hxxps://www[.]nomoreransom[.]org/en/decryption-tools[.]html#Phobos8base

Analysis

user interaction
yes
max time kernel
357s
max time network
357s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.nomoreransom.org/en/decryption-tools.html#Phobos8base
Sample260819-2pg28aaa64

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
780	msedge.exe
2916	chrome.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316531271028097"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{3D0EBE9F-F405-4863-B827-E48AF2722954}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
928	chrome.exe
928	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2412	firefox.exe
2412	firefox.exe
2412	firefox.exe
2412	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2396	4600	msedge.exe	84
PID 4600 wrote to memory of 780	4600	msedge.exe	85
PID 4600 wrote to memory of 4896	4600	msedge.exe	86
PID 4600 wrote to memory of 4896	4600	msedge.exe	86
PID 4600 wrote to memory of 4896	4600	msedge.exe	86
PID 4600 wrote to memory of 1148	4600	msedge.exe	87
PID 4600 wrote to memory of 1148	4600	msedge.exe	87
PID 4600 wrote to memory of 3812	4600	msedge.exe	88
PID 4600 wrote to memory of 3036	4600	msedge.exe	89
PID 4600 wrote to memory of 3812	4600	msedge.exe	88
PID 4600 wrote to memory of 3812	4600	msedge.exe	88
PID 4600 wrote to memory of 3036	4600	msedge.exe	89
PID 4600 wrote to memory of 3036	4600	msedge.exe	89
PID 4600 wrote to memory of 3316	4600	msedge.exe	91
PID 4600 wrote to memory of 4316	4600	msedge.exe	92
PID 4600 wrote to memory of 3316	4600	msedge.exe	91
PID 4600 wrote to memory of 3316	4600	msedge.exe	91
PID 4600 wrote to memory of 4316	4600	msedge.exe	92
PID 4600 wrote to memory of 4316	4600	msedge.exe	92
PID 4600 wrote to memory of 1460	4600	msedge.exe	96
PID 4600 wrote to memory of 3952	4600	msedge.exe	97
PID 4600 wrote to memory of 1460	4600	msedge.exe	96
PID 4600 wrote to memory of 3952	4600	msedge.exe	97
PID 4600 wrote to memory of 2896	4600	msedge.exe	99
PID 3420 wrote to memory of 2212	3420	chrome.exe	102
PID 3420 wrote to memory of 4404	3420	chrome.exe	103
PID 3420 wrote to memory of 4404	3420	chrome.exe	103
PID 3420 wrote to memory of 2916	3420	chrome.exe	104
PID 3420 wrote to memory of 1100	3420	chrome.exe	105
PID 3420 wrote to memory of 1100	3420	chrome.exe	105
PID 3420 wrote to memory of 3572	3420	chrome.exe	107
PID 3420 wrote to memory of 3572	3420	chrome.exe	107
PID 3420 wrote to memory of 5088	3420	chrome.exe	108
PID 3420 wrote to memory of 5088	3420	chrome.exe	108
PID 3420 wrote to memory of 3716	3420	chrome.exe	109
PID 3420 wrote to memory of 3716	3420	chrome.exe	109
PID 3420 wrote to memory of 4936	3420	chrome.exe	110
PID 3420 wrote to memory of 4936	3420	chrome.exe	110
PID 3420 wrote to memory of 4344	3420	chrome.exe	111
PID 3420 wrote to memory of 4344	3420	chrome.exe	111
PID 3420 wrote to memory of 4520	3420	chrome.exe	112
PID 4164 wrote to memory of 2412	4164	firefox.exe	125
PID 4164 wrote to memory of 2412	4164	firefox.exe	125
PID 2412 wrote to memory of 5868	2412	firefox.exe	126
PID 2412 wrote to memory of 5868	2412	firefox.exe	126
PID 2412 wrote to memory of 5868	2412	firefox.exe	126
PID 2412 wrote to memory of 3496	2412	firefox.exe	127
PID 2412 wrote to memory of 3496	2412	firefox.exe	127
PID 2412 wrote to memory of 3496	2412	firefox.exe	127
PID 2412 wrote to memory of 3496	2412	firefox.exe	127
PID 3420 wrote to memory of 1840	3420	chrome.exe	128
PID 3420 wrote to memory of 3376	3420	chrome.exe	129
PID 3420 wrote to memory of 1664	3420	chrome.exe	130
PID 2412 wrote to memory of 536	2412	firefox.exe	131
PID 2412 wrote to memory of 536	2412	firefox.exe	131
PID 2412 wrote to memory of 536	2412	firefox.exe	131
PID 2412 wrote to memory of 536	2412	firefox.exe	131
PID 2412 wrote to memory of 4548	2412	firefox.exe	132
PID 2412 wrote to memory of 4548	2412	firefox.exe	132
PID 2412 wrote to memory of 4548	2412	firefox.exe	132
PID 2412 wrote to memory of 2696	2412	firefox.exe	133
PID 2412 wrote to memory of 2696	2412	firefox.exe	133
PID 2412 wrote to memory of 2696	2412	firefox.exe	133
PID 2412 wrote to memory of 2696	2412	firefox.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.nomoreransom.org/en/decryption-tools.html#Phobos8base
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffa248bc188,0x7ffa248bc194,0x7ffa248bc1a0
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4457905368460372791,8827494616931456543,524288 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,7491930761689727631,15137444147118896762,262144 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,18097623752130091050,14010704702114922597,524288 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9220776754881884198,8459293826069195584,2097152 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,4128279039620999784,9774822897242619030,2097152 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,4049018128654942831,4029379124419207697,2097152 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,10987436276417047232,11505496750302270170,2097152 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,3508269278564515433,17228056880795607265,524288 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12764885295424226262,7652507143328958140,524288 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17805145933695634559,6729516431844229266,524288 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17805145933695634559,6729516431844229266,524288 --field-trial-handle=2284,i,5659629472092287903,2225087255787151704,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa15bfc728,0x7ffa15bfc734,0x7ffa15bfc740
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,15566738738203683185,16056122920130196356,262144 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,18407987257306858346,170355529966702933,524288 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,16044156007725445841,2952317974202512102,524288 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,13623728432956079966,14992701466665880220,2097152 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3356,i,4695878223466691813,17550953573435136455,2097152 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,15955831708338300265,3315580312861806973,2097152 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,18094612592879248228,39565233586638710,2097152 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4928,i,17030672083464893233,13662246445327545356,2097152 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,8103714839758101872,16042868172206060068,524288 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3948,i,16599519099547165851,12780066366677481470,524288 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,12027077770141080787,16122378569373615264,524288 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3420,i,5442840021492271145,15267239570627168800,524288 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5932,i,5411019991654438306,5968157569810469514,262144 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,12825991629871486660,10851782653856709832,524288 --field-trial-handle=1960,i,17797321582090343014,12571321224027417326,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:5548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5260

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {da5ea83e-639c-4ed1-ae5d-7ae6ec89ea19} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {192c2b90-c3bc-4327-b8ed-c77e4c24eaa4} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 27276 -prefMapHandle 3908 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {2e23906e-58be-4fd2-8a17-d1cdd0697536} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27276 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4164 -initialChannelId {018b4083-e6e8-4a5a-9e1f-001cbd7d9844} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3388 -prefsLen 34775 -prefMapHandle 2876 -prefMapSize 270279 -jsInitHandle 4424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4452 -initialChannelId {f3b2d2bd-511f-43f7-86a1-3cc4630a6d70} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 34931 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {39fa3748-a276-4c79-8b50-ad3cc51e2153} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 33031 -prefMapHandle 5324 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3212 -initialChannelId {6e5c7f31-2b2d-49f2-8468-effc382c5b48} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 33031 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {40b95925-cbf3-4c92-ac1b-a68e8ebf0cd8} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 33031 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {4e17d78b-2285-484c-b8ab-c555f30be0f9} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6272 -prefsLen 33031 -prefMapHandle 6276 -prefMapSize 270279 -jsInitHandle 6280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6252 -initialChannelId {d72a740d-1262-48f6-9b22-ebfe042e4800} -parentPid 2412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:7104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ff98783a9cccd9f380c3423c05d1b53b2c88dd19c30002e20fc1bb174488ca1f
MD5 1ceebe33383015d3dce2ab1ec0bfc28e
SHA1 284df07f392296c52bc4ac1e505f1233f3949565
SHA512 ec63633584b1f0c457c482fbced763bf7ea6700d718c26000ac5c7cc8c42cd77b61549e8207d93b2559587b72ad2e91a38cfa998a4d93fa268080a52998051e9
TLSH
T18DE022A6CD61AC3728FE479D50954B0AEB59135B2A81891F3A3CD21C8FB4A2A4196C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 f448c5a81a76ea27e6cc01e8d17329e2d47f15c5c68ee3f9173aa7481d6d2fae
MD5 4fce79b4cd820d866ae5abeaba6abc2a
SHA1 9b71ae97aaab5be6d930a93e14433bf6e1c9b599
SHA512 8f346cc6e2a252c7242e4c0eefb4048c9de61e7bda8dea826c9d90bfff389a9e0e16231a5a5c0e27a52b3dfd272f448abbea0c9f438d8e14e47d0f18c46db646
TLSH
T14EC02B73F7C01003FB000DB1E861003133310FBE06262392809E800815232F04282587
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 54d5ecb4a52904bc7ab0d160350e0cb1c89b249989fd5301d70a69df68ec1b3d
MD5 f45385529849ad5eceae21c3881defb5
SHA1 26dfaa31e22ae7f0e2133eb0c4af59f51ec534bf
SHA512 dff72fc00ac56a2d30ef3cac2cd011b4f972bf0e93898d6a90464759824d968d749b17c2636e354a29ac196f6c0c27c7e73564ae32f520f854e548e5226dc529
TLSH
T12081ADF7C3E48A7DC90156F4EB252F1BCD2D0A14822D3D56C8E8AF5B53E24B2D28064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 36d77e06622eba81a827f16eea5eb8f9d55519e1da8c34eed6b208be72e47bf7
MD5 d006c770a53e0a9e449b47de08001710
SHA1 2a5a8386433439d4d633844c09cfc2706e6d60a4
SHA512 155e01ef134d0bc46cfa562288b39795ebc324d051c56d1bbe86335d4f55d52c2abe188f53c6469b0b2eff67f30962ec6c9ee8e81657ced71b821dcde61eeeb6
SSDEEP 48:YALlqdZGeWPhKGDWzaXYfoKsBA4sBQfsBxEgmzsBZosBcKsB3SsB7vgymsBxnWza:DYZJ+I0WaIt2JoqLPo8nfnGXK
TLSH
T13D91AEF7D3E48A7DC90156F4DB256F1BCD2D0A24422D3C16C9E8AF5B53E24B2D24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 97cf3ef2005d63bc88cdaa4abc7ca7037bb3ec4dd0c2268c49bd8ebf1081eeba
MD5 02fcc1a205727fd2532e1ceba152a0de
SHA1 1c868f57e4bbac48d8d658e196ad71de81f81f85
SHA512 e64d7bba3cbbb23f6dc63a505f92f8f5071b00aa14f4603b7f01439a5f3c229f0eff59c7e864a588a534d0ec58bb1754cedd07ccbdaca205ff138218a31afc16
SSDEEP 192:sRj8LUsDOgWv7hhAPRp2W95Hsb+WNnbp0j7gqNkwbGKVyIsnAUgtaJ:sRj61i98Xtrwd03gsCK8
TLSH
T12542E82EBD10653B5CDAD269FD627703D7FB142225A41E84EAFC895C19EB8CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5c6a6d7c660cdbf6589675c4af007178a87d9102f94094ab9a8c6e4bef9b44c4
MD5 0e0b1a553a83413269790d78fa3b0a5d
SHA1 c036119f4c0b9aa1562ab03456d276d803a43a4d
SHA512 44f7eebd9d5c464de2f88bcc7b929d9ff8247d3adb814f54b2fba6c4ae39db182770dc86792f4e3adf15ca5fa8d110a0ea707e5baadbbbe6ad968c734d177cdc
TLSH
T158B0120080015101C04602B412425498B17C9F10DA0A270943F87D62E83DD628014051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fe22.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fe22.TMP
Size 96B
SHA256 e3e1a7c7213ca832c4fcdd204ffa5d983ac0df539dae923408b45405ba8d4ecf
MD5 0c1ac3ad0ea50bc1337b84b7af92cd4f
SHA1 c0d7b0dd93289650b6fc7bef51969894f904f5a2
SHA512 3b2e228cd416743b6f87e3719296bfd6426534fe8e7517b65df3b00e1cf007d8526b1a20e9e6b5d92f35ca65790ffce1eb19ce9ea4ea246dc1551c88baabf3a5
TLSH
T1A1B02220C0022203C00303B03088B8C83220CF20CA030202C2F00B22EC20A3000B0238
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 6296ee7d7d57096ad70d3e9c239364a7200aad4b5117dc0805a498222f47dc25
MD5 804e5ad574a9b8c01cd7a479063f5029
SHA1 220fad501bb4e7a38946492cc3fdf2f666bc8e6e
SHA512 40b4126b60154019ec8fb64fcddbeffa8332d1aa1193ab6b2a0cf163c225c4af6b154dbc4e79d1574a579fbda3092fa530f661974c7d036a5ba0734cf645adfa
SSDEEP 6144:NMOIO7ESq1wZOXS235yldRXwV1rUIqZ/ZLW3ExR:px6iZy5yXRXwV1AIqZ/piQR
TLSH
T1F43412B7DBC41F331A85DB68B7072F5B1AF9C48B8064671647997B4F28CBC694182CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 36b2fb99a1cca0575f2c81886ff6764517cf6b88b4c31d9183b2bca20f2d0908
MD5 5e96c1706c8348c0d0772ec4c7f5bece
SHA1 57443d0a604af6f737d90e982d66dce81fef3970
SHA512 b15623062e5ffd21b623655fd702dc86ca518e44c21f3bf4b241d096ad37e3c567f5054bb23cc85c0e302cc745747c37e4fb9d761737af6c4635e3cd47e4dc47
SSDEEP 6144:GOIO7ESq1wZOXS235yldRXwV1rUIqZ/ZLW3ExR:Nx6iZy5yXRXwV1AIqZ/piQR
TLSH
T17D3412B7DBC81F331A85D778B7132E5B17BAC48790A4672243997B4F24CBC694182CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 2a6e0b3754e2222021a4393eae70542e8b9d09d5fc3d6f4b4c45d17e3824b424
MD5 39915974229988d69aecd48e5ca89680
SHA1 94e52fd0fbba8f2602336328474f45be08a25691
SHA512 49fb4d89f9354cd45f36b245ccb0c730c2ce6f91934c1bf5dd3cdc6bc40c293a95fec6f5a52f1c75dee02de6109ba7d1b5776e64bc25719380cd3e12309557e4
SSDEEP 6144:1MOIO7ESq1wZOXS235yldRXwV1rUIqZ/ZLW3ExR:hx6iZy5yXRXwV1AIqZ/piQR
TLSH
T15C3412B7EBC41F331A85DB64B7032F5B1AF9C48B8064671647997B4F28CBD694182CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b61ed6dc7fbe84237caff76e66fd087db12a4b9d304c8a427599094009d701aa
MD5 2699c14af3c1272bc397eb4144e30446
SHA1 da21e59176ce1dfd6a5a3b6a14b9bb2b98c6d467
SHA512 f0e8b21b5f8f5796f2251f9bab7b3ccc36b79c5be7f5d9dc445f1a5b3ace6905d7b6e0b7a08af0ec65ebc57d18ce59b4ff12ea866401f8a03f29232b77d3536f
SSDEEP 1536:6JyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Wqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1F3C30237EBC21F335D92CB64BA534FDA97B644A99030D301AABD3BFB6C9345164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 626713238f309a8a0c8a82c7b1376c658254431ea69873a116de877e749bd956
MD5 b23e9c66ca88ead9cdfb4848990bd890
SHA1 a70c683ecb66fe7fd79a7a444a035a1d16c24a90
SHA512 6293def9757722341d64003bce5e10165888e70cc508b0efb504e412f1067289188d2155a7deac7d013b92fbec7dea69db114a74276e618fd8a9fad078b45ff1
SSDEEP 6144:1OIO7ESq1wZOXS235yldRXwV1rUIqZ/ZLW3ExR:cx6iZy5yXRXwV1AIqZ/piQR
TLSH
T1B73412B7DBC81F331A85D778B7132E5B17BAC48790A4672243997B4F24CBC694182CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7dcf2a14bba664849bf701517d48d8f2dfd1333a3bad08f76b944fd59ffe4701
MD5 66b8b7c28ba954920f9fdb57cd40c08f
SHA1 3aa193f4b99d19313ce1652e5448480867501dc5
SHA512 441addbca7cab675b709272cfd80c1d612b153b5e58878491d54ecf5913724bedc94d1352a769c21bb6a7b70df1e1381637cb7b0db1298e9b19caaf3a65a48a4
TLSH
T1AED023207C9CF8C0D111003843104F00375D14813003A10FF1500C2E4CB01C243E4FD2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b11d2e6f60d032021a0d9183e7b771f1d6e337e760515b537ab7c9786c93923e
MD5 56034f91d8a83833bf59aa49bee244b0
SHA1 b2b72c9e7996375292a8a6c5548dd8af82034205
SHA512 0b452eb12cb5bc31ff08783329d2241e6e026fa472c280a893e1f89893bade718a62bf9c10bcc3ef752b173638aa9e5e1630072da29c99d1ee7a0ab4bd9ca162
TLSH
T14561083D32574187E79F85F1F8F99E4C327941BB9B1F9E3C0268483D7A49B6A8423418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a38f9cb-18be-4bcb-abe9-67dbeceb145a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a38f9cb-18be-4bcb-abe9-67dbeceb145a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 369253ed5148224caf34de67b9cd3e0e646df3495727278c5b08b1c648a09c7f
MD5 6946237d29b41c6988c39d84332eb9a3
SHA1 6e4e8e00caaa823d8b3fc8c34e725f0b0cab9283
SHA512 cd768144399b1fc9bbb70d642ded461dfb724305ef628d2f59a76505a81299a0821734e5a5c232c06bb35822cb0d80b6ccdcf496465c48d73bb1b1d1e70803a5
TLSH
T1E141FFF3C2D48A7EC80156F09B246F2BCE1D0955836C3D1AC9D4AF5B93E20B1D64585F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dd6f306e140d30903abd35ab5f83d1a729eba69470f792dd8389dbed1418a285
MD5 ddfecc22e44055799912bc61713cdd31
SHA1 5c0b2aabe19bb287bc7c532488abb32e7e506632
SHA512 f6d9ad92bd06ac758430591e46e9a7f1c57f6e084d3b52530727da30ae489fa91f28e643db1cffa2ac6f57ec27d459f8494d5ba6b118a32cd055cc6dd56159c6
SSDEEP 192:sxZSRlkB/fwswa2Idp/gHW6+WNvFj/YL4Zb+CIgrJ:sxZS4B/fwswa3IHbd/br9
TLSH
T1C422B8116E28A97B8CC7E21ABF15BF53E7F91432A1951E48ABFC951C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d9a62b8650c4b0db354a377bb9e5c1840676f30f085dcfe2608d59611562a83d
MD5 79f26e279621fb105dc013de8dcad61f
SHA1 d4427c397ecf3cdb0c062418a392eddf01916fe3
SHA512 6344fd60f24a14341d34a958137c07e79bfb81bf70c934d75822d85b9549fb629a2f389596aed484f2002a27eccf9eb540ae2909d26d65bcb21e9c58e0fb773e
SSDEEP 192:sxZSRPkB/fwsAWpVGa2Idp/gHW6+WN9uFj/YL8ZbxrUIgFJ:sxZSiB/fwsAWvGa3IHbO/1xcv
TLSH
T11432B7116D28A97B8CC7E21EBF25BF13E7F91436A5911E48AAFC951C04E66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fdcd5ed7a60e94e654e732d1cb4a71d254b28ced67ed3a3f875291a02ccf81b4
MD5 58f0e9e56752c7b48631547bb2e0b4f1
SHA1 c5fb0a213bfb17a5f46c0a0620ae17e21ed2e0e1
SHA512 613f8340f0df35425fd3dc12d2ff884af78834b00227649cb5d202e608e4dd2e2d2d53ad391de4c74fe674788b5871bcccf2e27ebf312209eee42b63a0105048
SSDEEP 768:lwO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvqrobd:lwO6fP1Wvxz3ju1jaZILIsvBbd
TLSH
T126C2E83B640DCB7E4F801A9DAC5A6F973E9802C7AB588D8447FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2fac5d679806fae1da3dd774dc9ed437f8388f188cca4da234cd173f5627a97b
MD5 1d77a5b6eb1af60095dc54b6f848fdc0
SHA1 fc16cc79c8c42450ef9184420a70c5c648b2a975
SHA512 12141d308fc7eeefffe6cfe2a63683e931a526060b84ed40fdae0e1761857f9af6f6b06a28742bc6b7520c5efbcf28bbe5d792b869ed398cbe578817eb833bbc
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFOuI3KvasrylxIhKq00t:KUAAKteP2OuwKvaCOxuKq02
TLSH
T199A1141372BB03437C3E294C97A98B664B467263301CB42B37A910765EAAE344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 979f7c96cc756f50a613aee386f22d5d97f6b4b4bb94f0f1c8e2395a038e9db7
MD5 1d18fdcf709b09e5a236d0b1c2dabbd3
SHA1 aedb6f0a0fede9958611dad3aad55c125586414f
SHA512 3dd84902b87c97d12acb1fa89a910ba66246649b157a59a2c35ea3af07e5db1396d2bc485b6afe4b4072c1b28daa0936dbe1142e278c1509404b42d3bb998754
SSDEEP 384:HCbZcILsNxUCw4jKIa9DOMMe/7zJrNviv/+aaoq:HyLHRJO+/fhNviHlat
TLSH
T18F826C715C789C7718F2E181FA463A179FB4803BA6C96F84D5DDAF2C01EE6A81347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b48f28ded51336c74df061aa99a2ad9251238bf5bb41a16efd240110e6ea8452
MD5 46fc33e760217c5ce8cd1a882422f33b
SHA1 04be3784d67dfb017cf802d2979027173a38aead
SHA512 6782fd9a472e10d8bfd0d3ee439c1f9d9a98d93dc145b7857c9c040a08edfc5bc9889c4c55c8c92a5e81fa1d7774129b44c29a77e046a094dfea06d39bd942b7
SSDEEP 192:qON8S6O7+3hQmiUyF4Gttb02O2bbh2eQgGDoiU6:qON161dGt9DOMMe2LU6
TLSH
T1A602FA346D686CB74AF2AE45FA873B239FA5113FE9951F80DAE81E0C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 73b9fa486a664756a1e1823f4597aaad452094d1c80517915c0519b6cf516170
MD5 a844e94a3ac8044e28fac004516c92ef
SHA1 7aefb448ba6782e2beef086bca44192f74bd7f5e
SHA512 880710b7cffc0c963b63cb06dff296f26429d3989a816c7ed72458d114959b804f31d933e793fb6b5463614aba40e5cb1bd0beace124bd4b63a5c1ba4a16f57f
SSDEEP 192:BONj6O7+35QmiUyu44ttb02O2bbh2e/FF0SJrVcNFq/RMU6:BONj6Fs4t9DOMMe/7zJrCvU6
TLSH
T183120935A8289C775DF2A541F98736139FA5413BEA4A6F80D6DC2E1C01EF66C238AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e4eb99f3737bfe4b9160d0245980f3cdfc86dc08da0b19b31119754b7b3a854
MD5 39e908c083d775b0a39fd547e38c6caf
SHA1 a37e5ebd329ceaf01b7d00c312ff96b164e96ed6
SHA512 81956e3bc37edc0e848d227d8d30a66e7c3f23497e3ab6e3d5fa624390ff3d41b8e4ccb542567f49a0671c2eca6662d86b3ecb6fd93a22a3509ff78a1c4ff36c
TLSH
T12D414858B6EA2148B3B76F5BABF6A96E447FB9372F06C45D00110D4E0B63B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

432B7ADA7E05FA4DE214EE4D09BB2CAF525C346C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\432B7ADA7E05FA4DE214EE4D09BB2CAF525C346C
Size 13KB
SHA256 0e1e0b044acd1282e0a905063a54f807fb7ed1b36aba34177f48e50403279bb6
MD5 f8d787e8b2a161797a4e6b07a6a84f8b
SHA1 35e3f2b1f92a997d947905a47c8747317e63e13e
SHA512 1fb3fe59cc3ae64864a9cde9d5601cc97b90f607fa2828ac80d6c378bb1e4c1904cad5375033e3aa1e06252808007d112ea524a0a1d998e180c7b7dc762d8326
SSDEEP 384:/bJx9dAZ+H5Jv6awgVSq1pwQ71u1lZh6q6+XJQrkxc/cV:jVZV6aw6Bv9hujyqdmrDkV
TLSH
T15252AF376B297B8A1D22F820CF0D9C4A4C18FF7BDC56E16DD94469D18148BC8DC6AE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 05a9afa2fffec4af5911709f43eb6177efd0fb36050a6b4883c59332f95c0ab9
MD5 08dc7173cefc97b925ff12899a1803b9
SHA1 2d58c9462a7d79df31c1ebf53da7eaab8eadce05
SHA512 4ef039958a727aa4ad4e7ffafb772c5e3371920f87c08305de6c3a659292cc546c1b0381f6b2cd5e0c5e773b2a7a5dd17327cfffde962e73de64fac4f6f00a35
SSDEEP 384:HXkRyiO024YGDL84KKDL849B7SOEAd9KVRaAcP+AWRMAJ:3mZYGDL8lKDL8CB7S/AmVAf+hRM0
TLSH
T1CE728E3D4F003CAC25A781E8C5F992A94D18B7A7CFE6C0AD21583D0DC798969B5F948F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9633A975DA668BEB568305A814B209D23AD9A670

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\9633A975DA668BEB568305A814B209D23AD9A670
Size 30KB
SHA256 516d8069c0cfe3702f1e2dd849c97d1d0b1fc0a591ad4243c531ef6cb36734f2
MD5 ff842c7f0dd7bee7025f05a9bbba7a21
SHA1 d5a47347c5feecdae6d8c1586727bc5f85dca0c5
SHA512 a44264f31e1f0db2560a627054b4a64713add610037ee5293327e4a3e229acc831c2f655d4187e9c7fcbd71b7bbe0c9c6447b009912dacae94b750d7589f0b9c
SSDEEP 768:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPafHSG5qWPusKAvKiw2BWa:z+MQ+zyxKg8v8VGQPaf1G+w2x
TLSH
T12CE2D13A9D153A485887C9C093FBBB5D1D09EB074AF784FDA0142B4852C4F96BCBC89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A29B2E03821980677754947B37418EFF71FA673C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\A29B2E03821980677754947B37418EFF71FA673C
Size 2.0MB
SHA256 47da17026006f25b46dee45b4ce82a9e3bffe42b6f44447827ba4ffbaca35fa6
MD5 8b5138a0089e22fa9480faf2faaf09de
SHA1 d992a1bcd5719697500065b7340baff023debaec
SHA512 cf4e8fdc98f5dd7d7caee0a410c519b180324a9ff96926ce1ac417f972eb58c90ca75625489eb450db766cc13cc3cf0b7359c91bd8504f5411623cdbdcd5f7c0
SSDEEP 24576:IUaMeeOSpnkba3Tv4Oo3VS5SQX7yT2RtfZjVrmrskax0PQ+j:bangkbBKENV
TLSH
T1DAA50927EE856F57C86142B440BF23353B74D4866B92F32B26CFB021BC5A3794D625AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a5fb3ccec0936f14bf4f27c8425c6c2.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\thumbnails\6a5fb3ccec0936f14bf4f27c8425c6c2.png
Size 12KB
SHA256 bf640a95509009eca64e2e76d19c12b818ead0953a98acc37c36086099079c9e
MD5 d7cc1818e2088059033d496206625abb
SHA1 830550729eec06519d4e3c1f4c7885a39fdc3ab9
SHA512 4f7b3ad1bacc17ec8690196b4cfadf4a364e8076b72718a636a73409b294ac9596ccba04b9d7fa16d0ca4089fe123ae5c249ed455c372d25c7d0cad7f5e7dffc
SSDEEP 192:vlmC3pXyl5nBPchFTNlLOvMthfY9+x8P9Kwb8EhbyU7n63K6dWVNe6TD1:dRRcnBPcZlEMj6n4Ehbpn63DcfesB
TLSH
T18142C088AF200741ECC60AE315BE4AF8691785B0167DE970C7124D6B23EB75E7B015E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 53KB
SHA256 c4d4393a5e39a2af0421c4293a4b5117b866b5dd5b627b19d3d0b1465465747b
MD5 d72792174d0ed5569d85e758779c313b
SHA1 83a8f7591c11a8a392523471df2dbe0c3d8127dd
SHA512 c136b442d69365b2b8d8d92ae175a6851528faa6f16e0ab0ec30ecd64a6bc4f31fd6508d91a5ecd72c90676ffb6070a2bc9aa7f333bf456dfe5e082fac680294
SSDEEP 1536:UCxKylwgOfwnvzH5Z3gSvsXBcpUmXzYEvJ:UCxuTf8bHPKXaOa7h
TLSH
T12D430F44EB1E553FD86802BA9C911B003F78F8895A1A2FA73B5C54786C873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 539224d7f0f7b4b88593f17045b6cce70454f8750aa03751338c656876eb5710
MD5 7db7be6cd6ca5b1a547d59641c01907e
SHA1 c34386d87de7131f5cae8ecb8d23b9f7e1539f5c
SHA512 a4c8b9861513d11a14108672a4dd721914de1f3a3db5bdecd18658383a316cd14786fdaf1c5b5f7783baa56d04c36ce8ae47af53eb8bb01bcecdab2cd6fef2b4
TLSH
T12D61C958F629463FE446413ACC962B411F30344698AE7F2A34AC604C1E4B2CE76CD47D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fe8483f78394a17a86fb7cc1318ab7f2b78702fd7982d04cce23232bf7198d66
MD5 0970fd495d3a4456691f81b4c42c3a8a
SHA1 e6d9d841d276a0eb3caec9c8c8df00b3df8c4ea3
SHA512 f7981ccde1bd589ede7c2a79da4c707dedbd6d2fd9679671f60cbe8aad02324e37db86e12cc571e60fe35ce7c57d71fe36b4b0113596d79165bb283039103da0
SSDEEP 192:JH1d66JozGzgCl6mc0d6Ov5zbonZRgcyjnx:JVd66JozGzgC1jzbonZOcyj
TLSH
T135D1DB68FA29863FC419023BCCA61B410F36389B984E7F1531DCA4182D572DE7ACD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d4748ac9375c3808a92c46ea352bfed0323fd99390942cedff62416cd82bf0f4
MD5 5466d1cf8feadf88d52b57f718385aa7
SHA1 81f1719fa24396d80e5ff2ca2de2079e882f2f6a
SHA512 ba4f351db740746b7a3cb28b7aecb23235d5d5d6c8a1084fddb6f80abfd56e47477f74cbff446f1c0ce4adf32cac7b320b88dff9ed6a364b04ce5d24a0ec7662
TLSH
T1CC217C4C75B84D1AACC7E6AC7481128E53254F0B458B1D436D02FFCCCDD2AD971AA479
MD5 SHA1 SHA512 TLSH

Submit Download

06b690cf-34a6-4cb1-8182-b7457ada6d72

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\06b690cf-34a6-4cb1-8182-b7457ada6d72
Size 2KB
SHA256 38358523201a777f4bba1566bc259d8982801593809c3cd853f8c5f23ab65992
MD5 5a5efe1d1ff672accb68956913777e95
SHA1 1de93dbc9b380437a362262cfb9b4afeabde3bce
SHA512 217266e8e5b301ea817cd35568be29d3e7a7a03b1355f577a2344131afc923c233bd176dcac87fcff2530790b3a3f566c419446f68d35668e2730954e384cab2
TLSH
T1BD41546C36785C7B5CE7F58CD941334E57644A1350C228836E65EF088D9669E336A83B
MD5 SHA1 SHA512 TLSH

Submit Download

2148c3ef-473d-4e55-9759-0150d51385ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\2148c3ef-473d-4e55-9759-0150d51385ab
Size 235B
SHA256 bc4f2da13f96c63fe80de5231acbf5936977aa5961ca97cdffa5ac8c442ef88d
MD5 bb8f949b83627f1e8e79c9da68a9abd8
SHA1 a0a0b4627e0b2a4ac92a42646f0ba34319f9a9f5
SHA512 c2512824eb85b84f106ff0e09fd4128722b52c0b000ed1c97878b3ea233d14b88d0e39726386a79989bbc71fc050556e5063c55b8ec9d8c75318d4415d46c976
TLSH
T130D097C0149C372C08354F0AF1F078C2308C8C3310BCA820CA5184B4A9FA9C40261806
MD5 SHA1 SHA512 TLSH

Submit Download

3153137b-ad9d-4f40-aebc-94b9a8cbc6c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\3153137b-ad9d-4f40-aebc-94b9a8cbc6c2
Size 15KB
SHA256 5a19302d7ff2b467919b8623b51296ce8b921e20b7092a6f83b8918d7c4eba95
MD5 65dc27cac0790114989b220708ce7d7d
SHA1 c3d79d3b05d6a0e61a73e4f92c0e10f250971317
SHA512 577a28c92ab87101014ebff904467931453e751c0e1f78a30d1bc31da20e75457e5488a48b06fc3be3c2b07deddcc078b4f203da09c759a350726a8f302a79cb
SSDEEP 192:iyik1WPIpBTZ/9N6GzShVSEgQo77Pky2HxYfdyKQT1oSzQBrCgKCayFsmypWt/Ae:T0Ip5N6GmhVSELoXOxYfdyf3KtYM
TLSH
T1C772C9566820457A8291E369D4ECBFC3E1F538CB4C419FCADBE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a30043e-20a0-409a-b59a-58d805b11d6b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\5a30043e-20a0-409a-b59a-58d805b11d6b
Size 1KB
SHA256 61ea730fb4c1464cba272a79d59b7116dd473955f04c48876a5fb4147b59fd2f
MD5 57ffe3e8c9d83452b4115ecf65b53a41
SHA1 70ec5038cee6e159c98846528d5cbb45c590becc
SHA512 c933d0fc8c5bbb9f75daa94a03fb04ea96747b5a614bd513d7398be205bb6c8c606d2954df777e2c18d2c0ee94989da6d0972e9d6d645e2e3c19ed49072847e0
TLSH
T1552130F8592270537CA4E30EF666B71F6096603284CA02496EFC48250EE753F406771A
MD5 SHA1 SHA512 TLSH

Submit Download

b85a34dc-db24-4144-a2a9-e3131bf938d2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\b85a34dc-db24-4144-a2a9-e3131bf938d2
Size 883B
SHA256 c4f162ad788f7fa0a3b3e5354420306e5672489b300d9ce42d7e2b71fb09d559
MD5 b851e913866e8e66c513e6c53c96e219
SHA1 745927a25545d8207e0a6aba00a1ee93ba2f7566
SHA512 5ded8e1db35ad833ea1b5c956266adca3311aaec1ecc495b5619deea0f23f379bbb44ca0e962b0d9740d4e1b5c8d338d13b12360fcb4fe9f2c5bc2b719210852
TLSH
T1A111E355BA39B8A7CC79D24FC9553B078FE83523C0C995043DA0CD144D7E62EE3AAA0B
MD5 SHA1 SHA512 TLSH

Submit Download

bffc4576-3ca5-4e77-a10a-69d614aaec4d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\bffc4576-3ca5-4e77-a10a-69d614aaec4d
Size 235B
SHA256 066bac02d85d988af12344ee6b87d81c7c21163b026e96316624ad5f5bf82ac1
MD5 c83bbb6f41009afb88e88da1f1d859b5
SHA1 2ca526cde5a24cda1132ca84e3a774c0bd3f7b1e
SHA512 02571e90f934bb65a77c257b46939e900d758bff7b6c2c7c50b69a8ece8a683aa7e607e29adcf2fa14397a34d57f493dae93208b13cdd5fbf941051a993a9ad6
TLSH
T129D097D12498A7AC08100F03F0E07CD231848C3720716810DEA05838DDBAEC40151806
MD5 SHA1 SHA512 TLSH

Submit Download

d7bc165c-4c60-45e3-8bfc-30fed2c76621

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\d7bc165c-4c60-45e3-8bfc-30fed2c76621
Size 886B
SHA256 7c5a3ab7ae52b385b0e8abf394fc8c7f7808e217cb5c1717425384227823e3c7
MD5 2ff23bdbb340c158aaa414243e40d6d1
SHA1 d946e596fccb89a639710e24df972003a3e88cf9
SHA512 c1e1e359a5968c3527ef5d53e361386a36bc54295a66dda456d2649413d99aa718fe179a1cebc3bcf4d633b95797210cbf543941215333d7ca76ff040824ac68
TLSH
T1C6112750AE7CB9B68C79D54FD8A577028FE43423C0C959047DA08E184DAE51F939760B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
Size 16KB
SHA256 569b6b7bb400fe011c4372b6b5c24a3864e034c83e214057b1b9b343aaa62fb4
MD5 d09413b0bacd6cb13ce2a9fbf15ab4ea
SHA1 56c8a82e596777c6f673e8545cafcc1dcea25b42
SHA512 99e9f88cd3a1b46e45796c97d339be7a9381c59842da7a0296cf06dc1b3fb2ea7304777ad4c6bd5c14b5c83311c2c8331c7c8340134a777375c01b00b778452d
SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4Hab4h2:PI4LRfJXF4F6Z4y4U4f424E4o
TLSH
T14472421545049EB8294EA79BAA36BE01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 6KB
SHA256 a6ae6c1120daa3309c062c9083aa5e40e1378ea2e5be290338476f14810ad41f
MD5 b917e914eabdfedda03f0d392868b2a9
SHA1 d43673fb6967776f6aab546f82152395ab80fc27
SHA512 3475a25b4a53e7a38639fec3b7469304d9dca4f9e5d710aa5ab978237d92896022a3d476dca4ebd9257b8f6cece3b00926a6c043fe545de2915d73e90810f13f
SSDEEP 96:xHiUTUMqGq/fSHw1zSKSSlmdv9jqnytHlAsO7HjvsBw88n8L4cn23U1jGS:U/R/fSHwHSScxisIHzsBw88C
TLSH
T1CEE130789048CFAF64B676ACAC688C715AB2013BB7BF68D350B594C4055CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 8KB
SHA256 73de7e8a7835830716afd1e20de874dce3e786796c563b78ee8c0105eb001de2
MD5 2de056d43a78a92e409a8d6354b06a9d
SHA1 d82026c21ebb0577cc1b36980d2f941bd62fa66c
SHA512 61ada27ef2984d9c4b854c10f070d470a3e2d86d26978d410428845cc75808d87371bc4bab15b47230a071d2260e82fa2ffc1dcdc9a920ef077cc04f7a3e39f8
SSDEEP 96:xHilTUMqGq/fuHwObzSKSSlmdv9jqnytWRh5AsO7HjvokBw88rG0A8L4cn23U1j9:UyR/fuHw8SSc4REsIHzrBw88C0F
TLSH
T10E021F3C9404DF6F74B676ACAC2489315AB2063BB6BF6CD314B9A4C4054CF3441E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 565c90e0db09eecb4bfb452a8b9628e014b901c0f6b24bda5efc32fc2f7465c2
MD5 5b4cf755712030083e5fa35ad165545c
SHA1 792c96b306c05fb860bc1d72ba1045ae4bf6cd83
SHA512 fa92098efed77d2bd3789c77f0dfceba18d9e2b7847f88dca3b70028a63fd9134af286211353460190ee14f35d8ccb3655c6e721a9a95c307ccd7641e87c8393
SSDEEP 96:xHiUTUMqGq/fSrO1zS9SSlmdv9jvnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOgSS1xisIHzsBw88J
TLSH
T103E130789008CFBF64B676ACAC2888716AB2013B77BF28D650B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 7KB
SHA256 865efa4001b260dcbc67a218860c861b6594213320042b56a346159fcc83d67d
MD5 e12004dc8cb6ba09186c6d24cae452d0
SHA1 0b661bf5c268595d5c0e98859ebe890ee0495587
SHA512 a9afd8076bf27ae6f4801f131de5b9f1d7b7f315139f08773bbd16ff182a4655a9c811b3f92bab4e94ca8cedc2c6f2a13a03547dda1d04225a9110c7a164200d
SSDEEP 96:xHiUTUMqGq/fSHwObzSKSSlmdv9jqnytHlAsO7HjvsBw88n8L4cn23U1jGS:U/R/fSHw8SScxisIHzsBw88C
TLSH
T17BE140789008CFAF64B676ACAC6888315AB2013BB7BF68D350B594C4015CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 20defb44e5c5877a9615b7b20aaf9c487fbd45be1c4b78b2d757df5d3bf2169d
MD5 30aebfebab33783a7840ca39198c4743
SHA1 4678c38397b396054903dd5f6ad5d2c5ec748a75
SHA512 9628f1fe196752040b79853e861b0a7ead5e9f6f995a3ca36cc993b7e9360fadba21ec601a42cb03b9d19081eb8c79a6c59043e16090afb36514ca241ee39078
SSDEEP 96:xHiUTUMqGq/fSrO1zSKSSlmdv9jvnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOHSS1xisIHzsBw88J
TLSH
T1C1E130789008CFAF64B6766CAC688C716AB2013BB7BF68D750B594C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 016593d08dd6b306863d3e6777e1fdf26a13283ea8a7890594c41219109281f2
MD5 e4858417cb07766bb82f591fecd2aecf
SHA1 f07435b562dde16a08b77ab6df8ede3e5bf492c2
SHA512 55ca9ef4622eacf52c6fe148a0fece191d139b73540ceae7b3a26d99ac5128c410c2fabef76a5a2db3252c666a7f0b74e79664002ccba72bff78c1fad5122d83
TLSH
T1481175C7ED171ABB6F53D45064D99BEACBA52497432A40E0F60D160307ACB1BF2DE18B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 2b5df7183e9f0ddb6e40a0231ba4368946985426fdab0a5625a944dc3d8bac6f
MD5 35cf7d815848d6e1b1f0570d533758a9
SHA1 38c75d7a699ac63ea2decefa557308e489aaf8e5
SHA512 babb107b428a40b0fdfd27e9593cf67857d6360d76ebaa50a00337b749e60762decd171d0d7cb51a692a43ba1549255773a6eebec9c5349f2359438c1cbed142
TLSH
T1DA21DA42EDBE5CF21D59B36B61C85FE9D7140422825C64F0D844950009AC347BBD9659
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 231fa05911cf07467fe065b4071ba8a82defdda5ecbbd0447f4d3c6994e6ed0f
MD5 51cf9dc5995b2f6089b9a75a07b3c4c2
SHA1 e01a31fafd0658b981c9ea2c33040b88b1339201
SHA512 c48b77534db122795995e622f4d4da1a1a32145a6fb9f7a1dab37a811dad8800357d8cb652b914edacf97f7facea2902ddfc93d9a6d22d5aa11d954e09b75ff7
SSDEEP 49152:WBl3Q9jg9SieD+YhuB+GXZaW3seb0F/qEwL6:gl3Q9jg9/+GXYW39bC/YL6
TLSH
T178163AF824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download