b00629b64374429ef1c99d8122c0b4abc57ab0d7f74d426027bef680aa12c986

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
233s
max time network
235s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
twintail-windows.exe
Size 4.2MB
Sample260809-j12a5atdrf
SHA256 b00629b64374429ef1c99d8122c0b4abc57ab0d7f74d426027bef680aa12c986
MD5 6c1088c61160485c75253578a38991e0
SHA1 75ee2a017663fbd094d43b982973b5f4e2b6afd2
SHA512 93add4fe138e5a660273fbafa44ed87c0659093952d07d905af6f266778613900b7de83fe72e747744fec07bb0ab7c135c46186ee1144f6315e5d18e00412a51
SSDEEP 49152:N9I68mW8AJfTD5vxsCBxQ6HHAeJoYNivf15oByTQ+8lRv3iKWwC1fdMh3zw8glAY:DFqX3iMvDOwBOSC
TLSH
T17B263943F66281EDC069C434839A6232FB72BC4D07317AE75BD44B313E66B906E6DB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
230	5108	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
1624	twintail-windows.exe
2160	twintail-windows.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_1221741494\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_1221741494\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3660_820490521\_locales\zu\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\twintail-windows.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5108	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307367238016262"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{AEE0C742-9CCE-4396-A93C-5B0BA47A406E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\twintail-windows.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	firefox.exe
Token: SeDebugPrivilege	3476	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe
3476	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3476	firefox.exe
2132	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3476	3632	firefox.exe	84
PID 3632 wrote to memory of 3476	3632	firefox.exe	84
PID 3476 wrote to memory of 6096	3476	firefox.exe	85
PID 3476 wrote to memory of 6096	3476	firefox.exe	85
PID 3476 wrote to memory of 6096	3476	firefox.exe	85
PID 3476 wrote to memory of 1112	3476	firefox.exe	86
PID 3476 wrote to memory of 1112	3476	firefox.exe	86
PID 3476 wrote to memory of 1112	3476	firefox.exe	86
PID 3476 wrote to memory of 1112	3476	firefox.exe	86
PID 3476 wrote to memory of 2004	3476	firefox.exe	87
PID 3476 wrote to memory of 2004	3476	firefox.exe	87
PID 3476 wrote to memory of 2004	3476	firefox.exe	87
PID 3476 wrote to memory of 2004	3476	firefox.exe	87
PID 3476 wrote to memory of 956	3476	firefox.exe	88
PID 3476 wrote to memory of 956	3476	firefox.exe	88
PID 3476 wrote to memory of 956	3476	firefox.exe	88
PID 3476 wrote to memory of 1200	3476	firefox.exe	89
PID 3476 wrote to memory of 1200	3476	firefox.exe	89
PID 3476 wrote to memory of 1200	3476	firefox.exe	89
PID 3476 wrote to memory of 1200	3476	firefox.exe	89
PID 3476 wrote to memory of 472	3476	firefox.exe	90
PID 3476 wrote to memory of 472	3476	firefox.exe	90
PID 3476 wrote to memory of 472	3476	firefox.exe	90
PID 3476 wrote to memory of 472	3476	firefox.exe	90
PID 3476 wrote to memory of 5736	3476	firefox.exe	91
PID 3476 wrote to memory of 5736	3476	firefox.exe	91
PID 3476 wrote to memory of 5736	3476	firefox.exe	91
PID 3476 wrote to memory of 5736	3476	firefox.exe	91
PID 3476 wrote to memory of 5108	3476	firefox.exe	92
PID 3476 wrote to memory of 5108	3476	firefox.exe	92
PID 3476 wrote to memory of 5108	3476	firefox.exe	92
PID 3476 wrote to memory of 5108	3476	firefox.exe	92
PID 3476 wrote to memory of 4764	3476	firefox.exe	93
PID 3476 wrote to memory of 4764	3476	firefox.exe	93
PID 3476 wrote to memory of 4764	3476	firefox.exe	93
PID 3476 wrote to memory of 4764	3476	firefox.exe	93
PID 3476 wrote to memory of 5500	3476	firefox.exe	94
PID 3476 wrote to memory of 5500	3476	firefox.exe	94
PID 3476 wrote to memory of 5500	3476	firefox.exe	94
PID 3476 wrote to memory of 5500	3476	firefox.exe	94
PID 3660 wrote to memory of 2848	3660	msedge.exe	102
PID 3660 wrote to memory of 5284	3660	msedge.exe	103
PID 3660 wrote to memory of 5108	3660	msedge.exe	104
PID 3660 wrote to memory of 5284	3660	msedge.exe	103
PID 3660 wrote to memory of 5284	3660	msedge.exe	103
PID 3660 wrote to memory of 3408	3660	msedge.exe	105
PID 3660 wrote to memory of 3408	3660	msedge.exe	105
PID 3660 wrote to memory of 3268	3660	msedge.exe	106
PID 3660 wrote to memory of 3024	3660	msedge.exe	107
PID 3660 wrote to memory of 3268	3660	msedge.exe	106
PID 3660 wrote to memory of 3268	3660	msedge.exe	106
PID 3660 wrote to memory of 3024	3660	msedge.exe	107
PID 3660 wrote to memory of 3024	3660	msedge.exe	107
PID 3660 wrote to memory of 5144	3660	msedge.exe	110
PID 3660 wrote to memory of 5144	3660	msedge.exe	110
PID 3660 wrote to memory of 5840	3660	msedge.exe	111
PID 3660 wrote to memory of 5188	3660	msedge.exe	112
PID 3660 wrote to memory of 5840	3660	msedge.exe	111
PID 3660 wrote to memory of 5188	3660	msedge.exe	112
PID 3660 wrote to memory of 4056	3660	msedge.exe	113
PID 3660 wrote to memory of 3968	3660	msedge.exe	115
PID 4056 wrote to memory of 3044	4056	msedge.exe	116
PID 3660 wrote to memory of 1544	3660	msedge.exe	118
PID 3660 wrote to memory of 1544	3660	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\twintail-windows.exe
"C:\Users\Admin\AppData\Local\Temp\twintail-windows.exe"
1⤵
PID:6036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5908

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1820 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {a5c94938-f531-4457-a2e9-aace75ea2f5b} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {e1275ffd-70f5-4375-9548-96b983b875a1} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3516 -prefsLen 27274 -prefMapHandle 3520 -prefMapSize 270279 -jsInitHandle 3524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3528 -initialChannelId {4a6b3402-78a2-475b-8486-f761073a1127} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3676 -prefsLen 27274 -prefMapHandle 3680 -prefMapSize 270279 -ipcHandle 3768 -initialChannelId {7647db4e-9ec4-43a9-88d8-9f670d676263} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 34773 -prefMapHandle 4352 -prefMapSize 270279 -jsInitHandle 4356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2884 -initialChannelId {aa2e2de8-003a-4979-a9e8-bd84506ea454} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 34822 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4880 -initialChannelId {ffc2f692-9d52-4c08-a9ef-ea963eaab856} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4948 -prefsLen 33031 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 4876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4296 -initialChannelId {3335e37e-ba01-4531-81d2-f955b842049e} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4360 -prefsLen 33031 -prefMapHandle 4364 -prefMapSize 270279 -jsInitHandle 4368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5656 -initialChannelId {a44b3d83-0247-40af-a2e8-d9125d61dc6d} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5992 -prefsLen 33031 -prefMapHandle 5996 -prefMapSize 270279 -jsInitHandle 6000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6008 -initialChannelId {9c693d75-8979-4149-8508-1f4a6bda6def} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2836 -prefsLen 33071 -prefMapHandle 6108 -prefMapSize 270279 -jsInitHandle 4360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6296 -initialChannelId {56a7e4f7-8ecd-416f-b1a1-6090d12f5a4f} -parentPid 3476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fffd553c188,0x7fffd553c194,0x7fffd553c1a0
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,13334201940726470961,5556948508761033948,262144 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,17682303827647826071,7663103424182393321,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,18438109344062316513,14813669766050923438,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:13
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11170148980280121234,9366846548176913231,2097152 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,12450633535655997604,4712538709394753462,2097152 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,10656949207442060798,10466083066739692618,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,6626871018877937258,5146608902751349960,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16804882290721461364,2632139102005265963,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,9153491814308618516,93394865042533554,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,1366866325172738422,2910549544485222593,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,1366866325172738422,2910549544485222593,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5200,i,18439452657935000104,14129078970379856393,2097152 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6700,i,3897227226541810468,18426847123985265277,2097152 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7028,i,16003161641290327890,5067254308523231710,2097152 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7192,i,6983399644100932191,1506401903294298566,2097152 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,1853794275081703478,3154287164285104667,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7064,i,13520255555419380796,6187425517561379746,2097152 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,116308035071885664,12076195142145983685,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1860
- C:\Users\Admin\Downloads\twintail-windows.exe
  "C:\Users\Admin\Downloads\twintail-windows.exe"
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8028,i,7576298723678240225,15712502453918502352,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:14
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,17945954171513240906,14626813108700756062,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7852,i,10330310809155818788,14062690286737620078,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:14
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,17401188301313051956,6068947335272568320,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,5758663293280386208,108779289026419949,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:14
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,2290926605872411621,15599357945048744823,524288 --field-trial-handle=2352,i,447889560967713848,8005129018610169824,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4996

C:\Users\Admin\Downloads\twintail-windows.exe
"C:\Users\Admin\Downloads\twintail-windows.exe"
1⤵
- Executes dropped EXE
PID:2160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:2296

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e91f42556f71c004b2bca70eb3adac59aadb754fd16daf71d2beb1acddd18961
MD5 7c44a0525196f25fdc2118c75516ed90
SHA1 27cb1864035d44443f840ca4e4ce6bc52b18be96
SHA512 dd5478bc458f8b0191fccb1b2032a3f68e43a0bb3e3b7237b1daee6d21b12219addb0ffba6a30b73bd081c5f5f9a35b9ec99480e3b0977c370210e7a8297f900
TLSH
T116E02BA6CD61AC3B18FD272990505B46F70423972B428E0F3A7CC0098FF163A4549C9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 b577b64f6785cc096dcc34a336a96a5d10d123270a8d30ab41967e119c91fce7
MD5 ba88a9f37e5843435dc2e851e39fc91b
SHA1 7328773d1b6a4cfb2fc4af1eef722de5bcb9b509
SHA512 783ac783a08f0a7da8b33b78f265ebda5b5e301eac90a9f994183eb2be32cc0ee2064fc6fb6026f44b522e60473b4f71d2e9384456078554227e4f246f47e118
SSDEEP 192:RJ1dkQQpaJx3heVQrz9bmj1E8WkX+WCwzWXuIwyG:f16QwaJVhe6rJmjpuWC/XhwV
TLSH
T131128606D5EA7794FB6417B9B0DBAE2C34707CAA017B5F7B33F05C389C2AB809598204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b5e2a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b5e2a.TMP
Size 3KB
SHA256 d5d3f5f14c6067027caaab3d298a90d64e229a07e040ea63e1700e064061ea8e
MD5 0cdbfd3f2bdf7b6ef15f9b9533343879
SHA1 b6d7a9994ee60196fd0cf7722e3782d6b77f1656
SHA512 2a7964889f9576fa74356a98639f156ff171b81bb49a39598b0c275309aa84b983ebc46e117ee8aa8056e0b8e276635ee4dfdff6c9ac6f7f0c18d8ccedbfceb8
TLSH
T19671A507416A34E8F39A17F0F0E93F5570B1BDD64A9F6D6B31E898BC9A36F142621708
MD5 SHA1 SHA512 TLSH

Submit Download

f2ff34d4-7bcf-4c83-b03f-94f06c9812cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f2ff34d4-7bcf-4c83-b03f-94f06c9812cf.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2bfdd7a7a650358f5c61053ddef8710ef554880417028f84a78084600e8de355
MD5 40cc7d5fecb870e55a7f715e451b4f27
SHA1 868413f7237fc9434408174662a8cf98efb1ef3b
SHA512 bb4ac4b15f33b29bc34e46b124c28a37ebff040bbf25a88e3cfa327b6798db2df970ecd3c8b9d59c4ff484408c8bf4f7fd4a055ad54185f1da6bc78830051174
SSDEEP 192:D17ChGsGm5taij6N17g57fOxnCGHttpgiw/GmrmvmDmtvTmdamgW:D17ChGsGmjaiGN17g57fOxnCGHttpgiW
TLSH
T18EE1BCF783F5822DDE1195F0AA18AF1BCE2C0551436C3D5A85E46E4BA3F2871E191B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 eec3edb942544a43463bf3464c631ac2107665684195b0ed5e38d94833ef52e8
MD5 e0f3272abe1d7de92c4617ac55575683
SHA1 2e3766484148c9e5c1d335250d4329739b3d2eb5
SHA512 d668e14b0910d63cea573cce532d463f990b07069ed693748aca29482e27c668831b4cfff2b423211ba1818555a86d05664bf30f7790075105e3fead7d11ed55
TLSH
T18A31A0F783E4856ECA0196F0A618AE2BCE2D0511432C7D9A89E4AF1BD3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 5fabf1d60a97bee4269662ced4f1d51039c4da53a536a3408f153f3d80c946b3
MD5 bfc5818470f4b9eafe74fd132bc60b18
SHA1 e034047e6bcca62025ee7a1f15cd577bd7b1a6f5
SHA512 c3e6735a3932c73a10e30220300583855e9495342d111ff540f86f08ae22d7ddc9e4fe6d5d6e67bfffcc9fbf40d05c24f0cf5066dd2f96afdd0bd465dde3af4c
TLSH
T17AD02317114070B5A55C7F9D80F5ED4FC72710140401EFDC21F0549D1D3545C06277C1
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 060bf0c7713fd419cb21a0a7785cf14cfff35169cd11f5e177fe04ce0bdfbe30
MD5 00d657f1e008c2e753ccf61065666262
SHA1 e9406ab41dcc50b724abe81d503904d207ce849f
SHA512 0ba29ff163ec5829bedf576fe90dfc70473956f014af6585e1096daf9a7a3a32a14e6fcbf0ab214b5868d9c2611e5c75add0d9f6394eaf7d99ca37168919fe9c
SSDEEP 384:sxZwnN6Em1v/f2szRUei2chbm/bWo/oCWe+JF6d:sCNnm1v/fVRUdE/bRvKq
TLSH
T119A2F85265208877DCEBC619F9257FA3D6F91423DD854E4CA9FCCA0C04EA6FD2212C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 c3bc2ab40c69e44e79f4cd6f63d434f75889eee8101e816e93affda7b0260bac
MD5 e7446a874cb71e3b65262a3ff296f525
SHA1 6ea2af91edb2864f84e3b4007127394bd30d4b63
SHA512 7295a75616922a33483fbb873c873ad597f67ed6f02b6bafd919e9c70a8a0ba90211ed22c2bbdaf33b3f1972e70c7d3c34bbb68a60a443b21f6da9192cdbbb4f
SSDEEP 384:sxZwnV6Em1v/f2sBRUei2dhbu/bWo/oCPj+JF6d:sCVnm1v/fHRUc4/bRvkq
TLSH
T1A392F85265208977DCEBC619F9257FA3D6F91463DD844E4CA9FCCA0C04EA6ED2212C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5dec1c57180a86e5fc2cee35fe9ba8e04743dc196545199c193c99c0629464eb
MD5 eb7b07e93bca5c3d7f7a2ee41dd10259
SHA1 25451f896e6cd59d1b3b33c0c1c79b272ee62b9d
SHA512 7643c6152829b66dfe389d1c5849cee128895264cd0cb36fb36bff10e34d8bcac0f185da02a081a0b6f26c9765eb232205976ae0d1bec433b5bb6fcc890962f4
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3zzx4Ll8:wQAKq8y02yqEnjbWRmj1QWTu1jaKzzxL
TLSH
T1FF03FA3B680CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index
Size 72B
SHA256 5de43df479ced185ff36d4e4db98c5e7180a3c7b02d3b5d39ac8198e62762dad
MD5 8f6ad9d87d6a22505f7cecfd65271352
SHA1 bf91618d756865f6b95effb5da0cad5e18dabc7f
SHA512 a09e5d93420529721848f25a5c5534d8a4a70ae52abc26c1d5fe2e9321d7afefd1d594911e36c1d3b8a64f7806a1104855994f5b432347e462164fd7245d9466
TLSH
T126A002786AC00611C02212B035D7019EB362CE388715535B51927465D9A8545995181C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index
Size 72B
SHA256 35377e5656c920aac583da47631f491138cef28a4b4a1bb9fa3b4fe099586e0f
MD5 442f8c4795d1b82bc3eb90e922d8c71c
SHA1 d68ce367870d4a60426b0918e8e91d97bdec4e47
SHA512 b45d82d6c658d9aea66c86a24cd11285c1ae56a6a2304515db5b2931133f2523c5139b2f02e22a286c1c2bc38f7c9dc95403f1f94bb9fac1d60e6b6187596f89
TLSH
T1A5A00250CBC08105D12263B2569387411B10D8902210371780D14088CC909404D4600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 3KB
SHA256 317d7eed6fd5ddff105d3b4d4e778e4d6c58a5b1c58e09252aee8e45ee0f9223
MD5 43fc0d1b366baf61f061db5fd8e1c8d6
SHA1 8a2d125517207a320f911422ac67435ed126e61e
SHA512 aa342a609275bba926f7f2d9d01aae3b907bbafa1b4485cebcb610dcf0f90fe0eb3dbb4ecd391b583ccb9db767f0d7ac56f1a30f44ce7b336aa515d683e1a479
TLSH
T189511A0F8D435A29CDAC12B328F61040377598CE67C5DB0370ECA436BDC37251C94263
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 2KB
SHA256 cda20a330c2dcd3d3e32a6a7992688100984bd0ad655989844d7ac5b8eaaef09
MD5 133c51e1ecb3255e85ade71c0604d940
SHA1 f7872716d74f004d806aec1b166c4af904d95fb9
SHA512 d71df71816363ea392745ca058a7f9603946a7c84b9689672ee9d59f7703d41e89461f3cb79e959513c859b996fb8691bacd9679aacae56ba4c06d3b75a1e4aa
TLSH
T1B851C80F8E529E6AE96C02B314B2589433748CDD57819B2724FC0237BD477692D4B2FE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac99b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index~RFe5ac99b.TMP
Size 2KB
SHA256 b21a0a789e07077532161f049492ff337dfff881118749915b60355f65d14f4f
MD5 cf6ec69110dd0959efa526df4fea069c
SHA1 add205c7e41727e40f5ae5e4772f3715131747cd
SHA512 a4c69ec3e7ad0d35ec1791ebfa6528e7fe8248333469d398e740f4ab5f92e20ad24daf182b92a8ea740c356dbea51fb9f95087b85ab4a4aaa641d158b252999a
TLSH
T14751974E4D424A39E9C8417709E3A8B4373929008719BF5334FC9636ACD379E3D5E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c7d8b305af0d6f860cdd6fa65d335e8b78a66f71efb6fdb2d07826420d27d481
MD5 1f27ef14c154320dd0ce7e73840fd95e
SHA1 08d837fc317635d40e76efc9bc5297443c316f1a
SHA512 7c98348fb657598169ca2806f498c133912cefb8c71252979e706ac2ec84dc477bef2be01ad6b17fb3c8a94d215506597d163bf3701fbb941080da99574230bf
TLSH
T1A4E068FA2DA73824F86B93D21832906101023C50D944BCCF249EB59360B13143999C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 15a76fa3307e6ffc2138fe6fb49460b6ffb68222d5d7a891929d3b077e41147a
MD5 6dc9b372c6f2b58acaaf2cd2f6e6e877
SHA1 1a1da3b5303799cca67ba5c44d9baff9148467c0
SHA512 7d048ef1b53a38c95cd6b485092986254209412177d0355fab8e1f56f047c50db00fe3624a5d2b8386eb73146eb7fa3b8fbb4743fa3db5103b1309965a96eb83
TLSH
T121A0029B8F6CC181D004137096721A8C6B31C9D8176622219AAC017498533808192435
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b1f6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b1f6b.TMP
Size 48B
SHA256 bf1d58a3d9b79ec0aeca5c7a80e81d30068e54d8815e1a40cc56b94adbd36b36
MD5 efd2809b7d78f91f6e1018eb3bbfd38b
SHA1 c34cd7afa961a45277e47788048ab2026aaab444
SHA512 28cb93f175cbdf6eea1415a4a1805ffae39d7021f88b06ad96afa807b8c9aa33694d5066e75659e6133d19cb415085ec2bf65aa0b972d855988fe73bee9feb3e
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 52788b5db74d3884f8504c8a101bdb83c572086e6dccdea8ff488a1b926b81ef
MD5 6a37315a47a8be9e5dc273fcb14b94cc
SHA1 e1ecb5fc852a09b34cd9e1ae44a6677f40d47a52
SHA512 7d88bc0dd3d4ac14f79e667188c6d436c387360415a6fc344ea0dc75bc58c35d1a424c9793488096d97efbf2b0944b33c1e521bbe2c784204f0b70bd4b54238f
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5p:GZLVDJjEDPV0/ZdsL+
TLSH
T1AAA2490232BA02423C7D290C93979B674A42F1633469AD7F7BB900B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ff0839e55efe45d046069c2d85bd3a9dff7f7d37e65f360814ff3c74d0a9bd8a
MD5 f88660e640be995fe0d1b87facebf780
SHA1 84ba82c2520e21c409d512098ed3f77f01da4340
SHA512 01b6fae556caa09f015c79025b3844e835639a3b66fabf5e16a3951ad9506d3e93f9be8476735f0312cd9d7cb25e67b06f26b9ce3e323f122ec4df13b73ec61c
SSDEEP 384:nciFZ3yFaeO8o38NC8TUNTUlIRxT7m3ek32nn9rq34Jfb8GgFRLCaGBISfiYLUbJ:HFZ3Izho35wg7KekmkFGyRLeziEKJ
TLSH
T1B3D25A70E864CDABFCEA4E95B70E7A93EEE00123988C5EE8E5C94D1D04871DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cd35da18d45fd61894a74f496096881c2a101802d3371059d444dc2bc611b1d9
MD5 20ea93c7df882e8ace05c6de5078f461
SHA1 f2deea6cae394f1440fb5e48a109529947277975
SHA512 1d9cd2b82bb2d9e8258fe8e6e5ecb374a62de1053fabe30bcda5660230c836dfcf9d00e02a98cc6fbb221694f71612d90580476d2496d5913889fddf9382391f
SSDEEP 384:nNiF/3yFaeO8h38NC8TUNTUlIRFT7m3ek32nn92D424Jfb8GgFRLCaGBISfiYLUt:EF/3Izhh35wg7Kekmi4mGyRLeziEKJ
TLSH
T11BD25971E864CDABFCEA8E95B30E7697EEE00123988C5EE8E5C94D1D04871DD170B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d5a020762ffab5f9d886c02fa86eb3f221607fccc08b0d0d4f98b3602afe9191
MD5 50872e5305ebc011f82bf88ac40f4266
SHA1 131f6384ed4a824d7428f0c1ac7ecf7506a17395
SHA512 62b2340662f09e49939a1c6c7512a8a2b4785577690a8bbf8b32cfdfd0c2c60e718f90d513b49e42f5b1a525d310294c39943e324bc7c5f71029c3c3a1f930b1
SSDEEP 384:n1iF/3yFaeO8838NC8TUNTUlIRFT7m3ek32nn921424nfb8GgFRLCaGBISGiYLUt:8F/3Izh835wg7KekmS4wGyRLeiiEKJ
TLSH
T164F2B4F098D78977E8AE4B87A33D6E529ABCC113B8485994F7C94D0DCC861BFD706806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 42a26832ed95d6f3d59710bee7e4f5cbd9d77c28b52926c381e6c4ed3d157ab4
MD5 feaead4c2ac58603d0c096741d4a9a50
SHA1 08b909c510a94db04b36b44d893186f5e7ebd364
SHA512 bced4197e7e0badd8956769682b5cd95bf605c59f60d801f4d9504be1ad5a5b005b5823d4b644e9996b2e7aa17499c899eec999668f3b79d86d973c296a1a812
SSDEEP 384:n+iF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9BNQys4Jfb8GgFRLCaGByEUe4KV8P:VFccps39wgPKekmVBwGyRLeQVI8p0yt
TLSH
T11AB26C31EC68CABBECEA4F99B74E7A02DEE05163858C59E8DADC5D0D109719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b8ecaa453cde4cf9d6c5fac757ecfbe2509ec39e68260db4a39db0bd1824eb4f
MD5 21d5687d7ca47635ae6972a266c358f4
SHA1 b5cf2e9923e94b431be261ba2b9453c3a78777af
SHA512 a1d6a2344f885c917a8192cb83128a06aae1730de7d549466493431ca227ccf08bf086d8ccec090402625d14cb8a269098520b30dd8e1675e7dc91779bb77652
SSDEEP 384:nTiF9CcmyWCs38N28TUNTUlIxBPm3ek32nn9owE4Jfb8GgFRLCaGBISrie4KV8pB:+Fccps3JwgPKekmPYGyRLeHiI8p0yt
TLSH
T15EC25B30E858CEBBECEA4F99B74E7642DEE01173898C8DE8DAD85D1C109719D170B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 da91329f279864bd282110a5feab11e213a77e5397ce2bff22fc5f04e082ec6d
MD5 3187d575c8bc72adbf338108d5c5f534
SHA1 a05d979a24827287cf0c1324a04c09263f6c001a
SHA512 4cc25b70a70699cc8bc406d042af8784928fb7d562906e6a37c958dd197f6d819d7736aee4af45ce5cc3116ce5c62f6e9e6b8072076c461c2a35f0b22db63afb
TLSH
T1CAE002129304407EC535073040C317353B92C010117203479B1405552C123082F30EC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b1e14.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b1e14.TMP
Size 392B
SHA256 49615ad0faee186b2bbc4c67a159fa8921ad40aa60d9061b8db405da00ccf59e
MD5 f654aca7c874f700c50d362d75854078
SHA1 0853ac9653b66bf26495b810e2598dc928246548
SHA512 ded144e7e2fbbaf6ad2c2be892816956fac5c41afc6cf189dbbff2b8184f5a12a26eabee90f0d69fab522a984f859b3517211058ef2d296b89ee33f874f4991d
TLSH
T148E0021252004079C5150330008317252B92C010117203469B1405551C123082E20A81
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 37aeded29dc5740fcf6aed71f720841808e3b94bd3675d2af832aac9083e86a3
MD5 48570262024564f9cdbce869c7984f15
SHA1 e50d84122a530318b727a17fe870dcfcf11fb799
SHA512 546fe39f6c04093b9d73b12f2f4748ad968d47646c3d6d8f55f6b9ced9a19f0921c2490812792aa088032800045439ed0822bd8e06e9b9160d47923306a23f55
TLSH
T193513DE05C381AD1D0BD0A6EB49B38EC81E8C726F5A4347D6C98E9984A7E64D348583F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 86cd0d38b9002ee594f20fd5396938901d4c32426ee70e721bc17a1897d8a024
MD5 b116e045b4cbf1fb055db59755baa221
SHA1 3f03825068ff0aad52fd9571d11c8111b813a0ab
SHA512 8abfeaefc6b915373baf3c022735c7b569ffedb3a302ce8fe7722a52cc5b7c8634c26b2d2ddb795cc76c96044b44381a2b3feb4974abca14f02b9207d1c7386c
SSDEEP 384:HwCe7iO024YrDL84KKDL849B7SOEAd9KVRaAcP+AWRMAUwi:QqZYrDL8lKDL8CB7S/AmVAf+hRMnwi
TLSH
T1A7729E799F413CAC2597C0E8C1F882DA8D18B6E7CFE6806D21683D0DC7949A9B1F549F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 ac46c4b745e8ff5a003d958d9b43e062b75ab830bd636dc4a3898975dd719ad7
MD5 6a6f6d58dc64fd762cbf82a358134ce6
SHA1 1cad7326a6411039c0cc364405cdefef1fbbe83d
SHA512 38d40eec28725e93261f13eccb8195633e88cde2bc9fce1c7335f58d88a8a9cb63e407ef3670e3127f341f72a8e1a6c7c1b1655b8c9e4c4c97e6c0c0152c04fe
SSDEEP 384:HXkRyiO024YBDL84KKDL849B7SOEAd9KVRaAcP+AWRMAr97:3mZYBDL8lKDL8CB7S/AmVAf+hRMk
TLSH
T1A2727D3D4F003CAC25A780FCC5E982AA4D18B6A7DFE6C0AD21583D0DC798969B5F549F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 b2e39292cfbc1204fbf16d3c54bdc1c1c0b5c16f4a6d1521b035d24c6aa47bd2
MD5 2d64b89bc46694b58b4507888640677d
SHA1 48d3201b75aec5c41aea0ec767cf8655bfc08ec1
SHA512 f3c5892d5d6dd660c80c40e52c31a7d36920c6e66ee5247b769c6faf662c782447dcb4f8000caed36c6f02c86451b4b228430fb6a0026d5ac7da910322bbd4cf
SSDEEP 384:HJWJzVca12krtuVm+SglBOVjeQ8RJoFhghFUjUXPW35PIm59+GDa50HIsYAVoc4x:p+zVcWrPl8RJmhgTUjUXP6t9+GDa50Ho
TLSH
T1C0A24D743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 abc8915ea21a5e6965080e1aa7d8456f3a89b435609602855066aba905dd3fe9
MD5 0bb8a1501d88c988e65fddffad72e8a4
SHA1 2656d3cb6efb0e211c535071e4783a7754a5e05c
SHA512 0ae2501c244291292bc84f98ee166e4e712b1cf3263a512ac5426cdf6b3498bc67161985a01923b149ca49c77e6168953c336ddd7b0f60dd3ce8e16b2f63ffce
SSDEEP 384:kuJWJzVca12krtuVm+SglBOVjeQ8RJo3hghFUjUXPW35PIm59+GDa50HIsYAVocU:j+zVcWrPl8RJYhgTUjUXP6t9+GDa50Ho
TLSH
T1DFA24D743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 77d343e58b9165a77ff4616f8dbb16c248e50cc2933e4c556c69c7f48b382a40
MD5 ad5058390bc8853aee953e145049e7ba
SHA1 adbb19d3f718e7246749466b65c82f925b5f84a6
SHA512 68113d8c565a9c83fe094ce1685beced531ca7619999a7a655fa306f45357ba2eacde0af1699d41bbe35dc4415079eb2a7ccd4c8d85ee2768d9188dbb42a6f10
SSDEEP 192:WoOv5zboHtZJgyjm3Pdt1d66Joz0dzgCl6mc0d:WTboNZJgyjoFLd66JozQzgC1j
TLSH
T13DE11EA4F628863FC409427BDDA61B464F35389AD84E3F25319DA40C3D572DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 62KB
SHA256 880bcdad81aa935bb461a3df0dcaaa6d5206d9ad530b87fb4f8054ed7e312ad6
MD5 a0a92ac688ab9500a3badf0efd7ec2b7
SHA1 496caede7d3f1fb85385e417f3f7ac084192fad1
SHA512 50102a25c24fd7bf6ff2f22bbc2355a7dd83438c82333886aa614dcab18e9a18b4923600bff2f87c42a8375ef011c727d86811d528d91a2db9eea1b24e9bc89a
SSDEEP 768:XnXphmgyk8maRWfBs2rd6ltGcmhui72TF43KGxHELCnybpbCbzbHbkvphbp2/Ss:pPyk8maRWfB/rd6S72TK3cTbp2/5
TLSH
T15F53F080DB2A403FE82441BFB89517282A35F8614A596F5B3A9C14651CCB3FF3D4E67E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1ff1864ef01de45d0541357266aec0d3bfa70c2be3c71b3905d67691803571b4
MD5 d94d899d620b27d8fdda96422ec13f19
SHA1 6c656ada0b5d68ac1616deec6e40ecfa7a3ebe6c
SHA512 9aedb96cf2a8b9efb0984d7a4d3b5688a00bc521ca73c15b34030559c41c507f7c5c34ede573d9b4e762f4d9614259bee7f1119c8c17e933738d968e8dffe7c6
SSDEEP 192:EoOv5zbogZJgyjESt1d66Joz0dzgCl6mc0dz:ETbogZJgyjVLd66JozQzgC1jd
TLSH
T1FED1EB58F629863BC409423BCDA61B410E75789AD89F3F2531AC740D3D972CE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0014ecf89fc727784becd970ce4cf4fde139e18b9b9e5b7091a6772fd3da251a
MD5 b0d47a928a5f61132c5646e38c9c77f6
SHA1 a28666b44dca9b63cdbf9d75ec5b3eacadba7bae
SHA512 44e345023d967c3a87ebb6e6261f2b0c64905bbea0761614e833498bd8657fe78560deae88083f129cd4532900d75bb683a5c94ed631f7645fde41705cb6e36e
TLSH
T15F21AC4C39F94D3A69CBF29C7482028E57454E0B08875C8B4E03EF8DCED1AD9326A638
MD5 SHA1 SHA512 TLSH

Submit Download

1a64079f-a45a-4818-8efd-846acaaf4343

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\1a64079f-a45a-4818-8efd-846acaaf4343
Size 886B
SHA256 63082685a44ac19e485e2ec172bc4a79dd74ec24a0f4870c71623ce105a1cba7
MD5 d9f3e93646bd4b0e6b9913de7f9dda2f
SHA1 0130ec58a1c2255d4a072405c10fcf8885ff2c40
SHA512 eb138d40849372549d7a42741bb2fb2655334520143b6b7882bc78559adbe5288a21a4a47b0cb0469779b417ce5bb051ab74c665baa59956ceee80813e6b947d
TLSH
T1C4110080A574B6B28C68C34F95E33B438AE4B023C0CA49207D619B181EBA51E635270F
MD5 SHA1 SHA512 TLSH

Submit Download

2a6fa09d-5fd7-4fbb-b1ac-5b427071cd94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\2a6fa09d-5fd7-4fbb-b1ac-5b427071cd94
Size 235B
SHA256 3f9a3934fc65e448ce2f018f61aa8517bc96767750c806d1a8b0095d6b079461
MD5 67935d8be7d1b65f5c2e68fd0536d833
SHA1 cb4581f99c4460811487d1bab028e6537162a687
SHA512 a2c85f01ffcd17095b6149c3e59677b5ab7d58d3824835071e47de0a6d13540007a420324548a213737c3d2ee3561c917a66ef46a6dcd7cb092cdf9fcacddbcc
TLSH
T186D097C4189C279D08140F02F0A068E670944C3398B8A820CA520178C9BAEC84192947
MD5 SHA1 SHA512 TLSH

Submit Download

73d13f8a-e654-4834-95a6-0f191c2e0d69

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\73d13f8a-e654-4834-95a6-0f191c2e0d69
Size 2KB
SHA256 166201d01ba1d741b5915ea48b53845ef7145db4b1df27346de4a18472a64848
MD5 b867118e936762b23f10556e3da29bf3
SHA1 9c637d09440a944fe3ae0f0f5d1d0b3ad3fa89ac
SHA512 dbedb6174cf2162e8bb8340e234bd5154f24689a1d0cdbe40d2dbdeb13c788fd327c9ce49258df6fa56496dd09df767644d0097c530959631a7590fa03fdd91d
TLSH
T12051A6659060D87EC87DA30BDD223B838BF2240B408B194E6EDCAE0B257FC5EA355649
MD5 SHA1 SHA512 TLSH

Submit Download

a862d22e-e95e-42ef-8eb0-d9d232b2c804

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\a862d22e-e95e-42ef-8eb0-d9d232b2c804
Size 2KB
SHA256 6e9b3ec34c6503f37bb2c14c3d5c40766360b3b2ce3423ce97782f4443ca8467
MD5 ae49ba16a55a99a2d8d52ac7e6ed7d4b
SHA1 98d155cf814f8388e0691cfb76c6b83e595eef0d
SHA512 8e25872f378bc67464b692fef8c24e30d45ed0c10d1ea52d20ce5404de715e67b4dc8751e652b8c939dc657462238d36081f49daf212ba0d22a2690dc56f8f99
TLSH
T1B641335C34B89DB69CAAF29DE583374F53609A0340C62C936E51EF0C8C966DD336A53B
MD5 SHA1 SHA512 TLSH

Submit Download

e1b76fb5-6a74-4ace-a40f-7de71868413b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\e1b76fb5-6a74-4ace-a40f-7de71868413b
Size 883B
SHA256 eaf5f9ac5154e8c9f1f90be9019c9dec5c706fea0d844a33cf56c17d8cb1e131
MD5 b2e0bd037c5e27a441e882474af77905
SHA1 e0e5c0e1a4581b0d388014574cdaefeaabb255db
SHA512 3bcd5033bb22280ee27097d5cf4f264f9ef398bf89cfba74e93ffdd3688f5176734cb214c6eb2272ed97e2a73b7c76b92d4f7db6f912b3ac64da8a77479ec958
TLSH
T14911C0C1F534B6B2CC68C24FC6923B074BF8B523C0C985203D659A181E7A51EA35674F
MD5 SHA1 SHA512 TLSH

Submit Download

ff8a5d4f-1258-487f-923d-8ae1215bfbfa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\ff8a5d4f-1258-487f-923d-8ae1215bfbfa
Size 235B
SHA256 4b65271c672269a92e09e9c24bf6a5d755cd620b73f930ff8b0177ab467e247b
MD5 9db03051641d78dff6d1cd902708e05f
SHA1 0e1ed9c93a117ff921cf32b126d145cd43f48877
SHA512 7add60d156d95c19512217a5c587bc1d4de65498b9b196fbadbfa876b0d87383f2ea2637f22dae2747166f9c7b1a19eb0387cf3af74f88bbe875d3abd6cb2461
TLSH
T14CD097C124E8E76D08044F03F0E028C63084CC3310B0A821D59200B49AB9DC88212C07
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\extensions.json
Size 16KB
SHA256 f2fb274ebc2a1ceb3aba264cf9571f319847911ed9ffad4d115fd809c1a5778b
MD5 eb8d77bbdc9cee82463a973d8eefbc90
SHA1 7acde43c2f655be5191b310c3b2f9eaf9e5b75f6
SHA512 d483db71baf9c2ac553cf3a667a59e33ab3cb3b8085da6d73fe7bdda53f60b0c0c647686bfc0013c3815c995ab52a1ccc4265521a0513746b5ad16a7f205b67b
SSDEEP 384:2kI4vrUmldvUg8dhWC94zf96olL4HuL4PfL4HhL4H5L4HMl4hs:ZI4DRf8BX/4p6W40474Z4R4o4a
TLSH
T12172631545049EB8294EA79BAA367E02C37D533B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
Size 8KB
SHA256 86237b4b366c845b9b7172edc61326716ee29785356ebc2349ed07447cbcc9bb
MD5 1589d74694aa14729fe0411040bde745
SHA1 7438a920dd4f8db71b74a80cb520e29cd13a4ccd
SHA512 713e3431bdceb34f76026ade138e431b1071a804c22335246c9a6e8076d67f9604585847225b6421dc87a53fdf01c6d0ca3a428ff7b77f997458cb0cbb5a0f17
SSDEEP 96:xHPu5NTURy4qGqjyf56o1gNbzShySSlQdv9jKQntWRiKxiI4OBw88Yu8L4cnKV6v:1u5eyTR2f56o1gwySShRNxi3OBw88Ywy
TLSH
T1C3021F789144CF7F74B6766CAC288D315AB2023BB6BF68DA11B95484014CF3442FA7EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 6KB
SHA256 a940a22fa13a9cfc11b4cce857c55556561c03872ad77298ed82f87169e9b37c
MD5 071cc176c4799490068f8fb9d4fb81b8
SHA1 f778e1e66f239025ad8dd72d5162837f343f3c7b
SHA512 7f264e80ce529dacc57512749d22fe05ed48485f0e1ca410b3f180af854dd13f9dd86b181b4ee82edcb4ae5eca565cf1f0a0284c883673d8190942c561a585e0
SSDEEP 96:xHPu5UTURy4qGqjyfDfsX41zS4SSlQdv9jSwntH+xiIgBw88H8L4cnKV1HBm:1u5hyTR2frg4FSSFK+xi/Bw88vk
TLSH
T18BE11E789508CB7F74B677ACAC688C716AB2013BB7BF68D610B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 7KB
SHA256 4eab289c0abc38aa83a46c4db276a8e14d9ee7eecde64f46fca93b5e1f3a8e05
MD5 ac1e7083a46d5cc792760dc4893b403f
SHA1 ab3394f07b87e2442d5d84b70673a2c031e90572
SHA512 2af88d7d32153f8e8e2398318c826642bcb4f1f1da67d6d33dc921bbfbf26ee3e8a66fae52db623d57063c9f09613cb96f28cbb3264033623454f4b29cdb3f81
SSDEEP 96:xHPu5UTURy4qGqjyfDf1gNbzShySSlQdv9jKQntH+xiIgBw88H8L4cnKV1HBfGS:1u5hyTR2fr1gwySSE+xi/Bw88vL
TLSH
T13FE12F7891188B7F74B6766CAC688C716AB2013B7BBF58D650B55484014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 6KB
SHA256 ad560f56d8c08fbde2fce1ab867881e6dacdd44f0cef83bd3fd8c0aad7214d60
MD5 32cdc5f447d6ecc08b0f85f48a2e0cad
SHA1 bfa5673f618c069eb23a422436d13ece7331df6e
SHA512 fdc053f0e71f899de3f6917c85de09fc2cba16e560f1b8bf69f41d08cf3799c0571c479ecc42e6ec53d43dad409df5c6f72ff68a590df2aff37cfb1d7a344b95
SSDEEP 96:xHPu5UTURy4qGqjyfDf1g1zShySSlQdv9jSwntH+xiIgBw88H8L4cnKV1HBfGS:1u5hyTR2fr1gcySSFK+xi/Bw88vL
TLSH
T1C0E12F789118CB7F74B6776CAC688C716AB2013B7BBF68D650B55484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 164cb6ec280440d51dd5bf97fda75bba8adf6a9060f50f91d07c069184bd23a7
MD5 1c439b438057b71eaa225c72ea81c2ab
SHA1 3b76691212984b650a0004a33518fed146714ba4
SHA512 80d9175220e78bc7c89a3b9875836c78b2b3aa36c4ea7c939fdf0a253faa8b7d66eda1c541876514335420d7dba576588e781dbdfe4e0c09005d35506778bf75
TLSH
T152817C62DC2C6C86F8F8A2BE20E18ED3EB7BA00012E2D56895401039C49B3C63BD4679
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 eee755a3400332d26c3aa59fd0c6ba54a2ea65ce5f840e2bb1141e3f239fdfbe
MD5 ef1120a6aaa040d132371ee1656286f6
SHA1 05be81a48f0b7e845dc948047bb510a43a03b6e2
SHA512 d596aed659103b7b34184eaca1dbea4ef8fafbfd5c2ce4f863dddb46bc6e3cc26ee2e905f7c2299be96148b60288ea513145654c601016db52569d5fee02ad7e
SSDEEP 49152:KXg3QAjgjKR7bWUYMeF/GwF1+BXtKRzJ4oytz:6g3QAjgmuF/GS1+1tKRfytz
TLSH
T1151639F824D1A257F3818037668563EB21AFD00C6477DD444BE966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

twintail-windows.exe.crdownload

Path C:\Users\Admin\Downloads\twintail-windows.exe.crdownload
Size 4.2MB
SHA256 b00629b64374429ef1c99d8122c0b4abc57ab0d7f74d426027bef680aa12c986
MD5 6c1088c61160485c75253578a38991e0
SHA1 75ee2a017663fbd094d43b982973b5f4e2b6afd2
SHA512 93add4fe138e5a660273fbafa44ed87c0659093952d07d905af6f266778613900b7de83fe72e747744fec07bb0ab7c135c46186ee1144f6315e5d18e00412a51
SSDEEP 49152:N9I68mW8AJfTD5vxsCBxQ6HHAeJoYNivf15oByTQ+8lRv3iKWwC1fdMh3zw8glAY:DFqX3iMvDOwBOSC
TLSH
T17B263943F66281EDC069C434839A6232FB72BC4D07317AE75BD44B313E66B906E6DB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

twintail-windows.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\twintail-windows.exe:Zone.Identifier
Size 1024B
SHA256 9d936924e8c3bb676903f32cd6f8e3e8b03bdf60a0e08992e5e382bdff11c657
MD5 9dad7922877a9dcc19947c2b87205923
SHA1 0f65f9ce8d35ab8a0624bcdcfbe3619564e4766a
SHA512 599b91a9116c81813c179bf3585eaf522bd9d1a6fc2c24da4551c8f174a909b3bba2a6b237b21d2ea759d0cc5588eeeac8eb938e3205752a19bcba29acbdb22f
TLSH
T1161165FBD019159B2A07F8E79A5F996FB437F4D98A86014C11AAC049D0C04BBA0E6C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads