2d757e3c57dbdd2e20a26fda08a3e4a8be3855c62d4faf31322553352475f49c

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDMan.exe
Size 5.8MB
Sample260814-tsneeaxdka
SHA256 2d757e3c57dbdd2e20a26fda08a3e4a8be3855c62d4faf31322553352475f49c
MD5 a5e733f01c8e418e60496914d21562f8
SHA1 e266fcfef95337aa51ed27a0e40cdbf2c4b3be77
SHA512 9d4c9a61c9aae3e90985cf2e16d41fa4bb4a080e79711cc6e2b1c8119a480283da55d0cbd0eda5b9c1f718c2f27ceeb95b75e2f314c726aabfa93a2e333591b9
SSDEEP 98304:fOLXkhQGgb8rLyeVR/P4wtC18frP3wbzWFimaI7dlom:xhQxb8rLTV1gbzWFimaI7dl
TLSH
T1F6569D52BF4D817AC95A11300B2DAF2A442EBD54773465D3B2B43E7EEC763C12C3A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence phishing spyware stealer trojan

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDMan.exe /onboot"	IDMan.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IDMan.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2316_1851402991\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2316_150989735\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2316_150989735\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7084	5500	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDMan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2368	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	IDMan.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311990882297334"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDMan.exe"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	IDMan.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{AE169E37-A961-4712-B23F-44323C918153}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "225"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	IDMan.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	5500	IDMan.exe
Token: SeDebugPrivilege	5352	firefox.exe
Token: SeDebugPrivilege	5352	firefox.exe
Token: SeDebugPrivilege	5352	firefox.exe
Token: SeDebugPrivilege	5352	firefox.exe
Token: SeDebugPrivilege	5352	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5352	firefox.exe
5352	firefox.exe
5352	firefox.exe
5352	firefox.exe
5352	firefox.exe
5352	firefox.exe
5500	IDMan.exe
2316	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5500	IDMan.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5500	IDMan.exe
5500	IDMan.exe
5500	IDMan.exe
5352	firefox.exe
5500	IDMan.exe
5500	IDMan.exe
5500	IDMan.exe
5500	IDMan.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 5840	5500	IDMan.exe	89
PID 5500 wrote to memory of 2440	5500	IDMan.exe	90
PID 2440 wrote to memory of 5352	2440	firefox.exe	91
PID 2440 wrote to memory of 5352	2440	firefox.exe	91
PID 5352 wrote to memory of 5196	5352	firefox.exe	92
PID 5352 wrote to memory of 5196	5352	firefox.exe	92
PID 5352 wrote to memory of 5196	5352	firefox.exe	92
PID 5352 wrote to memory of 2020	5352	firefox.exe	93
PID 5352 wrote to memory of 2020	5352	firefox.exe	93
PID 5352 wrote to memory of 2020	5352	firefox.exe	93
PID 5352 wrote to memory of 2020	5352	firefox.exe	93
PID 5352 wrote to memory of 3676	5352	firefox.exe	94
PID 5352 wrote to memory of 3676	5352	firefox.exe	94
PID 5352 wrote to memory of 3676	5352	firefox.exe	94
PID 5352 wrote to memory of 3676	5352	firefox.exe	94
PID 5352 wrote to memory of 2732	5352	firefox.exe	95
PID 5352 wrote to memory of 2732	5352	firefox.exe	95
PID 5352 wrote to memory of 2732	5352	firefox.exe	95
PID 5352 wrote to memory of 3292	5352	firefox.exe	96
PID 5352 wrote to memory of 3292	5352	firefox.exe	96
PID 5352 wrote to memory of 3292	5352	firefox.exe	96
PID 5352 wrote to memory of 3292	5352	firefox.exe	96
PID 5352 wrote to memory of 4664	5352	firefox.exe	97
PID 5352 wrote to memory of 4664	5352	firefox.exe	97
PID 5352 wrote to memory of 4664	5352	firefox.exe	97
PID 5352 wrote to memory of 4664	5352	firefox.exe	97
PID 5352 wrote to memory of 5304	5352	firefox.exe	98
PID 5352 wrote to memory of 5304	5352	firefox.exe	98
PID 5352 wrote to memory of 5304	5352	firefox.exe	98
PID 5352 wrote to memory of 5304	5352	firefox.exe	98
PID 5352 wrote to memory of 3360	5352	firefox.exe	99
PID 5352 wrote to memory of 3360	5352	firefox.exe	99
PID 5352 wrote to memory of 3360	5352	firefox.exe	99
PID 5352 wrote to memory of 3360	5352	firefox.exe	99
PID 5352 wrote to memory of 1244	5352	firefox.exe	100
PID 5352 wrote to memory of 1244	5352	firefox.exe	100
PID 5352 wrote to memory of 1244	5352	firefox.exe	100
PID 5352 wrote to memory of 1244	5352	firefox.exe	100
PID 5352 wrote to memory of 432	5352	firefox.exe	101
PID 5352 wrote to memory of 432	5352	firefox.exe	101
PID 5352 wrote to memory of 432	5352	firefox.exe	101
PID 5352 wrote to memory of 432	5352	firefox.exe	101
PID 5500 wrote to memory of 4508	5500	IDMan.exe	103
PID 5500 wrote to memory of 2172	5500	IDMan.exe	104
PID 5500 wrote to memory of 2596	5500	IDMan.exe	105
PID 5500 wrote to memory of 3720	5500	IDMan.exe	106
PID 5500 wrote to memory of 2316	5500	IDMan.exe	108
PID 2316 wrote to memory of 5876	2316	msedge.exe	109
PID 2316 wrote to memory of 4956	2316	msedge.exe	110
PID 2316 wrote to memory of 2368	2316	msedge.exe	112
PID 2316 wrote to memory of 4956	2316	msedge.exe	110
PID 2316 wrote to memory of 4956	2316	msedge.exe	110
PID 2316 wrote to memory of 1836	2316	msedge.exe	113
PID 2316 wrote to memory of 1836	2316	msedge.exe	113
PID 2316 wrote to memory of 1652	2316	msedge.exe	114
PID 2316 wrote to memory of 1652	2316	msedge.exe	114
PID 2316 wrote to memory of 1652	2316	msedge.exe	114
PID 2316 wrote to memory of 4624	2316	msedge.exe	115
PID 2316 wrote to memory of 4624	2316	msedge.exe	115
PID 2316 wrote to memory of 4624	2316	msedge.exe	115
PID 2316 wrote to memory of 5564	2316	msedge.exe	116
PID 2316 wrote to memory of 5564	2316	msedge.exe	116
PID 2316 wrote to memory of 5564	2316	msedge.exe	116
PID 2316 wrote to memory of 3956	2316	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\IDMan.exe
"C:\Users\Admin\AppData\Local\Temp\IDMan.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:5840
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27098 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {89745668-941e-4745-88be-5fea006f7418} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27134 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {f66525da-4d16-40c0-b97e-1c68ec38aeba} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25213 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {d8c66fcc-4ab4-48e1-a03b-8e26e7414fd4} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4068 -prefsLen 27323 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4160 -initialChannelId {134c35ad-a804-499b-8c28-36d021764b92} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4476 -prefsLen 34822 -prefMapHandle 4480 -prefMapSize 270279 -jsInitHandle 4484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4492 -initialChannelId {b6397ed9-733d-4628-a55e-ebc8cdfdadcc} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5156 -prefsLen 35010 -prefMapHandle 5160 -prefMapSize 270279 -ipcHandle 5144 -initialChannelId {2bfd78d4-9fba-4f0c-88b8-d692898bc89f} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1616 -prefsLen 35062 -prefMapHandle 1604 -prefMapSize 270279 -jsInitHandle 4708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5056 -initialChannelId {6de142cb-648f-487c-8008-fc4be9584913} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5304
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 32952 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {a0d788ac-2831-4a7e-83b2-7873c8809a70} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5876 -prefsLen 32952 -prefMapHandle 5880 -prefMapSize 270279 -jsInitHandle 5884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5888 -initialChannelId {6df85d3a-428a-4a1d-9c86-682d131944ea} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6060 -prefsLen 32952 -prefMapHandle 6064 -prefMapSize 270279 -jsInitHandle 6068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6076 -initialChannelId {89f3f8b5-ea56-4a58-8d6b-84ad50f48db2} -parentPid 5352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:432
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4508
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2172
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2596
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b03
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff913a1c188,0x7ff913a1c194,0x7ff913a1c1a0
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,12187397812213893105,16161214217819935466,262144 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,16660212710319366711,5932048773769985957,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,12969154298343821526,10191914881521396840,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,3486415962582847603,3811674897987654574,2097152 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,8498682715543045947,14609678269495887784,2097152 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,7763646218052698847,9265349886285073766,2097152 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,14107785904331212288,1807195566071809878,2097152 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,4035025284530616360,4195948178522692813,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:14
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,807845812377642323,7688101606593308178,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,16727093256347911963,1663716141113156421,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12843028865994573517,13097206076573351642,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12843028865994573517,13097206076573351642,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,4674536873369031015,10246413481903439278,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:6384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,253402488965216684,249172526648930867,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:6328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,9090986802112165247,16183822605511846367,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,16204626369451484227,13475074196326206075,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,8349236407558600716,6562712699701402117,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
    3⤵
    PID:7052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,10221154139391513243,12791401878425120422,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,15771030711790617162,18033355591906626953,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:6540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,8463684301389543899,8997892276165741238,524288 --field-trial-handle=2304,i,5184957931032532381,8974445314168536053,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:1248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 1456
  2⤵
  - Program crash
  PID:7084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5500 -ip 5500
1⤵
PID:6808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 77e4f2234dbd0ef5d3be3c8ef1d2595d684bd36ee840680f93c46fa221bd3b27
MD5 fe96c75a97134caf212501acf8ca5200
SHA1 8332fcf8b436f9fd448f2d4fa7a69a57a6448d86
SHA512 adfc9c922b0ed3c1bfcea44d5476754b1b7aba50f45c98c9a016c5d3615ec7cc546d5d18c2e6fae2344891ba2265e8b99c88fb69da7f5aa4a70b237a6cdec573
TLSH
T196610C51D3EE09D2DB29CDB2D8E29494B2F68C898C076A40715CAE7454FEF20D0D2F53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7716.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7716.TMP
Size 3KB
SHA256 5960adf290d9d1343ce0da23b75147ba86948ebf2b5cd6cb435ad88b00edba61
MD5 49b38c4d7c73d575199850982f40e268
SHA1 96c9508eafa13a181bf5478c35a2f236fb53d6a0
SHA512 059ade6f73a3fea441259860a5f0e7110b46ab8daa7f9834ab7dc0ab62234b86de5487accf7ae00a08cc1d48f8468cfe4176b138284caa95bb0ac0032e127770
TLSH
T140610B51D3EE09C2EB2ACDB2D8E19494B2F68C998C076A44715CAE7844FEF20D0D2F53
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0518403dfcfeb051e68d1a83a3966d149d2ada22c642bef5c30d5c5f2d035364
MD5 e35e93e315535d2b6634717fb0df2005
SHA1 af3fa5796b3655b33f186042dbf438eafc8ccdae
SHA512 1cb10f784680749dc8541cf0e17dc699075f705454159a4f328aead9e9f5dbb4a1d7dd7de928fef4867c2c2cda799c108df783f95230f7502cc153fce102fae5
TLSH
T14341C0F383F4C56D8A0196F0AA186E1FCE2D0515432C7C9AC9E0AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6a18bf981f64804548fae51ece5d230bfde0888fa1fb78436d19b7adce0076d5
MD5 a94371e84b8bdf110ebceff46dd07e44
SHA1 0f92d3f16e5d58afed008bb98cd3e876baad4134
SHA512 5673a608797ca5f9e3e1a9967d530bb676274248f9d1552e83b85741836d364e902688bbe80f4896d08e4da977a8510581cca53f9d9f0b45a6d125e2eb067eb5
SSDEEP 192:sxRjR+2Cq/fVsQkLZq6zoD8ppx/g6+WNY0z/Y3z2tqGTIgD7WJ:sxRjgq/fVsQklNL/5P/kWC
TLSH
T12142D916AD689D3B8CC7E21DBA15BF53D7F91072A0D45E48ABFD8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 33757bffca34a657527e16b0d8f3bafa86f5c2bc443afbd4d30d68078da64814
MD5 38839b6b0bc3f6f2cd6901c297e5616d
SHA1 239bf447a0dc20c8538de70fea4d2ccfa20bba9b
SHA512 b0b7ef50c90b15a217ab51850d76c5d573bcca61e246767cde1d4d2be9d6d1a8abc902f7b7b0ba0e9fe093d601ba788eb214c0dfd629bdc3e3faf52525c8beb1
SSDEEP 192:sxRAR+2Cq/fVs4kLZq6zoD8ppx/g6+WNY0z/Y3z2tqGTIgVWJ:sxRAgq/fVs4klNL/5P/kWw
TLSH
T13642C816AD689D3B8CC7E21DBA15BF53D7F91072A0D45E48ABFD8A1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 71849c053c13d08362bb0b5610e4c83d03ef2726596b34e48f9f8268ca537b11
MD5 4df6280a8e94adf62196221a6407c2f0
SHA1 cbce0569cd170833c403023fdc6306233dd1baac
SHA512 f9bda0285be858783c26b124ea0629cd36f9757339d15def66d2d6ad6095968d540cb4df7f110f6d3d1b6404a7ef6c00124597dce767da69b2a94196f558644e
SSDEEP 192:sxRjR+2Cq/fVsQdLZq6zoD8ppx/g6+WNY0z/Y3ixqGTIgDJWJ:sxRjgq/fVsQdlNL/5P/PA
TLSH
T15542D916AD689D7B8CC7E21DBA157F53D3F91072A0D45E48ABFD8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9166a748b92e5fa5a507748a1452d72c148a23bd0fbfaf07737532c8a9c8aaad
MD5 46c41c8a4c8aa37a34edfef0ac029ea1
SHA1 040edbc09708736b136efe90a007a9031150b70c
SHA512 ab6a873f6d653bfcd449264583e74c01cf9bbce41d6b497ac0c8d0229f997ee37a9b0b0298d95846a5532409d7e329ce475d5abcd2b0ac370dc8170a316895b4
SSDEEP 768:GTEbso7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzWgMWcXroC6iY:GTEbsUE7lkWg0CfKsu1jaYWgFcECNY
TLSH
T11ED2DA7B640DCB7E4F804A9DAC19BE9B6DA802CB9698CD4047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b09ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b09ff.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f6197626cf8ad240b5b4b067db23e4dc0d9b2a7ab5d265de83fa362e27147c7f
MD5 14ecb265c9102b94afe2f930fa98a0d6
SHA1 9828fe69b731764e5dd33860b5ee1cb7f7aec774
SHA512 b5c51c6b1b757f2e4bfd90ecde1105aec03457269c9b8a9088ae7dba7a1875a90c15791f3be8ef24eeaecf576bc5e0851a0624b42d64f10a5805e31860d2b5e7
SSDEEP 768:Rrv+4UNbd43zikc+wfZOcf6MgvShCQtB2bwWV:RbsbO3zHwfffkvSt0wO
TLSH
T18A03CF32E86899339DE792487646BB63BEB851B3C8C54744DACD4B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 969fa0b690e73ba0e487f3d6658d90f492bdbe8c8549296e757915fa4b9e165d
MD5 e53b6e96437dfda5d7048ec45122bef0
SHA1 936be8068652ffa04575b4f9eb03a31cfaa905f9
SHA512 9515426f7f297b86112ddf261f2f5697085eb587d4f671593f2c804d51c49f5fe0ab6fcfea850cfecd3a0b9be26c346b58eb52ef7d3c648084e5988363875721
SSDEEP 768:Ib3X5c+wfZOcf6Mff6ww7vShCQRTPi9P0d:Ib3zwfffjfmvSHPJ
TLSH
T1CEF2BF71E8746E639CF6974966066B02BFF45173D1C85A48CEDD8B0C06C36AF1717836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 22c7436de4e9d8bca5042412982ab53cf98b758b28e38993716ba9ad2ced67bd
MD5 c992e4c4439bd8f5297e6fe8b1e51a84
SHA1 620428fc6276fcb2835f8de2a3e24ec008f29723
SHA512 c23822e752c30e57d933c0941cf765ef313cc19c0d186b29a772abdce6ce1cc07e1d8e05b4ad3a77de98c475984869814a7054b04e4987696ada80ab64474b3e
SSDEEP 768:srv+4UNbdk3X5c+wfZOcf6Mff6wwqvShCQRTPi9P0t:sbsbu3zwfffjf1vSHPR
TLSH
T12C13BE71E978AA739DF29749720A6B13BFF85163D4C84A54CEC94B0C06C36AF171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a66a272ec4d7ed0388177923d1a4cd4a988554efb4443665521d535a8bf94692
MD5 765aa98d8cd2033fcea7155bad974c24
SHA1 cf2524871e3aceac8ec4dfe99e4c07861af96df4
SHA512 bffef755129cfe5fb6a38927aa1ebaf4e0c8cc90f75cbacbd195b562f329943cf1eb0f0f8b9b0f842937e7d646c2c8d31b37a70808212ff257dc2b7ae8bfac62
SSDEEP 768:Db3u5c+wfZOcf6Mff6ww7vShCQRTPi9P0d:Db3mwfffjfmvSHPJ
TLSH
T163F2BE71E8746E639CE6A74966066B02BFF45173D1C85A48CEDD8B0C06C36AF171B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6cc7b07d0c7f1ed14d47e351fbab2eb11033358e07b9e07f01349f368fa66a2a
MD5 38e9fae79003fc19e23d8ef3785990ad
SHA1 2191c3d57882519ca396de25b484fac30e226e7b
SHA512 f3c8343a146d50ea74efa99fb4f81f1941b8e6d01627db78cf7826a1106c1ad719bbb3e248e232cabb53d794fa014707ca6400e4acf81adac49be009952a4bd4
SSDEEP 768:Krv+4UNbd43Avc+wfZOcf6Mff6wwUvShCQsT2bwWV:KbsbO3SwfffjfFvSU0wO
TLSH
T14603BF35E978A9739EE29648760ABB13BFB85163C4C94644DADD0B0D028369F231BC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 62f5b886725b04c3ca0fe28616ed802d72e9b8502d7089b2fb1871730bc695ba
MD5 2aaa1df21d5ddbb4068cd74c8e500617
SHA1 3d8258c48d93ad8c1700dd011f9fb5dfdcb31b1c
SHA512 c48ba9140d2990b18fc29bbe02a369a86bb08dc9d9e703dbf5b274d8b0ec9f30b958e33bdea5fb796e281a4ac38ecd4a96704631a4cbb04070735cfd0112e599
SSDEEP 768:bFQX31wgkhAtfZOcf6Mff6wwEvShCQRTPi9P0d:uX3zfffjf5vSHPJ
TLSH
T1351329F198E79A77D8AE5787573D6E02AEFCC163B1885584BB894D0CCD821BFC306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

3fdfad73-23a0-4a45-bf22-f6e3e700e18e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3fdfad73-23a0-4a45-bf22-f6e3e700e18e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 13377239dfe53cc226e463837fad49a3dc74e3215b140a3c8c8214d7e963fd6d
MD5 3509210a5feed87dc869462c1f7b7609
SHA1 71a74c798dd64f600ab67aa14d7b6c5e774e86d0
SHA512 04e19bfbb95d181e7c861a747cc8fae4318f6e5bba02a5771a9e3e5e8d844f1af465f1283cd4252cd5f869563e2ce2246d901051e7f4a53e0d8498f4923173f0
SSDEEP 384:HXkRyiO024YxDL84KKDL849B7SOEAd9KVRaAcP+AWRMApRK:3mZYxDL8lKDL8CB7S/AmVAf+hRMsRK
TLSH
T14C728E3D4F003CAC15A780ECC5E992AA4D18B7A7DFE6C06D21583D0DC698969B5F948F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 c30df3aa79b5f55e40d1bab611cb5743dd2685c68fa4443dbbf24ecf9b7049e7
MD5 bbcaf66b4d55d01a3cf9209c667c2262
SHA1 5b1e956ecae1ced931bf0ed20c5bcf302ff20f5c
SHA512 9260c20c708fe622f3e34b27b3eaad1edb6bd048d1e94a13000fcf325946e25f99418c6e10e61a82bf844efbb3f3b9a5f99c1197062fa1228682a25b2b61a0e5
SSDEEP 1536:jTrli1jHwHD83M90xc6Tco1IrNduJrmH9DzCvX2VynlljQBI79jvexu32WKCPsm6:j3lg5M90xvh1Ox9DpyTQBI79jvtKo8Qe
TLSH
T16DB3AEF6DFA2893D58FF802D6AC2883FF9232400F3A73019C963675466C6FB46675649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99afa921-3991-498c-a648-fba73c85f1ac.zip

Path C:\Users\Admin\AppData\Local\Temp\99afa921-3991-498c-a648-fba73c85f1ac.zip
Size 3.8MB
SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
MD5 95ba08187ddb4e27dd69430be0320e72
SHA1 ac31024971fe7cfb8b0f78f5fd711b67121875cb
SHA512 c4db61248a74a17417310c47b4c11d11b3299de2a3180541429dfc2d42a9adb4174381c54a321bec3a59dfc37ab6e2429c635f61b1ffc402833285d435d9d0cd
SSDEEP 49152:YRbffsMDFFzwF7YyPeit5NFn1ZG6joqDtaSi+Fk7mJe8K12MxH3+qcxDoegA3oE6:6bf2YXc/1ZLAAFk7Ge8sxVEh3oEVg
TLSH
T13606F135D65C1609CDFF83BA8D0D2FC2B84C4FAE8054B96B6A6A99715CE31E21F44B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2316_26755452\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dc3155a1ee0959121a133761aa430db8ff8d4121b4cc5b8ab6bdbe67c9cecf0f
MD5 5445841e362bbef8664ec18854734681
SHA1 27a2289cad812aed3a0dca149274a76dca0337ab
SHA512 e4e7d42dbafaca28b06edc105202cc8f51ea9c00204248e787e31487881663aac6c47d80614f1c19da03f4d371fe3fd46b4cba2d1944f16968914b9df411d6d0
SSDEEP 192:jOv5zbo7YZjyyjuTr/1d66JoztdzgCl6mc0d:sbokZjyyjAd66Joz/zgC1j
TLSH
T1CCE10E69F629863FC408027BCCA61B414F39385BDC4E7F19759C65082D972DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 460425c50b48fa32eee160053243cc1214abd4613c5beea201d18d6c7f0451dd
MD5 7482e087c674a27f1c1fc1e482fe8cda
SHA1 5a09353ed16e167d27974c79fad271798fa8914f
SHA512 f642a8d866d597a971e56369d3b75566f00181f97da7052f0a49e22bb9caf4a9770c7bc8ab0ccbefd03b0c386d226f2e6830ec694b0b85b324f200fa25e92516
SSDEEP 768:R1a2HhFV+GgD0Gcm+uEujKWYZI/8aIbgbRbvboFH:rhFV+Uujq1
TLSH
T16AE22244FB2A953FD41412BBDCA517042F3DB88A591A2F9B3A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 c3e1d174d5d3325385f090e1f4d1fac8424c69823f42203bcb4eec5c72c99239
MD5 272039ad4234269cd2c47243982a6d4e
SHA1 3f3bd423d80365b4cbf9a5b18007dff2c79471d5
SHA512 d0e7da2ee1bc63cfbd07ccd8691551c112e59060615856cb7d1419342bd55c055ed11581b30cea5dab32d5d9961c4c0f08b8d6b629f4fd8e97990f91de589860
SSDEEP 768:KhFV+GgD0Gcm+uEujKWYZI/8aIbgbRbvboFu1a23:KhFV+Uujqc
TLSH
T107E22244FB2A953FD41412BBDCA517042F3DB88A591A2F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 f28c37649b524930d440e44d9e6dfe1723224833d2dbf2742609cdcdd7820413
MD5 003d7bf31ba4562c9880d1e0348ef072
SHA1 c77877397867d2b40a345091b0a21843432b140f
SHA512 58636b1d3b7850b9e5d38a4af3896667ccb27f016bfd51c7b1e6894e52e489f01d3545f4a671957431529575b69b2cba183c079c15ca9e7efc80f1a5c6acb6fd
SSDEEP 768:R1fhFV+GgD0Gcm+uEujKWYZI/8aIbgbRbvboFS23:jhFV+UujqF
TLSH
T172E22244FB2A953FD41412BBDCA517042F3DB88A591A2F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 378a12340e3c4466616219fe79dcb087afafdd5335c469310f1d0c3f059660fa
MD5 03decb4f2d759e61a69b9a2356c0925b
SHA1 19ce209e037587cce4c909776089dbc115794f6e
SHA512 906e80b1274ceb93fe28b9d131d346eec7b2a0651a24bf57952944fd80fe0144d7d010a51b86b55559969cedf1f5d51cad7cbb11279ac777a3ad0a30b753e28e
SSDEEP 768:72+1fhFV+GgD0Gcm+uEujKWYZI/8aIbgbRbvboFH:dhFV+Uujq1
TLSH
T1F0E22244FB2A953FD41412BBDCA517042F3DB88A591A2F9B3A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b9b20fabad44da6c1cab85c0f2c353e2954ff3c33fe60c87a9594359b1f000ce
MD5 aabbd1c80b578f4e11cc4a75cdbe8f37
SHA1 7b2910401fd133a5d0bde5922e19a286a34e6d7f
SHA512 2efa322d9fee19d3ba97ad6345c19575a1c547e8351bbc0e5b07b65f88b85d5b319dcf7fb1e6a80f8590dc097e4d5ce0592398ec037a5c2688158505e12dd911
TLSH
T116216D4C35F88D6A68C7F3987440038F57694B0B44871D434E52FF8ECE91AD9326E479
MD5 SHA1 SHA512 TLSH

Submit Download

2a5e6d0c-6083-4693-b3b3-a2b7825969dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\2a5e6d0c-6083-4693-b3b3-a2b7825969dd
Size 2KB
SHA256 698671e73df87aaf50bfd2539fd46193e71915a07404e9bdb17a84f6c20ea70a
MD5 3149254688c0d1713b12c022b3100957
SHA1 dfebf0483b4e8e2d1d2cd51d04bf0d8e57c5f3e8
SHA512 242984d5d47328460a831a040cfba7d7e4396e8952eef308a09b5049fe980b4071e577dbf766e5b16a33ebfa1651c2c252f1a1ed295ed1b743089e73457f07b0
TLSH
T19A41535C35785D774CDAE24E8092334EDBB08A1340C258436E51EF4CCEE72AE736A91B
MD5 SHA1 SHA512 TLSH

Submit Download

502f2a5a-573f-426f-9b87-cd57e88b22ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\502f2a5a-573f-426f-9b87-cd57e88b22ba
Size 235B
SHA256 d03f188c5b629d7f32d478ebe7ad7ee9a6b1aaeb5f5a5dff7e46baa8ecc97c12
MD5 7c4fb62a46ca820a1394c119e79ef337
SHA1 8b3c3ec5e5ccb4fe7ae18b36b76105402ec5c93e
SHA512 866b5553169e588a84d87da39f232b6086a12056221c8c9f7c041f1df4627afda436ebd8c0a4216b2eaf6fe2c84f9557bda7cb1364dab05dc26735f5ae2c2524
TLSH
T1A2D0979225887B2C08000F02B0E079C63089CC3364B4981085D246BC8AFDEC801D281B
MD5 SHA1 SHA512 TLSH

Submit Download

a8caf153-5bd1-405a-87df-95458d47d134

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\a8caf153-5bd1-405a-87df-95458d47d134
Size 235B
SHA256 8ec71378636b938622e9e667a0068a7628a8fb67e146efb3297e6b4b9a03c58c
MD5 2476ceba8dd6fcbf3281ee450620c3be
SHA1 4079128e923cfea5735da38c2247c8bf72eb13a7
SHA512 f15835462e595f4f4889440e875e3d26663a64a042073ad3b9ca82f7390a7c6c63783b6ce45bb84a78c2e58acca8712c1953c003591bf0c3c4bf510da69204a0
TLSH
T1FBD097802898276E48150F03F0E06DC231884C3314AAA824D5A282B89DBDDC9822182B
MD5 SHA1 SHA512 TLSH

Submit Download

b08b3714-78cb-4d70-aa09-1505bf135bfd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\b08b3714-78cb-4d70-aa09-1505bf135bfd
Size 15KB
SHA256 efe75309b6a3d2d698e6cc72fae4f4e748c3848911d3870d685ea15a95e6158a
MD5 20e68044df5965a8f588878097de1695
SHA1 710dbdbb8be0ca1d51f7167e142222884a1cd658
SHA512 73554237a3ba35821f58804f22e8ae8322d712e5d23a2b238eb21f6f484bd0f2dd18bc98d23cdff8b5df408499d7f2e8918a3d627bf2c4e10858f8a62581b87c
SSDEEP 192:sh1xF+aGfzTls0qXQGNTZewoWeK7JPSUAFgsuSzlR5aeuG2hljhWYebC8f1CWB6X:nwAwHeDUAFgTSxR5aeBAJhWEsQX
TLSH
T1FA62D94A6820597E8651E368D8EC7FC7E1F518CB8C019FCA9BE47D0859EE09D5127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e249be26-d1b5-46ad-b198-638dfc895264

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\e249be26-d1b5-46ad-b198-638dfc895264
Size 886B
SHA256 6fb86fc2e2ce5067ebab5cc9bc4937f16b3389c62fd1819584c4882ce793baeb
MD5 742db16df6409bc0893e30cd66333931
SHA1 40561576fbe4e217731e5992c812af22404f07f3
SHA512 35ff88ec9664a311c1c84c97a67e9024d9795ddf8b7b6e81eeab9fbef9dda0ec79451db5d4d07a205611e74a21ffa162ef3cafaa62d4db9b804ec415d8cd141d
TLSH
T1571104459721BAB58C78D25B85D577138BE43423C0CB59187D945F084EFB11E9366707
MD5 SHA1 SHA512 TLSH

Submit Download

e9d851d0-698b-4f63-9a53-2d00d47d7160

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\e9d851d0-698b-4f63-9a53-2d00d47d7160
Size 883B
SHA256 baf423d53b53fa1752556855290964a0c30fa0653ff74a088375e4a1e9b85cc5
MD5 5876292a77d3824484976d95db06006f
SHA1 76a27f572d4a350691f25f791115cd639661d685
SHA512 614375fcae0f54c4e3b4d49b6cc0792e0f9b75e0a46bf992ca6fe343188692b0658665e0708d14d0f876786f430a3976ea8a6b396fc14b0b05ed0196705a8348
TLSH
T1F711D08196317AB68C78920F899537028BF86823C0C790143EA01E044EBB61E975564B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\extensions.json
Size 16KB
SHA256 564b87ed49edd4e2a68a38bf42c34dd4bcd78c0cb68a354a3f37bac2a9364be7
MD5 5098fd06ee6544c74330ec59585f5b2b
SHA1 91147ed24429cc0cc2285707909f1286f08448ac
SHA512 bdea4a0957ea4786b30c00b05c10a1a71c8260849aa733c1a226bcb84d185d10d0bb4352e1f15a49509293c9e29fd8e5a302aee88b96e714c530a9b536310789
SSDEEP 384:DkI4vE9Umldvb8dhW294znv96oNL4H2L4P+L4HiL4HrL4Huv4h6:AI4mRfIXr4zV664c4c4w4X4Q44
TLSH
T1AF72301545049EB8294FA79BAA367E02C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 6KB
SHA256 3844fcfcff14e3f92809feb1b85532c6ccf59d2d467c4737052fcaa17312412f
MD5 6c60712d0bd349b49e6f9b8ae97a08b5
SHA1 a6b74d49f6ff4dddde449a238457d48c5e1c3e93
SHA512 deda9328598f1bdc5d28da9896117362c55f520ad9c4d785ca6cf2f60300ba5094b16afaf122e4e888507dfe1f98ea7982b9de1d47f0fb256f958ae76f05467b
SSDEEP 96:xHtUTUPqGqTfo771zSgSSlQdv9jRKRnnH1Bw88u8L4cnyFa:byRTfo77xSSi41Bw88B
TLSH
T18FE1FF7890088B7F74B6766CAC688C316AB2017BBBBF68D650B954C4055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 12KB
SHA256 0078c993cf8f7178b88052157813d666c6266ec4be233a2439eb4bcec0d19b03
MD5 d9b7ca03fa71166b00df109d2cd264ff
SHA1 03b564a2a42f5516748751ee3c78c57851ad25ac
SHA512 ad6ba5fb6097113c1153781702de8c90a92ad1d9ed251f70bc4a0bc60031d5389ab57a716b9158febf7a03e3af5ab4cee3e492fa97056ff40f82de5dbfdc69b4
SSDEEP 96:xHzxTUPqGqTf6qZObzSzVSSlQdv9jZnnpwoDRMZafOBw88xaQEL32T/2T8L4cny0:lbRTf6qZpVSSMLRPOBw88xEL32T/N
TLSH
T19142BC389044CB3F30B7367EAC69597459794227B7BFBCD20AF89482446CF2441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 7KB
SHA256 b14609a8f0440148e288cdd030a45e2692874503f7e64dd71bc0a4ab1b7bff9c
MD5 6a199cfd1ddf889cc3e42381e8f397b5
SHA1 dedeb4fc317478f3604c3433614df8a7550b0ad9
SHA512 7ae2d51e0d47cd7f35874a5bb807ddcbaf53eebc909fcbbd61ca8398acc5ee63b79ed9de2bb0d4b40e7f61b598c29178c16d72ff52340d986d283bba450f5c07
SSDEEP 96:xHtxTUPqGqTf6qZObzSzVSSlQdv9jZnnH4Bw88yI8L4cnyha:bbRTf6qZpVSSo4Bw88C
TLSH
T15EF11D789008CB7F74B6776CAC6888355AB2023BBBBF68C610B954C5051CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 6KB
SHA256 0cbe6a1e6cddee4288ac17dbcbf70f2ac522d6f489fd6b0b8b30856fdb090017
MD5 40f8d71d44721b767509eb07bffa75fb
SHA1 aab99d3bcbfd50fb9c8129e5998a46cfe1bc3c77
SHA512 80c80769cbfbf1cd37f0a92bab93f228742445ce410a815701ee1c6f6b1f25793712fae3b7ae570b7f35f65eeb4647d21a1bd8b9f1348fc749b1ef6074a594be
SSDEEP 96:xHtUTUPqGqTfoqZObzSzVSSlQdv9jZnnH1Bw88u8L4cnyFa:byRTfoqZpVSSo1Bw88B
TLSH
T12AE11F789008CB7F74B6766CAC688D316AB2013BBBBF68D650B554C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 3e618806c64db0c369fac1442722510a80496fe2c64496cbabaf8ded4e5a507b
MD5 40ed0620cd43e172d20c343d9d174e27
SHA1 5b24b4ad12b258dc3997acb43fe66e58d1826271
SHA512 220153a1e42d8057aab347200e7c4de4d6e8778d96af9197795459cac02317faa5f68d826348761aa9373328f4bce8f71fdf15b37fdfc708c34ed4571e2d9fc1
SSDEEP 96:eWfx9T6uNQeW9jILA0NjoB8kMJttn0YJZQBSOx5:5x9FIOnNcB85JttnTZESOb
TLSH
T113918D057A1B286BFF67818FEE5D4CE141F4301A589048EC90CF6B56F72BA4B7498075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 6c39d249a22f64745a4923240a464df1a7baa8c6f39dfe609772f87f670fb560
MD5 74b3749bdb7908ed53b04466149aa024
SHA1 f214738d73bdddf6240e7e600f8e07974e6d53cc
SHA512 2956c2e6ce8e99162c66fe6d24b111111a22f2a4c45dd68228d97e4b63a11ef4323f0504b21adf7448403b3cf0b39cd2cb256ef733e3be9875b26ce6c9d55149
SSDEEP 96:eWfx9T6usQeW9jILA0NjoB8kMJttn0YJZQBSOxg:5x9UIOnNcB85JttnTZESOi
TLSH
T189918D017A1B3867FF67818FEE1E4CE141F4301A489048EC50CF6B56F32BA8B7498076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads