hxxps://dl6rt3mwcjzxg[.]cloudfront[.]net/assets/sqmarket/sqmarket-medium[.]woff

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dl6rt3mwcjzxg.cloudfront.net/assets/sqmarket/sqmarket-medium.woff
Sample260808-twwvysaj21

Score

6^/10

adware discovery persistence spyware

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4524	msedge.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 8216667e57e3dc01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270738"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3302939314"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31270738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3303453848"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0150459B-9346-11F1-AA2C-D2B4DCFC1B56} = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306799102659911"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{680C545D-9AA5-4E65-A4F8-7EBCBC2D20EF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5260	msedge.exe
5260	msedge.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1008	OpenWith.exe
6268	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	firefox.exe
Token: SeDebugPrivilege	3216	firefox.exe
Token: SeDebugPrivilege	3216	firefox.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
2916	iexplore.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
760	OpenWith.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
4692	AcroRd32.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe
1008	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4688	4440	msedge.exe	85
PID 4440 wrote to memory of 4524	4440	msedge.exe	86
PID 4440 wrote to memory of 2720	4440	msedge.exe	87
PID 4440 wrote to memory of 2720	4440	msedge.exe	87
PID 4440 wrote to memory of 2720	4440	msedge.exe	87
PID 4440 wrote to memory of 1556	4440	msedge.exe	88
PID 4440 wrote to memory of 1556	4440	msedge.exe	88
PID 4440 wrote to memory of 5092	4440	msedge.exe	90
PID 4440 wrote to memory of 3956	4440	msedge.exe	91
PID 4440 wrote to memory of 5092	4440	msedge.exe	90
PID 4440 wrote to memory of 5092	4440	msedge.exe	90
PID 4440 wrote to memory of 3956	4440	msedge.exe	91
PID 4440 wrote to memory of 3956	4440	msedge.exe	91
PID 4440 wrote to memory of 3520	4440	msedge.exe	92
PID 4440 wrote to memory of 4392	4440	msedge.exe	93
PID 4440 wrote to memory of 3520	4440	msedge.exe	92
PID 4440 wrote to memory of 3520	4440	msedge.exe	92
PID 4440 wrote to memory of 4392	4440	msedge.exe	93
PID 4440 wrote to memory of 4392	4440	msedge.exe	93
PID 4440 wrote to memory of 348	4440	msedge.exe	96
PID 4440 wrote to memory of 348	4440	msedge.exe	96
PID 4440 wrote to memory of 1156	4440	msedge.exe	97
PID 4440 wrote to memory of 1156	4440	msedge.exe	97
PID 4440 wrote to memory of 2544	4440	msedge.exe	98
PID 4440 wrote to memory of 2544	4440	msedge.exe	98
PID 4440 wrote to memory of 4240	4440	msedge.exe	99
PID 4440 wrote to memory of 4240	4440	msedge.exe	99
PID 4440 wrote to memory of 4240	4440	msedge.exe	99
PID 4440 wrote to memory of 1508	4440	msedge.exe	100
PID 4440 wrote to memory of 3728	4440	msedge.exe	104
PID 760 wrote to memory of 4692	760	OpenWith.exe	107
PID 4692 wrote to memory of 4640	4692	AcroRd32.exe	109
PID 4640 wrote to memory of 4704	4640	RdrCEF.exe	110
PID 4640 wrote to memory of 832	4640	RdrCEF.exe	111
PID 4640 wrote to memory of 832	4640	RdrCEF.exe	111
PID 4640 wrote to memory of 4844	4640	RdrCEF.exe	113
PID 4640 wrote to memory of 4644	4640	RdrCEF.exe	114
PID 4640 wrote to memory of 3112	4640	RdrCEF.exe	115
PID 4440 wrote to memory of 3868	4440	msedge.exe	121
PID 4440 wrote to memory of 2808	4440	msedge.exe	122
PID 4440 wrote to memory of 3736	4440	msedge.exe	123
PID 4440 wrote to memory of 2980	4440	msedge.exe	124
PID 4440 wrote to memory of 2980	4440	msedge.exe	124
PID 4440 wrote to memory of 2980	4440	msedge.exe	124
PID 4440 wrote to memory of 3904	4440	msedge.exe	125
PID 1008 wrote to memory of 2352	1008	OpenWith.exe	127
PID 2352 wrote to memory of 3216	2352	firefox.exe	128
PID 2352 wrote to memory of 3216	2352	firefox.exe	128
PID 3216 wrote to memory of 2836	3216	firefox.exe	129
PID 3216 wrote to memory of 2836	3216	firefox.exe	129
PID 3216 wrote to memory of 2836	3216	firefox.exe	129
PID 3216 wrote to memory of 4548	3216	firefox.exe	130
PID 3216 wrote to memory of 4548	3216	firefox.exe	130
PID 3216 wrote to memory of 4548	3216	firefox.exe	130
PID 3216 wrote to memory of 4548	3216	firefox.exe	130
PID 3216 wrote to memory of 5280	3216	firefox.exe	134
PID 3216 wrote to memory of 5280	3216	firefox.exe	134
PID 3216 wrote to memory of 5280	3216	firefox.exe	134
PID 3216 wrote to memory of 5280	3216	firefox.exe	134
PID 3216 wrote to memory of 5308	3216	firefox.exe	135
PID 3216 wrote to memory of 5308	3216	firefox.exe	135
PID 3216 wrote to memory of 5308	3216	firefox.exe	135
PID 3216 wrote to memory of 5564	3216	firefox.exe	136
PID 3216 wrote to memory of 5564	3216	firefox.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dl6rt3mwcjzxg.cloudfront.net/assets/sqmarket/sqmarket-medium.woff
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x294,0x7ffa8583c188,0x7ffa8583c194,0x7ffa8583c1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,10696436747024450059,3701716466979400195,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,996580387476855351,35498284363139684,262144 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,4245476634990809807,11311747382413672634,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9545168865361185064,1733178774621608501,2097152 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,15510330100634584002,3254454436141684323,2097152 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,5914244558964895398,8704566300755123015,2097152 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,3500728920736877741,6755129484561260914,2097152 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,13221729292257148622,3052298829808876311,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2620595194169355184,7301401316857149991,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,9199004309513014497,9762612733408611106,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5460,i,14844545906813276728,7143868939970432485,2097152 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,9620017478010753764,12123291165798396214,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14058969550807724088,13705695839633747106,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14058969550807724088,13705695839633747106,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,18320786353217798952,5957508833005759585,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,9953701964012734615,2284320999128888430,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3980,i,990351363635736932,5673684004943242735,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4300,i,14199250946414887663,11599190571276147605,2097152 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,12324112106923206459,9758923089281261549,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,16888494793955184545,17437488761706861109,524288 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2576,i,2002459150953759454,10218327410505240340,262144 --field-trial-handle=2272,i,3862055356770312440,11266941580360810123,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\sqmarket-medium.woff"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FEE919E5A91867BBE958F17BE2D7C7C6 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4704
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C5FAA02537781579235D8C8F13C5FCC9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C5FAA02537781579235D8C8F13C5FCC9 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:832
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2DEBC6C93E1BB5A863ECE9363584D0CD --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4844
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7A5F4AEBBD1873A92549B1D2EED8DC8E --mojo-platform-channel-handle=1856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E59EF8916B1DCFB01B53638FB485BA73 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3112
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7E7A4948609581873BFCFFDCDB49B2BF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7E7A4948609581873BFCFFDCDB49B2BF --renderer-client-id=8 --mojo-platform-channel-handle=972 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:6260

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\sqmarket-medium (1).woff"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\sqmarket-medium (1).woff"
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {ef46b31a-6c4e-4005-b211-4c734b1e0d6a} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {d9713d10-c327-4a7c-8aff-f719386c6f72} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 27276 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {6a227397-118d-4350-ba0a-ba725d5d2bb4} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3872 -prefsLen 27276 -prefMapHandle 3876 -prefMapSize 270279 -ipcHandle 3944 -initialChannelId {9c24806e-88f5-4358-ad94-a32702abd8e2} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336 -prefsLen 34775 -prefMapHandle 4340 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4320 -initialChannelId {1e9c4ae6-116d-4696-b389-38916f7752fe} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2884 -prefsLen 35012 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4972 -initialChannelId {f22deffa-a20d-4aa8-85c0-92c0d469e487} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5336 -prefsLen 32952 -prefMapHandle 5340 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5352 -initialChannelId {7b488834-4e81-4437-987c-551ab96401d9} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {baf6b9be-eaa8-4d19-8397-464a0e5d7224} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 32952 -prefMapHandle 5792 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {a50fa3be-30f2-4b38-9330-304cdc5ec4b2} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:6072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:6836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:6268
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\sqmarket-medium.woff
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:2916
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 39d254d56d6ed1aa8bfaac7cfe8b422ab2af1dc18363997df5ed5b6fd5174065
MD5 3ddb2af0b5230f3796c079d35f78a4e0
SHA1 23548109b4f0074dbecfb5943ca340f23db18ac5
SHA512 def8de11330a466e97ce3fb3209c36518dc85021c903378c5610af9739fdfe295792fd67f196b1f81c00c730848c24d194dc1d2b80193dfe58920cde88a3f086
SSDEEP 384:yeRdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:Y+eUZsLQCZsL3hUS4
TLSH
T1C553CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 d90b86f88f7e04235d5afded8e32ea7e3c3d329ba09e3a563445ccc12ef16a88
MD5 2ecac02e48cd0a7339d865f5dfe4cd2a
SHA1 62b9167ba7b7e8eda79c618b271ec210c35e2c1b
SHA512 e51b15ad56ce1fa0c6f40039cff23d5bfd584c784d6347de5b872e336eecad24e61f0e3eb148b526a4cb1c6d8f6cee719102f6a547e4316911629e3c17fa57a0
TLSH
T11EF09741943AEAC03900F9CC02798A3FB410A02200E4209AA67C94BF44967A9A78E838
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 be5c8e39d8720af80343f55f068be8429bb625a17de9af60fa2b3c662035013d
MD5 1e9ede7010ccdfbfabfdc9fe8f79bc37
SHA1 ce8086569f200253f1fa33c005123021ec0e1ef7
SHA512 bc4c7ee4ed42f392724073b37582021df802e521897553e11d599a32fd3453d3ec2b75bae44291a8dbe95fa365475133d30c5b4ff0e2ffa7535755544361fd69
TLSH
T167E0C03452FE011FE1F5E4345FC57821C46DF132142992B42AD49B0CA702700AC03E25
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 fde5025ef66eed55fd88d8ade54159c6896f668960612cdc8ac646f38c6df2db
MD5 92fd10844698a944de0d2c25a0e93afa
SHA1 1449b369c4e6fcd8a01e721c49cb1ff8abbf0718
SHA512 6db7c50c102e0f642aa312115f988b94bf36359d77515a4972a61ddbac533d9fb04756ac734eb4054291d3cc6f89ad0157b4047c9a055152fdd82eff17da3b5d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1f1f0f342d8ca1d23ca494a6634c4d55f8bfd04b84768b32ec9cc4f0ce7513e1
MD5 a0437b336265c7986fc083db1e1a8cb6
SHA1 75153b7676c2ed50ffebe36a72a67f86c9f8e1e1
SHA512 2bf1d03eafeee37e00e0b19d89d1fa29d61e3259c7f9b161eb66cf09b35e2dc3a91c189f9118c0729ce91be3bb730b640cdb41966c72f9ada39793b00cd22883
TLSH
T15C61D634C272B462F37107B0F0D21D25383283DEFA0B4CA10E9894B9D116F46DB295AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586f01.TMP
Size 3KB
SHA256 0356763370758f816467d5c61d207ddd03aa40389d2c3b9b4fe3f23771ff3b29
MD5 297178e835cc4b9f3f300bcf2c2e6246
SHA1 5dde504c0b4023449649d58fe13433c5c18a5c63
SHA512 932002ee2a97ebade8f09ff4335e960b84931e574a77f3237a939bb88f64dd8eef4d19e372b831f1c97cb6832dbf537f26082574344fe2e125d1a9533ccf2b79
TLSH
T19561D634C272B862F37107B0F0D21D16343283DEFA0B4CA20E9894B9D116F46DB291AF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a5c02c8d0ea329e46c4555499bb48bd2cc8e6b3d588bb9661ad52c2dcf795ee4
MD5 5d0effea077fa9531e54ee17fa9218a8
SHA1 5527173f5fe74574ce62497fe25115bd077e93d0
SHA512 3d6c62c40217d25d9fcc93163f573b8bd8868cb3deecf0b17e87ce0ba1e30ec00b1c6c58ac2ee283501d736e51475c243e1c22de4479e464d1a446a48cc32e01
TLSH
T1D9113DB3C3E5856E891556F05A24EE2BCE1D0505821C7C19C9D4FF67D3E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2812a938f5968eb4d61cb290fa7354499636470c76958249f5a715cea90a228b
MD5 e6a09f9ee52eea6d682da3a1b71836a2
SHA1 90bb24b741cbc7c304c3cf6ec0624e86f1a87021
SHA512 2b0f8445bc2ca76091bc3dc566e5af5d535bebc659331c9f13fcd84cee46f72f51e1a1508a3daa655bc5b9f078733890bd94220398bc14a4fa54834b5b23efcf
SSDEEP 192:sxZQROyM/jK1Ml8M9i/fks0EvsIdpJHW6+WNGY9IoxvaHIgrJ:sxZQY1i/fks0ENJHbGF9
TLSH
T19E42F8126B34A977CCCBD20DFA557F53D6F90472A2940E54A9FCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7348b47224ac39256ef69f95744a6c8aa08445e5f8b33188c688b6f3d75a0dc5
MD5 0313a71f06fb499ef16355105bc2bfec
SHA1 4a0975428ab3a218a62b267baa6529d106b25805
SHA512 c8eb8f825deed7475cf47287c95f4552a196cfafee828597ef3b8365a6a54633b55fb96a2cbfd1284bc4b916211870057ae4b2ada6a4e560a21216661c42f542
SSDEEP 768:Fycv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNWrohtg6e:Fycv21wWvu+Z+u1jaeFLeRNtzO
TLSH
T1EED20B2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0cf82853fde5cfa1be2981bf564b5dce5d6272b5e010d5d8adc2699c91ad0ff1
MD5 4516ac23010afa172d89053aab2e3a67
SHA1 484229cbf4dd4f2ae49a5a38347a7cb5580710a0
SHA512 2ff63369c5efa0fb541b4fcd591463b566c70fa6a376cc14e5bb9a4ed459f379284a8d3113d0d282a47709fda447519d0849ddf2af9b4ede6971bb157b831513
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDyqAKHqOCiAKTqEZmKSAimdeK+gW:mTv73uhl/
TLSH
T15CE11502303B0692787E6908A397863A5E4A35A33818E47F7BF941D21F6BE515CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc377057-64cf-4453-a2b2-f0344c73a938.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc377057-64cf-4453-a2b2-f0344c73a938.tmp
Size 13KB
SHA256 d4bda491db7c0cc3b52c534d82a3c3be7be3302d7c84e8e0c39f177720b894bb
MD5 68e1a5953c241ba05cff22f81fa548bb
SHA1 aadf0a1fd04b56528527af1ebf89c1b3c177df1e
SHA512 b0b1277917b96f1683eaa323f6e8a1aec51e37a4ec9555736ae9376fb81c842c06efbda8fa829d7827b77341316feb7a19ba83cdf437fc10165bcb8d01d91894
SSDEEP 192:sxZQROyM/jK1Ml8UQv9i/fksYBvsIdpLHW6+WNGY9IEH7HIg5VJ:sxZQYqli/fksYBNLHbGSh
TLSH
T1AA52F812AA385A77CCDBD20DFA517F53D6F40472A2940E54A9FCDA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590863.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590863.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 011b0fb6eb73f459b1319f4073d9c41cbb4967ac099bc982d667cb500b0ec3b8
MD5 9297414b03b20f3e4f084608eae594d3
SHA1 640bd8857ad36d96bd4566e5e82c93745b93a3e8
SHA512 1009bbef0fd7e6bbe79b1884e6dd15b243421d4091838533c5fccd8c685c69e74ff60c11afbb6896bc7410315735c09baab9e84eae7bfa6b7bcc4207944a2fcb
SSDEEP 384:dsNW7bdVVziahPe+CfdyRyJr7+nTKwBODNZOCU0q:dnTB2nayh7+newBKZOB0q
TLSH
T15F725B35AD385CBB9E93A105F40735038EF891A7E9853FA4D6DD6F1C01DB29C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3e89df7f884cd52dbbf4dcfceb057898f088fd8b855267c8b960218f5d450532
MD5 8a71f1206ed29c317b605a841a155513
SHA1 fd05ecb8c063394f30a99e62de49234cb071aa30
SHA512 88fac27f053af8e712f1c6d51f869c988123f8e63c500620c5846809ddd327fd694321808dd9f432a361bebea25eee3e42aeea1539740e00892bf6ed172d4aa4
SSDEEP 192:JONV66v+YLNQmiUyzeZh+CG1+Fde5RBus3IU6:JONc6vz/jZh+CfdyRBYU6
TLSH
T11502E935AD382CAB9FB2AE05F48737175FE4217BE9952F90D9E82F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3d5750104fda7c88d5c59ec7bb6dcef96b6de754a6008d416ba910a52145b067
MD5 3ddb5c72fee1a7abf335ee8acf7cf874
SHA1 127d2efc63b14307b4884684e21d7929cecb2bfd
SHA512 1ac61a5c285f612164e06e605cbf83369f46ec28782c5eca37a3d713454d58c0be0a3fb34cd372f702333b418749dfb8f3dcf6b6780f9c2f5db087056bde743b
SSDEEP 384:GiFgZcIx7sNW8TUNTUlIlobdVVziIhPe+CfdyRyJr5+nTKwBODNZOCU0g:tFehLwgCTj2nayh5+newBKZOB0g
TLSH
T1BCB27E335C689C7FAEE6AA45F44A31038EF891B7E5D57AA4D3DDAE1C00D719C130AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3618e8b3dff0928382fe4791209f153162f98cc5c491027609edb4bf65ade12f
MD5 9192bbf7ede29ccb24415ff121942740
SHA1 e87ede6cf9416a03c39135795d201647dbc5646b
SHA512 b68ff93a2a74eee3d5cc2189f5da83c1c5431c0ae97dc57e610e1cbda23751053411941d591ce3d102f051dc12f9fc27b64dadb49ed75b1d18cc646c913e48d8
SSDEEP 384:qZcIBsNWobdVVziIhPe+CfdyRyJrO+nTKwBODNZOCU0g:IBWTj2nayhO+newBKZOB0g
TLSH
T1F5928D715D382CBBAEE3B505F44735038EF89177E6C42BA4D2EDAF1C01DA698130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f01ff37b6bc301c374116455bafca7e9907510a40b000940e0139221aa5899bb
MD5 736c6a28b0f2686f0e7285f6f7ba7dde
SHA1 6a09231679216bfb4c77b41ec482c5b26a413757
SHA512 00603d867972e360cdee79cc811a73e2c099961e9d5629a68432f0b27da269fd907c437063cbfc61abe383716d1427853185d1d27ee96cd7d981fa35da33c1f7
SSDEEP 192:GONP6v+YLcQmiUy+eNh+CG1+Fde5RU2SJrKCHhqfU6:GONP6vzYUNh+CfdyRyJrz+U6
TLSH
T1A2120B31AC786CAB6E92B945F44735135EE45137EE8A7B90D5DC2E1C01EF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d054c35c95d89fe75d24c51513999025be65c6c647034ab92dedaf7b48773927
MD5 d0c173829afb7e2304588e552c311092
SHA1 e8af927be8d61c196d03ac9c43034a22cf7e9c00
SHA512 e8d633608726c7f3eafcf7e54f2980cef6900f460d3d0c1879864da3d5dd2fe399ba794f2c0bbc6b0aaef1920fd53f5322da8ff13a4e3189779695c752402875
SSDEEP 384:pZcI0sNWobdVVziahPe+CfdyRyJrO+nTKwBODNZOCU0g:h0WTN2nayhO+newBKZOB0g
TLSH
T162928D716D382CBBAEE3B505F44735034EF89177E6C42BA4D2EDAF1C01DA698130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 2fa781466a77828f9771e5c09ddc86f28ebf400eb7f9385273a26d80048e3434
MD5 6cce155a84d4d71ac281421ebd1eb0c3
SHA1 c7d7b09cb81c4d161456a2aa4323467b25de968c
SHA512 a11c12f076e6f491d72189ec67bfbd6c6c95eff279d6d1bc30458fdbccf7a09b41b32658973f8b0e34ce7b969c75292f825693043d34870e9c4faa604a8e1038
SSDEEP 384:GiFPZcIx7sN98TUNTUlIlobdVVzi8hPe+CfdyRyJrU+nTKwBODNZOCU0g:tFHh+wgCTL2nayhU+newBKZOB0g
TLSH
T108B27D725C28987FAEE6AA45F44A31038EF891B7E5D57BA4E3DDAE1C00D718C130AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11051e97-b004-42df-ad37-941d85097b85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\11051e97-b004-42df-ad37-941d85097b85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 c6a38a90fbe5b069bb3443a21c5179bfbab8a3cbe809ec099c1ec89deda0498a
MD5 7a320688e18a536d71b3023d5a511738
SHA1 ddaa4c3f0fa0b070ba5f693da1975cd2620b4ddf
SHA512 33a303d747936d06fc95c42d997a0e571be68672d15232f4a258f0034d3452afe50b0fd0bec7d70b6351c468ef714d2804e26cbfde28dd9badb84bd05dcf1c4b
SSDEEP 384:HwCe7iO024YPDL84KKDL849B7SOEAd9KVRaAcP+AWRMAjlr:QqZYPDL8lKDL8CB7S/AmVAf+hRMMlr
TLSH
T15E729E799F413CAC19A7C0E8C5F842D98C1976A7CFE6806D21683D0DCB98A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 7651714b57b9124bfdf66d13e6a97c0274c3da144ccc3c5211d8fc16f8819f58
MD5 4c676826f82c5f039c06f09ed64fe1ef
SHA1 20df8289c297751a1520fdd49739b4723b8a2e2d
SHA512 55cce85343f74fa69444557eeda546658d8c1cd45b53410bd0e4d3f7d01f89022cc7bf9e80223e4fc3dc025ba97c045cff185810c4bea706b594e976e706a212
SSDEEP 384:HXkRyiO024YUDL84KKDL849B7SOEAd9KVRaAcP+AWRMAKM:3mZYUDL8lKDL8CB7S/AmVAf+hRMw
TLSH
T1FD727E3D5F003CBC25A7C0E8C5A592AA4D18B7A7DEEA80AD21183D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5994f2e204225c885a30eaaa24e30d2276add6a546576fa41f814ffd2b82da4f
MD5 8031f7cec12cad4882673ae12ee7ace1
SHA1 04f308e484dbb99d3c00c14a6e7b19ee5496e732
SHA512 a6b5e2ff9159bbac2633bff492ae541029ebb7b0a6094ee740507eb975690afe65b51f800b35ecbce4b9612edfd9241e5dd2ad611405bab453a2a1928c1bdb04
SSDEEP 192:ROv5zbowbbWyjOcg1d66JozGzgCl6mc0dz:ObowbbWyjmd66JozGzgC1jd
TLSH
T107D1FC64E6288A3FC404137BCDA61F814F3A389BD84E7F1535DC64482D5B29E7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 3b45bd518de99736c1745a68c6d7add0f1348adc83b661983779bcb048cc1c71
MD5 0385a4faea4310a835bd786dd954a50b
SHA1 067ea441ca1873c62a3494d0006e6ae8d77cb8e3
SHA512 878367f038278e3342cf6e399d70b098c2be5f1246c7ed4a62c8b13c003437c3a8d7f3808813039966bcedbb7bf14ea4c77a74c39045ef38b42d117c5adbf1d9
SSDEEP 768:fWeE3G5zlXCFifzGcmhurj7yKiqkTuHFJ3iKKbNbTbBbvbVbebSbPbstDvkEXawx:IG5zlXCFY7y4tDvkEXawDEBl+
TLSH
T16503F044EB1A953FD41812BBDCE61B002F78F889591A2F673A4C64786C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 69f03fa5aabf3b9c457f4100f56a7d0a5afbdc51233f63efee98accd31efc295
MD5 f9af80dc1ff66a4563f50a19247d1424
SHA1 2d8061f6b4e61b3707962e200b745ad32cf8b3a9
SHA512 d02757f2028a644e9c81617374a6e5356870455e598a54c09c2dedf614419edee832257d6cf7ccd3eadaecd77dbfcdaef5cd9fc4412f460bf5b80069538861db
SSDEEP 768:EEiWQG5zlXCFifzGcmhurj7yKiqkTuHFJ3iKKbNbTbBbvbVbebSbPbstDvkEXawx:CG5zlXCFY7y4tDvkEXawDEBl+
TLSH
T12F03F044EB1A953FD41812BBDCE61B002F78F889591A2F673A4C64786C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4a608e203926ba443948c1d1010d99aa2a81f81e0fca85c9f5adc0e78a67d618
MD5 fa435455ecf802739596c968307d4054
SHA1 8e3420a59fb3393f6d61cd1f438d8c8083e34d5e
SHA512 84bda13a9687dfee4525f72275fda93fe110478b6976611072e7d0c5ae747b90871cdf12bb2cf557bc2def7c5ca5a4d4f19cbb15d9893756eab575f009fee7dc
SSDEEP 192:t1d66JozGzgCl6mc0dNOv5zboPwZbWyjOcD:Ld66JozGzgC1jsbo4ZbWyjf
TLSH
T1DEE1FCA4E628863FC404127BCDA61F814F39389B984E3F1535DC64482D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 ea2dc68f871ef11fa9ffc87ccd3688a893c8d5114a24b180752ca13a4155867a
MD5 0531f2ea603283d551119111aec3e8f7
SHA1 37dfd23303ac39aa1f34638b81db1d0230879014
SHA512 8afee830f6577ead4fc7a6ae13f7ac366501c3d19960292a39fa9b848b222bdb66f0854218bfe723e4e2263aa81b06b5ce53a89121d68c9901eb9f4c210c8307
TLSH
T18B61B958F629863FE449413ADD861B405F347456A8AF3F2A35ACA04D1E4B3CD36CD43E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a9ce2c30347b4d72de9aba90d44f23b4c006f07a97d4f315256d295908fbdbe3
MD5 86aedd0d9b28d0a9bfea15d5f118e52d
SHA1 4313128ed0bb2de76b0e0f784d51bc7b336b6995
SHA512 25a65874ec1d9cc708a4a9893364174eb23d343a22afe574b019d0439116fbe5fa9578b6b742af824036c1f6418886b11ccf38aa2ede996ced6644dfbfca999b
TLSH
T1C211874C39F84D2AEA8BF39C7441468E5B124A4B04571C4B8F02EF8CCE80AD9326A47E
MD5 SHA1 SHA512 TLSH

Submit Download

21a90749-0215-480f-8ec9-860e2bc0a4bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\21a90749-0215-480f-8ec9-860e2bc0a4bc
Size 886B
SHA256 f5ac30bd96ec04fe721b2aaf71d269a84497b947a2a0c6913a7edcc3123f3c04
MD5 ec8adda62d8e4f8c6ac7444b6b3c5135
SHA1 908981be4e8776846d39907c90fcd708ca7815c1
SHA512 3c23021d1c3c1a3f67c6dcb9161bf696e6c3caf119c334acfc49f4d602098eb5f3f208eb84c8560fd89d8ffa810d532ae6203df8d54ce4d10fb2b668574bd70b
TLSH
T1C0114090863579F2CCA8928BD9A477828AE0702380CA48147E901E080CBE51E567B307
MD5 SHA1 SHA512 TLSH

Submit Download

2b0f14e6-26e8-4684-9278-03f0708ff157

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\2b0f14e6-26e8-4684-9278-03f0708ff157
Size 15KB
SHA256 e5f640068c4137089032f008a55d55bf42e6a388359b982ea40a10598d4e76a3
MD5 42c1ba432b89242b6f39035ce3987543
SHA1 cb686c7bcf2da74b074ae16864b1ef74868c35ce
SHA512 729f470ce763738f3d04f3e53fca661df19b2f17dd5c3403e91586b38dd6e8879f5478e09d9886794c2501e116a2269d067e3e964616e13b1e3d7b67dc23c38b
SSDEEP 192:mu6lmjbW/VHP8BA21PXngWaXNJScdUIXguDFMMkpBIVlNo6aHjz74oa+t4bzx7zk:DHjCdHP8OLUMdmjz3a+t4bl7zKRXR1
TLSH
T11572CA562820497E8691E35998FCBFC7E5F528CF4C419FCA9BE0BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d71afff-08bb-4899-8250-16855b7a9739

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\3d71afff-08bb-4899-8250-16855b7a9739
Size 235B
SHA256 dafac7af0e439bed5adc15d2ab2833c7b54051238ae16594f0661e90e04e54cc
MD5 77c3c38eb5d8d2239461469c8af950c6
SHA1 d18cc636c710d405856e1316d6732b8f8e02318f
SHA512 60025002ff334d9f4e20bdac5bb5a824cff2f288573c11866adc3213ec11d9762c4549a62febe8758e3bc3afb82914d93a8b6bd1312a05966e94d1ba52e75276
TLSH
T188D02384388CA35C08080F07F0F07EC630848C33207CAC20D5514734ADFDEC481E1857
MD5 SHA1 SHA512 TLSH

Submit Download

618b7503-715a-4775-a878-2eaef1568256

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\618b7503-715a-4775-a878-2eaef1568256
Size 2KB
SHA256 770503f662f8658a9ebbbd7b914b51aa7fbec04f6fcd1f90dc71df2390d5ae32
MD5 8220d196461b53bd21c6f9e22a452203
SHA1 9a0590c5bcf20a09f92d95894768ecf8ab960672
SHA512 826bbf2b64d6d7b45984be9b82e0e1ce1014a8587290e95aa57c111fc0489c29deb331a9db5de4e42abc750f2b7e916564dafa186cb82e539a26a108c4ac29d9
TLSH
T15041105C79788DB69DAAE58DD491338E57608F0300C62CC72E52EE4CCC9A69D336A53B
MD5 SHA1 SHA512 TLSH

Submit Download

827a566b-b3e9-48e5-8c69-09e060ce39f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\827a566b-b3e9-48e5-8c69-09e060ce39f6
Size 883B
SHA256 c73854166e653984d54acda00d37b5a9a8ad13a06a1c4260f8969d79ebcf87e0
MD5 841d66ae29a1e033123d6916c3e506fc
SHA1 6cb70c16af51dc63ece6c3f26190ba9e5013aed8
SHA512 8670c97b25b946fefcd72891249e27b73a4f0d792b1db8b777316722896cf439ceeab6245f2efe6030f956559b6e84dddb8033d9420e1dce6b41c255eee83b5a
TLSH
T149116341E634FDF2CC68D28BC95037528BB4342384CA94103D900D140C3EA2E6B7674B
MD5 SHA1 SHA512 TLSH

Submit Download

a545b150-8622-4e3a-bb38-348491670838

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\a545b150-8622-4e3a-bb38-348491670838
Size 235B
SHA256 f230de78563082f37a0c188ad59a63a644217fd1743b0678374d72fdc7c3f693
MD5 04719bc730c91e20841f8fe73f2e9145
SHA1 81c0a1343ffb788eb3633756dbbf4149ec44f2d7
SHA512 8632dfb97761f7511c733cf4f3d03e85263f825115a3636de3a03237a09b635045891e17354f8c75ce8c0b4bdb0060c4d7a04366ae946353a9768511d3ee20ad
TLSH
T13ED09780248823AE4C160F23B0A028CA31688C3354A568208A6005398EBDDC85231C17
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
Size 16KB
SHA256 d4acb2198995e4d7f0182366d06d3dfce6c197eb119f6d0f76eaaea74b676d4a
MD5 196da17d87ba3f374a53b1a185dc0947
SHA1 f17e6c1ba8069919af868aa88919ffee1db41081
SHA512 8a676167d09269bdd9f4514ab0c7f502ec878035605aca3c8b9d904b3a8ebc06373d89bc8ff12b10ba3f168bb205ac0346d6e02b1fe8c4017c79a8963c0123c6
SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4Htr4h+:nI4qRf/0Xen4K6W454d4P4j4h4g
TLSH
T17072431545448EB8294FA79BAA367E01C37D433B60845C38F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 7KB
SHA256 0a3aebc4bf645cea38ccf0f2446736d8e703f6209ba426e18c478d2f03f00541
MD5 fe2f4e90ce62c008f832a756c3e0f489
SHA1 ced20cca1c68dcfdf283522214e06f7f26424b7d
SHA512 746d2922dfedc2f39a7c6eeb862c0048788b2fe5a3bc94682f91ec7e790eab99046cb680757d7fbf93d43a53f8cb62c46352025c8ac3a323633c4183eb638f30
SSDEEP 96:xHH1TUZfiPqGqqkfYmgObzSQnSSlDdv9jdnLWRcL4/3ArBw88P8L4cn/MVzW:91CRFfYmgunSSSRE4/3ArBw88Vg
TLSH
T1FDF1EB789148CB7FA4B6776CAC288D315A72023BB7BF68D610B95484051CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 8f759ca078c6ffd22d2b651b179a9bd8bba4d9bd24a7fd53286949240a04f33e
MD5 9d58815fddbf3c8a475cac9f4a5d10e2
SHA1 06661fb04d67ce56062813307c004325e7ef200c
SHA512 4763e461df32662ddd9afdd0ac6fbfd226f735c9aa26f0ffa6cc042d6e63a3dc34ebcba52d082219dabe90cdd5e455ff252f07327de0ce9a95e9df3b0c277158
SSDEEP 96:xHHUTUZfvqGqqkf+upX1zSuGSSlDdv9jEnLHH4/39Bw88n8L4cn/MVzW:9QRFf+upXESSaH4/39Bw889g
TLSH
T1F2E11D789108CF7F64B677ACAC2889716AB2013BB7BF28D650B65484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 ae5ab7888f630299b80bb1267250f79a766357178b01a9471e4bc1cb71ac728f
MD5 8425a1d623e23a792ceb3487830acc56
SHA1 fb4ffcce4fe72a0aabfe1e4d6d1ff2c18aae22d4
SHA512 429224a33d0b314f8659675894ded60b636bc2df04c11253a6f849f553099332a2d1b2dab1e8617c57a03a5b823589a004b63ff9862fdbc98ce99ea67399c64b
SSDEEP 96:xHHUTUZfiPqGqqkf+mgObzSQnSSlDdv9jdnLHH4/39Bw88n8L4cn/MVzW:9YCRFf+mgunSSbH4/39Bw889g
TLSH
T1F7E13F7891088F7F64B6776CAC288D316AB2013BB7BF68D750B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 a44a432a3e5ed51efb2a978b56cd49344189ddef48dc8b5a31a239d99bb3c1d1
MD5 1e91aad87e08391ce2d1ac36b117a2f3
SHA1 5dba3351131dd2ab61efbc0956393a2f1e82a2a9
SHA512 1ced2e43492940a0a09039ea21c0269f6e6c9c134a22e921c13ed00bc5385dafff5de273392a60e12fe0b6bb70b3bb06881633c5b39336db369c74bf87f7c6d4
SSDEEP 96:xHHUTUZfvqGqqkf+mg1zSQnSSlDdv9jdnLHH4/39Bw88n8L4cn/MVzW:9QRFf+mgtnSSbH4/39Bw889g
TLSH
T16EE12E7891088F7FA4B6776CAC688D316AB2013BB7BF68D750B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 2548a8194c07bc40e326607c6ff200feac69b5a159d30d5d36d6d83ee62b4276
MD5 4498e8b4670a25cdb11f3c5e9b6b3de1
SHA1 58d865ab9fe84258418dbd7d5b5078f97f758f64
SHA512 f254e10a609f220267d7206fa241139ce04fea87665469ebe1c1a98221a040d145d989a7c2eca80811f474efb9841bc8756ccc17c1cf9cc5d015c2f322d899d2
SSDEEP 96:xHHUTUZfiPqGqqkf+mg1zSQnSSlDdv9jdnLHH4/39Bw88n8L4cn/MVzW:9YCRFf+mgtnSSbH4/39Bw889g
TLSH
T10AE13E7891088F7FA4B6776CAC288D316AB2013BB7BF28D750B95484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 58d7d11c8ab7aadd67b0fa5aff6e5fea2adef34abcacd8e611fcc665212072c7
MD5 ca53f9761b889ee8bab968d009c893cb
SHA1 52fadaaae2cce32c69a23be77b737ef2c0c9e2af
SHA512 bb6903039bd1f539aba99a403f6759c6f99c822c9d8621cb45e1cccc9a0fc485aab1f9435f381bd3e2426840a67a9351263742c3f053fda4451241598be47fd7
TLSH
T11E21DA039D1B2EF6F791A145E0C58FF18744313244708CF0D5999C0557CA4AEE34181E
MD5 SHA1 SHA512 TLSH

Submit Download

sqmarket-medium.woff

Path C:\Users\Admin\Downloads\sqmarket-medium.woff
Size 42KB
SHA256 3c21de5d72e7f034a98612525e4718c3cd06192c7aa5ca9993ed378a86325738
MD5 c64563fa4880c7ef6488f3bb459d61b6
SHA1 c6741eccb810aa2a38d8e0b58f21dbb6dcb316f3
SHA512 2bbf3d9b7c753f1c758376d75c50b427ddadc69071cce3caa23a1b8f75d0cb866e157a2758abf3f2d180fc1c9b6fd18fc8281e516cb2dbb90331c3462b10d219
SSDEEP 768:n+hKt8LvJkkbh+zNflv5UncQpQT5ZmE+Zgi7jzk5nc8+sGahOJaoxvJlNnwreg:+hKt8TJz+pfZ5UncqQT5tkVLsMasRlNW
TLSH
T17B13F1F6A1C6F405CEFE6ABD82B99D4B315D8469FCC484EBA64B911B205041FCFC5172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6072-626-0x0000023FF83C0000-0x0000023FF856E000-memory.dmp

Download