hxxps://drive[.]google[.]com/file/d/1xv0PyG8v0lrG0J_Qfkh-BGX5PR2ynerD/view?usp=drive_link

Analysis

user interaction
yes
max time kernel
427s
max time network
440s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1xv0PyG8v0lrG0J_Qfkh-BGX5PR2ynerD/view?usp=drive_link
Sample260804-vb7mdsszct

Score

6^/10

discovery execution persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	drive.google.com
6	drive.google.com
12	drive.google.com
50	drive.google.com
51	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4172	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303358200920354"	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{CFADCEEA-8949-4BE8-AB03-7DF6819F1465}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3120	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
6632	firefox.exe
6632	firefox.exe
6632	firefox.exe
6632	firefox.exe
6632	firefox.exe
6632	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6520	OpenWith.exe
6632	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 5432	5020	msedge.exe	88
PID 5020 wrote to memory of 4556	5020	msedge.exe	90
PID 5020 wrote to memory of 4172	5020	msedge.exe	92
PID 5020 wrote to memory of 4556	5020	msedge.exe	90
PID 5020 wrote to memory of 4556	5020	msedge.exe	90
PID 5020 wrote to memory of 1168	5020	msedge.exe	93
PID 5020 wrote to memory of 1168	5020	msedge.exe	93
PID 5020 wrote to memory of 4180	5020	msedge.exe	94
PID 5020 wrote to memory of 4180	5020	msedge.exe	94
PID 5020 wrote to memory of 5848	5020	msedge.exe	95
PID 5020 wrote to memory of 4180	5020	msedge.exe	94
PID 5020 wrote to memory of 5848	5020	msedge.exe	95
PID 5020 wrote to memory of 5848	5020	msedge.exe	95
PID 5020 wrote to memory of 1752	5020	msedge.exe	96
PID 5020 wrote to memory of 1752	5020	msedge.exe	96
PID 5020 wrote to memory of 1752	5020	msedge.exe	96
PID 5020 wrote to memory of 3528	5020	msedge.exe	97
PID 5020 wrote to memory of 3528	5020	msedge.exe	97
PID 5020 wrote to memory of 3528	5020	msedge.exe	97
PID 5020 wrote to memory of 5304	5020	msedge.exe	99
PID 5020 wrote to memory of 5968	5020	msedge.exe	100
PID 5020 wrote to memory of 5304	5020	msedge.exe	99
PID 5020 wrote to memory of 5968	5020	msedge.exe	100
PID 5020 wrote to memory of 2788	5020	msedge.exe	102
PID 5020 wrote to memory of 2676	5020	msedge.exe	106
PID 5020 wrote to memory of 2796	5020	msedge.exe	107
PID 5020 wrote to memory of 1960	5020	msedge.exe	108
PID 5020 wrote to memory of 1260	5020	msedge.exe	109
PID 5020 wrote to memory of 1260	5020	msedge.exe	109
PID 5020 wrote to memory of 2400	5020	msedge.exe	110
PID 5020 wrote to memory of 2400	5020	msedge.exe	110
PID 5020 wrote to memory of 2400	5020	msedge.exe	110
PID 5020 wrote to memory of 4612	5020	msedge.exe	111
PID 5020 wrote to memory of 4612	5020	msedge.exe	111
PID 5020 wrote to memory of 4612	5020	msedge.exe	111
PID 5020 wrote to memory of 1472	5020	msedge.exe	112
PID 5020 wrote to memory of 1472	5020	msedge.exe	112
PID 5020 wrote to memory of 1620	5020	msedge.exe	114
PID 5020 wrote to memory of 5244	5020	msedge.exe	115
PID 5020 wrote to memory of 1620	5020	msedge.exe	114
PID 5020 wrote to memory of 5244	5020	msedge.exe	115
PID 5020 wrote to memory of 5244	5020	msedge.exe	115
PID 5020 wrote to memory of 2744	5020	msedge.exe	116
PID 5020 wrote to memory of 5784	5020	msedge.exe	117
PID 5020 wrote to memory of 2848	5020	msedge.exe	118
PID 5020 wrote to memory of 2848	5020	msedge.exe	118
PID 5020 wrote to memory of 1236	5020	msedge.exe	119
PID 5020 wrote to memory of 2140	5020	msedge.exe	120
PID 5020 wrote to memory of 2140	5020	msedge.exe	120
PID 5020 wrote to memory of 5792	5020	msedge.exe	121
PID 5020 wrote to memory of 5792	5020	msedge.exe	121
PID 5020 wrote to memory of 5792	5020	msedge.exe	121
PID 5020 wrote to memory of 2644	5020	msedge.exe	122
PID 5020 wrote to memory of 2644	5020	msedge.exe	122
PID 5020 wrote to memory of 5908	5020	msedge.exe	123
PID 5020 wrote to memory of 5908	5020	msedge.exe	123
PID 5020 wrote to memory of 5908	5020	msedge.exe	123
PID 5020 wrote to memory of 3492	5020	msedge.exe	124
PID 5020 wrote to memory of 3492	5020	msedge.exe	124
PID 5020 wrote to memory of 5720	5020	msedge.exe	125
PID 5020 wrote to memory of 5720	5020	msedge.exe	125
PID 5020 wrote to memory of 5620	5020	msedge.exe	126
PID 5020 wrote to memory of 5620	5020	msedge.exe	126
PID 5020 wrote to memory of 6108	5020	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1xv0PyG8v0lrG0J_Qfkh-BGX5PR2ynerD/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x2d8,0x7ffea611c188,0x7ffea611c194,0x7ffea611c1a0
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,4312933683176269088,7769940845415645114,262144 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,8339110787163373402,8392336989729426433,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,14110267822155218208,10350984757595775704,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,14328126940516534222,3167477373152841422,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,9654922437274499646,4663059407524488651,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,704602799938651096,5334448019937589130,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,8249821288524819846,11652473240201892636,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:9
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15021205538380195830,10858391043839959200,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,17732722081607845542,6752545853218294308,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,4354254121749920712,2632658762503931745,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,4354254121749920712,2632658762503931745,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,14395970825014505237,15955840478739479810,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8930426019390923525,1887493267355361595,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,13879174552474715682,10340654881818004739,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=604 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10331894230165352703,10627377367027893558,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5648,i,8150397037089923178,12231891828121499366,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6348,i,15508333577891776851,15843262607518710664,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,2606881896439710045,15290947424152316151,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,3046735607498448796,4736547714348625388,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=604 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5560,i,10129063945387366277,3173881314658702604,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,313934743299885037,14041360312450990403,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:2744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\sbmenu.obf.js"
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,17933246291954325259,8207092948358099542,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5304,i,9447001038575425818,13632845017157608266,262144 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,4573082001182629928,5648992225899413780,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5104,i,16516542739458441535,17892744235946023649,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,15892157737195440063,5351545802691002197,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6548,i,4258887876498308817,3494247836420518897,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,6096157339224460882,8517309793111194058,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,17448510545831073745,8798207796754784434,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7656,i,4560694209347779163,6043305815898141300,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,11237523253641678276,13903153744800033114,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7980,i,32076647778541656,2100701092287666882,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8128,i,7865073401495961294,17186390697380963921,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:14
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8284,i,2767011265368438817,6898029162038377905,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,9575930316586065342,9827785968863020619,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1084,i,8857136461447973218,14626663663614259482,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:14
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8356,i,13790689515231625517,15347077293903893420,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,11241585319205967889,16984897436826785217,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8016,i,2114482888408603732,9258390520112154481,524288 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8516,i,12329569833087468798,1594614353140554878,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7856,i,18434646090151233754,9513488534331843584,2097152 --field-trial-handle=2192,i,8733157084343260275,2985664161920989788,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:9
  2⤵
  PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:3572
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\sbmenu.obf.js
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  PID:3120

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\sbmenu.obf.js"
1⤵
PID:6368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\sbmenu.obf.js"
  2⤵
  PID:6612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\sbmenu.obf.js
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:6632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1892 -prefsLen 27097 -prefMapHandle 1904 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {d9833117-2b53-49e3-8600-23c837a5b738} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:6852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {9093e3fb-b07e-4073-9caf-1d18db4053f4} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:6896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3940 -prefsLen 27274 -prefMapHandle 3944 -prefMapSize 270279 -jsInitHandle 3948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3964 -initialChannelId {9e674024-a9be-4a99-a0f7-6f507f2365c3} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4116 -prefsLen 27274 -prefMapHandle 4120 -prefMapSize 270279 -ipcHandle 4188 -initialChannelId {b4ac58ca-db0b-46eb-9246-9e22912fe5a6} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3044 -prefsLen 34773 -prefMapHandle 2916 -prefMapSize 270279 -jsInitHandle 2920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1624 -initialChannelId {886f3dec-b611-4cff-838d-8bf6bc28337d} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      PID:4192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2808 -prefsLen 35010 -prefMapHandle 2812 -prefMapSize 270279 -ipcHandle 4892 -initialChannelId {bb7c04c8-b935-44ed-83db-7580de0a0142} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      PID:7336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5376 -initialChannelId {11e71781-537b-4942-824a-a19fc62a786b} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:7760
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {c0802443-6026-4c4c-851d-00b635e68aa1} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:7768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32952 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {c2ff0446-66ec-4ec0-b1ac-d0d17305c8fe} -parentPid 6632 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6632" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      PID:7780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 f296cee55d5a1e1e725a59ccdba8bdae6881abca157354c33f1163c428291802
MD5 9e7e15d23c977ff005c19e70a2a55caa
SHA1 c6838c69dc0d86ea8cd384ff6b13b260513fa268
SHA512 e8aaaf513ec18f50fffc61d6f3dfeb5c7ec03291c320f819a53b4eacdeab84d163e26df108863b9a8d0a9a5732bc58f5b7eb0018c9f979298b001da1ebbd7c29
TLSH
T165E026C404D9C2BEE708A48B626C634CC2C03B0EDFC8BDAE570088847049850B38AFE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5fbeb03df8a6ace56706ff90dcc144e39f9652ce9d945eb7de75235009acb9b1
MD5 3f684823cf6fbe93f51c33659155de4d
SHA1 e6b118e3c61bbfd0f6bf9d9e5b17216c82a121e3
SHA512 e35915dc86be89eb8a30b327b0d7a9ce9a9bf6cee5ada225102c5264a55afe1162ed05f8776373b50695fa46f204e47b7c8fd7ba14f048c7217291a5b8bb9737
TLSH
T149E0268509DBCBBEF7086557526C634CC2D0376F9FC8ADAF571884847041844A28AEA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6238214b4c64b5b165b56f9d518f5f2618bbe5105c9815d46214563d09371ff7
MD5 e9d818b78ab55d0c936408f42e5dfbca
SHA1 f3854597c975fc5744489e28c749a08243a63b82
SHA512 5c031b5e8f3c023852dd3f799a5b52b62232c83335e4a76f3eea8f3907d4818363849a94d861e672ae3506c4f32063d9fba2e07e918633175e0f22a8247050a5
TLSH
T1E0E0268614CACABEE708A49791B8630CC2C0374EDFC8FD9E271888C47002840A686EA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c0654308f97800e57d5cddf283587992c00bb48b3f74460ef672608da046e94f
MD5 0a540b607706097ab3e1f2b140be3a74
SHA1 006ed457211b624f7e296cb33f993779874c95dc
SHA512 73f3d29468fe09f0dbd2d168d6f00b392b5ec4307962ea2e5024359659f3a547647d34bb835a2fb7074203072db19b5f2999950eab3c97ff7db628a2abd9c1db
TLSH
T136E07DC855C8C2BEA7286487A2F8770D83D0370FDFC8AA9E1B04CD857001F54B6C2AA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 16KB
SHA256 dd1b1bc1b12378c3f2d5257e13fce269351f7205c0b1d9a353bb6519020cd4dd
MD5 1828eec30395f0667811a9b55c744f2c
SHA1 62389846e8e32746da94a1cd5874918bc6f61cbc
SHA512 a5baf8d674ec9368cc53cf6074f6734dd5c01a7372bac636df0b064617759485d480b6dbc4036edbfaf5e54da5c44363fd51d76897fad1e959033897b377510c
SSDEEP 384:WBY2ZpX4PZRjQrzKRr39XXU0AoL6RHYnF+CP9JhBI9V6oB:WBV4PZCKV60AoLaYnY294Vv
TLSH
T1E172C0D059E96EF459DA15C4083D61105F23B520ABD3C7829BE24A72EEC27FC16FB490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 36KB
SHA256 57817ef6d0681f1ddfa0d3e07cf28a53dd54b949514c4a1b232fcdbadb67c596
MD5 0c8800c6bc03d240d0998883263dfac7
SHA1 a5f70cc9715a13a8676377fdf0c7cb729f33669c
SHA512 228747ba85b28af4da83ffc1edde736c9dfd6c07ade2973f06cab260710ceab2d4b574951ac336f5466e4a8be328f378dfe6faf1104b2e98032714bd31949396
SSDEEP 768:OHnY8GOdX2rOVNtT1z89b1sBPQbImxsKy6zTn0n40b+rvAkLOj8:+RX2+5I9RsBPVmGKVzvFb
TLSH
T11503F12F0776683A415AC98D89AA1A350184DB580339E03DADD166F0D43A729FB7BC3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 26e67cf91301c1739eab66475be28edaa9d4aabe1ba03d0d581ca4dcd7d6cf4a
MD5 8ad2f90a31a6ec0c25a3221c17b5cd3e
SHA1 0193f359d1815ebac9614efea3a5f706698e6f21
SHA512 675136409df1ed40936b3b1df76d546737eb5eed5228e89ae0964e6d0dc5fa844d74c0122f61894e254d7599070c96a1d757e4385ac2ade5496ffc019f56a094
TLSH
T13F5195EACB2F9ED2C320D2B19CED05EC717E89E686076B3583F123B4A70230E2751465
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6ff0a10687871101ca8bfe7cf473bc380290dd95e5f7589b488af56b13049c2b
MD5 31ea3476b125962603ffe4be105ef7f1
SHA1 490a62b41c8bc019b420e20abe0bda8f59597110
SHA512 a78f8eb08a2a81b1488dc3371470337172393c9c023a16d22a37c768afee56d9b909b303524b8364c5625023f01e7115fed5d4d788e5fe889563e0fb16f6c6bd
SSDEEP 96:0VRRR0A7I3JqbEfYNATWTxEKyiE/Pgspqj:0U+I3ONOQApqj
TLSH
T19F916FD9D6DF4AC6CF24C5F25DAD0CE9BB6943A0C546373262716338AB0B7AE5370008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59c7ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c7ea.TMP
Size 2KB
SHA256 819ba6833b7dc82021fa3d70417667848d8c267abaf1812f448d36a1be03edbb
MD5 88444fae730e9bf20ff8471679d1e29f
SHA1 91135aef3a8b3ad653052d84b4f557efc0c96118
SHA512 6ab7bfd821126a95e5b820d70841326a8fb2601b80bed3b5a5774e9837c81fc0a6bc49d619fbacee640f5b0ca92866e1dd002e3e5c7f01575f49b4551a832e5a
TLSH
T1805163A8CB2F0ED2D374D2B15CED46EDB27E48D6C6076B1593F222B49B1230F2391461
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevToolsPlugin.html

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\DevToolsPlugin.html
Size 220B
SHA256 fd59488175e43bb4713fd621e785b618fc647a3521d305874722bd6b7fd1c649
MD5 0d09cc16eebaeae80fe58be258501fc8
SHA1 898cae597eb3039e94878df3eb5ab1c012bb5264
SHA512 f90c0ea0174598146450074c57344765b725ac0e44ca5c21f979b8f77370be94940aa53b684d9ef1e77c3090926e2004a931e6c0bfaa1f5bee3247a55799ff83
TLSH
T131D0974D08CC55A2432004636A26BC0C3F4CDA20813BC6A3E878C1582022EBC80D0880
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c9666066b4abca57fcb35953362f7f775d87e18dfdab217fa87d6c271bf49f7d
MD5 f8aa26e475228d9b32061f48b14a907e
SHA1 3a885bebe46a5396cf59eb5f760b611abeeba917
SHA512 34fec017312260ca09069c4e91dd45c1272a754fa0f361268bda2c46567b56cb71f0747308f3291f97154499b0e35cdcf726f7b3728d0afa260d49186374f511
SSDEEP 192:Df+YjKbb8S2azbDvpamB6ozctu4X67+qz0XskjOjmoO99:Df+YjKbb8S2azbDvpamB6ozctu4X67+r
TLSH
T14502B9F7C3E8862DC91156F49B19AF1FCE2D0A14432C3D2AC8D8AE1BD3E2531E21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 bd0613248384823871c50e7618a733f1efcc265c590fa188e34e31e1f8b08cc0
MD5 784cbc8971d34b03b3ee1232334407cb
SHA1 f5ad2f2f54d1ca69c13adee4708a642e8bb6b930
SHA512 0843c799bb0b8e3c666d824da6d0163bbaf61e2f575a44c824d4c122fc7f4a0eef184b1fa602e6712dcfd6df4aad8019620aae136789e44ce2a53e4d56ef3206
SSDEEP 192:DW8Wt5OavOKjBlHL1To1pama6PqcIuQNZZeRWmskij4cnQGjjzjOct57QRGk:DW8Wt5OavOKjBlHL1To1pama6PqcIuQw
TLSH
T1E612A9F783E5822DC90096F4DB05AF1FCE2D0614432C397A88D4AE1BE3E2471E156B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 fed86b4250fb20f0cd861642b1c2d1aadde3791848476dc70422c2e28c8c953f
MD5 564d59e71fd3ff8a6bccb3c2878532fe
SHA1 f7cb2fc5a03b1885074605985b03352f5c3cb7a5
SHA512 bfc0dc089437ab3eaf9d613866a9056ffb7b195d28b95d504954be951f8e4c3583c32ce1c514a839bda16645eae8afbc447b3bb727f7c3d0c90a1d00ce5fbcd3
SSDEEP 192:DW8Wt5OavOKjBHL1TotTI6pama6PqcIuQNZZeRWmskij44jjzjOc57O+dGFTE19:DW8Wt5OavOKjBHL1TotTI6pama6PqcIv
TLSH
T1001298F783E5822DCA0196F4DB05AF1FCE290614432C3D6A88D4AE5BE3E2471E15679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 772fef9e6f22f9749d9b89733cf0e18bd37d69b5feaedf9af49654e80f350009
MD5 5b9f08b4205bc7ad8b72821b0e82de0f
SHA1 871a379d8fb20d157f7f3720b9cde17011a41ae4
SHA512 174e5e1dd1ef740e38d151e3483d4df68854065cf24f261cf9bc0f070262d5440a0a28daa034ccf4d89c281d2bcaa076694b6d9a442d03748839f76860bd75e3
SSDEEP 192:Df+YjKbb8S2azbXpamWp6ozVoytu4X67+qzfK2JR:Df+YjKbb8S2azbXpamWp6ozWytu4X67j
TLSH
T1D802A8F7C3D9862DC94156F49B16AF1FCE2D0A14432C3D2AC8D8AE1BD3E2531E21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2df6efbf24f3c51e337ac1bbdc6ae21839d686bc8474c12d64a7accbd68723be
MD5 1e32ef555a2de839481d2073ec7c61e7
SHA1 d3f85b08c07ed516cd5e5348b17c61ba0c1fd3b3
SHA512 a4e2ccb83fe6b3d8ac5727098ec061dcc80637fa2815320b0dc3f0be96e83b760f0cf6470217da23d5c6d8f6bcf3f3ac080a66814432faf65f81a6c5c6491b30
SSDEEP 192:sxRMRH8bR/fTsg9Sy/ivKzoA8pUIeO/g6+WNwULXYZ7/qsfG7+vIgDsJ:sxRMVqR/fTsg9Z6f1/5bX8dM
TLSH
T13F42B7567968993B9CC7D20DFB55BF53E2F96032A1D01E58ABFC9A1C04E7ADD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 abc41f50539b111850914437dccfcb55633decacedd93da3729192602e2d3429
MD5 56956234f27afa26cec123e3f1e97445
SHA1 78f98e587cd53194aa78a7c735c9d61b1fd56e0a
SHA512 f60bc54883df89162865bb4b593728f62b4d89eabc72f9af79027bcd8c5eeea51a92b274a1600ef49584fc0c70e079cfb64ace63520f124ceb98d3461b2db899
SSDEEP 192:sxRMRH8bR/fTsg9Sp/ivKzoA8poO/g6+WNwu0/YZ7N0sfG7+vIgDWJ:sxRMVqR/fTsg9a6f3/5W/OdO
TLSH
T10942B8166D68993B8CCBD20DFB55BF53E2F95032A1D01E58ABFC9A1C04E7ADD221350B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 31ba209773d53ee507c63211a0d4ec5d276987f3c887ceed8b11b371fa5c8a60
MD5 2ee079fff1d585058477c45c2804b3b5
SHA1 5dafa18bb1007d467354c2305bc9b71b85faec3c
SHA512 4d5b55e48d52aa637f2cb55d9008eea0d6b7922819d3eaba1b623f703e6d594bbfa30066878f163b248d111b86c29bcc8b866f8c3f6f0f123ea6cad4e296dc7a
SSDEEP 384:sxRMVLk/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfo6Hsg9Z6fg/5bW/8dM:sIhk/f3jfW9RC8wAefo67ZB/5I8y
TLSH
T13F92B806A824ED37CCD2A21EE6757F73E6F5512682D02E2C69FCC61C40A79FC6117927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 35KB
SHA256 62c00b9f2aff8fb2cff79572202a447307ddb8e57d3645a70ff3b03fb1004972
MD5 2044d9499c50b82651212c56bb5d425e
SHA1 334fb31f879c15e04b79fdef51364b4e58d62b0d
SHA512 b26ffcd896a689f7f1c80ec27cae914905396781196292dc18e6c2c9a310c41b736ac2c90edcbeb315d5330b6d0c52c0176acb0bb3e36a1e03ad9b7c213f665c
SSDEEP 768:sIhK/f3jfW9RC8wAeGzsfW4Mnc7WeT+J//5ANy:/hVzsfHMmW75AU
TLSH
T146F22A059814D837DAC36E2DA57D7E73E9AC505652C0DEAD69ECCA0C00AE5FCBB07863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1814981d18be48d2f8394d003d4007e8a3fdbdf73401e617a8f5a7c0ff3a157e
MD5 f0f435a27619abeb2bfaf37985f51487
SHA1 3b1d7fb1be43e80ab80cbcc1676e469a427d8560
SHA512 9976ea73aff7b18fdd5d4775a4b8215386cbdc53d3ba2c621b985c5a0e8ee5a06ccb0718f3994d5c8f9ea23d1f4fc11be8b3cd3612fa15693b8c95aa571c3867
SSDEEP 192:sxRnRH8bR/fTsR9Sp/ivKzoA8poO/g6+WNwu0/YZ7NKsfG7+vIgIJ:sxRnVqR/fTsR9a6f3/5W/Gds
TLSH
T13D32C9166D68A93B8CC7D20DFB55BF53E2F96032A1D41E58ABFC961C04E7ACD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3b2085bccef5fcde814c87fe56edfc6237c3731d09d73143b53696b6b3e087f8
MD5 4b06591880deb335cee7847b3da8f7a8
SHA1 520ec1c023fc08c03bc461232ea5cae8bd8dc563
SHA512 5b87da87923678934a04ad387e9303ee867905793e41f3b6c1f0ab22512f3a0caacc361f024ac7a2eeecd5e8dfbf8838e5ecac69b72335f994ad55981a71e6c8
SSDEEP 192:sxRMRH8OR/fTsg9Sy/ivKzoA8p2Vgdy/g6+WNwULXYZ7/qsfG7+vIgDsJ:sxRMVLR/fTsg9Z6fg/5bX8dM
TLSH
T1C842C7567928593B9CC7D20DFB55BF53E2F96032A1D01E58ABFC9A1C04E7ADD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 95eceb8007f40a610bde5926c906e7fd8ed5be1f9c6581c7845915d0b53fd96a
MD5 d091e2af1ab683aa26f77138bfaf3080
SHA1 bab6b1d7a309de6a7826cb4c7f6929b90019e476
SHA512 5ef4c79d8af92eaa3d016814156ecd5a37704e518a602c1fb47eacaf84e0a0792489131aa19ceff6eab0c35aa9827cf03fb607eb31e1067aa2e79a510aa27f19
SSDEEP 768:kZac2SGvWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMUSV4frol6+J:kZac2SGvWgd5f/bu1jaBUU4MPJ
TLSH
T11EC2FA3B604DCB7F5F800A9DAC566FDA6DA802C796588D4047FAD90C03C77EB912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 c7737936551b506cab6a8e13d7d6ae56979ac15afa7c84656e117142111eec44
MD5 0d324366c142dc8352aaa382afa47d04
SHA1 e9268931afb73cd60b925ab54270e112e47f90e0
SHA512 4b1701290c0824cb429e41b1d868663b5b4ae65087fd22b54aec76e8951757ef63302d83fbc0932ef00cc0b5847fd1ee0f8e317ba3bd2e1a4f926a70610fb3be
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6froOpa:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0VG
TLSH
T163B2DA2B604DCB7F9F801A9DAC196FD67D9802C797988D4047FED90C03C77EA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index
Size 72B
SHA256 d16848e47401a7ee9cde793f5de8bfa9ffca603eb9f737a5554af38ea3f05ead
MD5 44c52005215407dcfe3baaa5229f5513
SHA1 83ed35bd7253937485c317a9837707ebeeef6087
SHA512 b24ab3a876425cd5a34dbdc01138dd866398426a04338138b4260f17257e3068ec100c1eccf70ed23f42441383586abf7f4935daf8b60dc09d242dfee69d74bd
TLSH
T130A00259068D7144D44266B329E701B253004D945210572540D0105DC9E8656864204C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ddfd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index~RFe5ddfd3.TMP
Size 72B
SHA256 690703b9fa7d751019c539d1b4622301488ad9fd6cf675ade88dd8bd5b1f2e2d
MD5 47651f8f4895e9fe47dba731224b57fa
SHA1 c07be7f63c394bf7bd43f7fffe515b2b18cc166f
SHA512 88c6bbf0db6d0cbf93b306cceffbeb3f5be2541a6dc3e4763ae649e922bb5dfcd987215afa37f00ff09d13ce1ba5ac6e39387d03ade0a6f4cedc49b7457a7343
TLSH
T1A9A002500BC54047E09365B11DD203A153018C14F110120650D11244CD58560864300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3d3ed05b-13bd-4104-a646-2725f360952a\index-dir\the-real-index
Size 3KB
SHA256 bd7c173153b32c87867b694864fde9799e7787ceba518f6b0c7de9e2f3169c5f
MD5 dacd268521d2304ed6971b9500bad1e5
SHA1 ffab426381e84495fc6db369132d676d6d1c4c55
SHA512 028e184763bde0d5cf229c9cc13be4a21e8b6ce54782084ef711aea19bcb3eb4c539c55e1b3b6a631de3aab8930a9c96c96f3446897d230121ee8e3d495869c9
TLSH
T16351D74E4D4B1DAEE9AE14726CFB1486337A68EE4749EA0B669CA1303CD332D2E55109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f15e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3d3ed05b-13bd-4104-a646-2725f360952a\index-dir\the-real-index~RFe5f15e2.TMP
Size 48B
SHA256 be43e485439298634faddd8b0f238471dda93c004f9220e9365d28a01f11e667
MD5 ae69bfddff0f45011407f691c1eeeb0a
SHA1 cbb728c93c34921870a700790f4a88fb5006c51b
SHA512 87442b1e1e4c9f824b553466b59d879a4a5e1931aa9bc7d3d8fcf487dea207747c153f7b1e3b674bb453a2834bc1e43e318d04ae490a39487790edc905997826
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 273B
SHA256 2ea567234827a32b076224365ffc90dceacfdfd19a5ee390a47647df794f28c1
MD5 dd366f5093e89df558a551703cade2db
SHA1 9712590e10af8169b629f222ed7343e649ceff2a
SHA512 b39aa334f19acb49e116a044f3a4d317710701fdcba9b7878d91d50fb9c00aa083807a0310ae0333ff6c742c92e3ee84beb0305945d4e70805b2775a1058f404
TLSH
T130D02BFB18D94864FE6F83E7603694B141027D504A49DC4A5128824724A17253437C65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 66838e64f4cfc6d9588ab9f97efd93e6a4bac04000d6a9c23e9dc60d0e5344b6
MD5 329041c72e6ef507e2ded47c00424377
SHA1 368df79d4593c17562f2379378e98c199b7172d8
SHA512 82ff2b4b0163362da011ce306d7d63c7a6f09ae5f27405b338d40a1ce7ffee71adec56b83db384ab68061b6c093c943148678618424bb61b13d1fe0c4c86caa1
TLSH
T143E0C0F72DE60834FE6F83E7603648A104027C10C545DC8E5126B18730B2325203FC25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dbaf67b11c5a68d65c9921d3b6aa40f1cdcfb14e8be998ea5225d0bc3e22e332
MD5 d0466b64d036012c8d7b66963eacdcf9
SHA1 6408dafc871e56013c8de5fd891f7c5e0f02c7c0
SHA512 15816fb974c70c2f43062936aa9e3e5b58ed5d6dd38eb23d588fe464e18803c89184abe4f19a539f41fad8cb951775be2edb3349a02b1b2dc94713c371088f45
TLSH
T10EE0C0F739E60834FE6FC3E72436887000027C10C545EC8E1126518720B2364303BC65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e888e2a2f52f17502b951ac58f583933325b53afcf65caef9f83ef7b2754cce4
MD5 16e6762ba16a07cc0c3a8158b56f9383
SHA1 c3ced512b7da86ecc9b27304977bb95d74279123
SHA512 5876a4eb3f00629d754fbd194290aa1b70a8942fe3df33abb386bcc984237fc1b1f6b6345fcd5ca5acd5ec8a535dbb905075ea9ad45b2645477d493bfc943de6
TLSH
T132A00276CA9C80EAC0110270D0A202B46310CCE8A645236144AF03A48D6924545FB10C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ede48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ede48.TMP
Size 48B
SHA256 e347e21e7ea7727e72a21598fe8e51d8d26069b33ac54a7899db8c48c4a98a17
MD5 357473745559eab857d94d99d2925664
SHA1 6d3521a25b2848e450bb3b5763b67d03a7767afb
SHA512 9a786baa2554b2c7fe1c73d716e3b1a3e2b8001e60b205679ecb1c74868e48af14c652807028ae1a899ef4e2821188b4495b792cec2e7e83cf700ebf90fd75ec
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e8a4be9c02247de268dffc77486f478c52b80ffcafdec25b9ac8191ae857be9
MD5 34d95b67fd5bee71d0c03b9f7fd2352e
SHA1 964d05cbd02ef07c103e02d05c9899cbc47fd15a
SHA512 f436299f63a842ab6d77c181770432cf8314341139291cf819262453551d5397a7fc2ba90117ab8231a1b2ec4ae104275aebcc5beebb6c66eb23005d45767629
SSDEEP 96:Knob8YmCO8myBn0w8K8p0u8YIYh2IhhsfocSmCAmeVT0UAK8V0aAYEUl6/LeKg0o:6ob8YmCOVyB0wUp0uVIYh2IhhsfocSmQ
TLSH
T1B2911386707B42412D7E295CA660D626D682B0737418B92F7BEC54B11F6BF010EFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3876.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3876.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 7bd2949fa1052aee16a7119f13f9dff3922fea606dd181fb30f97d8b4de7fbff
MD5 e07d59f8f5172fe6847f8c3bae3abdf6
SHA1 5a16893428e4aee3cf7a5dd398fd291fb71a7621
SHA512 6a66551c2356ad0eab77c48e7edfdadc063066933a82cc33a19d71d87e82d82ed404f5b11fc32086f4f379ca5a821b89ec5556e2580bf02a36650b09253af0ba
SSDEEP 768:Erv+4UNbdV3SwB9qRaAam6aQMGdjWca4Ghf9Dd3I:EbsbH3y0maME6pDC
TLSH
T10CF2AE31A868D9739CB79295F21F7643BEB451A389C84E94D8CD6A0D039B4CE330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 621235a3295bfe6364883918f0bcf79aae8cb93f5b2200ebfa033380a770e937
MD5 55057c49fb210691aa8d7f86317e5871
SHA1 0922535050c282a51cb697fe6f46dc97c5f29d48
SHA512 8edeb5116b97f4d9e970ec4e6beb05d4a4484851c292bc8d6e5cbcf6a95663d407e1a4f43a11ac7cf13a0ce81f20c8d37c053be6e70b041cf5ef096f89ce5fa9
SSDEEP 768:nFar33wgRYwH/lqmAam6aQMGdjWca4Ghf9Dnh:Ur3PjmaME6pDh
TLSH
T14C0349F158D78477DCAE8787A33E2E02ADBCC163B4848944B7C9690DCE560BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 42d129d3a7f62529b3ef2dc7690bc7513e2c243b3d5558ae9eeb0cc550c0ca09
MD5 455d1368979058c77bda76d1ff9417c0
SHA1 904f50ab941292fe36eb9d0fcd6af478c9ab586b
SHA512 cccb8e9b97f1c2bc8a00be750c76eca1a5f649fc0c12c323627286584b062e5e8006b766158638c8c4ccb3cc315002003ac16ebd33803b36be315274da9cfdad
SSDEEP 384:/ZcI238N1wSqiwrmivu6epd+dfYbRAvpgOWmkA1QiZh6vPqQMQYeJfjWca4G2KC6:X23/YwB9qR3Aam6aQMGdjWca4Ghf9Dnh
TLSH
T128E2AE31AC6899779CA79296F62F3643FDF4916389C84E88D8DD6B0D039758E2307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 283db7e8a170bbb9ae8c14031a5f405c36583ec9896a3338ac37fcfe6d42ec61
MD5 287fa6cc49392029d336f16af58987ef
SHA1 a4ba6fc9e84e4711a11daa96f8529c90e61ff6d1
SHA512 15575584261b52a9686ec47cab77e119a0dbedb9622fe8cb01a5bf1032d1be35cacca9a737dd27904a3282116adbce9b53d2acd3711aac2ebecf7dc63a2a3cd4
SSDEEP 768:nFH63IwgRYwM/lq2Aam6aQMGdjWca4Ghf9Dnh:J630CmaME6pDh
TLSH
T1B30349F158D78577DCAE9787A33E2E02ADBCC163B4888944B7C9690DCE560BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 df507d9f0b76a7bd823f01fab76b3ca6b779aec837d6422ed769239229ebc796
MD5 af9e4d8a33f92db69252507360dbf61e
SHA1 90c043c2db7f87547cb25cb91e53f2dadfc8eed2
SHA512 75a2f58cd00c8f6b356573d2cb3544aaaa9b237e8acb0758ba69b5597c903d59515524c938418220c05368fd757de13e82f02ed629f1375bf17edb8ecaf208a4
SSDEEP 768:nFPN30wglJwB/lq5Aam6aQMGdjWca4Ghf9Dnh:xN30lmaME6pDh
TLSH
T1C40349F158D78577DCAE9787A33E2E02ADBCC163B4844954B7C9690CCE960BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 49aa365578b3df15b4262535e088a94516bfa3eb90c63ee5b7f3c08f8bae6248
MD5 7f43cca93fcd3b8c86d9f0438a5bd30b
SHA1 7958a8ce55dcdda2c2b4014c8d22aaf7f4170fd5
SHA512 e1da14a67b559226f56dc52517a2daad9b66f07dbcb37a6033f1880afd74942d5cde2cf7b21bfcc8149720007a5447e794634db79d18d6182961f346c2f2a1b0
SSDEEP 768:/rv+4UNbdq3ZwqGAAam6aQMGdjWca4GhfBRPeU/:/bsbc3mKmaME6ppH
TLSH
T1F3F2BE31A8689973DDB79A99F21B6B43BEF021A385D40E94C9D91B0D43974CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 7659b19e39d3f28e715c2227842329298f27204ce7b905de1825a91352805a72
MD5 eee0729717b39cea7d58371b15589374
SHA1 d050a4ffc1cf073a8fd3e78d9f914ce1cdf0bae9
SHA512 1d2d80b487fda958ecb146f8f77f699834b6d99c02b65d662f37e9784de6aad36b230617d4225b3a732dd89545e978ddf7f82b2939f2b43e7b4c3ca8020bea49
SSDEEP 768:l23CYwL/lqRzAam6aQMGdjWca4Ghf9Dnh:l23C2VmaME6pDh
TLSH
T1F5E2AE31AC6499779CA7A296F66B3643FDF0916389CC4E88D8DD6B0D039758E2307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c2079233145f9902af1ea686745f2e462de4f75102ed0e522a98f22f643a7a0e
MD5 cc0e7879901d682000de615eb82bdff9
SHA1 155c369575fb1ece0e81d68489f57cd9cbcf2787
SHA512 86c3b7cebf14ba167fbf2694391306603dcb4eb5d9333e9ac7c0420a3cde1c71c5abe0847780f17170c682a12cee7e85d7ca33c2a01b382d2be1a9623526fe7d
SSDEEP 768:nFxt30wglIwgJqMAam6aQMGdjWca4Ghf9Dnh:Lt30QmaME6pDh
TLSH
T1110349F158D78577DCAE9787A33E2E42ADBCC163B4884954B7C8690CCE960BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 af9fd145e71e6d5794d227ee6dcb80d73f61dc7522adbd4228f276722ccf3f60
MD5 99cb027ec2f21390f7ccfb0ea3caddae
SHA1 a05db5788c8fa89e97de8f40e996b413d70f7b8d
SHA512 a30a71899e83630f670fb7c8c51938272e68668eac345b5938f3baf84cd54b20506f568238f001c85115392903279fe646662f04fd004c88fbac47441cd1cd93
TLSH
T1AFE00203530404F6C00C033000C3271067F3C87101F117074E1011D51C132111E30F04
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5e93a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5e93a3.TMP
Size 392B
SHA256 3592e9f4c48620ff250266175af8c9b41d6c9d4c1517bb592229d39fc55ce036
MD5 ade056faa5b70e846b6082809fb3b1c3
SHA1 a0a208c13cfef95df57d70502339b3d62471e0c0
SHA512 245ddbaba610ae93f28457330b597140b66c26482370eb9e40d9d62916fbec090d0dea849f790af24c6a4a91db32283f64e1b1d7969fa0bb324662775fbe6851
MD5 SHA1 SHA512

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 5ed01c7715bb76b6c5ba28d9f0afd2309fc18eefa8d797d9b3e3950143a80a45
MD5 d783c0798533b8a706b1e6f4c1bf5683
SHA1 a4592ec748d05ad72a96af1f49fa3c3e851f9771
SHA512 c1bd49a83ac094e251a12c26ebde7c9f905981f98a1296af56850cfb4c8eb35df62821f2b9c85629cb6c42814b6e79d6dabe2185102bb636ea0066a76eb72c38
TLSH
T117513A890AD112BB6BA7BBF00E4195CDA33B3A0FE2E984CF54D048B465738A356844E8
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe599dcd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe599dcd.TMP
Size 583B
SHA256 f0c70e902aea5bf7ec1493d27a52fd62e0898270adca402ada5547b719855f15
MD5 1a3fa8e42d6c8934a9e9836ba7186a4d
SHA1 bd3bd61c237f602b66c51b301b98a36cf1a40b81
SHA512 b655fb57bd9c9545b29b2e4736808fa3f40a960102278bb99dee05620e8c29bbdac10991ad033bc03bc6aec418ad0bb3423c27611643184fe9fe1b7fcd60de55
TLSH
T10FF00C34330995E8E1F1802900FA9692353688BA8A0458EE1C17823DE32AF987481B3C
MD5 SHA1 SHA512 TLSH

Submit Download

3a5c2266-1a48-4470-9802-e2e03904932f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a5c2266-1a48-4470-9802-e2e03904932f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7a8884dc-d43b-4a36-a47a-f899aa952dd1.tmp

Path C:\Users\Admin\AppData\Local\Temp\7a8884dc-d43b-4a36-a47a-f899aa952dd1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ac2152cab390651ca350b19ff28012f51ac4ec9bc2adb63a5153369fb6761f99
MD5 07242d2953e9de46cd9895173a3d6368
SHA1 b9718d42591f7b5ab34213478929020f44e04f36
SHA512 ff6032612270444abb2620536fe327ebd7101b0af00cbfb1c7f5e688e94c058c6c59286f5e0410ab7ad71753aa43b4f0715ca6264efd483c6aea0b29bf4aa2cb
SSDEEP 192:/Ov5zbo7UsmAyjXMgoqo1d66JoztdzgCl6mc0dz:wbo/mAyjqNd66Joz/zgC1jd
TLSH
T151F11064E628463BD408427BDCA61F410F3A385B984E3F1971AD604C2D5B6DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 07afb69a93273212da453887a3cecc98cdf3fdda2185f66e3d593a89252f640f
MD5 18ed28cb9e1d277c958c308871678bb7
SHA1 50cb1bb07907201370f178889cf205b639da358b
SHA512 df51cbb8eff85cb504739948dc10e8fe92eb0eae03b561423958000f706fce810f907b6d7785d6630eec3e373b9328f817fdc4cd2689ac29edbef981df585ac0
SSDEEP 192:7oqM1d66JoztdzgCl6mc0dDOv5zbo7UfZmAyjXMN:Mpd66Joz/zgC1jmbo6ZmAyjW
TLSH
T188E11064E628863FD408427BCC661F410F3A384B984E3F1971AD644C2D472DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5aeff55291df528b430a043383ab9f8691788bc893303bc19fae7d655c612fed
MD5 25b430b7cf22f793325d64be6117e817
SHA1 c2b131c8d80d11d06486d481f7a4d033b59223d3
SHA512 5728e467baf008e5fc41260457790c079e25971bd8fcdd04494798a91a2f45a074b5f1ec1d17d9c458c611ebb99e5f16e3cb3097b89b9cb7fdac7c8102aad210
TLSH
T17421978C3EB88D6AADC7E79C7444028E9B158E0715871E571D02FECCCE91AD9336A63C
MD5 SHA1 SHA512 TLSH

Submit Download

5ca59428-9a0e-4859-bf96-101d9b73ceae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5ca59428-9a0e-4859-bf96-101d9b73ceae
Size 886B
SHA256 2b68ba821447e662e37f91ab78fafe831e4b0e16703b784b881b27fd58e47c5f
MD5 1ebbff256488272c2b19838a8de27d07
SHA1 e0dbfab12f9a1b719900bd28b3c61f2c3c63d522
SHA512 1d68e087335b63307b87f97ce601392eed73ef99889bff753e5574a30e915c9991200be32d995ce73469fdf2a26faa8e4e977cb9a38eb91be493f39edbb87bdc
TLSH
T1C4114050853475B2CC28D25B94A07B438AE87823C0C70C183DA25A180DEF44F9B5B30B
MD5 SHA1 SHA512 TLSH

Submit Download

8888e339-7b2d-4e89-9f3c-29d2a1aedd8a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\8888e339-7b2d-4e89-9f3c-29d2a1aedd8a
Size 2KB
SHA256 7ea0bf37fbd3b44f5c9a123adc531137f8ef50439d442414d008abc665652907
MD5 7d7c8eb1fc8dbcd631f5e0ddc4a3b31e
SHA1 bde3f4104d8b185bed79c728e7ed0a3be195db31
SHA512 797ee6b67c090e17e1d78cef0ec4d00967b4118f99e394f78ed62176de7b92fad71ca202029c6a268c49cbd8b5563ae788241b5506847bafcaed935bc25353f0
TLSH
T1FC41665C35784EB68CDAE18DD492378EE3A0994304C31C432D95EF0C8D9A69E736F42B
MD5 SHA1 SHA512 TLSH

Submit Download

a5319ec9-146f-4a3d-aa3b-0beb9906d675

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\a5319ec9-146f-4a3d-aa3b-0beb9906d675
Size 734B
SHA256 3842ca035ade29f3a7c95b2b670e11a9669fc2f2680aa5b045c0ec6974941ff1
MD5 70f1b6152fb5036f6e7f09404fd98089
SHA1 f4e3bb3ecb216e1ebed02308aac5c025371578ee
SHA512 bd51c3466d855b3ed27d6ac5e8496869ebf9b9d88e5865e935e643d27e71c954eebbda63ec97dee230ebc68aa71c611039c44819bd504dbab4ae01a291d00f55
TLSH
T1D501DCD18A217562EC78D34EDA19370A82E4A43394C744286EF895140EFF51F9226B0B
MD5 SHA1 SHA512 TLSH

Submit Download

bf833953-47c5-49a6-8b75-2a62584c5b92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\bf833953-47c5-49a6-8b75-2a62584c5b92
Size 16KB
SHA256 d0a1e6a367744faebfbf790b8112da25158aac82df39cfa0e144d877e4125cbc
MD5 9952ca3a62ba5f1c030f5ee9c6acf346
SHA1 9d72652c6561a9cebc9b12b2efcb714036190ceb
SHA512 69eaa29433d9b82a210a25151de631ef3daedd81ce520316a08b65818568cc4d6257a328e485d043b8b02227a4fcc3ddcf76b2d18ee87290db92eb388b2ba921
SSDEEP 192:HO0uiMkmKxKcMsSgZ72zc2/OBG12waBO6VzSG2aE9SMiyXa8KUdFIjSzm//4lJe:qg2/OxwaFmG27SMiyK8KCFPmXP
TLSH
T1EC72CA56686055BA8591E368D4F87FC3E2F638CF4C019FCA9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c668ce73-f450-46eb-9620-05f43c1a33b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\c668ce73-f450-46eb-9620-05f43c1a33b0
Size 883B
SHA256 778eb113f31d0fe222a1b89e1fda4cb63f46158e954f9aecde2f7d7c739c6609
MD5 5d01cd68a0ac57d1ccc398698112871e
SHA1 2f641c0602cc389ac0f8a1a4772152f9edac0419
SHA512 da6973c1d268cea154669eec7c6788d54841f95c0f8b9ba434c7c0e63cb0aad8328f67622d5f5823056ea908aa258557c300eec029afc7df0fa78f2a00c285e6
TLSH
T192110044D5347672CD28D29B88513B0397A4782380C644143DF15E040EFE62FAB6B20B
MD5 SHA1 SHA512 TLSH

Submit Download

de3ab648-c354-4abc-b094-52127b97248e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\de3ab648-c354-4abc-b094-52127b97248e
Size 235B
SHA256 8ac49a77ee87f8a19bf577c8a17171f630b8c6cbf4649acb2a0e9ba7041b8f59
MD5 39cf0d6a3dbe6ebfc7e3ebf53dc5809b
SHA1 135aa519a2dc81a44a24b15238bd5c412a621d5f
SHA512 e89cf3bdabca8265b94c7c4ce36726f330de954eeecdd416d1385471ea6ab597e75cecdea272863ef257837bc191ed71ac13450a8e5bfea318d975d644452bc3
TLSH
T165D0978064A8F39E88180F4BB0E02DE631594C3390B468508A900034C9FA9C54165C0B
MD5 SHA1 SHA512 TLSH

Submit Download

f43a3dfa-9617-4bb4-a142-533ca4c163b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\f43a3dfa-9617-4bb4-a142-533ca4c163b5
Size 235B
SHA256 abd1f668aab1f498b841b6567b34ee653fdacffd7b9b6aa68099295db8805637
MD5 f1877f259957dd1969313fbbcb5d4245
SHA1 ffaa674202c45e8fc48549c7c6dd6ddb2251f831
SHA512 fbf224159b4a4ac29591dbace32d94874ac118d4cf51e85c47f8312ee6b20f46c028d68e60e1d4fcb0b3bd724c868836e748220bbab0c15f01af02a91c688bf6
TLSH
T174D097842488732E08100F03B0E1B9CA31854C33A0F9D830AA914A74CAB9DC809A2816
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 6KB
SHA256 6ff94c76a8f3fcbac1895f75ef3499ea9850cb551ee89f020e0e326b2c7b4edd
MD5 1ac7391960e463822d1a670ae7b06464
SHA1 8837fd10a6bf32ea474f31c5070c6fccc952e6f1
SHA512 c2fbfdb192eb7f83d88a7db8fc0903cb63f4d06c77a962622c7a65cd81856208801a7dc748c67445f6c092a47b1da1a5e818fb249de3c8e76957aa50fd225a39
SSDEEP 96:xHdUTUZqGqofyCp1zSNTSSlcdv9jXnUHgYETBw88u8L4cn7yTM:P0RofyCpwTSSbgYeBw887
TLSH
T10CE10D7894088B7F74B677ACAC648C316AB2013BBBBF68D710B55485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 d3b049192399305b9de00111f6b91149f95df9f50ef5af2a4a7be6e0e4ec46c8
MD5 07dd09f30222ddefdc9ec82f0a083678
SHA1 9f87d89b81d55cc5a2b4ad79e27c6518aef66df3
SHA512 69ec7f7ccda563566b76bcf93a212c8e45c6741693f6b599a2beb01f335e0c5a88c1747d4254853b569179664f6de4b66c82838506b261cdd04021eea9e2def0
SSDEEP 96:xHdUTUZqGqofyP21zSFaSSlcdv9jWnUHgYETBw88u8L4cn7yTM:P0RofyP2waSSagYeBw887
TLSH
T145E1107890088B7F74B677ACAC648C315AB2417BBBBF68C710B54484054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbmenu.obf.js.crdownload

Path C:\Users\Admin\Downloads\sbmenu.obf.js.crdownload
Size 1.4MB
SHA256 52c8c12ad1b8a866fb7074e08a168016cf0bcc3cfa57ded045e1757192bd3c22
MD5 04bd10894f523269d789dcf3d1b8c76c
SHA1 f066b8c98c5ba552e53cfcd3383ce564437c8fd5
SHA512 93dee1f0796e464c09d9206dbe06ff76154f0024351f35145ed0acc69ea971b5d8cf5334d65ebfe9e08e2be3b007e65110f0da999ad644b465214f1fc51ec794
SSDEEP 24576:mYESVkdkp3PIrDID3BfnZAIp5hvYscxfLQwzC:ZcECTC
TLSH
T1AF658D145364465B0B9E4E4C454F37CF18E55F112B26F58908AEE7B3B3AEAD2E83EC24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download