c3b99b8812bb6168794582bc1afcac9bd8dcd1cc61b3c23c6a56b6339c62d45b

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fix/IDMan.exe
Size 5.8MB
Sample260809-rafkqsygla
SHA256 c3b99b8812bb6168794582bc1afcac9bd8dcd1cc61b3c23c6a56b6339c62d45b
MD5 4965f7f297fce41ac2556067b722f03e
SHA1 450d10b825f6973bd1ad16a9fa4de31e5d5d7ca8
SHA512 6fe1661836e23aeef1c1e58e5e8e89510112e66106fc360fcb7ba2c835238d4530e372a628311c5e4653f987c681a3f89f5a120ceb88f083117a018a8251d308
SSDEEP 98304:6+/mEfM78Z4CfoCCPaP4Vhc18frP3wbzWFimaI7dloOY:a01Z47V7gbzWFimaI7dlRY
TLSH
T19E569E51BF8C817AC95A1531072DAF2A402ABC98773465D3B2743E7EEC753C26C3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fix\\IDMan.exe /onboot"	IDMan.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IDMan.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_850790057\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_850790057\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4532_1434497695\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1371329259\_locales\af\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6456	5720	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDMan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4676	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fix"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fix"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fix\\IEExt.htm"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fix"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	IDMan.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307577020084106"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "220"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fix\\IDMan.exe"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	IDMan.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{FA51EC35-4A1F-4B52-9964-9022CB6BF9A6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	IDMan.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	5720	IDMan.exe
Token: SeDebugPrivilege	3016	firefox.exe
Token: SeDebugPrivilege	3016	firefox.exe
Token: SeDebugPrivilege	3016	firefox.exe
Token: SeDebugPrivilege	3016	firefox.exe
Token: SeDebugPrivilege	3016	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
5720	IDMan.exe
4532	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5720	IDMan.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5720	IDMan.exe
5720	IDMan.exe
5720	IDMan.exe
3016	firefox.exe
5720	IDMan.exe
5720	IDMan.exe
5720	IDMan.exe
5720	IDMan.exe
5720	IDMan.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 1860	5720	IDMan.exe	89
PID 5720 wrote to memory of 5840	5720	IDMan.exe	90
PID 5840 wrote to memory of 3016	5840	firefox.exe	91
PID 5840 wrote to memory of 3016	5840	firefox.exe	91
PID 3016 wrote to memory of 5116	3016	firefox.exe	92
PID 3016 wrote to memory of 5116	3016	firefox.exe	92
PID 3016 wrote to memory of 5116	3016	firefox.exe	92
PID 3016 wrote to memory of 2328	3016	firefox.exe	93
PID 3016 wrote to memory of 2328	3016	firefox.exe	93
PID 3016 wrote to memory of 2328	3016	firefox.exe	93
PID 3016 wrote to memory of 2328	3016	firefox.exe	93
PID 3016 wrote to memory of 3488	3016	firefox.exe	94
PID 3016 wrote to memory of 3488	3016	firefox.exe	94
PID 3016 wrote to memory of 3488	3016	firefox.exe	94
PID 3016 wrote to memory of 3488	3016	firefox.exe	94
PID 3016 wrote to memory of 2008	3016	firefox.exe	95
PID 3016 wrote to memory of 2008	3016	firefox.exe	95
PID 3016 wrote to memory of 2008	3016	firefox.exe	95
PID 3016 wrote to memory of 3248	3016	firefox.exe	96
PID 3016 wrote to memory of 3248	3016	firefox.exe	96
PID 3016 wrote to memory of 3248	3016	firefox.exe	96
PID 3016 wrote to memory of 3248	3016	firefox.exe	96
PID 3016 wrote to memory of 4724	3016	firefox.exe	97
PID 3016 wrote to memory of 4724	3016	firefox.exe	97
PID 3016 wrote to memory of 4724	3016	firefox.exe	97
PID 3016 wrote to memory of 4724	3016	firefox.exe	97
PID 3016 wrote to memory of 2572	3016	firefox.exe	99
PID 3016 wrote to memory of 2572	3016	firefox.exe	99
PID 3016 wrote to memory of 2572	3016	firefox.exe	99
PID 3016 wrote to memory of 2572	3016	firefox.exe	99
PID 3016 wrote to memory of 1052	3016	firefox.exe	100
PID 3016 wrote to memory of 1052	3016	firefox.exe	100
PID 3016 wrote to memory of 1052	3016	firefox.exe	100
PID 3016 wrote to memory of 1052	3016	firefox.exe	100
PID 3016 wrote to memory of 2096	3016	firefox.exe	101
PID 3016 wrote to memory of 2096	3016	firefox.exe	101
PID 3016 wrote to memory of 2096	3016	firefox.exe	101
PID 3016 wrote to memory of 2096	3016	firefox.exe	101
PID 5720 wrote to memory of 5168	5720	IDMan.exe	104
PID 5720 wrote to memory of 5856	5720	IDMan.exe	105
PID 5720 wrote to memory of 4916	5720	IDMan.exe	106
PID 5720 wrote to memory of 5492	5720	IDMan.exe	107
PID 3016 wrote to memory of 2840	3016	firefox.exe	108
PID 3016 wrote to memory of 2840	3016	firefox.exe	108
PID 3016 wrote to memory of 2840	3016	firefox.exe	108
PID 3016 wrote to memory of 2840	3016	firefox.exe	108
PID 5720 wrote to memory of 4532	5720	IDMan.exe	109
PID 4532 wrote to memory of 4128	4532	msedge.exe	110
PID 4532 wrote to memory of 1320	4532	msedge.exe	111
PID 4532 wrote to memory of 4676	4532	msedge.exe	113
PID 4532 wrote to memory of 1320	4532	msedge.exe	111
PID 4532 wrote to memory of 1320	4532	msedge.exe	111
PID 4532 wrote to memory of 4684	4532	msedge.exe	114
PID 4532 wrote to memory of 4684	4532	msedge.exe	114
PID 4532 wrote to memory of 1384	4532	msedge.exe	115
PID 4532 wrote to memory of 1384	4532	msedge.exe	115
PID 4532 wrote to memory of 1384	4532	msedge.exe	115
PID 4532 wrote to memory of 264	4532	msedge.exe	116
PID 4532 wrote to memory of 264	4532	msedge.exe	116
PID 4532 wrote to memory of 264	4532	msedge.exe	116
PID 4532 wrote to memory of 3216	4532	msedge.exe	117
PID 4532 wrote to memory of 3216	4532	msedge.exe	117
PID 4532 wrote to memory of 3216	4532	msedge.exe	117
PID 4532 wrote to memory of 1680	4532	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Fix\IDMan.exe
"C:\Users\Admin\AppData\Local\Temp\Fix\IDMan.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\Fix\IDMShellExt64.dll"
  2⤵
  PID:1860
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {ed0443ba-6800-4c3a-baf4-8ae76fcaaa1d} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {0be86531-0cbc-4785-be30-ab6324f2c398} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2328
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 25164 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {a7005bb6-5e40-4a15-a082-37877096b97e} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27274 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {e64615ae-9ec8-4e99-b079-7824b302df57} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2992 -prefsLen 34773 -prefMapHandle 2840 -prefMapSize 270279 -jsInitHandle 4392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4400 -initialChannelId {d6348b1a-ba87-4dd0-a0b6-43237cfcf6bf} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4656 -prefsLen 35010 -prefMapHandle 3236 -prefMapSize 270279 -ipcHandle 1616 -initialChannelId {b3598461-7a1a-48f7-8d11-31269d074abb} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2692 -prefsLen 32952 -prefMapHandle 2984 -prefMapSize 270279 -jsInitHandle 3004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4832 -initialChannelId {a7fe8f47-819e-44f8-8f58-db1062eedb2a} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {7480d23f-0b49-42ea-ac3c-d96260234c37} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5740 -prefsLen 32952 -prefMapHandle 5744 -prefMapSize 270279 -jsInitHandle 5748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5756 -initialChannelId {e41f9a75-6a82-4e7c-b614-698a1e4d7464} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 32952 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {eeee7624-fa64-4792-93fd-dfa1e6ed6ca6} -parentPid 3016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2840
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5168
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5856
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b64
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd5caac188,0x7ffd5caac194,0x7ffd5caac1a0
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,12129656969610113726,8395217976347120614,262144 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,2756342718868460047,15745686948813976903,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,7048424088667163873,11944665950065157610,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:13
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,10595412711356940779,4251574354748331685,2097152 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,14188762343822210903,5891722658845525925,2097152 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,934725638182861439,4117426097129878100,2097152 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,6392384657815975184,3728106432964938480,2097152 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:9
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,14843160599486515031,5650883171532380082,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,954369678031147983,17314115467148658286,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,16423010211149150161,10361957552023179947,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,16423010211149150161,10361957552023179947,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,8392434550155504905,2255829819884167154,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,647813093145547301,5782586831933542046,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
    3⤵
    PID:6504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,15652521056363217142,12007393936245982172,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
    3⤵
    PID:6592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,16843363348781416109,14424929770349799941,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,7275210988911954957,5186297174258497495,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,8255308723646152671,1564765964981575012,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,397732900281169710,4613636600740061449,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12688387236554459924,12642909645412984969,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,7857251499824908353,17990502831986649938,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,16244711606052742259,12020278118052397093,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,14055036491998272456,9475905358781485858,524288 --field-trial-handle=2232,i,10037469131887629189,5183374051364600028,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:6588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 1824
  2⤵
  - Program crash
  PID:6456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5720 -ip 5720
1⤵
PID:6404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 25e985798256cf48eae5f7e44c20781ca52d6b560f79b1b169c6656ae6e1fad6
MD5 08529f36bdb3d59c98de64e5dca267f2
SHA1 cac642b4249244576930b54927f3602ae81772a4
SHA512 12c0f446dd2acb702e91f4dd318fe43c271c29b62965fa4455330792c613fcf4574aac2788a0a1ced2363b74e5603b5ef46921c995c08baf9cf13df52ab94524
TLSH
T1B6515373332D09D8EB2A847510D29AB632F5C35D87076E4282995CB77906F4052F2C5F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5adb7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5adb7d.TMP
Size 2KB
SHA256 3987eb853f6fd89ae78763b71cb90572b7e917cad48bf0714bbb12f063d7b651
MD5 42a0ae5349e95ff9f66e316b0da0aec9
SHA1 d22a00ddb0829a224bb726f066e4b34a61e18de2
SHA512 c5b5a7c474cf4fbc82f95113bbdbc17d7306d6ec3cee15a6ca70df62b9acc4f1de24d7a66877754edea63856266ffcdd26139d530b9f24ec4c199398279f8a74
TLSH
T12C514173336C09D8EB2A847520E2D6B632F5C35E8707AE8282995CB77906F4052F2C5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 35c27bc0326948502cf976be074403bd24f39a6f0917f583e38ab537600c85e6
MD5 920450e8e8569bebff4aa8d696f3d7fc
SHA1 03f140d1f846267c1c17af4a64134ae227aa0262
SHA512 6aff93bbace97f6a0a28076eb6318f1b89597499420104ae4ce73c20f8a918436c42d98a7f1e23b264542dac81426f60c3d000b666e8138c2a8119eeef240407
TLSH
T13A319EF783F4997D8A0186F4AB186E1FCE2D0915836C7D9AC5E09E1B93E3471E140A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2c378ffdd1dc9bc29491dff2144442582b4a8a81cbb0d4b33f24c087a0fe9bbf
MD5 c9ab10e6f1763f1ca3e88c2289ebefce
SHA1 69009f241a828e44e3446928dc081ba7e6daa561
SHA512 d5c3bfa845d8b16aedcd417f20320e8b3ec1142b987d25992401df45e22e4bbd450a49e1325aff1bac1d22610897d7fe967e808de1c53647188a7d55c06be0e3
SSDEEP 192:sxRorC+/fWsGqrXZWlzoA8ppj/g6+WNYZN/YD9P23SEGQXF9IgVWJ:sxRoe+/fWsGqrp1J/5k/3SoE
TLSH
T1E242B8166E68A93B8CCBD319BB25BF53D6FD5032A1D01E58E6FC961C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 08c7e101a87713ef0088cb75cd9b2a0e92eeb5c2de71ce4908f600acdf2e077a
MD5 b854abc13b9960da87836ffeecb97dae
SHA1 a9124814039690a223b9c6805f9fff1fc528a955
SHA512 8fa13a668fb861379515982e2bc818dbfd14e8bf246698ea391592bc4efc33a35f17ba0751a63ddc33504dd3d7bfbd55f4e07a5fc20b22be9b5152cbab727ffc
SSDEEP 192:sxRPrC+/fWs2bqvXZWlzoA8ppj/g6+WNYZN/YD9wU3SEGQXF9IgDUlVjxJ:sxRPe+/fWs2bqvp1J/5k/+Soi7
TLSH
T16842D8066E68AD3B9CCBD219BB15BF63D2FD503261D11E58A7FC9A1C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6ca0086ae6416461bef7b93adb04d582b411a5bc83f4d24f744cfc4651c14bf6
MD5 afd8bb016fc090a42bdef2eefd7b08e1
SHA1 264820df2b8dcdfb37b23b56709963fd1cceefb1
SHA512 d0f38091e4e470c07234509f638952a5752a9848023456287a065eb2897cebe07b6664ac590cbc14a9fa770db5364653fe9b06974f05a4365b31b78dc75ca171
SSDEEP 192:sxRPrC+/fWs2bqrXZWlzoA8ppj/g6+WNYZN/YD9P23SEGQXF9IgDuWJ:sxRPe+/fWs2bqrp1J/5k/3Soj
TLSH
T10142C8166E68A93B8CCBD319BB25BF53D6FD5032A1D01E58A6FC961C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3937f8bf5ca4d885c15ef0848b0be663a3a6928f4ebea69257eb5b7742682332
MD5 3e42c697ff4e48cd93731e841ff5a278
SHA1 49818b19458fbd0cfcfc3910c532f7e232dac5fe
SHA512 efc2491c0cbac5556425590887ae3d1bad72f4f4ea089c059f15d4c04e7e0c2fc62e31ea5ce0906eba8ac2c2a71e83caf7729c2c36a4d2cbae248a6cd771a7a5
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVya3c16Mropi9RM:azfW/dE7J0Wg/XfHfu1jaZa3y6XpiXM
TLSH
T1B3D2EA7B640CCE7F4F800A9DAD197E9F6DA802CB9698CD5047FE941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 65a8938e4b186613a0ae9186503458e9d5883361abd26b9250085e255b23c20e
MD5 f5c0a0c5cb49717e47787117b1580a30
SHA1 0fac6638e4d441634a93fb7296d8042fc4f77b5c
SHA512 97ffb3636afcd4a53a49e19c1f2d922b245cc1833c610abacac416b2d16eebe0b63d6b15d1e319a142e8afb50f0e08ec8f062907734261eb26013194decba720
SSDEEP 96:KREFw0Oy2UWS/fg8UK4Rg2Uc00/uUJHoZs4q26gWeDzgggK41gCgcwgziIAJw7Xu:CEFw0Oy2rS/I8oRg2700/uUJHoZs4q2t
TLSH
T159A11100767F1290787EB52C8278986FC2817867741DA82FB7E811661F67E136CFDAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b6ba7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b6ba7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 e7f77835190d84833a191cae10286b24f0201708ced076e1832a5752b0a4172a
MD5 3c5a0f2f259184bba3648938472496ab
SHA1 156638a93053e693812e9670b0d1c639bbce8157
SHA512 7534808192aaae4969c5a555efe6a9012a8dde318d2d3ae6b5bad945ce3a9ce058d74da161021e3cf6edd3b7506162da5a6d093b8cb868e6b9d5780ac1888a7e
SSDEEP 768:iFQG3Fwg5nssrEnjN3Gac1Fc2ewBKZOKd:5G3GsQnjMa32evZfd
TLSH
T1191329F598D78977D8EE9747673D6E4299BCC1A3B4844994B7C95D0CCC821BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 86c983ae94d54179e2ed1b904f6c8be4b65d4ba24fc8c3abaa50d5aea7bb07b4
MD5 9070b35b6c242611a9327b0eab17bb64
SHA1 78c8b0544314bdf4e2b208e3a05c5a66f024fb22
SHA512 0950ef1b953dd33319b55a81c339e98260c9d33da646089d997bd7ae16d2c84c45b18e67feef78e8241f085e672314a497ab12003dcf7452b40daa184ac0dff7
SSDEEP 768:jrv+4UNbdP3tYi0FrEnjN3Gac1FceVH1SCx:jbsb13YFQnjMa3EH1X
TLSH
T15313BF3169A8DDB38CEAE74571437A53BEB416A385840FE8DAC9AB0D06875DC130FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e49087f2e4de2326828dfe3ec8c35d3a7466281105095c5de735221030eb62dc
MD5 51546fbef0ffb47e788d4e8b1f08fa4b
SHA1 8e189cfff79365534a6769a475ba31544699481e
SHA512 cccf74e565310cba0ea34d9dbcef59006974cb45e34baf63518c8a52f7fab498a0a1d8952bd77cbaec5353d541dce17ce199fa02b768ccc76c07573aa0173018
SSDEEP 768:rrv+4UNbdS3imi0drEnjN3Gac1ZDeVH1SCz:rbsbg3ZdQnjMawEH1V
TLSH
T1B403CF3269A89AB38CEB938571477A037FF4125385940BE4CADD6B0D069B5DC230BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c1702db424ba3bd2ec1fe68a0eb83852d7267c19f0ba8eb9926d2cad388af3c9
MD5 c0997fa9a15a56d58faadcb6cd01e8b0
SHA1 40ff5678523bf50c62714155d4b33ed308ed0c5f
SHA512 55aa0b174b7dcb56b359dd58599646aa05bcbfc3f229054c7aaf853ce1b6773ef6c9aa8e85dfd48ad93bacd4d06d526e55210b5751643c2410e7ddb4be8e2a93
SSDEEP 768:srv+4UNbdS382i0drEnjN3Gac1oceVH1SCz:sbsbg3zdQnjMacEH1V
TLSH
T1AB03BF3169A8DD734CEBE78570837A437EB416A385840FA4DAD9AB0D06875DD230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 86dd8ae0ad68dbc245040814561c8069474e7e9b1a4d3b33357fcac4d1d5f2ac
MD5 e1ff54f2c42377d9bc4db6a55fc3d1fc
SHA1 5e89bb33154df31b771649d50cff04f1602d702d
SHA512 1e0d1b518e5c5f2e071a565bd531347d90979201ad839739cd0d09739ed536e33cd803141c00f19ac79d1f9e2dd2c38e11ac89132edfb12d652e2645c75e1be1
SSDEEP 384:nrRZcII38Ny+aNljJKTWZlf8hyEGB5R/fU2y2rEoajo4cdR8eHhVODjYPNDUMc2a:FI3aYi0FrEnjN3Gac1Fc2ewBKZOKd
TLSH
T1D2F2BF706969DDB38CEEE34575037B43AEE416A3D4D40EA8DADDAB0D119369C270BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4da9f60-7265-44ae-b2ed-2292a86f3a13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d4da9f60-7265-44ae-b2ed-2292a86f3a13.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 12eac96a70c9cedd06a60dbc6a1d04ae899a706e945de601e2c46f22e6bdaaac
MD5 e687294e9a961a9d35b3d3765e45baf0
SHA1 22e3f5e39ecbfadc6327a7f32767ecf5ab828213
SHA512 b7c3846f61ebec4481b2c537f90a95f738396c130d6af446a1c5f8fa3eb1706234c9dfdf30988780a6a85a5de9dc6fd5e32350fe6ddb4ff51f32a59246b0cb3d
SSDEEP 384:HwCe7iO024YGDL84KKDL849B7SOEAd9KVRaAcP+AWRMAmsD:QqZYGDL8lKDL8CB7S/AmVAf+hRMDsD
TLSH
T1AD729E399F413CAC1597C0E8C5B982DA4C18B6A7CFE6C06D21683D0DCB989A9A4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 51d6d5ae475ff58d8ab38b98df89aeb5f3e76305a8159b703951eab77b369fa6
MD5 9a180a9ab2fcaf00bfd9c4ff0115fa77
SHA1 5dcce2566e3e82ff20cf2863ccb520f00eb3dda6
SHA512 84558d84c7938e7e8c123aa6a58edd7f5c2fb8f4658dc009d10872b48c4c6af6fce1242d1fc7c189e089b6a922c3e04e4ac1749c8e55ad2d958e452e57a5e078
SSDEEP 384:HXkRyiO024Y/DL84KKDL849B7SOEAd9KVRaAcP+AWRMAz:3mZY/DL8lKDL8CB7S/AmVAf+hRMe
TLSH
T189728E3D5F003CAC25A780ECC5F982AA4D18B7A7DFE6806D21583D0DC698969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07939ca1-ec1a-46c1-a94d-a1b69d7c4574.tmp

Path C:\Users\Admin\AppData\Local\Temp\07939ca1-ec1a-46c1-a94d-a1b69d7c4574.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4532_920572362\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 c70921562ea5193376b1001f4a423148ce36fea82cd45026bee087e1875435bf
MD5 82aaf349d5f18b4028bb10faa2f98451
SHA1 14f20f2dcd74cd8ebcaf5c6e01d2a761477f8fad
SHA512 3577f2f1ceb66e864024a2f9a396bac6ede6967360ae4dd13551da69403c3404f1af5ad80df418f116bcf2e468994658ad473b1be1c30517e2e71210f4ef4b92
SSDEEP 768:Jud1sD/mh5eGcm+ujE4ZKRM519Db0bibtjH:bD/m7EcRj
TLSH
T180E21284FB2E953FD41512BBDCA50B042F79B88958192F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 936789b1a98c92e9a9a54f2088e28b507a8aba22b5acde2d2026322e3bce5078
MD5 2f50b0988dbacb453f082792c893e668
SHA1 492cc7200ec767e912c39bd86d8bdbd0fb5ac60c
SHA512 574b7c1ac587ef922638d1552b77b05b856dcf8a810709836c716dbdbef9dbdf5273aa98e3c41e6ee9d16ffe9227042b36ac58220740046dca20d7558359bce0
SSDEEP 768:31wufD/mh5eGcm+ujE4ZKRM519Db0bibtjH:fD/m7EcRj
TLSH
T1C7E21284FB2E953FD41512BBDCA50B042F79B88958192F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5eab4cc1fd147cfc620151d2c1f7cfe19e7a3203c0725ba20a602e544ae0cc02
MD5 4091688b5745cebebd1b06e6aa15c429
SHA1 d4a5830650ca3a8f49aad2e3a6fe6d36e2ca4c19
SHA512 5c745877790c19d7f1e8234c9dd92f04fb79a18748649ca2a14265cfa1d477151dd90c1c3492bbb82d63719732aef7704034c81943a3a15c72fb1405859b4006
SSDEEP 192:ROv5zbo8bAmyjHxy41d66JoztdzgCl6mc0dw:Obo8bAmyjBd66Joz/zgC1j
TLSH
T10DD11F64F629467FD409023BCCAA1F400F36395AA88E7F19319C74082D9B2DE768D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c6353102bc554c8aed5c1aa3e459eec7d0da008aec8bfdd99ffcd23013202a2e
MD5 b059f0c931f6157699aa7c6390d4b793
SHA1 f8c980a006db6110d18e51530bacc41509620e7a
SHA512 409291ec48f64c79c92bc394356049dbeadd6ba5e75d2ed4ec6705584d744bfd8e72acd8e5c09e839f2d49c3c1c11f4c42e9c5d044a381121072c9b1484af3e6
SSDEEP 192:g41d66JoztdzgCl6mc0dkOv5zbo7fZAmyjvO+:ld66Joz/zgC1j1bobZAmyjX
TLSH
T121E10EA4F629867FD409427BCCA61B414F39384A984E3F19759C74082D972DE36CE27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 8f6a7571e8ac5e3e314dff2940836a81fce4630c1686b43263a9b35916686c9f
MD5 05e6bc6fced4b60ffa5617e03abf52ea
SHA1 f110821b48345f600504f5b5c1e5431e4d631888
SHA512 21f673541987b1ed8108935a4d7a2328e8a0b8d2c22b7944a6f0339f14478ca861f85aa45bba56295f7f794a36d09524fb6e6a516e52a40a95844d3649f4c2ac
SSDEEP 768:pD/mh5eGcm+ujE4ZKRM519Db0bibtjy1wuw:pD/m7EcRV
TLSH
T143E21284FB2E953FD41512BBDCA50B042F79B88958192F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 225dbb0a99ec2035e573b327cf6628e2b8a2a2ad8e37463ef379c342b3ff4ea9
MD5 a92be8e33d4518eeeff72caa5186b012
SHA1 02512894f814b8edf95c4685c09a08b3e9adc884
SHA512 7b72a37b76207a2e38d536ab2b432a6b326e202ec7a7f6a4a168d9d831c36a0ca34c3a15e67e2bad17d0aa1927707bfdd78ab364a6df6ad3664ecb58d275581b
TLSH
T115216A5C39FA4E2B5C8BE29C7881038E53154B5F44871D474E52FE8ECF81ADD316A439
MD5 SHA1 SHA512 TLSH

Submit Download

249d01ce-ed8f-4668-938c-d00020e79259

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\249d01ce-ed8f-4668-938c-d00020e79259
Size 2KB
SHA256 05bd117cd91a3013c9506332cb11ec44932e710255523c4a5d12ef64ad554be9
MD5 250b9f04819fce98bdfc5f073a803047
SHA1 fc735b89d3a44d40f31b4043b88dbce38ef66f36
SHA512 eeb438da33dfd243c5365817d4afcdd84a705d1ba2e3b9f550915872782257828daaa94561eae27ab57b1270e7a6c3173ac5f54fb423ce82aacec517964e660d
TLSH
T14741545C35784DB79C9AE65DD44123CED3606A0344932C832E51EF0CCED669E23AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

27b31fa4-95ea-4d02-b47a-c34f42100141

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\27b31fa4-95ea-4d02-b47a-c34f42100141
Size 235B
SHA256 bd410a4d707c0b3c5f2ae44a44d4b57cc64dbc2d7efe29cf2c77ef2a750298e6
MD5 cb76bd5a4090db25584e07ba10dc5505
SHA1 f211ac3c03c6ff07c32377c09c973336659b0f17
SHA512 5e0d959121e8ee93d6e33fa6f5dfdd0f5ce3f0a3afc610296ba220f04ceb0e3a851e1dee7de90a73b370fa2de9d76ce497890d04d26b5848830ca531a55a57a1
TLSH
T1BFD097C0689C276C08141F03F0F038C234988C335464A820D6A000B9AAFDEC88111906
MD5 SHA1 SHA512 TLSH

Submit Download

7ab7531d-6149-417b-9eaa-49608ba4ffb3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\7ab7531d-6149-417b-9eaa-49608ba4ffb3
Size 886B
SHA256 a6c8fff870c21b3bb32d4187e9276ee59693995bb88ebf2296e7b2b261eb61ad
MD5 8f7cd54bad697578faee3bd46e3b37d4
SHA1 6a206ab1d446a1fc92030e8c38b617790f681f9f
SHA512 1a752dee24e0952e1f85089321504def36678503dbba1616531aeaa6ecb66ba3d569a1bcf6f3ccf1ae3b89590b799e5e3469b5d99b1b27b53b52edc2904f8825
TLSH
T18F1127C19579B5F19D38D24F88F9775287D8342380C9590C7E549E180EEF51E935670B
MD5 SHA1 SHA512 TLSH

Submit Download

8f0f3314-b1d1-4dcb-9dc1-c674f68ed2a0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\8f0f3314-b1d1-4dcb-9dc1-c674f68ed2a0
Size 883B
SHA256 5c35a433d4fb235f9b9d6aa2371dcc9ca06c96976143f73a7ae9553193dae90f
MD5 8b949fef137112992cf6af8d0d213140
SHA1 a78652a738effd928e44ea217e9918a4c7e401bc
SHA512 20ee356d717dd0ba61af3f988c703d9ce3f4fabcc314b8a44cda5d62c847c21bc342cbcd9620f3c6170bd6ee04b9a9f5e2e17f7c8a60f5cc02aab44394a7517c
TLSH
T15E110490A635B6F1DC28D24FC8657B41C7E8752380C6550C2EA59E080EBE51A976530B
MD5 SHA1 SHA512 TLSH

Submit Download

998a4ca4-4cf3-43c4-bac0-c631d78d9b1d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\998a4ca4-4cf3-43c4-bac0-c631d78d9b1d
Size 16KB
SHA256 a630582b31785003643b88386940650cc9656c3c67bf5e4ab6c0dba75e264a2c
MD5 a7fda737ae49bacb7069ea5888997e71
SHA1 8bc605b011158bdcc22bab79c4a5542ce49c130d
SHA512 298e941743d665c714a38c707b537fb5f65c8dd5c6c7c3dc49f1861c2c9bfd1c41ec95fa2a84c4746c156258d90250ed730a3c829db88fc27025eaf31f90a253
SSDEEP 192:cguHJYu3XdcBgxAJOBgj7xoOJawKhJuXamS9zi7614Kb93VXkQJPBT1ljYTPOb:IGuHd90JFDXamS9W7614kjXk0uTPk
TLSH
T18B72C756186096BA8151E36894BC7FC3E6F638CF4C019FCA9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dee970cc-5040-40d7-9b9f-d4574055e0cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\dee970cc-5040-40d7-9b9f-d4574055e0cf
Size 235B
SHA256 194a0bba8fd90484ca39d2330b7406de9310ab5c1eaaac33f49c0d13d0f6d636
MD5 997f3688c51562d3e056eed884026e7b
SHA1 ec3d3fc2529bca6aef9422637f3dc0c6820ceb49
SHA512 cd1b035545dc00c2915df95a3beac791f52614573643c3f994102abe187216fe836389eee6f6ce2444a4125f1ad5817c95e7fd04ab220c5c20ea7b235ee3c655
TLSH
T1E9D0978018A8B36DA8240F07B0F469C6318D8C3328A0A810D6A001F8DFB8AC49261816
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
Size 16KB
SHA256 7c53a423bfbe8d9e90f27da120b31565b6c74614ca80576bd5486103b972f7af
MD5 d5cd79e592639e975760408680d08f7a
SHA1 c2dcd64cf0791be589a1bfa45c7d98f3b700e387
SHA512 8693eb9c8fb18ffc131c7db146761a02b6a30c858d2eba76fa7b574bad155f94c8e73460dfc4a13fbb91e766331988c4119f62f9880b6cdb9897dc3be14ce770
SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4Hf2N/4hm:1I4vRfjXM4H6F4/4r4Y4x4s4U
TLSH
T1B472521545049EB8294EA79BAA367D01C37D473B60845C78F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 7KB
SHA256 29bf52939f176370f82da850e9feff359565f9b7ab151ebabc2513b58e7f4049
MD5 2824136e8a054a177754eb3d994fb09d
SHA1 f6093c95f7075f9d15f9f135c1293e3bd7b6e6f8
SHA512 aa38f4bedba001de05fde10993b636c636c27c2562f9cb7fcc16724a47c399322a69b5ccad8beb8cc23df59619f9959c44aefed3502ce3cec5b8c85bde7c30ae
SSDEEP 96:xHSFTUNqGq1DfGVaObzSISSlvdv9jDmnNeRWR0EcSqZJg/tBBw88v8L4cn1VrAx:cpR1DfGVa6SSV8RtjBtBBw880M
TLSH
T174F1EB789144CF7F74B6776CAC6889305AB2023BB7BF68DA10B95485050CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 7a78da6e091dd1e955aff551f8f07460edbe1292013dce502c984b86e0606f86
MD5 f58e4ec97e117394618220746bcd9e4c
SHA1 d8d9a2307be15fef280634f0ed3c4fc912519821
SHA512 d6deaec91ba8a09036f481698f785d43981dd0fc2acd690fdbc88df04a73f58b4259c293f4528ad0e7aeb4c2a0d27432b1f3f0beae062b2443d068fd4dc0a453
SSDEEP 96:xHSUTUNqGq1DfGVa1zSISSlvdv9jDmnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGVaFSSV9IjzBw88jM
TLSH
T10BE12F7890088F7F74B6776CAC6888316AB2013BBBBF68D650B954C5054CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 1495067d15e854f97452213bd5d09d7f56c490b7f8ff751af779e3d718627c20
MD5 421a04d811d8ac201e919eb6901f1bbc
SHA1 237002a0dd066db75642c51b39101494b0c38a1b
SHA512 0b4e5c5a1b4f8212f67b3dec7598492a849762194e80eb76e635bd6e158c58629caf3f0489de0a6397ab41e47e785bb44cd3bf1226b19d97bc41f6abf06fe20d
SSDEEP 96:xHSUTUNqGq1DfG45G1zSLSSlvdv9j9nNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45GSSS49IjzBw88jM
TLSH
T171E1117894088F7F74B6776CAC6888316AB2013BBBBF68D610B554C5054CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 8KB
SHA256 9fcbe736abfc8687b8d75628cbe37978d276024e9e950eb8602b8f3051c10f0e
MD5 de4c5a88ee148b7058221703f1fcec12
SHA1 cb163a3143b030e0e69f9ae93b4ac3c2a2e45af6
SHA512 09898325e0993e7e336f1cbb366cf6878ecaa168c35793f153ddf385c212dd387c9716fa3d7c4493dbacf7e782012ae8e716022e84362861ef77ae7a9e21e975
SSDEEP 96:xHSFTUNqGq1DfWVaObzSISSlvdv9jDmnNeRWR0EcSqZJg/t3LTOBw88eX8L4cn1M:cpR1DfWVa6SSV8RtjBtPOBw88NM
TLSH
T17A12FD385044DF7F74B6776CAC6889305AA2023BB7BF68DB11B958C5050CF3441EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 65f4ea10407f07142f99f77ca756256813a00170f5cb66fed18af161a4a2e257
MD5 b1966aaaba44efcae3691f3c3513867d
SHA1 67189ff802cd91e16aedd77e81b2ba3b31c98ff8
SHA512 4499dc61bb382d9ba7cd3e46cbdcefe8a8a30261f293a98ccac94580a0e38bbf10363eb6e5114526a7c49ddfe195da87c556012ddb8f86ebf42f253f0f503613
TLSH
T1E821D55B94B73A39B7069359448B0FB6C29720228A7188F0C19A9E8A17BD085728D019
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 00b4b7795ccc49e9dde6131d62c372aea3d465146e3cb2c1a345d672a0992876
MD5 173b6e9139ae3f8ab051bb73ebb307d4
SHA1 48eafd141a7be95c576370755ac7914ace6473f4
SHA512 9a5160e78ad91f8a3798ecdb1ecab9a4298c2d600fe68b267d09b7aaea6fbe55acb6ef940d86f4b0e293b1223e334630ef6711cb4a9c177f35aba105fa89e749
SSDEEP 96:U9fTJ94T5tAfeW9jILA0NjoB8kMJttn0YJZQA:S99gtqOnNcB85JttnTZV
TLSH
T125918F02321F386BFA5B438F9F170CB241B4340E59D144E840CFAF5AA76B78734844B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads