6dcb19adc30f1f0da64a54f180017898f66c9a2381c686db6f2219439899069d

Resubmissions

09/08/2026, 11:07

260809-m8bl8adr4y8

09/08/2026, 11:03

260809-m5373adq9y3

Analysis

user interaction
yes
max time kernel
600s
max time network
492s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0srd8b479kj0f31m54zw2h82hv64v5k5.exe
Size 5.0MB
Sample260809-m8bl8adr4y
SHA256 6dcb19adc30f1f0da64a54f180017898f66c9a2381c686db6f2219439899069d
MD5 b7a26f6a56d119a1553cc7d393a855a2
SHA1 4b48e39e58288cab8770cc4a734fde844d537537
SHA512 b2f32d5e90c43741a50fcd875e772dd44bf689d5ce2ddc7caa1b3519b057c7628ee5c0b1909c334fe8903e9de44b82a9bbec93b407152f3f7c0e53b677ab5b58
SSDEEP 98304:EM25VDWc7VDPL2o/Y7mgTm05AwJHE6hnYQlZqL9PlFN:qfDWwZDng7PAmkwDZqL1lF
TLSH
T13E36AE42B392C599C166C138CA52D7A7D7323C090F2166EB329C7E1E7F726E04E7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
280	3516	firefox.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Roblox - Windows Installer.exe

Executes dropped EXE 1 IoCs

pid	Process
712	Roblox - Windows Installer.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Roblox - Windows Installer.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5444	msedge.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Roblox - Windows Installer.exe:Zone.Identifier	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	firefox.exe
Token: SeDebugPrivilege	3516	firefox.exe
Token: SeDebugPrivilege	712	Roblox - Windows Installer.exe
Token: SeDebugPrivilege	2684	msedge.exe
Token: SeDebugPrivilege	2684	msedge.exe
Token: SeDebugPrivilege	2684	msedge.exe
Token: SeDebugPrivilege	2684	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe
3516	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3516	3872	firefox.exe	97
PID 3872 wrote to memory of 3516	3872	firefox.exe	97
PID 3516 wrote to memory of 3900	3516	firefox.exe	98
PID 3516 wrote to memory of 3900	3516	firefox.exe	98
PID 3516 wrote to memory of 3900	3516	firefox.exe	98
PID 3516 wrote to memory of 4036	3516	firefox.exe	99
PID 3516 wrote to memory of 4036	3516	firefox.exe	99
PID 3516 wrote to memory of 4036	3516	firefox.exe	99
PID 3516 wrote to memory of 4036	3516	firefox.exe	99
PID 3516 wrote to memory of 1428	3516	firefox.exe	100
PID 3516 wrote to memory of 1428	3516	firefox.exe	100
PID 3516 wrote to memory of 1428	3516	firefox.exe	100
PID 3516 wrote to memory of 1428	3516	firefox.exe	100
PID 3516 wrote to memory of 4896	3516	firefox.exe	101
PID 3516 wrote to memory of 4896	3516	firefox.exe	101
PID 3516 wrote to memory of 4896	3516	firefox.exe	101
PID 3516 wrote to memory of 4324	3516	firefox.exe	104
PID 3516 wrote to memory of 4324	3516	firefox.exe	104
PID 3516 wrote to memory of 4324	3516	firefox.exe	104
PID 3516 wrote to memory of 4324	3516	firefox.exe	104
PID 3516 wrote to memory of 6072	3516	firefox.exe	105
PID 3516 wrote to memory of 6072	3516	firefox.exe	105
PID 3516 wrote to memory of 6072	3516	firefox.exe	105
PID 3516 wrote to memory of 6072	3516	firefox.exe	105
PID 3516 wrote to memory of 6092	3516	firefox.exe	106
PID 3516 wrote to memory of 6092	3516	firefox.exe	106
PID 3516 wrote to memory of 6092	3516	firefox.exe	106
PID 3516 wrote to memory of 6092	3516	firefox.exe	106
PID 3516 wrote to memory of 6104	3516	firefox.exe	107
PID 3516 wrote to memory of 6104	3516	firefox.exe	107
PID 3516 wrote to memory of 6104	3516	firefox.exe	107
PID 3516 wrote to memory of 6104	3516	firefox.exe	107
PID 3516 wrote to memory of 6112	3516	firefox.exe	108
PID 3516 wrote to memory of 6112	3516	firefox.exe	108
PID 3516 wrote to memory of 6112	3516	firefox.exe	108
PID 3516 wrote to memory of 6112	3516	firefox.exe	108
PID 3516 wrote to memory of 5760	3516	firefox.exe	109
PID 3516 wrote to memory of 5760	3516	firefox.exe	109
PID 3516 wrote to memory of 5760	3516	firefox.exe	109
PID 3516 wrote to memory of 5760	3516	firefox.exe	109
PID 3516 wrote to memory of 5632	3516	firefox.exe	117
PID 3516 wrote to memory of 5632	3516	firefox.exe	117
PID 3516 wrote to memory of 5632	3516	firefox.exe	117
PID 3516 wrote to memory of 5632	3516	firefox.exe	117
PID 3516 wrote to memory of 3024	3516	firefox.exe	119
PID 3516 wrote to memory of 3024	3516	firefox.exe	119
PID 3516 wrote to memory of 3024	3516	firefox.exe	119
PID 3516 wrote to memory of 3024	3516	firefox.exe	119
PID 3516 wrote to memory of 5364	3516	firefox.exe	120
PID 3516 wrote to memory of 5364	3516	firefox.exe	120
PID 3516 wrote to memory of 5364	3516	firefox.exe	120
PID 3516 wrote to memory of 5364	3516	firefox.exe	120
PID 3516 wrote to memory of 4444	3516	firefox.exe	121
PID 3516 wrote to memory of 4444	3516	firefox.exe	121
PID 3516 wrote to memory of 4444	3516	firefox.exe	121
PID 3516 wrote to memory of 4444	3516	firefox.exe	121
PID 3516 wrote to memory of 712	3516	firefox.exe	122
PID 712 wrote to memory of 928	712	Roblox - Windows Installer.exe	123
PID 928 wrote to memory of 2684	928	msedge.exe	124
PID 2684 wrote to memory of 3524	2684	msedge.exe	125
PID 2684 wrote to memory of 5444	2684	msedge.exe	126
PID 2684 wrote to memory of 6096	2684	msedge.exe	127
PID 2684 wrote to memory of 6096	2684	msedge.exe	127
PID 2684 wrote to memory of 6096	2684	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0srd8b479kj0f31m54zw2h82hv64v5k5.exe
"C:\Users\Admin\AppData\Local\Temp\0srd8b479kj0f31m54zw2h82hv64v5k5.exe"
1⤵
PID:1376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {b2cc60d4-ed5b-44bc-87e5-0ef09ee16d93} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {96986901-2c03-4a16-bc33-863de5b1b307} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2976 -prefsLen 27276 -prefMapHandle 2820 -prefMapSize 270279 -jsInitHandle 2860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {ec150bcd-0837-4f2b-8ddb-828da0768fb4} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2868 -prefsLen 27276 -prefMapHandle 3728 -prefMapSize 270279 -ipcHandle 2820 -initialChannelId {79bb762c-b13e-493b-9cd6-3802ed2bc23c} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 34775 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {01e09ce6-665c-4396-b911-311c7314fc4a} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5112 -prefsLen 35091 -prefMapHandle 5116 -prefMapSize 270279 -ipcHandle 4968 -initialChannelId {a8377e7c-00af-459d-a019-adacdff61fb4} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32979 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5300 -initialChannelId {64ab54cc-c3c1-42a6-815e-2a213d92427b} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 33031 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {72205cbd-1476-40d8-bf44-cc24cca4186b} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 33031 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5668 -initialChannelId {f1a8dfbe-bb6f-4510-8c2a-e11254b8c4ee} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6188 -prefsLen 33031 -prefMapHandle 5356 -prefMapSize 270279 -jsInitHandle 5028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6172 -initialChannelId {67e1dad6-e8a4-4b26-a445-68f4756edab4} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 33859 -prefMapHandle 7112 -prefMapSize 270279 -jsInitHandle 7108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7104 -initialChannelId {1cd67fb2-69b2-41b6-b98d-17531fd4a1bb} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6980 -prefsLen 33859 -prefMapHandle 4772 -prefMapSize 270279 -jsInitHandle 4796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7128 -initialChannelId {fdd352e9-c8b4-4dad-a884-9d5a72c48113} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7368 -prefsLen 33859 -prefMapHandle 7372 -prefMapSize 270279 -jsInitHandle 7376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7384 -initialChannelId {bb6e266d-1b2f-4ca6-b7f5-79483ecccc0c} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 8144 -prefsLen 36620 -prefMapHandle 8088 -prefMapSize 270279 -ipcHandle 8160 -initialChannelId {1158981b-5d7c-43c4-b071-23bf0573e1d6} -parentPid 3516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:4444
- - C:\Users\Admin\Downloads\Roblox - Windows Installer.exe
    "C:\Users\Admin\Downloads\Roblox - Windows Installer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9PMF91N3LZ3M?ocid=&referrer=psi
      4⤵
      Suspicious use of WriteProcessMemory
      PID:928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://apps.microsoft.com/store/detail/9PMF91N3LZ3M?ocid=&referrer=psi
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffce3cbc188,0x7ffce3cbc194,0x7ffce3cbc1a0
        6⤵
        
        PID:3524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,5257472727696356285,14860443896936878438,524288 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:5444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,14172101976736036251,17535540108743971227,262144 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
        6⤵
        
        PID:6096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,16592229340209097779,5672624125357589563,524288 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
        6⤵
        
        PID:4352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6437372469187397075,11312162910098073323,2097152 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        6⤵
        
        PID:5960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11488288255110468247,7063250438802441668,2097152 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        6⤵
        
        PID:5612
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,13294501127665092364,2748968807655291029,2097152 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
        6⤵
        
        PID:4112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,14839422653977855570,16745598193058833683,2097152 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
        6⤵
        
        PID:4024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,7848737666341329658,14119441023746815272,524288 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
        6⤵
        
        PID:1516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,7682042924287512930,16515796915654995981,524288 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
        6⤵
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5256,i,16159160840254514783,7252325810945949340,2097152 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
        6⤵
        
        PID:740
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,11459417333925070663,438121752373421870,524288 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
        6⤵
        
        PID:4952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,15920887770709742179,6333911927952340456,524288 --field-trial-handle=2332,i,8218255663021625958,8446871937952735023,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
        6⤵
        
        PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4620

C:\Users\Admin\AppData\Local\Temp\0srd8b479kj0f31m54zw2h82hv64v5k5.exe
"C:\Users\Admin\AppData\Local\Temp\0srd8b479kj0f31m54zw2h82hv64v5k5.exe"
1⤵
PID:6048

C:\Users\Admin\AppData\Local\Temp\0srd8b479kj0f31m54zw2h82hv64v5k5.exe
"C:\Users\Admin\AppData\Local\Temp\0srd8b479kj0f31m54zw2h82hv64v5k5.exe"
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 844ae3427d65d0118558fd78bcf16af6dcde644e70269131582fa869e189f9eb
MD5 8f6efa399c73cb488b4f64d48ab22793
SHA1 25d98b8b3dbdae40cbc51015a3693f7a3a2772bc
SHA512 07a8ade88bd99425ac062c4c997e40a89eb062cf57388e7841c7fc8a023739ba5e1eb7bbca8b1295bfd4fad9a5f6b362cc32e057631f08b066dedf276c5f6f73
TLSH
T15DD080107935A5D5E255007D54509601511C9B9726635315F210880DAD3745157C15C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 59KB
SHA256 58f13519b3328248b2b24077c8ff15ebd06912ab370d84aef0b5bb1c1c4dcf85
MD5 0e01bda90b1bf85493db5c28eeabb59d
SHA1 86a0b84a048b4db5987ed6f9733a71b0b7d780ff
SHA512 cde861416342b304fa7de2f8937ce954a1dbf2bce2927dc8ad58c5d78618fdb30c480ed06b89efb0e88e903f4450c01382d00700a346117b1b9349507433c719
SSDEEP 1536:m8JvtK5JbSKBF640AY7Us8Pk5+dWuiiO31T43A/IgBjII9:jK5Q+GAY73j+Gi41s8Bjz
TLSH
T174431217DE40F8E0BB1D5C5C376A418E7BBE3424C226C24F06166A19AB8F986DD1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 58KB
SHA256 9a00c2cf7c002936690a4c9f31cf5ec05a1f6d4b63841912c6e26f49435ce81a
MD5 336671e3ebb84d008bc5d72a892f44f8
SHA1 49713d792cd4c298cb17709b5755248d0c8fc2b4
SHA512 1b171322e7a6c79d0579c908cfafda4e492b80e64936f798f962fc01b179bc460ee5f668857d667df8d169982420e8c339c8a0b4f6f45698ce481731ce72a25f
SSDEEP 768:00AFBQheNhpMsteI0S9knjNAR8JrY8y7syOip7AHKmE0nGzNH+//rebhaiJLOO/O:tAFJtEI0pNARL8yKE0GxieNr5OUVbFO
TLSH
T1584302AA90C7EA36A49E450AB3D80993727488767CE914DD35430ADDF4DE07A1F2CED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2f6ae93ad83f9bab43d68f3a08bc72cf1e6c4804ca299187521061698bc90aa3
MD5 4f9ad1dede5e3835d99281d0d68ac429
SHA1 a57aeb55e3e1f10212427d72ed9ed602019d6c8a
SHA512 87e63aeffffc9c01afa7200d0d108410bdbafc5241d26eca8896c9a208aa2c355239cf4e01d367a66437252c1aa5c40d10ef8da461420d494abffc1d24f6769e
SSDEEP 96:JxUGcCTw7bjKKEht1iT2SE+la/4AcZwhp:J6GNTw79WPii4U4XZsp
TLSH
T162A15F335D928091EB1A317061E0F3643E758DFDF90B9E024AEC8F79A5A43AE4277918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e403ad36b87aedc1765a7d2afaa754046551b5a9099cf814e0b4517e88999f2b
MD5 886e9a2553bfd09336a9afaca1005f07
SHA1 867699c01739de5bf984631bd2ac9de0ac00d028
SHA512 d94939c85f4056e6939bf6a5d485e2ff7ae343fe37bb869e11304e5677ab7f7f8ca7099fc7adda7eb507800ea279840e19979fa09b960e3759146b9be068f130
TLSH
T12B518CF783E4856E8D0596F0AA18AF2FDE2D0615431C7C2689D4EE27D7E34B2E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8b69c83adcac45de25c734b00270d74cb587c8d33c88de7a66ffee7156402d72
MD5 656cb9329b641e5e61588afdcd98c28d
SHA1 0296055e40281c5be9087203eb210f93f97c2118
SHA512 fa669620fbbe956bf481b9c92be4fe53e8f87848b46c19df397e906be1ef22bb9e194915745671d91b01e3a7b87ca5824d78bde84a814f3affebf245b853ee14
SSDEEP 192:sxZiRvj//fvs/WpVt8KzEdpw1HW6+WN3Vnt/atfeUfGMzrRTIgEJ:sxZiF//fvs/WvtdAcHbT/OnBI
TLSH
T17F32B7526938987B4DC7D21DFA25BF23D2F91422A1D51E98EBFC951C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9d7bf887cf573337473720f8f6fe7c84142e57439b040de8c364d4038fa2c04b
MD5 bdf045d5e9c604acd977889dd1268290
SHA1 6f802c9e5b79fe1e94960fa7410c55e40eced853
SHA512 741a122f7d75cfc2bf45652dba7ecdf99a181a6e3f53a2af1c2542b69e7a7eeedb2824bc2e29211c22de90c98db91cfbc4755907b2010f42ba7a700e23a0df8b
SSDEEP 768:zZqbUm+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVdZLlRTKrtroVc:zZqbUm+WvSCs6u1ja+ZLbWrGm
TLSH
T1AFC2E93B340CCA7E4FC01A9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\6bee03fa-d866-4be8-bfd1-e38ef66f9970\index-dir\the-real-index
Size 72B
SHA256 814a0d776c43214429750bf7b92dab52dffd96db663b47600aa6fd22e6d7bdc1
MD5 b6124491924588afbf8a02f88768c4a2
SHA1 b4bd90e436e1b7855825c2041b3f6f0d911c2dbb
SHA512 cc154534556c83518384c796fd28956b97a546b73f6d4a10f4909275bdf356366d7e0c9b0cb792893f5c9b1e11b62a95829da9d5445dc659aab433d909cd8231
TLSH
T12BA002D45A858024D803C6B9703145DE12114C5F2645238244A41188CC90480C121031
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59afaf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\6bee03fa-d866-4be8-bfd1-e38ef66f9970\index-dir\the-real-index~RFe59afaf.TMP
Size 48B
SHA256 b98e52abe784fad150e47ca9b29cafc0e627fcd314146f59ca1fe499ccfe04dc
MD5 7febadd4add2a22c8ede01562a8a6d5d
SHA1 c73254ba7ba7857b340259bd1b9503116afca14c
SHA512 2bef8f3b3a1bbf157307918d1aa696bacca28e58c62db51c11c6679f07f519cc92672cc6e6c82084a37c0a7a8e7bb14d58311eaef3aafc9ca4dd5fd8f4886c2e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\8418cfa9-88bd-4c67-b44d-2b763a0123fc\index-dir\the-real-index
Size 888B
SHA256 fc017639be880d2b78948e8a8732890d58849a26dfacbeb3249ae050e70ef2f6
MD5 a70fea6732a7956ddf6e2b7abe967c8c
SHA1 62db76b74d1ddd9fcf6f5a71db0b98eaed738949
SHA512 8d687e16a41151b5843e8b815280522ad516060fe0b151f76ec4aaf2d6f40b4f368482fb8d26163ef0de4c9a43ae10bb115315569eb0dc2c1432571231a9a516
TLSH
T1D71141198C015104C1F9E8F1D2BD2E95DA2DA2CC7493340B80EC101054E7EA4D64D7C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59afaf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\8418cfa9-88bd-4c67-b44d-2b763a0123fc\index-dir\the-real-index~RFe59afaf.TMP
Size 48B
SHA256 bd73a8cf8a4dad3cab037153a486284f5f1862bd62fbf0efa00566676f93f5bd
MD5 f0ed753c893613dd218a16ebb0f410f8
SHA1 8a332f6d95385bbfe60b74d091a0e37204a4d552
SHA512 06bd36dd0aa4485d1270a985ba376a59a5f23aafc9815c93a57d60ddb3d6fba83bb760b0e8b80ef15b72d1f161af0e312a058c653f86b356b57975ae11187136
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 eb50618ab1e3eec6d626891a5da9a770d335319d3eea4597d280f1b05a68204d
MD5 6f97eb3e23aa5d79cac7de9fc7b0b3dd
SHA1 de596f2826de03b73d2adc75b92db7065439cdd0
SHA512 11fae61cc7bd2afb8081a08d0faf473f7902f88f9e2d272554815700dc62ffae88e3d53c1b0550f65185865eb108e31e4c0ce2bbf7d36fe1c854e2663769ea4e
TLSH
T161E02256223282229BA244ED4AA5F25DE83F39135A51CF690084708608BBE5A98B2F17
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 382B
SHA256 38fbb43f9132bd93677c2c5d4fa1dbb433a68e9efc192512443908158eeb74a8
MD5 cc14020931b5f7d554e3328ac9ee5dd0
SHA1 35b92a3c4aff6b2284b3d0da294800a84588b3c3
SHA512 b0115e6fd3aa4c4071ad79a815f283fe9957d5f7381b119e3632cae919f78f986cc9d4fd6e520a349582ddb171011bc30337a7fb14617f23eb3439727f26498c
TLSH
T12AE06156367283219B6145DD4DD5F35DD83F31539950CF650084604608FFE5994B3F1B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59aa9e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe59aa9e.TMP
Size 195B
SHA256 4c8c72604c1c6d8048ae5ff29e6e48a5d286ef619245f8b5c68595ab4aec0532
MD5 691dce728156e5f1c59cacf40ce2901f
SHA1 844b96ba8773ecba9956b371695bb847b8ca8ea5
SHA512 e3d7ec27dafd41c99ba6c358eb4a451bc12cab924d02d4fb985b2661e9c00f23e5c777eaab5b70aa9882d57d139719e0cd73dd3c66ec83d7f929f0371a621640
TLSH
T11BD02292903245128F5056A28E76F289DC2B2D5319C2CDA94084B1810CBB3868082B1A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 1933a4994f0d58e80ad20c9661ee88d57146f0833c2e7b7338a7c1710b62b562
MD5 98b5b2c2c52ec6653ba24893f5ad24af
SHA1 29fed0364c3beeaf147d60711d3f3d70725b025e
SHA512 9f72410f9f3a654b60e1d3cdeaf8c1b72380b1ba4a8ad3d202c8226dcd395b8f168c40280348961ab328504e07a8d9e91875934110e699ed85711323ca54b781
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59af9f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59af9f.TMP
Size 48B
SHA256 bac1274382f53504562832530ba9a8c8cc4aacd1a7c41cab4972dee6295bfa05
MD5 9290fa5ba17c7c5500c678ee9f5683a4
SHA1 e46dca8f4dffe8a2b76427208180493bf6bf2cfa
SHA512 be6051018629e0a1f3c975f18cd8c486cb8cf98b956c8f249a9aef3a28f38fba1590eb70f98670fd0c6307486ded320327aef09b61d7798f207ec62d6dfe8ee5
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dca48f2dd16a936a8be6d63624684f8ea25fe5d3d3ea9a62c34704571a73042f
MD5 76bae8cb846e4f1d45785ac985885ebb
SHA1 73ada6640955106ed1e2e3275df3a724a4a1d579
SHA512 3386183bab81af8b0fc838152dd9ddbec48dd3a6dcc3b2243046fd3a8cbcb6bd9a4bca25f8cf1c83f2f77cbe7d263b8b751d692d94ccf6fd13ceb32d4fdc3ada
SSDEEP 192:9ONH6DbBQmiUyQPmBa+jYOmeW+E/0e4SGNzf3qhU6:9ONH6nNmBa+sOk+cDKf6U6
TLSH
T111120A32697C9C775ED2A955F88B36239EE45127DA4A7B90D6DC2F0C00DFA5C130F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 944d5f426034652f54ca9e2c1f4cae9d7d3a57e2ea8d928ddfe50f0e34add31f
MD5 2a8b2f2ad99cf4aae739974af08ce75f
SHA1 5c18b8e84289555139a847b5b39ab0e6065c2e1b
SHA512 01885d4ca18c38f53f16207c54283902b336789be12a92b72a4489388f67cad50a4f2504cbee79efc6e77bac15fc8b5b99cf5be8b0962f44c34274413855796c
SSDEEP 384:zMsN2VVIebNpduEa+sOk+cDghLAStkk7sm5E13x:QpI2pbaZOkVsGSCm5E13x
TLSH
T17D721970D8A45CE388A1E9C6A446F6176EA81037C58D2E5CDAF8BE3C308F5FC1357826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 775d4fba4bdef54fee4db5685a3dd6bf3c733ddc7724f7fc7b11c81c08792d89
MD5 6d0ecb2184bc3b74533b552e0d1603b1
SHA1 896f1965cabfaed1a9c1dfcb8953bd3e31777ac6
SHA512 73ec0bdddc74b0340158c6e72c4b4f32da739a332b5ddd5f72a5687865f83b67fecece190fa5efe2a63dd124535c5f84de365affae2b0d1ad9575a877d072a03
SSDEEP 192:vON16Db6QmiUyUPHBa+jYOmeW+EKRgfqwU6:vON16uBHBa+sOk+MfvU6
TLSH
T15302F83569785CB79EE26E49F88B3B279F94203BD9562B94DAD81F0C00D765C230B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

0b67f44f-c940-47a3-b0ee-87d9bf1a758f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b67f44f-c940-47a3-b0ee-87d9bf1a758f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f0d196cb72190a9e899cb720f5503e7ff21c8fb7d645ad221f1230f66ab6a84
MD5 5cad02127f4ac272e343fcb4de03451f
SHA1 d0f513d5056e59a6310c06d2334f5d178509adad
SHA512 39f0f8a76901f498766365563b11a66708a6bba577a89939cfa03935be6cf1a1dd400c36e2c0b0459dcb4b0170f6dd8e85b96467af573acc13fe118b35674419
TLSH
T1C441E758BAE91158B3B36E469BF6B86E447FB9772E06C49E10110D4F0A73B40C972737
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp81C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp81C9.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

mozilla-temp-18467

Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-18467
Size 1.4MB
SHA256 79784060d8673750e7c30837756fd8e564983163cc3249198013f8fb0acdd13d
MD5 e25a0ad531e2f16eb900da0ca03f1418
SHA1 04c903288d5620b2f8a020b5ceb3a6611eac3a93
SHA512 75695cec8bf41547cc784bf471bbc458cae04c5be3d9472f7aaf28dc4dcfaafcafd932622dcb49fb824bdf593a13105df2161b933ca8036f5aaabb79573a25f4
SSDEEP 24576:cLdns1GG+2DR7BWYpCYo44AsW4z3ZBWapK:8s137V3DsWAjh
TLSH
T124656C8027FC1539F7B70B79BD7A18214B36BC39A952E6AE0549152C08F2B56CDE2337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 f6eb2914d8ea216c5df13156ab9272a32e61f9350adddc6a27040efa340be0d7
MD5 320f1b7a7a7ea82a50b729179d49c162
SHA1 2f0c5326c6e623969329d30efb8ef38dfccb8949
SHA512 8eb63993ddc5fb89024172cbf2ebbe388c56099042a3490ccbf6ff8ffb85ad7fe03c8aa60631843846f3e31736581afd273b0922ea1642fa0bb959a995e4bd91
TLSH
T1CD61D958F229463FE445813ACC961F411F343446A8AE7F2A35AC614D1E5B2CD778E47E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cc595a71798d9fc02ff0b67478d95049f3341e245649ca1cb27d20725c2c07a8
MD5 a9e629af3b119e45b9af36a6e083544c
SHA1 79f80a51b2a9ec04198e9cf70a61a30973189138
SHA512 3b6c4164ba4fe9230a1146542021a813b591794fcf52e5306dc7cb7a8608fb8c27e9f3fda038366042f2175ab1de32ba5c77bc06303e04fc556c3c008a1e34f2
SSDEEP 192:YOv5zboaZDLyjl8l71d66JozGzgCl6mc0dz:jboaZDLyjy5d66JozGzgC1jd
TLSH
T162E10F64EA28463FC408427BCCA61F450F39389A9C4E3F1536DD61582D572DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 50KB
SHA256 18e880027e0708d5bbcb45a9b154764afba9e8a016fdecb2fc9187f1a08a29f7
MD5 2aec9287585dcc437ce5db8a602a1f5f
SHA1 2c4889cd271364f9d8cef4b7272c8bae92a61f1d
SHA512 bc7ee95d8d0ddb391057ca13df656798c247b3f738b298bc1940f88c0eb2c0f0780a3529256de22a41456d653b06f77953ee3e5d74b50b869b053c4822a13627
SSDEEP 768:VIyEOKUtFJFu1WA7wD+GcmhuKDNKAfh1bKOb7bvbEb3FS:BKUtzFsWgwDDNmU
TLSH
T13D332144EB2A553FD42802BA9CD61B002F79F889591A2FA73B1C55386C873DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2fd2631c8faf9fc27ac5f65e9ea98833d36e8376af197ef635bb9c8c993859d1
MD5 505bde3ae6c0945f82c85297c95f28da
SHA1 a8311b0a3cd452ad76843f7f7a21ed6013ec252a
SHA512 9ab35810f2d3c953fab06737daff6ea3773591d307aae9f9daee4539e2b759e65cf8e2579668efa0a4f4d20f801c81cc3ccef7a13aef381b47ab82e03ee23ed8
TLSH
T1FE213A9C39F94E3B98C7E3AC7852178E53514E4B05471D474E02EE8DCE81A99336A83D
MD5 SHA1 SHA512 TLSH

Submit Download

5bba3205-2d67-4f15-810c-200ac90e17e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\5bba3205-2d67-4f15-810c-200ac90e17e2
Size 235B
SHA256 18bf3660de7ded114aed1d7c8572b1ad0c47858a5676f710e389288ed1482f34
MD5 90867e7016206e077774ce98713f09e6
SHA1 3e415ee0c11197673d1e8ac63affcc7310554b5b
SHA512 4925ab80a04eee3357b85c1d149cdf17ec18f39ef1421672c91287d9c8f88252b1d985306d16b9c8a0f6eb6a14d36a95896f4bdc629b9b0c51589e1973cc87ae
TLSH
T120D09780A8E8275C0C100F02F8A068C231898C3398786C61EAA14638A9BEDC84192C26
MD5 SHA1 SHA512 TLSH

Submit Download

6d4a84c1-01b9-456c-8607-c678c2383188

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\6d4a84c1-01b9-456c-8607-c678c2383188
Size 886B
SHA256 c304052862176404d4c8f8ffd391fcbd2e5c3ffa01876adc44e49f9a4fd41771
MD5 78d535fe079d78abf907ddf8ee2e4896
SHA1 eee92de13e1d64702f02820700df4a462769b27f
SHA512 22ec3a0f762bae247cb3222b74ac3103c623e6d2e9713820c41efaca5bdcc53135cf676a8653ca25048451adf47fe7cdaee5784238e7aa6dd7cac11f18b2957d
TLSH
T195112751D97475B1CC78D25FD4A57B434BF83423C0C519047E954B140DFA61EA3A761F
MD5 SHA1 SHA512 TLSH

Submit Download

9910ba9e-27f2-4230-a91b-6d1604e3f34e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\9910ba9e-27f2-4230-a91b-6d1604e3f34e
Size 21KB
SHA256 b23577c124237f9c2c9db316946f82ecaf331c55a597ee0609c670ff7f237176
MD5 2a4aed68dcc9dbb993f711a728b4ebc6
SHA1 77f55e3e8eaf9bee67fd30b4a878e5973752344d
SHA512 25df8ce827dc97b0f7a7eaa4a87af1cc6e1c8608c96eff5ff4c370c998492150c37810e4dbcee274e2a35e39ef0c7f072b66aa847ce2fae413bfcd158194c173
SSDEEP 384:3F6PghyfmFB0PVKv1Xoxm+WimRwEK3rq2oInh9CieUelPm15CdgD5QjbvWdSRsk+:3WghyfmFB0PVKv1XoI+WimRwE4rq2oIV
TLSH
T1DBA2E8FDCD1240473E65E51EF2E9ADAB2057193209CDC3CD69FE483A26C69BB1227318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99c81183-26dc-48cb-8ded-e269ac684495

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\99c81183-26dc-48cb-8ded-e269ac684495
Size 2KB
SHA256 d7407d7c8b09832752f0c798ac50fb00a09a4ea84fab1f12c49d2c3cedbf923d
MD5 2a4cb9094125219daf9d073f2cb0b576
SHA1 f3fa03e454891a0a8785ff121e26815bf8e0b0b3
SHA512 59618b449a0d44084aab921321363d5be4b8b69695fc88cdf9789517b9f625a501db88fc7987df516ff8d76bd717bc1f3ece67ba6687afa64a6fb98fc8196f00
TLSH
T16741435874784CB69D9AE19DDC81338E53644A1300C23C836D63EF088DDA79E336B57B
MD5 SHA1 SHA512 TLSH

Submit Download

bf6d1e61-56c5-48ec-826d-5d7668ac0dd3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\bf6d1e61-56c5-48ec-826d-5d7668ac0dd3
Size 883B
SHA256 22f27be46023213cdba9eba6c00007e76a488092a6d7a191276031a36315d022
MD5 58abe3a771d0ae180f02e42e864d629a
SHA1 b231dfe90fab497616ab913ff5fe04c3a9f6dd6c
SHA512 dd31fee2704fec779200c7c54ad78579ba75347c11fcf425bac8ad00447223343406bed14fa95ad7adbdfacdc63ba566a6a33a5fce24e20fcf287a70e6e3826f
TLSH
T1D3112752A5347572CC7CD25BC8557B029BF4392380C555047EE11A140DBF61EE7AB21F
MD5 SHA1 SHA512 TLSH

Submit Download

c25076bc-e857-44ca-9e99-d22548da9667

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\c25076bc-e857-44ca-9e99-d22548da9667
Size 235B
SHA256 9525f80942f2ab8930cb4e225dbab1b70246ccf485e1dcee836be3128d004920
MD5 7731ef8408dcbc9c105144571e0c96c1
SHA1 a9c4f06fd975151b8e77f1c9da7c9deca9df2697
SHA512 2639ac97438d012f4181bec309088b0c7826db7b7177c6314fee4547a4fe141bb9b5e9b9be2547671cb2d748bb4da8f220509eefb863bbd15e29c565fea2ab34
TLSH
T19ED097C124A8AB2D08080F06B0B02CC630544C3328E4AC60E6900534A9FDACC4396C16
MD5 SHA1 SHA512 TLSH

Submit Download

c5fca3ce-649f-4136-bc1f-d2e0be0d772e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\c5fca3ce-649f-4136-bc1f-d2e0be0d772e
Size 16KB
SHA256 4f9c9f286c7555653fc95222979d423566be6c78f7b884ce2d9bcd21c5cd7624
MD5 5be8f8905890f9a6e51ad67a0178ee30
SHA1 8ecb6ebd8b43f1765aa0efc36153bd15148903bb
SHA512 80af0b698e5d1d09c2c0da9e52ea95185323932bd5e25a6daf388294d334eaa06927bf420916a61f0d9e029ca38eb34eb24c49afe53083544b08f3185183c745
SSDEEP 192:CV4zeDwPLyOMWHbtSTl3r8g+hAObfGrb+m7YKJx8OA8qfInmRXYmn8iNRzxLuSeJ:Mwe0GXW7wzhp+XYu8iNRlCSeRgJywAZJ
TLSH
T1A572E916286055BA8251E36994FCBFC3E5F528CF4C019FCADBF47D0869DE05E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\extensions.json
Size 16KB
SHA256 a734b31beecf51a99d5d071bcf7d99f6317b677f77f51926030320c4dcd304a8
MD5 8d8a34189bc6712cb4e0a72920a06f7f
SHA1 40c2c09e76e3c97f260c8d2882b2318b4c59b278
SHA512 544d7c451baac64154ca1053fb82f110241450208ba3e477fd85943b035a803daffb9ba375c9bba9fdb2fba76a57201d0461f5eccb7a65ea447351524607c215
SSDEEP 384:B4kI4vuUmldvB8dhW694z396onL4HyL4PLL4HcL4HpL4Hv0t4hf:BvI42RfiXb4p6Y4g4P4W4h4w4h
TLSH
T10F72521545049EB8298E978AAA367E02C37D473B70845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 7KB
SHA256 c5c51ece7e9a89cfa9165aabfd17afaa8820d7453739de414d8ce3bf0de03f10
MD5 14adbff0e9e1adb1acecb1eaa7b14ff0
SHA1 75404396a02c631762d13dcaf87eaf6e71811438
SHA512 2fa0d281f424db25b0cb357b97f384e187c8f4200cdad4994b3c9cc9aab5fd1e1c0914e9ba3b37c6113f68f3bc1ab17df653d9749c80e1a2eeaefbaabec47593
SSDEEP 96:xH07wUTUzqGqvf8jWObzSkjSSladv9jRUn/5H1Bw88n8L4cnDOaGS:acORvf8jWujSSai1Bw88M
TLSH
T138E12E7895088B7F64B677ACAC6888316AB2013B77BF28C750B654C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 8KB
SHA256 7fd833809246369818e4fc9c63dcd0c020db8555345a0e5f44fca2b614d09137
MD5 e5ff30bd60efc965da0891ecbba68447
SHA1 5a8e4a10e1f85bb4e0f7aa97baa1b47234f69c0e
SHA512 404f84b1ba30c8c2ea849f9e47fc7d259aee4eb043e6c8cb45e4384920da14692f5b7c78dcfffad6a1cbca0f2c5f0989cd2d605a03b1a8e367ebfed9f9a0d70e
SSDEEP 96:xH07wRTUGPqGqvfdjWObzSkjSSladv9jRUn/5WRGjKhoOBw88n8L4cnDfaGS:acfCRvfdjWujSSanRG5OBw88j
TLSH
T190020C386544DB7F75B6376CAC688D305AB2023BB6BF5CCB11A654C40508F3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 7KB
SHA256 395e2fb7f152421d4422a980c1e091b514a64bd414bfb7e6225a6e5589339cdf
MD5 23323770e42b02bc30153d825b0e417e
SHA1 377df65ccce3f92b05c122245b0b63e59edd4ed3
SHA512 0470bb7e8cedb6a333b0016f7c6ec484813c13ac98681b152de0588595828a95792f47772a51c6a78a66ced1dee1cb42d691a392ad01513519cb17303e631c21
SSDEEP 96:xH07wRTUzqGqvfdjWObzSkjSSladv9jRUn/5WRGjiBw88n8L4cnDOaGS:acnRvfdjWujSSanRGuBw88M
TLSH
T157F10E78A544CF7F79B677ACAC2889305AB2023BB6BF68C710B554C40518F3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 371a2719fd32d40cf56de2c40e71f0702fc696fec230b47c691dd6364cb94626
MD5 950fa4403d1a2c761c4787aed615d6e6
SHA1 d1774c7e8e49f001292dca4f1caec266de9f15a3
SHA512 ebeba65071b753d9187015157da77eda0e941bf1186db992f067fc254ad968c650c065297a55c089e7e4defe7e1544a73bd3b38d985dc0ff17dd4179cb477e31
SSDEEP 96:xH07wUTUzqGqvf8nm1zSXNSSladv9jSn/5H1Bw88n8L4cnDOT:acORvf8nmASSz1Bw88L
TLSH
T128E11E7894188B7F64B677ACAC6888716AB2013BB7BF28D750B654C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 a11849181548a43f95f95287a6a5ef1d3980194627ef143511a5ce55b8d55519
MD5 bba338e7bbf926bf40f63330b7d7e23b
SHA1 640f5caace8039bd8492c984f53194cd5fee01f9
SHA512 1686b8741d46bd8de3e98b0b64448d51f99b61c5de3dceda9cda5ed9dcf622aefa07ea32f65786480c7b3c029da61aea6829b246d4cbfec4f38d006919ad457c
SSDEEP 192:VqM0k2hj8KeZixVdFna9ajBwnRmRuLTt1DC7X9WB48c2Xu21a/I5u:V10jhYKeZ3AuJfnOV2eX/I8
TLSH
T15EF19F0761833EBA92938642F4CAA6C9FC4BB2A5873900D8DD02672DC54D3EE467B1CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 30c844210b86dd54dc88b8f6808223fb8292319bfc333d8836ce8707ffa2d4e6
MD5 039ef95050cc7405f30d045ef31fe3c2
SHA1 2ba843cb2f7ebb17b1a4cb690442dc70ee21aee0
SHA512 6c73a7b7113af2df88b730d9529e4a566259e1cab5fcd054f7c5ba42ae1e670450f3ddb3216d45c932d02cf1a68eba41fd81cc6f3fd4e2a795b022d8b5b6b241
SSDEEP 96:o/MZFdy/o9lbaSEfewV5RoiyRy1NOVjoPLTt1D3eXvid+iNA9WBCUKO0bkoZk8WH:CMbkg9pgewnRmRuLTt1Da7X9WB4O0bvu
TLSH
T14DB17D1273433C75B365CA45A8852FE9F8A7F1024FFE04C4DB251E2B849C74E0A195DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 a16dc16a89a7e05a445d820c10cc6d40add39aa22eab35238628561e8b680129
MD5 b7ff55e72cc4e561d06ded02b9ffb65f
SHA1 77d24d10318a469d0dd8c918e437575042a1e9db
SHA512 5d9534c96a5df058aa342d539b3c8067ff377b64adb1410047f60bd34508c6fca6ec2c5bdc2d63066a250b44d21501cd7c443229bb2c9b837398e6ea38f631b2
TLSH
T186714D47E5D75EA6D6C6A112F4C9C2D5FC47885A835018D8DD01B610CA4C2FEA2FB789
MD5 SHA1 SHA512 TLSH

Submit Download

{55d0a02b-9bd3-4e58-99c8-3840f5700278}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\default\https+++apps.microsoft.com\cache\morgue\120\{55d0a02b-9bd3-4e58-99c8-3840f5700278}.final
Size 16KB
SHA256 9e06854a0f498727e300937c4b74eacb2f805fc9dee3f6b1518d24b62461cb24
MD5 5ccbec4c4a12dedc93b340aab0ada8db
SHA1 8d5c4e77e28fad1435360ee0ac80ec99e0930fd3
SHA512 d01cd7801c1c0b3c2992edba5602349e1195c54bcbb450605e86217bb4aadabe1442aca004858e86e7029ad62b963e403f9a203df2cf8eb16a39506806f7f213
SSDEEP 384:4RpS1oJeUJ/DUwTL6I6oAk305g9QEEyHmP:qpaoJxxDqI9Akk5g9QPqE
TLSH
T1E772D0BFD00C54B3463B225FC09476C6B72C46B5AD0CE4EEBA8E7BB926850CB593D509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26897234seennitlrfyf-o.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\default\https+++www.roblox.com\idb\26897234seennitlrfyf-o.sqlite
Size 48KB
SHA256 f866c23580726d9c516c8279e6f0f916bd77897410dd389c22f82c37c0eaf727
MD5 3330b88e46fedd946f8a936e6fcd9a2b
SHA1 8cf573f5eafc7cf43d2df90f7fd6788a6324ddea
SHA512 609a729898f1a8b8e01e0137cd1d50db17e050f03703f1740b98d4b9177982d811e70c1987caa5d359916b73944fbb20c545d7aa6c5b46c4d43a5781e7326228
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE4:Oa16S6CKnqlizbxV+2xVeU7X2B0
TLSH
T11C236DCE3F07E511C53AF0B178A08D51BC5E321E07222AD569D0DAE4C8F215AEE1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\default\https+++www.roblox.com\ls\usage
Size 12B
SHA256 117290faa19c128b5b79a2860271c81c6a06c204f2525d00d33d634708096b45
MD5 a9515e0422264f66c9353a639c4bf7bc
SHA1 7758ae6974949edbfc0249a70c4bd4580b05d144
SHA512 ecbd55ca72e8cefe078c10f74ddb8ad00749fcbb601fc428bb4f9d1088849e086d9fbb8e51687198bc5e2a36527ec2dbecf000ee31fbbd7ac58dec2bf6d87bbd
MD5 SHA1 SHA512

Submit Download

memory/712-1544-0x0000023EF0040000-0x0000023EF0050000-memory.dmp

Download

memory/712-1447-0x0000023EF0040000-0x0000023EF0050000-memory.dmp

Download

memory/712-1552-0x0000023EF0040000-0x0000023EF0050000-memory.dmp

Download

memory/712-1818-0x0000023EF1980000-0x0000023EF1B9C000-memory.dmp

Download

memory/712-1538-0x0000023EF1200000-0x0000023EF1226000-memory.dmp

Download

memory/712-1532-0x0000023EF11C0000-0x0000023EF11FC000-memory.dmp

Download

memory/712-1531-0x0000023EF0280000-0x0000023EF0292000-memory.dmp

Download

memory/712-1509-0x0000023EF0200000-0x0000023EF020A000-memory.dmp

Download

memory/712-1499-0x0000023EF18C0000-0x0000023EF197A000-memory.dmp

Download

memory/712-1551-0x0000023EF2470000-0x0000023EF2998000-memory.dmp

Download

memory/712-1426-0x0000023EEE300000-0x0000023EEE464000-memory.dmp

Download

memory/712-1555-0x0000023EF22F0000-0x0000023EF22F8000-memory.dmp

Download

memory/712-1559-0x0000023EF20C0000-0x0000023EF20C8000-memory.dmp

Download

memory/712-1561-0x0000023EF2160000-0x0000023EF216E000-memory.dmp

Download

memory/712-1560-0x0000023EF2300000-0x0000023EF2338000-memory.dmp

Download

memory/712-1568-0x0000023EF5910000-0x0000023EF5A96000-memory.dmp

Download

memory/712-1614-0x0000023EF0040000-0x0000023EF0050000-memory.dmp

Download

memory/712-1727-0x0000023EF0040000-0x0000023EF0050000-memory.dmp

Download

memory/712-1814-0x0000023EF0040000-0x0000023EF0050000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads