hxxps://gofile[.]io/d/78n1UB

Analysis

user interaction
yes
max time kernel
60s
max time network
129s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/78n1UB
Sample260802-xt7ffsee93

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
110	5892	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
5264	TrashCrack Ext.exe
4996	TrashCrack Ext (1).exe
4596	TrashCrack Ext.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
31	api.gofile.io
32	api.gofile.io
33	api.gofile.io
72	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301714032682617"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{89103F96-67DE-4128-8D09-062C3846357C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1096	4524	msedge.exe	82
PID 4524 wrote to memory of 5892	4524	msedge.exe	83
PID 4524 wrote to memory of 5908	4524	msedge.exe	84
PID 4524 wrote to memory of 5908	4524	msedge.exe	84
PID 4524 wrote to memory of 5908	4524	msedge.exe	84
PID 4524 wrote to memory of 4200	4524	msedge.exe	85
PID 4524 wrote to memory of 4200	4524	msedge.exe	85
PID 4524 wrote to memory of 2588	4524	msedge.exe	86
PID 4524 wrote to memory of 2588	4524	msedge.exe	86
PID 4524 wrote to memory of 2588	4524	msedge.exe	86
PID 4524 wrote to memory of 5204	4524	msedge.exe	87
PID 4524 wrote to memory of 5204	4524	msedge.exe	87
PID 4524 wrote to memory of 5204	4524	msedge.exe	87
PID 4524 wrote to memory of 6000	4524	msedge.exe	90
PID 4524 wrote to memory of 6000	4524	msedge.exe	90
PID 4524 wrote to memory of 6000	4524	msedge.exe	90
PID 4524 wrote to memory of 2288	4524	msedge.exe	92
PID 4524 wrote to memory of 2552	4524	msedge.exe	93
PID 4524 wrote to memory of 2288	4524	msedge.exe	92
PID 4524 wrote to memory of 2552	4524	msedge.exe	93
PID 4524 wrote to memory of 1356	4524	msedge.exe	95
PID 4524 wrote to memory of 6048	4524	msedge.exe	107
PID 4524 wrote to memory of 2328	4524	msedge.exe	108
PID 4524 wrote to memory of 5996	4524	msedge.exe	109
PID 4524 wrote to memory of 2364	4524	msedge.exe	110
PID 4524 wrote to memory of 2364	4524	msedge.exe	110
PID 4524 wrote to memory of 2364	4524	msedge.exe	110
PID 4524 wrote to memory of 1100	4524	msedge.exe	111
PID 4524 wrote to memory of 1100	4524	msedge.exe	111
PID 4524 wrote to memory of 1100	4524	msedge.exe	111
PID 4524 wrote to memory of 5152	4524	msedge.exe	112
PID 4524 wrote to memory of 5152	4524	msedge.exe	112
PID 4524 wrote to memory of 5152	4524	msedge.exe	112
PID 4524 wrote to memory of 3452	4524	msedge.exe	113
PID 4524 wrote to memory of 3452	4524	msedge.exe	113
PID 4524 wrote to memory of 3452	4524	msedge.exe	113
PID 4524 wrote to memory of 1220	4524	msedge.exe	114
PID 4524 wrote to memory of 5880	4524	msedge.exe	115
PID 4524 wrote to memory of 1220	4524	msedge.exe	114
PID 4524 wrote to memory of 5880	4524	msedge.exe	115
PID 4524 wrote to memory of 5880	4524	msedge.exe	115
PID 4524 wrote to memory of 3860	4524	msedge.exe	116
PID 4524 wrote to memory of 5080	4524	msedge.exe	117
PID 4524 wrote to memory of 5080	4524	msedge.exe	117
PID 4524 wrote to memory of 5080	4524	msedge.exe	117
PID 4524 wrote to memory of 5396	4524	msedge.exe	118
PID 4524 wrote to memory of 5396	4524	msedge.exe	118
PID 4524 wrote to memory of 5396	4524	msedge.exe	118
PID 4524 wrote to memory of 4380	4524	msedge.exe	119
PID 4524 wrote to memory of 4380	4524	msedge.exe	119
PID 4524 wrote to memory of 4380	4524	msedge.exe	119
PID 4524 wrote to memory of 5416	4524	msedge.exe	120
PID 4524 wrote to memory of 5416	4524	msedge.exe	120
PID 4524 wrote to memory of 5416	4524	msedge.exe	120
PID 4524 wrote to memory of 1804	4524	msedge.exe	121
PID 4524 wrote to memory of 1464	4524	msedge.exe	122
PID 4524 wrote to memory of 1464	4524	msedge.exe	122
PID 4524 wrote to memory of 3764	4524	msedge.exe	123
PID 4524 wrote to memory of 3764	4524	msedge.exe	123
PID 4524 wrote to memory of 5264	4524	msedge.exe	124
PID 4524 wrote to memory of 4996	4524	msedge.exe	127
PID 4524 wrote to memory of 4596	4524	msedge.exe	129
PID 4524 wrote to memory of 5028	4524	msedge.exe	131
PID 4524 wrote to memory of 5028	4524	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/78n1UB
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff80e48c188,0x7ff80e48c194,0x7ff80e48c1a0
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,10657120604598596774,8697815740493689112,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3057664441376825045,13035428671825978591,262144 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,4486719714439136412,13190804269457625219,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8961195658444625086,1008564333983179679,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1074363195772741252,6557464439772891943,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4948,i,6992560484704698233,17139062154792636790,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,7035672910047176634,3515486418567493058,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,13069197690886639796,9066774695325270138,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,5960142649799249999,10292104756952048350,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,5960142649799249999,10292104756952048350,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,907874973354434906,9186054286267926419,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=136,i,11813894209434098265,9909390295298130028,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,8456929193482279664,16523526768696305320,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5768,i,2237962906062498735,14934320292188657503,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6108,i,9137621158470050819,5937803820071829785,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6252,i,9224949681431424236,10836183094304970487,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2116,i,1312149822333803364,5079612472178926589,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11515138453258566023,15875101084014709336,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6304,i,2613243727230019451,16537475712424713631,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,13280901816012865014,10078419824109645901,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6648,i,9407079995492177616,12574810316855227433,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6644,i,8330256704762080477,12039150820202101920,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6996,i,9454952401837993562,17765168656823047444,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7140,i,11350673326548326857,16518653856339879861,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,12934958013058379228,11140912363394702986,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,8027098265152361317,1902198033499333944,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,2731773720214580872,16434316297977851166,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:8
  2⤵
  PID:3764
- C:\Users\Admin\Downloads\TrashCrack Ext.exe
  "C:\Users\Admin\Downloads\TrashCrack Ext.exe"
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Users\Admin\Downloads\TrashCrack Ext (1).exe
  "C:\Users\Admin\Downloads\TrashCrack Ext (1).exe"
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Users\Admin\Downloads\TrashCrack Ext.exe
  "C:\Users\Admin\Downloads\TrashCrack Ext.exe"
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4379584854174108239,1067738844833433457,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7120,i,8175811168415177396,11341688528597997316,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3712,i,16313366322277625337,3677315558369281136,2097152 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5330783323206952220,386272764012452644,524288 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6468,i,18282911989573657069,4815182299582657858,262144 --field-trial-handle=2400,i,15275293713010786632,8663262748872035470,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:6188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:872

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
PID:4812

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5364

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:6012
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {b8d5a221-8465-4ef6-bf0e-6a18cfda48fc} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {6b591aff-3050-4029-af61-d31be71551c6} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 27277 -prefMapHandle 3792 -prefMapSize 270279 -jsInitHandle 3796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {27e525ba-1523-4fc6-a2df-8391c1d2d002} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    PID:740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27277 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {42aa4bbb-3cfb-4630-be41-34bbd91c64c6} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 34776 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1244 -initialChannelId {c2267f5f-79fb-4af7-8d48-6baaadfb6a9c} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2848 -prefsLen 35013 -prefMapHandle 2852 -prefMapSize 270279 -ipcHandle 1644 -initialChannelId {5e056ccc-e958-48ef-bf45-80fb7feaac15} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:6964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5004 -prefsLen 32900 -prefMapHandle 5044 -prefMapSize 270279 -jsInitHandle 5048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5056 -initialChannelId {e6672663-4fc9-4384-a5d5-fc98aa314673} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:6984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32952 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {0745c414-cc51-4de7-b8c0-eb83a8ac01b6} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:6992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {66fca579-f6d3-4072-a10a-3e8cd59c881f} -parentPid 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:7016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fc7159350bc5db308259f87324635d9e411088051fd21b6c6d39ec5240d8899f
MD5 11b320bbae71238015192c6ccb57705d
SHA1 f6f9b6a6cf6b3dcbb38d3b6202db949b49d6017c
SHA512 c436fd386e6be913065cff7ef5aca82e51ed8fbf0b3aec79ae42cd961a4ad43523e822614d0567cfc818fe5ff8094d811fddb075582af8b5c1e47a43686092cf
TLSH
T176E02BADC921AC3708FC176D64154746D700031B6A44592F3B3D600C8FB2B371686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 997bfef15e37943a4662ebfada7297533479154a0a657b378367048ed3bcd2c4
MD5 ac529dad8e91e4a7d913a21500a5e7aa
SHA1 d0c5d24b08e0c5713be9973307d9762e3b408fe1
SHA512 d47544982a4909f157c55945845528001996fb5b031b074c8bcccdc52ed19f3510462547158568252c10604ce8a4ade7bd22b6df00266bdd188118e72303455a
SSDEEP 48:8iW/q8M3cNN4KbmBUHJQWjkSvkBep21n5OSbcRZTpg/gYVG:qqJ3cD4KbmBUHNvk8iUSQTT2/gYg
TLSH
T1D181B4F564C2E0EAEF10E933E9EA5344B23642B945337D9010BBF7B03A26FBC5815158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b71a7fec9a8ce4d89877200d0d0c6017b742a168bb690a71a34f872238cfe8ef
MD5 3953de217db55b9d7da25362c3f29954
SHA1 e870a2542cd84f9fe0e272b344cf112391c76505
SHA512 9bcccdfa6d45a6b7803537ffc4e0990519d0c4c2e24d68c98d63f0b8e8f6cff193dc83e9b80f9c534bcb97a2e0129b0ca00c86ec460a429549e8a78a63101113
SSDEEP 48:NX/aW/qfgM3cNI84qpmBCTrH+QvkSvkOdHepI/xm7OSqCcRZmBdqMglVs:1tqd3cy84qpmBQrpNvkOQKS4TmbqMglq
TLSH
T1DB81B4F568C2E8D5DF90D133E2E55348B17542BA60337D6110BAFBB03A26FBC5661198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588a1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588a1a.TMP
Size 3KB
SHA256 738e0d0e3f704a3811c50d4e59946d0c89f60f9e371c2ce27952ec46d496ec65
MD5 c931f19ff0825758d20465084fa41425
SHA1 009698f50ea05223d33bbb0f5fb765b6f854fe80
SHA512 04b5c3e840dc4c31309ca0d40407c46b1742792fef88a7aaeb4c75fb41f713be328bb3dfef58427d85af5418d07637185f2dc0747fe7d3fcde554fd57ff60dc5
TLSH
T106715FF965C260E6DF61D173E1E14349B23682F945337E9115BB3BB03624FBD8125058
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7936ad40-8cc1-465c-8a76-2463733af9e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7936ad40-8cc1-465c-8a76-2463733af9e9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 36d8203c82a202d0d3cecd6ef9fc1ebeb3c250a47c6badf530f47bf6423e5f54
MD5 e4a5d2451c7e100bc0a2e031ebebdd91
SHA1 147046a501c41a1866a275109ef751b6b9061917
SHA512 54ae56cb52071dd435da2116e364dd4442bc8c9e5e9604bbd153173a9da6570188db26bc678536a07f7c3fece22d5bd8e556c90500d80cea04e1790b6c381d00
TLSH
T1C461ACF383F8856D9D2196F0AA14AE1FCE5C1415832C7A7989E4AE17A3F3431E145B4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bf425aca12b24ca3881377efbe241d0de1015db3d194533c86cf17e5774973eb
MD5 92c3a378c45112d3757d215a04d9c11b
SHA1 580ce45116d2e84dd1d015af71d7437be97156d9
SHA512 10aee54a01f7b9242a59ac9994b72946b8b33edabb5d418c1adfac10187fddc9f93ccc696229e479fe781fe238c35e9402e138bdd947e4d6649e0405b2357f97
SSDEEP 192:sxZXRSyMqZjK1Ml8Mjd/fJs22Guo4ggPzodpaglfHW6+WNeGNdYXlDR4KIg5v0J:sxZXbbd/fJs20ilHbtdoTB4
TLSH
T19962FB156A34997BCCDBD20DFA457B93D7F94463A1904E4899FC9E1C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dca28e3fe67f62ce5852f20c0cc67366ec3548d2261497697c217fb22902bf08
MD5 f2412d01385c4ae9049d6b83ae0e1ef2
SHA1 d475269dea1f027b57f829d3878808928e7deedb
SHA512 8fc33cfc4b0d4c0f9eea4daa5ad6aea0155086835871adaa48d1111496c345eefac6ed19284de522ca58e57fe769d7a61006de0f347fd8c2e14c72bd7531b184
SSDEEP 192:sxZXRSyMqZjK1Ml8M9d/fJs22Guo4ggPzodpRlfHW6+WNe6aXYX1DWEKIg5v0J:sxZXb1d/fJs20ibHbKX0mB4
TLSH
T1AB62FB156A34997BCCDBD20DFA457F93D6F94423A2904E4899FC9E1C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9d717066a79c8b2237811869a3f8db2ee217b43040718428c38f6f911909844c
MD5 f8f95dbc267972d03f97988f6c86ca2a
SHA1 898ab71382ff3242d4d50a3fd968d8f565541653
SHA512 6c6d30b1fe3c29d907c6c5be5d4a2204449a0f3cf43f2b583780e5f23d7cdb24367df80d65cf607aee5892b128f11671ae9f1d0dd72076f16bd8980b05b6f2b0
SSDEEP 192:sxZRRSyMqZjK1Ml8Mkd/fJs/23uo4FgPzodpRlMHW6+WNebV3+/YX+nrdEKIgj0J:sxZRbMd/fJs/zZwHb+t+/znzj4
TLSH
T13062FA156A389D7BCDD7D20DFA457B93D6F95463A2904E4899FC8E0C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33a391965bb825fae1d2497f21874e02decd5b8ff9cdf8aebc5e72f48bfeb07a
MD5 f507ff5bd5c06654fcd9e4a6ca28d6b2
SHA1 a6187c5652047c7037e91a584b1ca96d7dade399
SHA512 3e724b626826c7c781641fa2a424bc9a18388d5a8173091a2139547486c15caa5137487bd38922f981006881decfd8ac7a5b0db4c5c85de6a406a6263478b5dd
SSDEEP 768:/Zk4PXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OViiLl42vJ4roWpN1Z4STU:/Zk4PXDWvXt4hu1jaHiL+QJDWpah
TLSH
T1D0D21B3F680CCB7E4F844E5CEC26AF966ED801CB66988D4447FA494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 70b0460a9ca60639b89e1b26f862abde0586a7643865f48df66a808321fd9923
MD5 a7f007ec201526a6e11f05487bd8a507
SHA1 83e3894021c17f21c9292685c26e02a6b9cf9f81
SHA512 ac8b6245fc8b6cce34b79ce2d850302986e60f17584f0001081a43da7bb4ffdbaacacf243f3405cd39d82abcf8b78ec69ae1e7a6176c612ffab7a431579e30a3
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU107bS:EJGnYNSv9PpHV/qjevS
TLSH
T1F4B21D13313A03433CBE2519A2A686779E4231B33019E66F7BA904764E67E224DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f6e1c2015aec2375dae28b0bca623cca232890789ca4913eab4f8579fe19c295
MD5 6764856bedc0fb1f9d6ec47ba025f567
SHA1 049ae51724faef05f2fa63c9ba44f98b2186374d
SHA512 6e8c8c6b2a3a33d14eb973c6edfed3b816a295ab543de84e752ea1398ab05e123230c3cca55fd2ec333dbf26b5d6b02fced26889a368341628ed1b418631825d
SSDEEP 384:n0iFiZcIa3sNb8TUNTUlI4kszoNmWdnwBfgVH41Lvpgd7B8wFlJQPJnTKwBODNZK:PFQa3gwg++VVHSKd7B8SJQPJnewBKZOB
TLSH
T161D25B72E868DDBBEDE65B89A74A3A03DEF04293E58C5AD8D6DD6D1C009719C030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 954eb5dd415cf70baab7f7596a3669270e84193cc120588c15a7cb916f43f103
MD5 14726ff68331da424dc7d21feda44884
SHA1 ff9e3f819eef017638437e2b72d4c2582016b893
SHA512 b856a521fddb807581dea90220c494e70f6458f125be57431f2fd76ccee89d763777dc63bedec11e37ed86b8d4b91b71286d0b132d3a6fda062011e842bd6d1b
SSDEEP 384:nPiFDZcIya3sNLM8TUNTUlI4AszoNmuWnwBfgVH41Lvpgd7B8wFlFJnTKwBODNZK:aFbl3gMwgC1VVHSKd7B8SFJnewBKZOB
TLSH
T1AAF2A1F198D78976E8EE4B8BA77E2E0299FCC153B5885594B7C81D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d3531c36c1dadd29d331d7797219cad946b589b9d253c47b0f04bfcc3e29ab19
MD5 d200286177a62cc7501ffe7be2346ff5
SHA1 90c134335b94e9b6e82906fda3fe0fd05ea6853e
SHA512 1f42ce44582b2380e0ee5f508434aff9726b1b1d65d9e12578346f06de1dbd7215ced4b3eaae5db6798d80d11b1f2caadeea613a938eecd83feb65fb8f31911d
SSDEEP 384:ndiF9CcmyWCI3sNb8TUNTUlI4krzoNmndnwBfgVH41Lvpgd7B8wFlJQFJ9kOJHyk:UFccpI3gwgLDVVHSKd7B8SJQFJ9v
TLSH
T123B22A32E868DDB7ECE65B99A74A3A03DEE05253D68C9AD8DACD1D4C01DB19C030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f01085085255fb2af695d304fae793c5bca3e7cf09790ca6619de22046f10607
MD5 56d57c7aa9ec8ce12b80c441b7599967
SHA1 bcdadbaac1145c35c23c07e0330ab9255b72d8ac
SHA512 8049d5eb41a8e581a0e1c72bceb7fa953abb7a958614d0b4145b9ddc4e58b310df333eec96c7e5b4aeb5682a3ee94ffb882170b307a9dc578738da481fe268fc
SSDEEP 384:n0iFPZcIC3sNb8TUNTUlI4AszoNmNdnwBfgVH41Lvpgd7B8wFlJQUJnTKwBODNZK:PFHC3gwgCJVVHSKd7B8SJQUJnewBKZOB
TLSH
T117D26B72EC68DEB7EDE65AC9A74A3A03DEF04293E58C5AD8D6DD6D1C009719C030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 68e5edff4b205baea017d59dfaf166af7de355fd7518a7e9072dae2a20d51995
MD5 9502752c90f8673085e8ff16fbf51c86
SHA1 6b4dd522a83b573dbe8c72b5201db91a32001642
SHA512 ce0314a75fa8b598b8a38901b4fba9ec33e7b1c760c4be5f27175babe3cd41ca30b329891f6a0fca187310bbc52ce6e5e47809533688f1166b462c658bd564c2
SSDEEP 768:mmFccps3HwglsNVHSKd7BbQ1hhkoFYS/vg:mSs3/Y3d7RQrhkoaUg
TLSH
T1ACB24B36EC98CEBBECE64FDAE74A7A03DEE011A3859899D4DAD81D0D00971DD0347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0741a5131956d3e6244841ae4d305697bc6086b63ccea1727ca5d28660ff5fe6
MD5 076053d21fc2b7a79ef45b855e576eeb
SHA1 8797bb80f825e7825070d12d0d0b182cad0455ae
SHA512 44507f508edce49a8ef20a96b90672b908182d877f9bb4387c79b64fe368092ced8e6f6e48fa7dbe0fb23efa9b909da576602d8429920d25637e098a06a2343a
SSDEEP 768:eFccps3wwgldAVHSKd7B8SJQ6JhkoFYS/vg:as3Uy3d76SJQEhkoaUg
TLSH
T19EC23A36E894CEBBECE64BD9A74A3A03DEE04263D68C99D4DACC1D4D01DB19D034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 57dc58c993df5754f2d919fa85be1f310db91fcf05c4f058d3e0538da1067ee3
MD5 5c1eb8902e74dd7358dffb4b48362e7f
SHA1 91d2e14537db8849e9558632d4a8afad1fc7179d
SHA512 95ce58158417ef9642f09b637e9f66e06619fe437e67c81c39e054f60902bc15a060944657bad56321598816672b8ff0830d2f05f0bdb52a6f359ad53e67d438
SSDEEP 384:nPiFPZcIyV3sNb8TUNTUlI4AszoNmodnwBfgVH41Lvpgd7B8wFlCWJnTKwBODNZK:aFH+3gwgCUVVHSKd7B8SCWJnewBKZOB
TLSH
T147D26B72EC68DEB7EDE65A89B74A3A03DEF04293E58C5AD8D6DD6D1C009719C030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c2794aa8a6f92d8fd9393328a8107cfab0ec4ec1b288153e178f81f20574f7a0
MD5 fb4e2a100c7a12c6dbc47bb4c76ce4fa
SHA1 76d020738943145d7b50ca097db3c07cd150f496
SHA512 c740d12a9abc06317973797e0ec68323c4ee3b61cc95ecfcb8d2a61612119e2aaefe54adf2914f5be8f88a8639ad9d64e158ec800a7d39a83c9efaf55629e332
TLSH
T1AD412A68BAF9115CB3B76F16ABF6646E487ABD772E06D05D00110E4F4622B00CD62737
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 25c4deedb77f32b9c2a32fd00022417bf2bf3656b50d903c472fadde37235ccd
MD5 27c0b77989e0a80904220e7508253666
SHA1 55b864ef55f331f5e6f60ff6adb18f2cfe397a74
SHA512 65054d171198d484cca4ca2a8804fa26ef3e7b88860c202f4f329acf0fbf0af9bba40d40a827368144f4b9e76d9e19ffca820ed2c8b7321d589ba384df1277be
SSDEEP 192:J33Ov5zboBb5N2yjwZCC1d66Joz1zgCl6mc0dz:WboBbX2yjGd66Joz1zgC1jd
TLSH
T11DD10D64F628863BC448533BCCA20F444F3A395AD84E3F29359D65082C5B2DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e710f5be3b1e4bba5c26d39d541909139d118b7cfe6b02dd3b55451d43afb329
MD5 f1c3ae017340fc747d70698fd37e2454
SHA1 83ff33bd652df34d5600278540a3d6aa4ff2763f
SHA512 43e8e1355c6aa3a8bfc394a0501d7bb8497fa3c2853291d17b67e7f2b4838d49c6199c90771b11f1fc7568d423607eba447f3940a10f9abda55963bf2c1d48d9
SSDEEP 192:733Ov5zboAWZ5N2yjwZCC1d66Joz1zgCl6mc0d:Mbo/ZX2yjGd66Joz1zgC1j
TLSH
T1D5E10D64E628863FC409137BDCA61F444F39389AD84E3F29359D75182C5B2DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\events\events
Size 1KB
SHA256 cd0ca39c0fcc807662a83d261fac5262a5c6990beddaea7a7d6c0dee968b2b32
MD5 598e74220025e533196f60f3a5b7df8b
SHA1 b0f0dd9988c2f6112a3158b40e80ca4ca0a57618
SHA512 b570a91179ed8a690771d0f4e6c2bb0061ccce82fa8a51267ebdde00c4ff4c106f5da40ab995e14359f3f2995bd9c6879e434ce120b86c19d0b4fccf90cab2b7
TLSH
T10F214F5C39F84E2A5CC7E35C7455128EA3954E1B18871D470D12EF8DCE81AD932BE43D
MD5 SHA1 SHA512 TLSH

Submit Download

1eed18f1-8921-4143-9554-71c5fc23238b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\1eed18f1-8921-4143-9554-71c5fc23238b
Size 883B
SHA256 ee007bd55fc786a2d11e5ac401a42e51ac96d1f506480377fa0447767b996908
MD5 13e31cd6a5f4f532c41f12f9e7287616
SHA1 915221a266ab43ae97016582d4a330c903310478
SHA512 7ddd3f3c7b89fea390375dc02addcf5bfe0974d23b4f64ea97ab82d849d2b384e7371b898aebb932d958cdc8619c31a840c81aed3af1aa87429eefcfcd878b84
TLSH
T126112342A670B872CC7CD34FCDA63B124BB8751380CA51143DB55A140D7FA2EA3A671B
MD5 SHA1 SHA512 TLSH

Submit Download

314317b9-6a0b-4ff8-baf3-57d2addacf57

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\314317b9-6a0b-4ff8-baf3-57d2addacf57
Size 235B
SHA256 d3c6436973a1147990eff5479c0b6ca9bf63220cb93507d1e22e4aa5b9e50a02
MD5 c8806e895e9db68609b30065369c8d7f
SHA1 27a1438ce0753cf6ef4468414ad900562982bd33
SHA512 f693d169d7101971102eae8ac50e409e22328ab79efb8cdc2332d98a655bccc174a7109aa746949c54d848e5242ab3c2a74144a1539b2eb1ed88e0eb4573f0b1
TLSH
T1DDD097982888331D08220F06F0E0AEC630948C3314609854E6910438DEBADC862D1806
MD5 SHA1 SHA512 TLSH

Submit Download

8f3ce06c-b0dd-4628-aa38-a68d45be0711

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\8f3ce06c-b0dd-4628-aa38-a68d45be0711
Size 15KB
SHA256 a22477d00dbfb447220bcf72658af807fe1e92d21cff825e877d8a29a7444118
MD5 48b8f3f187e154f8b374ecdc521aef5a
SHA1 0133da53e9cd66bd0f1333c6343d968835f8d79b
SHA512 86fedaeff8cf707d28c0ca92642cd7980ec7ae5d8515ddb5dac630edda64a2bbf362207dd5db4e75ad7504f76cd82ea4a20cc7c046f684d0cdb801f48a896e62
SSDEEP 192:OT8YNgzyZFcNCjZdGqd8oM9xfP6YNZAfE3aC1SLKFYKjzpg/hX8t/1j4ABd33RA1:C8JM9O3DDFY8ziJXc4A7+a5ubLst79iN
TLSH
T1FD72D9566420497A8291E3A9D4ECBFC3E5F528CF4C419FCADBE47D086DDE0AD112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdec3597-f3b4-4029-aeeb-198d2c5da5c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\bdec3597-f3b4-4029-aeeb-198d2c5da5c3
Size 886B
SHA256 5ea9b1a7c1081553e28e32947ed96b065474be0d4f99e739827b08c6f08f913f
MD5 8f3eab68e765d4d5ebf5af3ef3fb545d
SHA1 5a2de4e54c4421ec4c23bdf604b6559713476db0
SHA512 ad52aecd604035b3dc0d7bcc21bedca64a337b58390ef77a78420a8c921ff66ff00cc6072a0b9da76fd6e1fbf189bc268dac45ffddda5e6fbd379767039e937c
TLSH
T1A3116741A670F9B2CC7CD38F98D137424BA03113C0CB55047D956A280CBF52F63A2717
MD5 SHA1 SHA512 TLSH

Submit Download

c956c05b-6673-4e2c-afcb-3d308168510d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\c956c05b-6673-4e2c-afcb-3d308168510d
Size 2KB
SHA256 3108cbdb3920a9581de4c108092b889234f1fa6ac9a0765ac8bd34ffea1acedd
MD5 1e20f5ce95b1d895a5717ba01ce7a1ed
SHA1 88422bad2732c2f50a1ee4b53b30e576518a99b5
SHA512 4e0568896b3abb77bbb92ed5e3cbef4964933c6f10750d3d27983df35b450a69f13459d3abaab409c1d2f2e3d6492f8079fa464f327edebc020b3f774a634b8d
TLSH
T10841135C35785C775DEBF28DDC82234E57A04A1210C628872D56FF0C8CEA65E336A67B
MD5 SHA1 SHA512 TLSH

Submit Download

f53b0360-012d-400b-9c57-567f6c790bce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\f53b0360-012d-400b-9c57-567f6c790bce
Size 235B
SHA256 2b78480bbb6a8c1ddc59ea368fcca3838b800859dcc706b9c50cc44e0b9b639b
MD5 b22d61690ecc1ba95bb1b379678014a3
SHA1 c537ab6dd3369e030cee69e38a5afe45e437f199
SHA512 194acb191dd8d29a53ae3ef50892a80355cd2dea4b9082b4556ca3f3c4333c6b998f766ca313bac2bc1ee6dbd1806b586e0bd5a32799874abbb73002917ea2a7
TLSH
T10ED097C028AC6B2D08141F03F0A038C230884C3324F468208A50813C8BBAAC8462181B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs-1.js
Size 6KB
SHA256 df032b01d9c6456a8d08c6282a37a14305f0b5c4d4f2772699009b3569553826
MD5 00ae28b70fffce22d83ac8925a40d80c
SHA1 6174ab5b12a2d8f9079b94d5f34f172c915b564b
SHA512 fabd62477086bdfb051f6bd84753d53335ec8720e090c2a13b82687316045fbce4d64ccf67ae730b17b2b083d3d317abc13be1d69216e386b8bd4eb3bfe0bcd1
SSDEEP 96:xHdLUTU0vqGqLfy7h1zSKESSlNdv9jtHn/HhrTBw88P8L4cnzgvJC:zEiRLfy7hrESSpPhrTBw88lk
TLSH
T1F6E12E7855088B7F74B6776CAC688831AAB2013BBBBF68D750B554C4051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs.js
Size 6KB
SHA256 3cf71076ef28ac0fcb5fce089798591deb168fde31d7684add3ab66a59d6992f
MD5 2766aa9e4bb2718da37872090294314a
SHA1 f904cb8bda7595e7b55e9c42349ec2c0f1e31180
SHA512 c0940849d500fadda88c17ae92076db922ee23ef1918406f3300fc4c39ec09fce4d0dcf55069ba4d191669ec94970c1781780aa0fc1bb3c5ad418c807592070a
SSDEEP 96:xHdLUTU0vqGqLfyYc1zSpTSSlNdv9jtn/HhrTBw88P8L4cnzgvJC:zEiRLfyYcMTSSBhrTBw88lk
TLSH
T15FE11E7891188B6F74B677ACAC648C319AB2013BB7BF68D750B554C4051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 fc3c56ca21acf5f8dceebd8619e4c5a2c66a2e884150ce274f0bc10b6716b5b0
MD5 7cd4c89c52bc9d9c2c0ec9921d710bd0
SHA1 ed287bf0b2e09fe6ec110efba8bba772aee871dc
SHA512 9ce9af3edcbbaa487604a82494759bb57392e57ac8c5f7860091fe0956ce2b2312a27d1c9da07cae1e77bf6b9db55f4883c82bf08d6fbffa8ff0fbf4ef5bbb5f
SSDEEP 49152:WUjnfs6yaP6ryMtpBd5C9S8ARzMUghuRPbPxYUpq:/zfslaP6ryMtpBBRzMUghuxq
TLSH
T10F1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TrashCrack Ext.exe.crdownload

Path C:\Users\Admin\Downloads\TrashCrack Ext.exe.crdownload
Size 2.1MB
SHA256 05d4563ad9ee11b070fd1bffca035918a2399c4475e327c0743e53a433e27ea4
MD5 11e6dd65d7991dfd4e0a0f77357a1437
SHA1 8e8b4ce58d4378b467028d4df1fa2bed3cbf9afa
SHA512 437e1d4f9273bdca0252987ec1e1ca927734f6e7359406ce522ced0b6fdd4c706c830b2842a3c8b9d35650e285b6aba2ef8f8a76f0dee58e31104337081fcb05
SSDEEP 24576:vFe58TzK4PLMsx7icDOCnGiErt1bQLISVaGyojTyZ+TMFzTkrdzGsOhSn0pWM/99:vE5864DlAnBOupBknhrMLJox6
TLSH
T13DA5AF87B3998EADC03698758C06D113EEEAF8109730D2EBB7C61D56D6592D04EF8B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads