ee
SSDEEP 768:MzW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjfroI+iCYs:MzW7kf0Wvqidau1jaa5LA3jMCs
TLSH
T1E0D2FB3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14265497bc24c783_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\14265497bc24c783_0
Size 63KB
SHA256 23508feee63ca7a853fd657b475ffb474b423aac020cec3b1f43252d15e3bfab
MD5 d6a85183410f90c5437f05cb8a59cd6c
SHA1 478219ebf5037da4cc46ce852cc718ee4703d1d7
SHA512 3ca7c831a0a6ee58512c9f65d97d20def4d5bd1c36aa50ebb1e65a4314daee7b01cb5a59e917384a7c75e238a679e938b04220a9eb6e3e4be5531f6b80037fdd
SSDEEP 768:Ho7D6c61j/SAXPeEFfgoAaWhrJTt9/XTghUyqxTBXSD74+EACmiQsNnTBVR8noGS:a61j5RmtRXNyqx9XY4JuqdV6no83iPj
TLSH
T1EA535BA63371B8B3827BA1B190AF170B713ED167B404C4F8A194EEE54A54B9A0177F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 d3a228aaa533f44ffa5a6857e7aeb854737c4773b7eae9126d9817729619b967
MD5 38348890005959b52c82b3f7c7dadc47
SHA1 247ba53c9e44501616241c1aaa46005b468b2f5b
SHA512 aa6ebcef0df090c68084f8957b9decda0b69d3c2ab4b148589ede53d59f54fb01e597cfca48182db22396275416331d2b29cfcc408796f30874d12bcba9c7409
TLSH
T114A0022039642641C62003B15BF182D02BE14C202385A60280F011849C78162614AA45
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 54cf85bd5ce033188e5c7081341e5ea66f0961477269bc8c6c32f61a57fcb8eb
MD5 0c2f59002383508d1c8318dc55d40fb0
SHA1 c61afae321a3157598873473348900248519d291
SHA512 0884281de2d6ee4aa9d2f481b1fab1a1d0c4c260904e1d3b10c1e6e80009a00ce0f7d354c877255e61063eacda6ba384dbb10ed723ff148a2da481226e0bf397
SSDEEP 192:s2t/kh4fjRTnMv2zLJ2W1yZBOfX8L6xWqkIsPITOSuhWMfKqzkc:s2F6JB
TLSH
T1F7D1620A703A4601387D389DB2AB89765F4635A3751CA4EF7FB900A60D67E210DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592ef6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592ef6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7eb31f4c3f30b92e3780de2755a4d45222ea48ec95571cd24c8ae5a0cdde1446
MD5 fa3710563ec4d7baa9a98d45e3a9bfbb
SHA1 d972fd40a826c17a83f295825cd3fae02608b61d
SHA512 14f8b11ab4c23e9d4f9f67faa8d938ab904541f30e16726782b52244d3060b39809a113dcadcf180f3116348f723a9b2519fbd1a40145af991355561b252c3ba
SSDEEP 384:HZcIhsNAOM1tDb3ffu7dEh+CEJrnnjcDVVZoJHWi0qDieK:vh51tDrIWuhnjcleHWqieK
TLSH
T1BF927D716C741C378EA6F649F88737034FF84077A6C46B64A6FCAB0D01AA7A81307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 702a5eb05133e4e02aa580fb0286af26f6fe1a241400471462eff4a48e8ef8ec
MD5 9b6f11529fa7d0c12a31b12e33506f45
SHA1 1d1cd3c95355bb12a51a1cdb77f60f39c96b34a5
SHA512 839eb195daefb8f1540db2e612645d101257dc845ed90c65f7d694e4614e025da6278e81d413bea6407299323a2a595af8f66f49707702e45d8472e817469d4b
SSDEEP 384:ziFiZcIfzsNi8TUNTUlIlTM1tDb3Kfu7dEh+CEJrqnjcDVVZoJHWi0qDieK:eFQbvwg21tDuIWuhqjcleHWqieK
TLSH
T1EED22BF258D7483ADA6DAB47E77E2E024EBCC067B580665077E89A0DCD562BFC306C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8d49f81c0aaf4efc9bbce33487901ec299f56e0fbe1954b221687ee0cac7dc4
MD5 da3da9c1e9537fed2614b6e8bb97e790
SHA1 4ad67fed0062dead62711a590c98301fbf6f61cc
SHA512 78cf2bcbd9a699ecec9a13bdda216019e646b92dd9326bb5a0d36f0fc6298bbfbbfe2cb91d628f9c2e412e29f837eef540f9504ca25fd64043fc86fff59779af
SSDEEP 192:MON/64BAQmiUyP1kW5GBPKlt+FdG8PohIaDnMqU6:MON/6eA4GWAdEhxnPU6
TLSH
T11B02E8346C796C6B9EB2AE45F58637175FA8103BE6856B44EAE85B1C00A775C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0d9701ddbaba06123391d482826583e4338916b48a1dd5c11d910e9875aa5edf
MD5 4eed0cb2e9255cbc22656ccbc61878b0
SHA1 6f7fae4ff18185bfb0e82ae1839aacbe4dd50827
SHA512 43ddf31d90d7b43c772b70cd5ecce14ff9818b62fa1097026131c77af2958a6fa18a52282bb46f2d3c1034fe23bead72b0ffbb96501b9b464e450f24d5ce787d
SSDEEP 384:yZcIhsNaTM1tDb3ffu7dEh+CEJrnnjcDVVZoJHWi0qDieK:AhG1tDrIWuhnjcleHWqieK
TLSH
T1C6927D716C741C378EA6F649F88736034FF84077A6C46B64B6FCAB0D019A7A81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ab73fcea06c08c924555bfdf7789d02da127ba260d86dd0dece92ca4ff045d7
MD5 67cc94410ea1539ca8fa9f98e40abe88
SHA1 e56976112d7a6001551035b07139f94e55e29910
SHA512 8b4edb135746a3816894b0eaf58b0cda2a7d35ce2c6fc8c5ec1d1f04259a4a15523b37177cc6cce66cb6885d410705150578bc7718b6850de25abb3cd7c51065
SSDEEP 192:rONx64BoQmiUyaki5GBPKlt+FdG8PohrGFC1SJrdWwnYqcLGU6:rONx6eI4iAdEh+CEJrBnjU6
TLSH
T1BD12093568756C2B5EA2A591F48736039EE8413BEA856F50E6EC6B1C01EF7AC2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c80aa184bae8ee75225010bd7472d8ce15e1b8e3a06ebce5fcc34986cede528f
MD5 ee1716500e85bfb0b046b28d1a370ff5
SHA1 ea8a218c62fef2bcb22cd126a321751315edf083
SHA512 5c4cacfa908bca859839b6436cea2887f17f9b25bd13ccf6dcd1bbe598715bc410facc9b144d1e8c6de1834ec09bb940e47c5255b1726862bbc3dcd2bfbf6815
SSDEEP 768:eFWI6wgX1tDXuWuhgs5t45Fj9DMcleHWqieK:vI6tDMcIHWjT
TLSH
T1A4F25BE188D30CB6C5ADABC7A77EAD0259BCC137B4849518B3F4A52DEC5A5BFC312811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 daa41b9d67ea6a497a08592547baf244977a7436f9380620d80352709fde1f06
MD5 f4d3fcb574cb9291a85fef692317b526
SHA1 7f129a06d081ba0206ef5c8794a544b107fd5b0c
SHA512 af9418aff7c25fd95cb98e207960cd00c81be2814d34602287ef460ac71d93449219f348d846713abd7734fae9877131bf4b30f43889b718ef92399ed476794b
TLSH
T1BEE00103934151ADC070037004432F301FD6C035412147976A72015D4CB27017F452C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 97baae15367ef9349820cb639e13f9c2ed9d22bb368a1af20f1cf46f9f70a4b8
MD5 acf4accc2055f6a53510d80696a9115b
SHA1 9fcab555c95c4ce9d225efa130b017ce020a516b
SHA512 51c88cf6cb9415b7bca6d8578c7c1d905bafec025900522d9224d7223662a75f63b1427be460768f527182e9b94a8abc04bd33bf06c92e432b8804f93630d841
TLSH
T1F1E00143934151BEC074037104832F302FE6D03542A64B976B76416D4CB27057F552C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f50d6f3fe498d54e7c9e1c1e01b28e21c230c23716d73a05d96b3987cd821dbb
MD5 891ff00a75b2a54e70c25b07dc733580
SHA1 6c1980c1c9328190b91ec11fe5952bcdf74fc17d
SHA512 82998033d94f5d96d7f4c61d0281f201a13c92a30ef9d1520fe927e0a8f4d17489f96570722b901fbc91cdead26f750f413a2f07092d344ef5cfca08e5fac22c
TLSH
T173E00202D301418DC070027004432B301F978031411146056A6101595C617012F041C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 67485e4cc7552f9650cb0318cdfb206fb4eb36b2d52726f23cd1c53cbe9279eb
MD5 eddcdfa1e5ab946c92b8c6acb0b20bc0
SHA1 6c890cbcce7a33b3e0a05a0cc28e0746846665be
SHA512 4f1ee63a120873c1cdc8ed951d3cffd9d5de63010d5de20fe14e1a9ecc81cc13c07ca2e1ec01c2c4eabaaf327b8b8ddfff52feb5030d590455c0d6f67d0eec33
TLSH
T1B0E00203D34151EDC070037004432B301FD7C035413147876D6101595CA37013E053C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58afb3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58afb3.TMP
Size 392B
SHA256 5a6ecf27f8763418fa7e1e68c3ee46dd19014eacaa837defcdf40114839f237a
MD5 81b3b95af6f3d0d20894879e45148b7f
SHA1 33c4edaab4bafd7e20f5e268e16f7b0e11bbd3d8
SHA512 0adbbde174443dd9f80e9ea32997127a8c54506c61c27e62b00160423bf1603ed44d56bcd0ef947071d7dd5823b50213016f6987a81504e5edac9a3bdf962ce5
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 83aab308816d74e0756e75dbc4ee2579c6dfee1512d10d1fb3ca8e24802e3d77
MD5 57ccb0632bee4cdf7055c93e99cae8b8
SHA1 ae799789c78617fa55347b3f9b69443fa8c6ba25
SHA512 160b1309c4a7e9943cbee37161025dcc99aea605c9643173e376d2beff91b88893a3acdf24ca16eb374c3b55ea05e275e9daee513a12d04bc0a6b989c35e92ed
SSDEEP 3:MsEllllkEthXllkl2zExlld2+:/M/xT02zl
TLSH
T13F440404FFC1040DC70033305557C3500370DC150511D7433C770413FCC5D414C00414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9db7ed10-935d-45d9-b826-c28a0a97d390.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9db7ed10-935d-45d9-b826-c28a0a97d390.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e27786a3d00a7e6f52a885bed318fd5c39b1b47414cffd8e57eec1ee7345ab22
MD5 49b77db471874d84c649e8f4bf27014e
SHA1 dfc834eba92142106d0fd9e02b3612706f0a6926
SHA512 6ea9e5316422e4d5af451c56413b612c76a2e69cf493edf6ee24772e27384da195386607854b9b7537ea6be2906e6e345bd95b374d2352c1c35f74c3a4e46e5d
TLSH
T1E241FA98B6E91149B3B37F57ABF6A86D847BBD772E07915E00010D4F0662B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 128ee011af6d1bc0f5e524f7bfe8f5695de7f2082c5f6d7baf40bb2047ff9be7
MD5 7baf55a15aab39fc7c4f9ec85b2eb02e
SHA1 d2b1ede21c3e4827039c2234fffc451d428c642e
SHA512 2cb1c9757885723feed118e8db78ddd3a847a0cb5f5c9ab91c73b958b48438540549a95959449e38e6dfa6e6801b7636cdbcbe33630da4e2833820f035d12e7e
SSDEEP 384:HwCe7iO024YCDL84KKDL849B7SOEAd9KVRaAcP+AWRMAm+x:QqZYCDL8lKDL8CB7S/AmVAf+hRMV+x
TLSH
T125729E7D9F413CAC15A7C0E8C0F952DA4C19B6A3DFE6806D21683D0DC798A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 23eaf921f9f77ee438fd6b0cea9d57d642636e5bfcdc16c8fe40cea9f2baca7b
MD5 6094d5febe5c1abb58c7f34f5fd285e3
SHA1 7ddc00981a95205a18b7d4f9abea7dd302f972fc
SHA512 4a545c06bce3d5662f6317b888599c6e345784a51259ea798d5a2f502c9a73b5503b5661d2b29ad32878cc9a81b81143f50935d36dc99c080e6c261cc8543c82
SSDEEP 192:zPOv5zbowMqmyjFyx11d66JozGzgCl6mc0dz:zgbowMqmyjczd66JozGzgC1jd
TLSH
T18DD11EA4FA28463FC409127BCCA61F410F35395BE84E7F2A319D741C2C9A29E768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ac552f931899e86699a2cb39629bd32da74c7c341c21eb4f04ea242cd61a4c5c
MD5 5905c4ac839def365b2c3177d780808f
SHA1 1f2c6e2908d6da352339102865433a7753279862
SHA512 0073215a77eee7657d722af748b347f7aa2f5d887b579ab1cb0ab2d98e07a05688c432567a968a3aca386668cc1b89e79f48e732f37980bdffab1a73867e3509
SSDEEP 192:x11d66JozGzgCl6mc0dRPOv5zbouZqmyjFyC:xzd66JozGzgC1jjgbouZqmyjl
TLSH
T166E10EA8FA28863BC409127BCDA61F410F35395AD84E7F29319D741C2C972DE368D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 44400b0c9ca258af8a6e6f39531c5a44c4bf0b82115f2c51c5a28e7ca779068b
MD5 fae1cc2e3437485201b92e048e305faa
SHA1 4f3b3304ace3bf98719eb029acef922e751d3fbe
SHA512 e127a85d98ac052ee22e1cf2c86f3cf4a5fd32a0b761b948a7f7c279baf86d5166ca97b787cdf8766367acb74d74d2c1d7c18baa910857d52f08faa5bd0e5388
TLSH
T15721918C39B88D5A5CCBF36D745101CDA3554E4B19971C530D42EF8CCD81ED9316A87D
MD5 SHA1 SHA512 TLSH

Submit Download

2405cb8a-26dd-475f-9e3e-f094e49e9b46

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\2405cb8a-26dd-475f-9e3e-f094e49e9b46
Size 16KB
SHA256 c0a743c13521c10cb6f8188137159ff37e83e6c7321e907298490b881bd7d880
MD5 e6ca29ed3c6a99e526d713173de800f1
SHA1 ca8e669807769051d35ea13e8255abe6f5e0c72f
SHA512 2d92f794de7d34893763dbe7580c90c65894aa73ae83f9cf9ad6f07a8a637c8c666c2c4b41d750dbdf2661287192cb8bbc625d042ce98ae837371b6af83bd8be
SSDEEP 384:FSmbixtc1znVrTmYueGT3A+C+EdJFV/ge:RVWYJGTwzdjVoe
TLSH
T1BD72DA56686045BB8251E36994ECBFC3E1F538CF4C419FCADBE47D081DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35483e96-fb3e-40eb-8b93-99144cf21140

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\35483e96-fb3e-40eb-8b93-99144cf21140
Size 2KB
SHA256 092610d6baaba2e1d11c44aa0268d47d2500fd768b39a4b7a61af9f4873fd9af
MD5 aaba00607cad2117bb77df3657db205d
SHA1 2dfe9d959ad67042acf5deed22385ad474cd7b69
SHA512 3aa4577583aeccf81b2c0f7fc90d9111e54de1648b066e72089b65f0d2872a027bc5174cd10f6618f5fef830df8bc39c70eaf3c7db2f66a925f3ee532fbbc54d
TLSH
T12C4110AC36785CB69C9BF1CDD982238E57254B1350C628832D52EE0C8C9A79A236A526
MD5 SHA1 SHA512 TLSH

Submit Download

76d5188e-1af2-4d20-b296-0c74d66d2a8f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\76d5188e-1af2-4d20-b296-0c74d66d2a8f
Size 886B
SHA256 8f3f7bd99916938f8946a9a10bec480caae125bce4b5a0f74cd9ff44e1fb07e1
MD5 0a6425c6eae561c799272e1ada668bac
SHA1 a2df627f80b51daffce271d864dd3278e665d563
SHA512 09ab7ebe6418f8cae9b1568e29eae1b1180d7270cf0dc97b8b89e52ebc8393673c30fe7dc335bc3982f3fa7f05f6c21a7a8e1d1066beb85769972d0050639a8f
TLSH
T1CE1100D18A20B9728C7DC28BD6E477438A903423C0CA48103E913A280DFB52E575A607
MD5 SHA1 SHA512 TLSH

Submit Download

aa8452ea-6b63-46a7-a16c-e4a69a1e6c6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\aa8452ea-6b63-46a7-a16c-e4a69a1e6c6f
Size 883B
SHA256 11e66c12af0b7667d2efed92f4c0dc1bcb26adbf3a9750d66c1a9a4c34c13a65
MD5 2373b68a600b07bc89da9aa050905579
SHA1 11164f12f5b34f55992cbcf4383bdb33f9a99af5
SHA512 97b1197e2c5dc4649a01e23f167bc552ae83a467bc1da42892b150e7472bfce9227f0de0a8b54e53d2723f742ef3862d0d89040448d097797222da43f4df7ee0
TLSH
T1421123C1AA30B973CC3C824BC6953B429BA43533C0CA90143DA12D280DBE92DA35A607
MD5 SHA1 SHA512 TLSH

Submit Download

e25ad839-9c93-4920-bddc-fb24acafd77a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\e25ad839-9c93-4920-bddc-fb24acafd77a
Size 235B
SHA256 aabaa85781d4cd37fc05003f4008cd07cbff307cacb8ecb6f38a8cb2b1e95a80
MD5 601d2791aff174a5ffa95690931227de
SHA1 2f697ed8e9ab4da32ebe5823288c6b73bc559ed7
SHA512 12be988b3e5249dd225d03cc854909d09e18a5f98f77bd6abcf69833eb2a6ec994596098877f9da9df76125ca11e428aee2daf2143d6ffb39963df8052bd3e4e
TLSH
T154D09780249CAB2D08101F2BB4F069CA30984C3328A4AC10C67101389AFDAC84211D16
MD5 SHA1 SHA512 TLSH

Submit Download

f82d7903-8285-4c18-b9e6-0d9cecc1ebb8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\f82d7903-8285-4c18-b9e6-0d9cecc1ebb8
Size 235B
SHA256 6822af21ef6aee776ba685025d4e3bca35504bd8be1971627a2fd5229719bba5
MD5 22b80c56e37658926fd884c54334b5a9
SHA1 7f299755886aa2d92b10baa96856976024e676a1
SHA512 caa77c9ec33e3858fb2f6bca3dd83bdbdca96bbc77ce994b45b074dbcc29fbafbd319bc679a31243f061e7f80680ba0ca269c9e0846b4dc7a563cbcf68f6b7cc
TLSH
T115D097961598672D08040F03F0A069C630888C3314B09C70D6600538AEBEDC7226191B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 a74428daa917c41158586580d6f4fc6a1315f714aca3f6bfef4b2fb078832179
MD5 30bc137fde3d2bb253fedf10ca2606e1
SHA1 7d9a0c201295ab8f9ba14334319b315ee0df8f54
SHA512 e2e1b876abf13ca876d7dcb521fcce628f8e89dcd00bccab7953203ef1b58dd74a63710b7e52ad6593e3fcb1795f6c3f1c3a11d28a88d2303a9e98124bb1816f
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4HwAS4hZ:ujI4VRfOXN4e60434L474f4QD4P
TLSH
T16972431545048E78294EA78BAA367E01C37D573B60845C78F4DD8FC802FA5B906FBA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 8KB
SHA256 176112305bda8720acdd6b5f4df59a713f4e3cabc74521321eb2f9567069a6df
MD5 963c4bf9536847d8a2677f5bdb0b205e
SHA1 d6ab09c1a04e742d3b0d4f5e26746c390c4638e5
SHA512 71242efbe6292b5044cab00d21dae6d2e257f5d019e1b2525753661c1ed98110ed43cba07c4c9e7a041916330b2521ac6118ea887b8d2130ddcf36e513e0b609
SSDEEP 96:xHcZTURPqGqdfuU3ObzS/CNSSlDdv9jtnERWRrBO+yG0zBw88EMR8L4cnrzBHK:6UCRdfuU3xCNSSs8RYG0zBw88ow
TLSH
T1BE020E786004CB7F64B2767DBC284D706AB2023BBABF68D750B95485051CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 5eec5f635e5a6afae3900dd8b15214efccde9f3018be560cf3e01c8790fdc0a2
MD5 5274414f4fa88f76dc0fa6a81bcd7f5f
SHA1 be667a176a281c477eacc626bfcd3665517474e9
SHA512 7e4aae53ec6f8b484caee488a0ab5374b37f2f2d05e6cb8f7522ce3ba0ce2d689a548460f94daedb89b68b4829f55fa0e5382f262885178ad196b5193d65b070
SSDEEP 96:xHcUTUuqGqdf2U31zS/CNSSlDdv9jtnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2U30CNSSs9A1Bw88+w
TLSH
T179E13F7894088B7F64B6767CAC6888716AB2017BBBBF68C750B554C4050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 81deb86e79fb261c32f86e8e866b34d7c678fa418192271e390a2f34c60a005c
MD5 bd0ff1668b67dd4e1cdb9dc12c750c4a
SHA1 bb5e5fdc49d50245cb62302d53940bb34113a993
SHA512 5d88f324daae43dd1125fce6e80a44010a9e27d876b137c8dbee7c137da594e719f50879719e0818b6ceb856b7702ef60391d335b2911c5aa317feabe868ebf6
SSDEEP 96:xHcUTUuqGqdf2oE1zSHSSlDdv9jznERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEaSSe9A1Bw88+w
TLSH
T1EEE1307894088F7F64B676ACAC6888716AB2413BB7BF6CC750B954C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 095f77ba37ccb4132e441849b4f9c72c3147c8abc499b370bd311887e7f2574d
MD5 fc8e33dcfbc99e28ea990ed24da44cea
SHA1 252e7e44d91da0408581626fa9a41bf6e3fc7f05
SHA512 2438ee78d23ac25af1e2816831a27e39e414bfe7914cd0ce1c8cdbe8387297a92b4d61352a6eb7a8a93131a504f4e3cabead89c4f69ab2701d3d011cddafebd8
TLSH
T1C121E35A58A76FF03B2850AAA0C50BFD450A3035433E0CB18B1ECE8A4A8C00E330A0BA
MD5 SHA1 SHA512 TLSH

Submit Download

«YursFileReady_PassWÖrdIŜ__««1111»»__».7z

Path C:\Users\Admin\Downloads\«YursFileReady_PassWÖrdIŜ__««1111»»__».7z
Size 1.4MB
SHA256 78e1437fb8db2a587b1cc8a351499ff7b98d7fb4a06e2deb1abbb773adf93b6e
MD5 1c21138b4b8990c17f54e4f1f993ecd9
SHA1 083c1849edc1e81c3708e32427832f53d6f89c61
SHA512 956cb00bb7b1899bc5282fc970c52d429e4eb866f99314752f987e35816d58717a34139baac158c5deb8d28848d840608e0c4e9fb4482b16db1fbdc8ae7d4ae6
SSDEEP 24576:W3VLSlzEfmDMEsW+avIBnGXTkWUX40tdPYVFmLHcRIog5Be+0FyAplD3/+PVFAjZ:WElwfMMMvIB+obX4zfgHuzmBWplDvWFA
TLSH
T17E65334975B1C25B535186AC63ACB2A216FE373FDE9709F58848822610CEE7F8FD1B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download