a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Size 5.9MB
Sample260810-ee2bsa1aje
SHA256 a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7
MD5 c774d5974de582179c34963c36752c02
SHA1 c5ea7995fb4caf689b3445b1a786bb9ee95b4807
SHA512 68e452cb351f32bdc4ebfeff1e3c423a5f2b02bcf5af18f9adafa65431d1fb7235b5e3acc7ee93638283657dff528954b9c97a9504287da1ada9adf804855b4a
SSDEEP 98304:XrojEhNYLL8Al52eIP4bO18frP3wbzWFimaI7dlo4:5PYX8AlgGgbzWFimaI7dl
TLSH
T142568C51BE8D8176D90B113247299F6A102EBD28773465D3B2B43E7EEC323C16D3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware google defense_evasion discovery persistence phishing spyware stealer trojan

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe /onboot"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
119	1884	firefox.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_2056366234\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_162092805\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_162092805\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4352_1437729929\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1804838133\offscreendocument_main.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6632	4328	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2860	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308075733712405"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{6C7CAC63-2809-479A-B1C0-C7BFFCFA4AEA}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "221"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Token: SeDebugPrivilege	1884	firefox.exe
Token: SeDebugPrivilege	1884	firefox.exe
Token: SeDebugPrivilege	1884	firefox.exe
Token: SeDebugPrivilege	1884	firefox.exe
Token: SeDebugPrivilege	1884	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1884	firefox.exe
1884	firefox.exe
1884	firefox.exe
1884	firefox.exe
1884	firefox.exe
1884	firefox.exe
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1884	firefox.exe
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 1036	4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	89
PID 4328 wrote to memory of 4124	4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	90
PID 4124 wrote to memory of 1884	4124	firefox.exe	91
PID 4124 wrote to memory of 1884	4124	firefox.exe	91
PID 1884 wrote to memory of 4672	1884	firefox.exe	92
PID 1884 wrote to memory of 4672	1884	firefox.exe	92
PID 1884 wrote to memory of 4672	1884	firefox.exe	92
PID 1884 wrote to memory of 5568	1884	firefox.exe	93
PID 1884 wrote to memory of 5568	1884	firefox.exe	93
PID 1884 wrote to memory of 5568	1884	firefox.exe	93
PID 1884 wrote to memory of 5568	1884	firefox.exe	93
PID 1884 wrote to memory of 6132	1884	firefox.exe	94
PID 1884 wrote to memory of 6132	1884	firefox.exe	94
PID 1884 wrote to memory of 6132	1884	firefox.exe	94
PID 1884 wrote to memory of 6132	1884	firefox.exe	94
PID 1884 wrote to memory of 2384	1884	firefox.exe	95
PID 1884 wrote to memory of 2384	1884	firefox.exe	95
PID 1884 wrote to memory of 2384	1884	firefox.exe	95
PID 1884 wrote to memory of 5524	1884	firefox.exe	96
PID 1884 wrote to memory of 5524	1884	firefox.exe	96
PID 1884 wrote to memory of 5524	1884	firefox.exe	96
PID 1884 wrote to memory of 5524	1884	firefox.exe	96
PID 1884 wrote to memory of 4856	1884	firefox.exe	97
PID 1884 wrote to memory of 4856	1884	firefox.exe	97
PID 1884 wrote to memory of 4856	1884	firefox.exe	97
PID 1884 wrote to memory of 4856	1884	firefox.exe	97
PID 1884 wrote to memory of 2964	1884	firefox.exe	98
PID 1884 wrote to memory of 2964	1884	firefox.exe	98
PID 1884 wrote to memory of 2964	1884	firefox.exe	98
PID 1884 wrote to memory of 2964	1884	firefox.exe	98
PID 1884 wrote to memory of 2332	1884	firefox.exe	99
PID 1884 wrote to memory of 2332	1884	firefox.exe	99
PID 1884 wrote to memory of 2332	1884	firefox.exe	99
PID 1884 wrote to memory of 2332	1884	firefox.exe	99
PID 1884 wrote to memory of 3660	1884	firefox.exe	100
PID 1884 wrote to memory of 3660	1884	firefox.exe	100
PID 1884 wrote to memory of 3660	1884	firefox.exe	100
PID 1884 wrote to memory of 3660	1884	firefox.exe	100
PID 1884 wrote to memory of 4736	1884	firefox.exe	101
PID 1884 wrote to memory of 4736	1884	firefox.exe	101
PID 1884 wrote to memory of 4736	1884	firefox.exe	101
PID 1884 wrote to memory of 4736	1884	firefox.exe	101
PID 4328 wrote to memory of 828	4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	103
PID 4328 wrote to memory of 4860	4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	104
PID 4328 wrote to memory of 2304	4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	105
PID 4328 wrote to memory of 4804	4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	106
PID 4328 wrote to memory of 4352	4328	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	108
PID 4352 wrote to memory of 1012	4352	msedge.exe	109
PID 4352 wrote to memory of 5960	4352	msedge.exe	111
PID 4352 wrote to memory of 2860	4352	msedge.exe	110
PID 4352 wrote to memory of 5960	4352	msedge.exe	111
PID 4352 wrote to memory of 5960	4352	msedge.exe	111
PID 4352 wrote to memory of 5576	4352	msedge.exe	112
PID 4352 wrote to memory of 5576	4352	msedge.exe	112
PID 4352 wrote to memory of 4080	4352	msedge.exe	115
PID 4352 wrote to memory of 480	4352	msedge.exe	114
PID 4352 wrote to memory of 4080	4352	msedge.exe	115
PID 4352 wrote to memory of 4080	4352	msedge.exe	115
PID 4352 wrote to memory of 480	4352	msedge.exe	114
PID 4352 wrote to memory of 480	4352	msedge.exe	114
PID 4352 wrote to memory of 5444	4352	msedge.exe	116
PID 4352 wrote to memory of 5444	4352	msedge.exe	116
PID 4352 wrote to memory of 5444	4352	msedge.exe	116
PID 4352 wrote to memory of 2136	4352	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
"C:\Users\Admin\AppData\Local\Temp\a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:1036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Detected potential entity reuse from brand GOOGLE.
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27098 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {7d06ad44-98ac-425c-87f0-10fd0bbf4afe} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4672
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {b0a4a8af-35ee-49e0-a137-cae1304736d6} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 25213 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {c43e9b59-5271-423b-90ec-1d72843ab331} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:6132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27323 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4048 -initialChannelId {ee860b7e-a4d4-4f3a-be4d-1e5d23282a17} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4488 -prefsLen 34822 -prefMapHandle 2836 -prefMapSize 270279 -jsInitHandle 2840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4516 -initialChannelId {e6809d37-7dc1-49e5-a4b8-2d599fd477ba} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5108 -prefsLen 35010 -prefMapHandle 5080 -prefMapSize 270279 -ipcHandle 5172 -initialChannelId {1d4c166b-5eab-45d1-b521-3df0303b1a7a} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 35062 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2924 -initialChannelId {11519a01-1d73-4ce7-9447-556021d2b2bf} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5744 -prefsLen 32952 -prefMapHandle 5668 -prefMapSize 270279 -jsInitHandle 1616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5772 -initialChannelId {8fd3835c-95fc-46b3-b17f-b48486eb0ca5} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5908 -prefsLen 32952 -prefMapHandle 5912 -prefMapSize 270279 -jsInitHandle 5916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5924 -initialChannelId {309bbe4f-6493-41db-8539-02b6887c4708} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3660
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6096 -prefsLen 32952 -prefMapHandle 6100 -prefMapSize 270279 -jsInitHandle 6104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6112 -initialChannelId {2960f928-3e9f-49f2-b32b-081066683083} -parentPid 1884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:4736
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b08
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x36c,0x7ff913a1c188,0x7ff913a1c194,0x7ff913a1c1a0
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,11715375977167319613,12521801369571000710,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,1382776417648051652,10434146710661249872,262144 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,2794519507140121962,15997630964389835975,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
    3⤵
    PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,15668446962585413312,16705293454273973448,2097152 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,1374243008003371224,2939849298590623173,2097152 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,1434891890040765005,4767478752916540391,2097152 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,8128031076849459936,17330889340867524823,2097152 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,5535512680991366857,3589652086443763065,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,5274097852452542393,11506190045458408769,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,16211913222852890135,8744688483755035947,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,5761791557650706882,3794903128918475810,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,5761791557650706882,3794903128918475810,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15137823935925019764,18046738611593089616,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:6384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,3687723735730554216,2817490316549752568,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,9637722322426224388,9414289224494280852,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:6152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,16931596568576705009,14832446772370050574,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,5531741954791222972,11804564478259352268,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,4980004543642937163,9635860874813433098,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,1302796301864075690,7028831476065194934,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
    3⤵
    PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,16878733348062350841,14849790947396611303,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,1203802588742917482,482085741566757892,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,778246220810248824,11538013324051529816,524288 --field-trial-handle=2288,i,15447810207944150355,14262245205359969783,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:6780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 1468
  2⤵
  - Program crash
  PID:6632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4328 -ip 4328
1⤵
PID:6504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3cc6af853ea8d87acfbffd56cc50a1d6cad10fb6ab8b73451c0c39c986e667eb
MD5 4b7eaa758d2b583873b993c2e11e81e2
SHA1 96681fc5df98004f497ec6f7264f601d585c873c
SHA512 2f52c4955bc841d82fa5da436c334ed2214b035d358ac876c08932490aed6d15032f9d738cb3199bebab44840ad353df6711e11bed360b29390cc60a61c0f61d
TLSH
T11E612B91D3EE0982EF29CDB2D8E29494B2F68C998D076A40714CAE7444FEF20D0D2F53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a765a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a765a.TMP
Size 3KB
SHA256 704bc86ad966d176c4e9eb3efee2fe1f0f2c8eeb0fb1bc8fcde420122bf7918a
MD5 a9b3cffbd5db311a6ef8bae2b7661743
SHA1 52b4261e354e167d1db9aa7ff6dc681ef4cb0797
SHA512 44a436888cb5f11df0ebdab918c61fbc9557322719d4a4f5476f4d7e264477e86663234b61e556293323029a46b47c55632a0e426a684f0b3cfca544ac989bd7
TLSH
T1E8610B51D3EE09D2EB2ACDB2D8E19494B2F68C998C076A44715C6E7444FEF20D0D2F53
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7dd84a41ce69a34dbe498cd33ffb0989912fea878f68c84e7352eb5f44b8bc73
MD5 5c580301962a815b58d3688d7a10b628
SHA1 324a03824ee38e9eab8fb89c1a5d69e158206aa6
SHA512 dc8d3b8a7886a5d122565f4a0ac7e6415988dad20709e3925933e39da7bdf2d5e8097da99ab8de42b3a75844f063d2ff7d1183bcd9857707e9dce895fc5b05b8
TLSH
T17741CEF3C3F4856E890156F0AA18AE1FCE2D0915432C7C5AC5E4AE1B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8950790f32066528fd1ae9a8049d18dd64c4e50dc1d9862388f7f66bc14b75f4
MD5 b22e67a3b58c16d1481dfc8fc28dfb01
SHA1 1817c6e67c86c7ec24051c99d631ceb6012d2564
SHA512 c19e493d62397295cace7b9d180f08a636b3ef7eeae46983b3e9584a90695beb37f39e814760b692e28e5decf922eb79c2acdf0540abc62864e7a2cc696fe9fa
SSDEEP 192:sxRNR8CX/f+sjG+6A6Zs9zzoD8pp7/g6+WNYTI8/Y3SERdc+GujIgDvlVzJ:sxRN1X/f+sjG+6Ass1N/5U/MAIbh
TLSH
T1FD42E926AA24A93B9CCBD20DFA55BF63D2FD503261D11E54EBFC961C00E76CD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 abfd54ff23ed4629336ffb21195e97254a86f207d106ac664d8e1e01bb393282
MD5 41373062c0aa5d36f14201b325bd0b15
SHA1 2c51b3dea9a1f4430ad8aa5a3fd036507a3953a7
SHA512 093a23bf46a51f85c9306342f98046baec194c44db2085fe2d3fd2df6dfce53b063ea2bf96ee92be8d15eb4e45bd78f7d30c87e45d33fe557d69fb9283659a7c
SSDEEP 192:sxRCR8CX/f+sBG/A6Zs9zzoD8pp7/g6+WNYTI8/Y3Sk2hc+GujIgVlVzJ:sxRC1X/f+sBG/Ass1N/5U/c5Ibf
TLSH
T1F642C925AA24A93B8CCBD209BA55BF63D6FD103261D12E54EBFC861C04E76DD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 073649f6cf00c97bb6e21a299a6496c09368b2ae2e24b4d34c78447c59bd56cb
MD5 684462b33c3c98f838565fc173b8f1f6
SHA1 e9b980b5137e570318f8057d03be00054a0e6ce3
SHA512 d5c7bb6e7c62a603bb4c3ae55127538c3f1546f3021021d29bd8c2ae21faea7710547d1ee05ed0f57b14244dc4eda62e5ec1f4a1dc7c519934ef0536dc68029e
SSDEEP 192:sxRNR8CX/f+sjG/A6Zs9zzoD8pp7/g6+WNYTI8/Y3Sk2hc+GujIgDVlVzJ:sxRN1X/f+sjG/Ass1N/5U/c5IbD
TLSH
T1EE42D926AA24A93B8CCBD20DFA55BF63D2FD103261D12E54EBFC961C04E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 74de9650e9dd0ba8fad3d3691679ed446823e50715b527e15c692dfd6198db42
MD5 4a011e6dd05ee443351c0f2860524ba8
SHA1 a9959f83a32410227152f2fd35862d54b13e3511
SHA512 a3073ba86e5f521af1be103442ccd255f3158ccefbd4431f06d93fd53d53cbbb04560511ef971a4485286ba47a2d74f6ffac88b75b3c8fe9ea3762c4b78789b0
SSDEEP 768:GTEb337pLuLf3kWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4UgMWcSroE1iFO:GTEb3xEf3kWg0CfKsu1jaTUgFcJE8w
TLSH
T1B7D2CA7B640DCB7E4F804ADDAC19BE9B6D6802CB9698CD4047FE941C02C6BFE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc3ef0d7-fb50-41c9-a192-0393b09a7c19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fc3ef0d7-fb50-41c9-a192-0393b09a7c19.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 9436f837cd6dc5d3899db32ffe39e590b7627bcc4803863c7f5281a192553b25
MD5 56f9241de1cd2ac8f4bf16d09d401783
SHA1 c96878c4e9f9c39a98ee9225038ba6f9f07aedf3
SHA512 f574673657a8df2481f366e46a0815acf99e9d6aeb2c22469920825d4111427c6b6a95e4c4ca97c8c2f5f3fbaebc93b39b22c6e344cea2e6ec76acda9bf9bd4f
SSDEEP 768:DFQB3VwgLCSUgtfZOcf6Mff6wwXvShCQRShy6DqZW/:mB3NfffjfavSmTii
TLSH
T1BF1329F1C4E39576D9AE4747A73D6E12AEBDC123B5889994BBC85D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8780df1b1129057a2a64638071f11bb659e8cf611dec1acb0d872bb9cf2e445f
MD5 9b67fd350d2dee77ab254c890f545ee7
SHA1 36ad34f3e8bf756a73106c24485a54623001b9b9
SHA512 b60c81bea8a4043985d3a1db9c299136389670c9c40c87a99b4bdcb3ce8b2b3b73ecbf33259b50bde1df37ecf802c3b26e1263851bfad1723ad844e27eb07915
SSDEEP 768:Hf3NCiAc+wfZOcf6Mff6ww0vShCQRShy6DqZW/:Hf3QwfffjfxvSmTii
TLSH
T1C0F2BF70D97069738DEA9645B60A7F13BFE95123D5C89A98DADC5B0C01C32AF131B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 87eb71306d5719acd3a27a8b270bb426f22fa4b956fb0f8cc2ce2ad82ec42c88
MD5 e7abfc1b3de7eca63021b83d3d494d7b
SHA1 177cd630f2a399ff3c3bb7e2f0f9d387656dfeeb
SHA512 dc2eb791a3612488ceac72b4ca306df93dae152cb6386b83a247bd259167ad8df6ecebd2f13452fe9775743915853252053c4b3ea10a3e476deeeb298c9b2a1d
SSDEEP 768:rrv+4UNbdU37CkAc+wfZOcf6Mff6wwTvShCQRShy6DqZWv:rbsb63Awfffjf8vSmTi6
TLSH
T14913BF31D9746A738EF69644B20B7F13BFA8516385C85A94DADD5B0C42C32EF231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e8b7f8efc666807e8a9ec9d0498a297ac397ccc93f6f542901afcff0b7e89c80
MD5 4c24a19341f1adae264f4d824ee0705c
SHA1 b27ec42e4cdb36f8e9806579590c5a770c15b31a
SHA512 2bc8fa99dc1b82bacf872434c6a3a33dc9b207eec81bdca86a39e113ba2277db33309f642bd111bf16f247b6034943d361c4a931f4eff42256f7903051376ee7
SSDEEP 768:Rrv+4UNbd43EIkc+wfZOcf6MgvShCQtB2bwWV:RbsbO3ENwfffkvSF0wO
TLSH
T18003CF32E86899339DE792487646BB63BEB86173C8C54744DACD4B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0fa21c1d8061756ac4dc3aea8bdd97bced2db6e2af612011fa9f2156dd0abc69
MD5 16a7c2accabfaff8c85a64f6b93779eb
SHA1 1844cb03dbbbf48ea5b149f5b3af254f96a91643
SHA512 3c0b9997fab34cdd84bdb92a37cbd767eb05b0aa1a4462f786fc97f7e0b5b2e3906bbb2e1172359e46c14046d849aed53cfd09f0ab4447bd5b8d00fc33fd0c5f
SSDEEP 768:Bf30CiAc+wfZOcf6Mff6ww0vShCQRShy6DqZW/:Bf3twfffjfxvSmTii
TLSH
T1A0F2BF70D97069738DEA9645B60A7F13BFE95123D5C89A98DADC5B0C01C32AF131BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a37fc7ac11ea4f421e122cdb9d86263caecbc46d5fa48961f414204b70c56374
MD5 afab9a2b53909c2e034341719ce80167
SHA1 c30a86a0c58364c09a7d4c4e1c8854798f02d109
SHA512 3ded4fa8727a8fef0d39227e703e5907628f9902f96f0dc2bea02cd11f7a9d7917780a5c5dc6b342d1b5a7551ba63e2b47468fa2e688a09dc0dc475a0aab2d4f
SSDEEP 768:3rv+4UNbd43bac+wfZOcf6Mff6wwmvShCQsS2bwWV:3bsbO38wfffjf7vSd0wO
TLSH
T11003CF31E974A9739EE796487606BB23BFB85163C5C94644DADD0B0D028369F231BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

01d3b866-9d6d-4d15-8868-fee70497c229.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\01d3b866-9d6d-4d15-8868-fee70497c229.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5a46de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a46de.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 ac11eeff409c3f28aeeb5f26b5a878305988bbaf8a9023c06187f01666dbfaf4
MD5 ca9f12b511858065a26755fa73913614
SHA1 38f9377236ffc3c0facbd9bcba4020c69ed30966
SHA512 58483eaa038a63546e8684db78a49d5348063295a1964e28b6693a9af71b00533ec0f719acdf254954a40269ac8b9f06d9d8bfdc06a759cfa9513427a152afae
SSDEEP 384:HwCe7iO024Y9DL84KKDL849B7SOEAd9KVRaAcP+AWRMAuwj:QqZY9DL8lKDL8CB7S/AmVAf+hRM3wj
TLSH
T173728E399F013CAC1997C0E8C5F892998D18B6A7DFE6806D21683D0DC7D89A9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 4f06a1e762d39717c6a8720a4f5bfd0736cf48e93d23087ea22899458b819d24
MD5 94d967207e9b2c7a6ea7f1366fb7f7ed
SHA1 9680eeaebf954c3c4ee785b08ef089c313511af4
SHA512 4cbb13e957a932199826cf954f7d0f7dac5e2845e18380f940c7da24b0e24a8c0b0550618a92b90245f4f5cdf217e95526e103445268fddf14e72ba6ddaccb6c
SSDEEP 384:HXkRyiO024YmDL84KKDL849B7SOEAd9KVRaAcP+AWRMA5:3mZYmDL8lKDL8CB7S/AmVAf+hRMc
TLSH
T1AC727E3D4F003CAC25A7C0ECC5B992AA4D18B7A7DEE6C06D21583D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa5b45bc-3b67-4ef4-9367-ecfceb99e74b.tmp

Path C:\Users\Admin\AppData\Local\Temp\aa5b45bc-3b67-4ef4-9367-ecfceb99e74b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4352_1095233820\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 90134718088219aa7af8304874310f1c67bcb65382bfecfc1eaab23767eb22d3
MD5 930e1665d96fca8b510f677124ce4ae5
SHA1 ca19b1cc2868543f5c1f9e859a7a028c784a22b8
SHA512 baa0248314da8a854294efceae12f9c7b2c9ce1019e9128750262e4d2de0242e867bb8f21d1c2902ac52989a9582b4e43c355aa760684a5ccb34db866bd82846
SSDEEP 768:7yj1fnUXmrD0Gcm+uyl+KWhFDpebBbLbsBH:UnU2QMZh
TLSH
T13EE21184FB2A953FC41512BBDCA517042F3DB88658192F9B3A4C64686C872DC3E9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a9c582a76434f43a1a882c69fb3d617fa189ec265a6c40291f8bf1c1768859f0
MD5 d58ea04818903c79a9af88725530b2bc
SHA1 1b0bcdf027ba834694606bd9f91560b674c83eba
SHA512 b7a48028b7d025ce434794a4ed9a47e514cc695bff801202955128b01fea58088d8fc8e6e623f0bb0c3122385e83a3b236033404ad1c61e65aef3e87fe08fee7
SSDEEP 192:jOv5zbo7UZjyyju/Rf1d66JoztdzgCl6mc0dz:sbooZjyyjEd66Joz/zgC1jd
TLSH
T12EE10F65E729463FC408027BCCA51B410F39385BDC8E3F19759C65086D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 47a24b5f28e9f1aed967454f7f992415151d886b76789f53968ce1593ca4182d
MD5 9dfe251e7cdd87e78c284af12b47404c
SHA1 7de617a6473b36e0c1940fbc851301b3b62cf7c4
SHA512 26c0d7fbbbb1a48b30b65f120f8a358c54e5a09278824bdf0c25f231edc9f1f18666ea723a8ad9028796c4607b27457a34861436e06fbe6d4a3cdfcfc98c3e2a
SSDEEP 768:KnUXmrD0Gcm+uyl+KWhFDpebBbLbsB+1ayw:KnU2QMZX
TLSH
T1E4E21184FB2A953FC41512BBDCA517042F3DB88658192F9B3A4C64686C872DC3E9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 69ba13e8d7198e94ce43fbb6390aac8977684814c709758ca9c80d11a7319d9e
MD5 268f15aea5cdb412de1fc29ece2b1bbd
SHA1 11cdc2e6258db3cb508849798ff3b343a8c54896
SHA512 dcbb8072047505f81b45c12d6240d545d7acae7f93004bb176aa263808a7bd54eabb5df0b5b4bfb8c11e06f3be01b39a41723b5d9f3934ddbee8b57092b65a79
TLSH
T1A9219E5C39B98D7A6C8BE69C7540138E53554E0B04871C43CE02EF8DCED9AD9326E53C
MD5 SHA1 SHA512 TLSH

Submit Download

3842808f-4e4a-46fe-9a37-589650d6e53a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\3842808f-4e4a-46fe-9a37-589650d6e53a
Size 883B
SHA256 29a52f47a4e781f9f519c6e263a888bcc5bd8c3e42cb53c2c6f1ecb94713c4c3
MD5 c3b6c88fe5061b1b5cdd90da404972a3
SHA1 7bebe2a2739bee5d789053b89134d35ed27608f6
SHA512 8d90a6d28285fdf750eceb201f1f94f21796a25d99ad0cf2e07b33fc6881eb1d5e108c15dd7b5b2131eefb73bf4c472f4edc8da5802acbe3737dbe53f45c86ab
TLSH
T154119081A631BAB2CC3CC24B859537164BA86423C4C695147DA05E084EFF51EAB5664F
MD5 SHA1 SHA512 TLSH

Submit Download

415cbd27-d863-47ac-afa5-6e1feb4cf7fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\415cbd27-d863-47ac-afa5-6e1feb4cf7fa
Size 886B
SHA256 429f8d4adbe98e6ef5afe23e750c35464329c491ae568538bce2b4f305e7b5b2
MD5 60f4c57305187572be97196424e00f5a
SHA1 fa87ccf75433d49875e2617bb6b9bd5efb62198f
SHA512 f1bffa7c3b1f2fc29b0a22435488f95b70b4cec009d54674b44c6ff9c73d29186e6d5f75279aaabf9b4a5f49f09fa26da86d05ca490374a052f718f73464378b
TLSH
T1BF11D0418B257AF1CC3C924B85D03B124BE46413C0DB55187E545E084EFE51AE7AAB0B
MD5 SHA1 SHA512 TLSH

Submit Download

7fc27e63-abf0-4179-b7e6-425117a145b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\7fc27e63-abf0-4179-b7e6-425117a145b6
Size 2KB
SHA256 769b8acdf95b453b95fe89af6a8bf1658cc95524566404051a1e29fe6bb34938
MD5 6e004343f61200f8aac55c4083406b81
SHA1 589f2f67488529d51b1996652f90f10289c0875e
SHA512 6de801e69bacc7e779781f456c4936d5bf7e65ad8f5c89b57e825b78091b3d343d5ad57f0ab170f0f191f81ed3c98f4061c35498645d04ba73ab6a05e60f1966
TLSH
T1F441755C36788DB74C9AF24D8092334E97B0891340C658432E55EF4CCEE62AE336A41B
MD5 SHA1 SHA512 TLSH

Submit Download

821d666a-645e-4745-9092-b4f4907ea23e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\821d666a-645e-4745-9092-b4f4907ea23e
Size 235B
SHA256 bf6d0c758538d87a09969f7e939f45b9e0f28b220bbcee981e2643616c201539
MD5 b9fdc39035d2c4e00378f037a79db17c
SHA1 15cea9e4ffc630db45d300b054958e9e3760bb2c
SHA512 0d7b1d557fd34435c7aae4c41e5fd20b4793453efdf66e5a7037e25bebd0287a8130bc0fd6274a832cefc7d39270149501e25c3dc0b3f801f00d9d2e7b293ca1
TLSH
T1F6D097801498A39E08001F1BB0E239C370844C3324B06820CDA14035EABDAC48391C0A
MD5 SHA1 SHA512 TLSH

Submit Download

9f012292-c159-4960-95ac-092163cad213

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\9f012292-c159-4960-95ac-092163cad213
Size 15KB
SHA256 0c87ea133d2c5e90a89a8759f81bbf2f06fff4b06ebeeab6d3fe965db8f583c1
MD5 0822cb6e7b1254ea9bcf2c145a6cf4d5
SHA1 26b4f4a550aaa0b41aca330da8d1a855fb641952
SHA512 cababc3da4cd41534bbb5b1c5e4338261d2266f1b4efa57a5f0e3150bd2518473a9e39c04e67827a4ddb0dd8219f764e352e5b993affdef24e164f45dd9d5cc5
SSDEEP 192:YzE1XBUu8o1EGcej99b5QKziKaR5yUPcktaJX5bSZtZq7/dYvD7E7YN5iDd7+:rZofi99bKKeKaR5yUPckgAtj
TLSH
T1C962D84A58205A7A8651E368D8EC7FC3E2F618CF8C019FCA9BE47D0859EE05D5127D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7b94d0f-6a14-41fe-890e-f89cbed0c4b3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\b7b94d0f-6a14-41fe-890e-f89cbed0c4b3
Size 235B
SHA256 1aaeb486e640d3e9345dde479e357dd3a849572ae38d97a37dfcb1af0dc027fc
MD5 0b73ce0cc85f7fca52439662d3690da2
SHA1 536cf7f4e8c34c96048197d8e1f8f27e6a9affd6
SHA512 ab5f248b52149a735440782668dcafb2395b8a33cdfa969addf14feef732303ae6b4ac7fd8f280fe8edabe944ebfd24a36064f96f8dad2e6f70a14597f913a3f
TLSH
T1F3D097C0248CA71C08180F07B0E068D6309A8C332870D8608AA1487CCEF9EC4D11282A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\extensions.json
Size 16KB
SHA256 0ba27487188ccb8e6eecdce0425f65f2bc1fbf26c1a2457f364a22162e8ed34b
MD5 918ac04278239186f40a8e6b50e82557
SHA1 d6d66d40ed72cc094e2574460fc5e13f3b63bd63
SHA512 64fd6fb18a06ae3c9f8d0ffc75d7ff1b84517470be81a2686b4022ef1e4e8a8b34336ce81ae6f450834330ee544884fc086a25b8aa4a864cb332c198530fd394
SSDEEP 384:DkI4vE9Umldvb8dhW294znv96oNL4H2L4P+L4HiL4HrL4H4B4hg:AI4mRfIXr4zV664c4c4w4X4k4m
TLSH
T17472421545049EB8294FA79BAA367E02C37D533B70845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 6KB
SHA256 50a0a706c3a10de77032d7e4b56e44baa38aad34976975c0913acafe74c693ec
MD5 84aa7af8a451ace0034a7669ec97d73e
SHA1 dfe1683c38853147e8bdf0b6eb8beb4514fc268e
SHA512 0a90dbb249c6e6199a0ca2ad0e3b014dbb24accfcae828f348962c75a9ad2624b0bb34bc41e42613dd76d9edbbee1f99fc77b37a2aa6ceb5881d4d19ad2f24bc
SSDEEP 96:xHtUTUPqGqTfoyJ1zSGDSSlQdv9jRKRnnH1Bw88u8L4cnyFa:byRTfoyJPDSSi41Bw88B
TLSH
T175E10F789008CB7F74B6766CAC688D316AB2013BBBBF68D650B55484055CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 6KB
SHA256 73710cc5632932a9af1ff90565b585c702cd62667715e684365327fc655dda56
MD5 21de501ab74a949daf086270b6db90db
SHA1 d24cb28572789add60f961cd3d92557667e15b9a
SHA512 1f6a9abd748740ff3383e4f27ad36d9e367b86e7d816fa99569a7cdfc1dfae22409d4c40e9853a639fd195eb563e2ec0f6c94594ee6fdcf1ca9655f3ae7159ba
SSDEEP 96:xHtUTUPqGqTfo771zS8SSlQdv9jRKRnnH1Bw88u8L4cnyFa:byRTfo77lSSi41Bw88B
TLSH
T1E3E1FF789008CB7F74B6766CAC688C316AB2017BBBBF68D650B554C4055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 6KB
SHA256 a4c508f8ce20f770d7a944b057deb7c36864c9c9bffcef211fb0367d2e74a941
MD5 cf87f8d3aecf970d35089b6b2cd1ec6e
SHA1 eaad76a0172a15b96e1d4e5becbcd254e672aa1c
SHA512 11f53733e4b678475268a6db317e73ae47f9d59878561e352bff45a5d4c3b0ddb510d412601f058a9229a1ed6d0e4458d0b79e50c3ffd9d9ccc6ee1cb726fa1d
SSDEEP 96:xHtUTUPqGqTfoyJObzSGDSSlQdv9jRKRnnH1Bw88u8L4cnyFa:byRTfoyJIDSSi41Bw88B
TLSH
T103E10E789008CBBF74B6766CAC6889316AB2013BBBBF68D650B554C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 7KB
SHA256 f47e5ca8f3675e1c6ff39f205c7618863fa14cef21d6b7c2d73efe0aa0fcd780
MD5 2eca2714d98c9aa914b385df9a0d760a
SHA1 acdee61505ebff134e20cddcd480682dc05594ea
SHA512 a190097239e8602181b5c559f783fbeedecfbdd38f5997fb7eee5309f2698488cd918dfeba75760727055eab6b22c50148196bab413518d2e3f3f0b47f58aea6
SSDEEP 96:xHt9TUPqGqTfoyJObzSGDSSlQdv9jtLnnnH1Bw88V8L4cnyFa:bvRTfoyJIDSSaH1Bw88C
TLSH
T10EF1FD789004CFBF74B6766CAC6848315A72013BBBBF68C651B944C8455CF3845F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 7KB
SHA256 a2ad88ffb1c5c87d751eeff04d69b31448efe366ea8efe3bf96bcd4198f090d7
MD5 500334e1a9c9756cbc2f09de28b90e7b
SHA1 71fd9cf28aa773a894b9a53b16c4bca0179e362c
SHA512 5b7388690eec767e5ebf94c257e077309b5ccff85ef67a257ea9b159d304e334e7c54b686de92a4b3ec9b2fb7e87f9100dbe6be0bb77beecf7944d0bc2617092
SSDEEP 96:xHt9TUPqGqTfJyJObzSGDSSlQdv9jtLnnnWRARFsBw8898L4cnySa:bvRTfJyJIDSSaWRmsBw88X
TLSH
T165F1FC389004CFBF74B6766CAC6889315A72023BB7BF68C651B94488455CF3845F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 32981f73c30a33c530944968ae93744a21815c748e9073df208971c2cef82d61
MD5 f6e02aa373426819a5cd7a557c939fb0
SHA1 bacf7f79d2691d096b92d6082b61875d12a812ae
SHA512 21489f1db226c72afc6702a66f277b1da5df8ab3fe0f17ae5dae56e35a03a3e14af747826c52c0be5587e3d0e49d4a425c6ea31bc08fb1cfd6cf30e702e978f7
SSDEEP 96:eRfx9T6yo1QeW9jILA0NjoB8kMJttn0YJZQBSOxw:cx9sIOnNcB85JttnTZESOa
TLSH
T1CA917B02771B39A7FEA7C58BEA5A8CE141F43019589048EC90CF2B56F23BE4B3898075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 a6d3578989be9c006dc0a0469e5a4abaeb1b9a3db0415aa6dad2bb3b728d7798
MD5 76ba49eff4daf3e78c17bdbb0d77e240
SHA1 095cf06cd19edd242f45db9e91d8b28123759a36
SHA512 0904562fdd83567c3680b93e31324a205058c27403caa8ca4d3a603f56ddb1f959375b44039efd5acd9d0cb40f63fcf1a982bffbde13d1b195dce82a7374f9b2
SSDEEP 96:eRfx9T6yPQeW9jILA0NjoB8kMJttn0YJZQBSOx/:cx9XIOnNcB85JttnTZESOd
TLSH
T13C917C02771B39A7FE67C58BEA598CE141F43019549048EC90CF2B56F22BE4B3898476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads