hxxps://realizationnewestfangs[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://realizationnewestfangs.com
Sample260822-k22tqaef64

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2416	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318632307190775"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{49FE7DDA-80B9-4541-A26A-27E67DE161EA}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	firefox.exe
Token: SeDebugPrivilege	4388	firefox.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
4388	firefox.exe
4388	firefox.exe
4388	firefox.exe
4388	firefox.exe
4388	firefox.exe
4388	firefox.exe
4388	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4388	firefox.exe
4388	firefox.exe
4388	firefox.exe
4388	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 3060	3964	msedge.exe	86
PID 3964 wrote to memory of 4488	3964	msedge.exe	88
PID 3964 wrote to memory of 2416	3964	msedge.exe	87
PID 3964 wrote to memory of 4488	3964	msedge.exe	88
PID 3964 wrote to memory of 4488	3964	msedge.exe	88
PID 3964 wrote to memory of 4168	3964	msedge.exe	90
PID 3964 wrote to memory of 4168	3964	msedge.exe	90
PID 3964 wrote to memory of 1612	3964	msedge.exe	91
PID 3964 wrote to memory of 1612	3964	msedge.exe	91
PID 3964 wrote to memory of 1612	3964	msedge.exe	91
PID 3964 wrote to memory of 4436	3964	msedge.exe	92
PID 3964 wrote to memory of 4436	3964	msedge.exe	92
PID 3964 wrote to memory of 4436	3964	msedge.exe	92
PID 3964 wrote to memory of 3540	3964	msedge.exe	93
PID 3964 wrote to memory of 3540	3964	msedge.exe	93
PID 3964 wrote to memory of 3540	3964	msedge.exe	93
PID 3964 wrote to memory of 2344	3964	msedge.exe	94
PID 3964 wrote to memory of 2344	3964	msedge.exe	94
PID 3964 wrote to memory of 2344	3964	msedge.exe	94
PID 3964 wrote to memory of 840	3964	msedge.exe	98
PID 3964 wrote to memory of 840	3964	msedge.exe	98
PID 3964 wrote to memory of 840	3964	msedge.exe	98
PID 3964 wrote to memory of 2584	3964	msedge.exe	99
PID 3964 wrote to memory of 2584	3964	msedge.exe	99
PID 3964 wrote to memory of 3848	3964	msedge.exe	100
PID 3964 wrote to memory of 3848	3964	msedge.exe	100
PID 3964 wrote to memory of 4272	3964	msedge.exe	104
PID 1692 wrote to memory of 4388	1692	firefox.exe	115
PID 1692 wrote to memory of 4388	1692	firefox.exe	115
PID 4388 wrote to memory of 1788	4388	firefox.exe	116
PID 4388 wrote to memory of 1788	4388	firefox.exe	116
PID 4388 wrote to memory of 1788	4388	firefox.exe	116
PID 4388 wrote to memory of 3228	4388	firefox.exe	117
PID 4388 wrote to memory of 3228	4388	firefox.exe	117
PID 4388 wrote to memory of 3228	4388	firefox.exe	117
PID 4388 wrote to memory of 3228	4388	firefox.exe	117
PID 4388 wrote to memory of 2428	4388	firefox.exe	118
PID 4388 wrote to memory of 2428	4388	firefox.exe	118
PID 4388 wrote to memory of 2428	4388	firefox.exe	118
PID 4388 wrote to memory of 2428	4388	firefox.exe	118
PID 4388 wrote to memory of 4224	4388	firefox.exe	119
PID 4388 wrote to memory of 4224	4388	firefox.exe	119
PID 4388 wrote to memory of 4224	4388	firefox.exe	119
PID 4388 wrote to memory of 3548	4388	firefox.exe	120
PID 4388 wrote to memory of 3548	4388	firefox.exe	120
PID 4388 wrote to memory of 3548	4388	firefox.exe	120
PID 4388 wrote to memory of 3548	4388	firefox.exe	120
PID 4388 wrote to memory of 5580	4388	firefox.exe	121
PID 4388 wrote to memory of 5580	4388	firefox.exe	121
PID 4388 wrote to memory of 5580	4388	firefox.exe	121
PID 4388 wrote to memory of 5580	4388	firefox.exe	121
PID 4388 wrote to memory of 5828	4388	firefox.exe	122
PID 4388 wrote to memory of 5828	4388	firefox.exe	122
PID 4388 wrote to memory of 5828	4388	firefox.exe	122
PID 4388 wrote to memory of 5828	4388	firefox.exe	122
PID 4388 wrote to memory of 5844	4388	firefox.exe	123
PID 4388 wrote to memory of 5844	4388	firefox.exe	123
PID 4388 wrote to memory of 5844	4388	firefox.exe	123
PID 4388 wrote to memory of 5844	4388	firefox.exe	123
PID 4388 wrote to memory of 5872	4388	firefox.exe	124
PID 4388 wrote to memory of 5872	4388	firefox.exe	124
PID 4388 wrote to memory of 5872	4388	firefox.exe	124
PID 4388 wrote to memory of 5872	4388	firefox.exe	124
PID 4388 wrote to memory of 5500	4388	firefox.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://realizationnewestfangs.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffdc902c188,0x7ffdc902c194,0x7ffdc902c1a0
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,3930239391202569195,7426379084055962257,524288 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,14345895843361938920,10805716899716216690,262144 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,3554803883579302629,6566284916556225580,524288 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,2748021361749219763,8064000793580795298,2097152 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6206294850050963235,11927650065395514743,2097152 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,11341075263463482386,11591984449339785915,2097152 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,9818666867328074476,3269280023732954890,2097152 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,5825165359545626547,4307705939706496476,2097152 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,14147991619042963533,8406360257671719916,524288 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,18096347303592521037,10587521802489480086,524288 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,14772592224295960945,14586243884308944860,524288 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,14772592224295960945,14586243884308944860,524288 --field-trial-handle=2260,i,5256483474977477659,1252869341667664826,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {a0cf5283-bf00-489c-a1c9-bc8fa4021b86} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {f0d0e3b5-efed-4f81-9cf0-76763bd6519c} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2808 -prefsLen 27276 -prefMapHandle 3560 -prefMapSize 270279 -jsInitHandle 3564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3572 -initialChannelId {eedea5be-f3ae-4b8b-a3be-689b1177b78e} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3720 -prefsLen 27276 -prefMapHandle 3724 -prefMapSize 270279 -ipcHandle 3824 -initialChannelId {83fac987-77fb-4932-a4e0-43183e9232ab} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 34775 -prefMapHandle 2968 -prefMapSize 270279 -jsInitHandle 4040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1648 -initialChannelId {aa5fc931-4d14-4d00-9204-63eea3e5e3a0} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4840 -prefsLen 34931 -prefMapHandle 4844 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {231a52ed-4d5a-4a9f-9612-88a9d02e8916} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32952 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {90e72c2b-e2b6-406d-b71c-4663766fb312} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 32952 -prefMapHandle 5332 -prefMapSize 270279 -jsInitHandle 5336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {304c48fa-122a-4780-8e62-22721a130eac} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5336 -prefsLen 32952 -prefMapHandle 5332 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {ba26c2cf-a18b-41b7-a7db-8a851deccf8c} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6204 -prefsLen 33031 -prefMapHandle 6012 -prefMapSize 270279 -jsInitHandle 6216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5992 -initialChannelId {070e55fe-7977-48db-9b87-745cf9213251} -parentPid 4388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4a302129b10cf3ac8d6fd58a3a115f3f386534b351087f5a1cace69357f97312
MD5 77728a4729b6fd40e598dd660abe576a
SHA1 68496608431a924a2d7c2121e8150e4f311e8140
SHA512 f142cd9419f9f0c16da905686ab4285a9458d6c66c5b6488e9a2585b7c19e4585467885a2c2b0f98da0edcf3314d34c539118044e770f5666f21a0196dfc6daa
TLSH
T1D6D02330A9DCFCE0E0360438813103027DCD8A893483A307B000441E4C753C373D94B3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 542201aede71affd73baf241642d71bfb8ec10c963f5cd13eaab5ad83cd7a6f7
MD5 cabc1560908ea5a08d10f8568fada7b1
SHA1 8667083e7f6bad8b16cb51cbac0197e9bb8b6ac0
SHA512 de8bc719cd27e58c1bbe63b51323af2775b8d8914d100ce829d06786f74788422b8298736ea525a7bc0789b7547b40428037a3c33e2b1b81917b420c2680aad8
TLSH
T14A61936D02446642F332B630D4E9170670B1ABFE08175E5983E49D3FD62F7E6C94789C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5897a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5897a7.TMP
Size 2KB
SHA256 e537247f21d294a93d0665a2c0f591a04f30a960538eec0490c0e4b197fdd4b9
MD5 b8bbaa2e1a80af2506fa9c6b2726bd7e
SHA1 e62183761949f60936172a7dd7f72819a785ee84
SHA512 c456f91e1d1b630f7c339e29df6716b9b403f7f690391353eed31ad8e6d60b10da15e1af043814bd6a5291e8d00184d6cefb2416f5d970667f932d66d964af4a
TLSH
T10451816D03456883E331B631D8E91351B432ABFE08174E5983E09E3FE62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dbdbd75-bb0e-46c0-bff6-fdf9c273d4b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1dbdbd75-bb0e-46c0-bff6-fdf9c273d4b4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8b42ff2fd1f76cba61b18409262d354f818caa7cf41d79e53343f90ae026b205
MD5 db965ce76e0dd0940085347b30aceed2
SHA1 6b94c2515926423c71f5988a2becabfacafaf4b1
SHA512 b2eacd6b23fb00d5af63be1bd73afa0333f50ad84c4bd3c9d32180e50c61a7124ff4ae9827d09032a2ffcdab0ad96014f1887043c50519f7543e630bbe5ad6cb
TLSH
T1D38167B7C3E9C12D8C4116F4A715AF1ECE291A14422C3D2AC8D8BF5B93E2931D216A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8337d49ec78f026d6a7c34ee6ad729b348403287d2644ed9e32dcb2e327453a6
MD5 4b4297e8aef8f9b1163d6818e6734aa7
SHA1 c01c88d03392e880f0f6c85aebd0fd8d92f0d13d
SHA512 8c1229f8ad247c6e644c8c229bf1efdbcff3b96a04005ce14d66a1ed2d64f0bd567d57620e7df29bc6393ccdaf69f33a7c67882b33308a68bef65e4cb6bc9be2
SSDEEP 192:sxZFRYk//fnsFJ0SIdpqUeHW6+WNrBV/YwNgWHIgrJ:sxZFp//fnsFJ0bGHbT/f9
TLSH
T1BA22CA126E74A93B4CCBE209BA15BF53E7F9503191951E98EAFCC61C05E6ADD230B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a680d4109c4462d11bc07608f371b87d0e0c94b10d52765dea910c5abaa06673
MD5 9aba2ed4dc9972fa55c2669b17173e55
SHA1 00413da4ad23c03d7a2a481d0b14ad49ac51c3c7
SHA512 bc79f23639a45b88d2700dbc311c66592fb6f1fc58683af5406d4d280f3e07d049883b580d44cbe93f1dce7477119725fe84cb1de88978661aee75240f761185
SSDEEP 192:sxZFREk//fnsTWpVVJ0DIdpqUeHW6+WNn2BV/YIRnZ5IgFJ:sxZFx//fnsTWvVJ0cGHbG/Xv
TLSH
T14832C8126934A97B5CCBE21DBA15BF13E7F9502291D11E94AAFCC61C05E7ADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f118dcdbb32034b36c0348efb8da83c006fb05384f23e27f42072f2ddf14889a
MD5 0ba5675b8b56f223bf8b80935d88416f
SHA1 35ba9ef62c40b9b1b7574e4650b4654b95d00cb4
SHA512 24312b0b753fe15d81c66f0f96beceb7a97fa73c6fd600ed49a073b8bab95180c4a1d11ec048f84ab9e3a41049683e7b6ca441063fdd2fba636ccfeef4838acb
SSDEEP 768:aizmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DiCrofNya1:aizmjYDmWvmKyEu1jakPLZQDiZVD
TLSH
T153C2F93B244CCF7E4FC01A9DDD5A6F973EA802C76A588D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 8008f1bff5ce857f409e1a80c1a6ef5f009fc6c8cdb9118a1f99ca94f4343673
MD5 354fbe719cd98fd5e447ce68143e96a5
SHA1 89478cd5f2fda9daedd94e177c493f202253880c
SHA512 a926cc6994687549393a35a3224a395c6a8861e72a62b23fe7dec400b5d8c4de15be11eedda09a25a5ee4a5f288a141ab1af76a7042690fbb8ee0ba1f9a49632
TLSH
T1A0A0029027D05D57F9804AB8519143C1734159344130971F59D915C598B61538D41088
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 948576d6c5a823463791f8dacca07d8352229b2230f9acfb9decb42c51330064
MD5 62a78f4e567fa8b1b07a74aa02faba35
SHA1 cc9e48d5bd57d5b6e2ff22debf2cbb530423bf82
SHA512 c931561b0e069db8e9b304ed6f9022434ecdf9453ac66046cd0f22771817692b71bf3d5a0de1ba4c634679522038016bcb4e73c5b8d473e05744a6d4be9b2406
SSDEEP 96:KEG0KXqSqQ4KhqzgzcAO2m2o2J9mA2KeTmK2a4gB6gnK:CfnQgzcAO2md2JAAQTmK54gB6gnK
TLSH
T1CF91469631F782412D3E3B1C8570DB5E9A827A633029E42B3BAC42754E67E119EFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4cb2887cec9f99f1ba5030894cf571bab0616ae5799ec38012e51a3c831af2e7
MD5 e3bc532a91b5f77b0f4f7c2c61aef973
SHA1 1341f3be334b39c683c6e4fb34a610893ad115b4
SHA512 336048ad24a6b7629771d28014208d78d06c3e58f0a5688feb77f1d8a7b93363243ff40f68a1ad3a593d886adfa9e6b25d6ddc1d813732f6ad00e807e6ab12bf
SSDEEP 384:CZcIhsNMnhJt0iYf+9OMYDuFu4AStv47k19U6wivf30o+:whpAoO7gwSD19UpinEZ
TLSH
T1C6A25B7098A85CF708A5DAC1F446E5076FB8403BD5C8698CD5F8BB3D309FAF91326826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 663aa750b9572bef416e91e74e69fbda5e760f60630956dfd6d91eeb378a9654
MD5 ebae75b09b651f6803db651a61f7ecb1
SHA1 1438ede85198ec75f3942588b91c239b4d6a5a3e
SHA512 2b0b3022f3335e88917bc89befecd1c91b57b491b9fadd90d90e9566f661c17f564e00edd60b4e308e48127220fb1082c1e588eaba6dbf18f2030d19937daa32
SSDEEP 192:EOND6hZ0QmiUy55pc/+jVfO1SYo25wOZiJL0U6:EOND6oMpu+9OMY42k0U6
TLSH
T14302D93568686C778EE2AE45F48737239FE4112BA9956FC4DAE81B1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 67fd982a700e8b90d2eb8c484976cb03584c8bf3d227073c31ca652b6eaa8630
MD5 a10754d3de6000f6a7796da482cdc72c
SHA1 f7a828acc5253f2b638ff5f65a0e7b495f49380f
SHA512 f809651a3837ee1ebd4407ba720718ad8ef12d66971b9fb4d6cf94f6882369fddb838588dec30f39dab7ca30fae37cf5067c4bed7a2538a128c92668fa01a412
SSDEEP 192:ZONt6hZwQmiUyQ5dGc/+jVfO1SYoQIel5cOqOqAU6:ZONt6Edou+9OMYD09sU6
TLSH
T16E12FB326868AC375DE2A955F48735139FE4522BEAC57FC4D5DC2F1D00DF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f3cde30af51a21732185e80f73c918b548b36788189684934dedbb0ba76cdaf2
MD5 36e902d49282b4ff9a1645efb5c9bf96
SHA1 1f2856cdec12f9a7d78f9ccb9295562628daf899
SHA512 13dd16969992316c20d5b4e79e352599fe8e6c5b8e76015d7f776e3b7be444842cab0879a22810de03aad86217009eadd5fa840b94bef3f51311509756c10d7a
SSDEEP 192:uUm+xasuheOwQxMGsNMnQKnJMZEGlQmiU1PXH4H/+jVfO1SYoQIe/5cFTOqAt4/8:eZcIhsNMnhJt0xYf+9OMYDuFsivf30o+
TLSH
T1A9827C316C789C361DA6E645F44735179FF89027A6C97FC095ECAB2D00DAAED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 02883bc09f41ef20387c356bb250b2165a05f3d7a418f153ee5b025bef8f21c5
MD5 0f8ea340f229b8f6dcf0332b4e068fd5
SHA1 86de17e9f98375bdbd0ad74b7c4b00e492a4da0e
SHA512 c4c3b640c14085ed1f8ebb6475efaecee4a2f6ade8da3c0beb81d204c9d41769ef215070dee29cca4b0c57e50b1ce6b977f68f9a2d22872871cbc2fee16976cc
TLSH
T1AA411758B6F90148B3B77E1A9BF2996D487B78772F0A945E10110D8E4A62F40CDB2733
MD5 SHA1 SHA512 TLSH

Submit Download

22637

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\doomed\22637
Size 94KB
SHA256 3a39714a543de96fe922f33614cd8ad12a7f2e2825ddba63c2094385d770052b
MD5 1e6564926f549a5168bbf40ba4596063
SHA1 26bdfbced6bbd3e4ecc35333b42f59359c9a990f
SHA512 b821a3c49ec956ed9d2d6175e39f3cf3bfcc9837d8ecefd8e147092269d61c24af9c28cbd5242241b95298b0c72b407b369df48ca8765342ed75f3356ddf846d
SSDEEP 1536:zs9LEUefe1+85efXGsVYFOgc/bBdXrULrmVaQRKTIIeeD+dNTtIRdMgIyyaoTOkz:zs9VD19UhYj0bBdoLCLKTIP/t+/yaoTt
TLSH
T1E393127BBD4130394C9303ECD84A29D2ECB9CDC1DFA6592AB0E43F4767DA876D991880
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2368

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\doomed\2368
Size 74KB
SHA256 a409d61ba5488f0ab48c788966a611e62e690493021e86889b218b31ef1d9dac
MD5 c58dd023458f594253aec641af3a95c8
SHA1 92f5624c04e7d37344ac3e1722a550ebe158b56d
SHA512 24c86dca4f7eebfa49a0bd665c49f2d99dd0187d6c50af4d7a6436b21e39133d72fd9f89c6073136ce4833c38e7a40c7b210646f55ed9a5f770b039174bcd455
SSDEEP 1536:pZm33LoGmhj36FBQ3QrsQMKXLVmqo1Fo0bB/D/q1QmM9nI01aoL:K30GmF6Fq3Qr0+hmqo737/UnM9laoL
TLSH
T11073023FC81EB00679E1852E8149745EEC1527A3F2D7A48092463A1CAEED7DF7FB9054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03D74D5ED346B6A425AA45C38A54C3F6BCFF5085

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
Size 47KB
SHA256 eca3d9d8f0ebbc3eeee2ce603ba2086ae34711cf17aeff37d86b45bffc75def2
MD5 b4f983e2f3220ad02f767a92a610b001
SHA1 d9d41a8365f761ab3b15dd9a86dea544af8650f3
SHA512 aa8bf60919031f805137c26f33be2f947aebd79738ab095fcb5147353a01a53c2f85d441d7a7112fc7ddb8004b4005aa1ae12d930dab8a2d193fe36621381ef8
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uz55Gm:eUEEoBVQDjeQaLnP2pfZTqgSE8/rw2z
TLSH
T1D323F137184E3A60C241F350D4DFA549BC82F512AFE299AC90787B8746093D95FE52EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

472B8E216813F951583927AAB9A3216AFFC3F223

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\472B8E216813F951583927AAB9A3216AFFC3F223
Size 96KB
SHA256 8fcd8d7f01b17b34deec35818c409ae575f541b6b27278d339e9d1fe9b9b494f
MD5 dba68bf5d4d14dc2852f09bb738f5453
SHA1 c78d72a4aed402f8f045f5e815bb2fa2c19cadbb
SHA512 6b99a9611a4f2886e923cc8868da0ba8ff730beb1a8ad119216e56f23f33b1ae17109fd4c5cb495995a6da3ef3e77c538016174abaf0e46983ac004022557797
SSDEEP 3072:6sm9F1XcQWNkyqFTsUUr7Kxv7jVh9zi7/rY:5EXFWNkdF7/hifY
TLSH
T12BA302BE7EC77355A0D5A660A6C17E4C6F28620FBEB3F0C8610D58E457C0AE0946578B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 5df1258a518be691aa82469fbc2e15d7ecdb0c7cac222f523859ba17c588266b
MD5 020932a8900a35a65ac4390f4bf2e30b
SHA1 31c65fdb08f7f3108b1a015a7cc457c4fff4fe42
SHA512 99ffd0faf1c66a4e385496522899c705362f526f2de9b84c6ec8c7f7e716b195b4895982c32d9cf2e23f743172733becd7c1541f05227a12230c28326c8f4215
SSDEEP 384:HXkRyiO024YQDL84KKDL849B7SOEAd9KVRaAcP+AWRMAtS:3mZYQDL8lKDL8CB7S/AmVAf+hRMp
TLSH
T1CF727D7D4F003CAC25A7C1E8C5F992A94D18B7A7DFE6C0AD21183D0DC698969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 12KB
SHA256 635bc6889e3b785fed533c73159a5b160fac4f2494911ed263e0024ae974afcc
MD5 0a0f53317e68de548b1c19d08d97a3c5
SHA1 7a1d9bfb8b6507d4f1e8b49af3e327c467f50e8d
SHA512 9eb4e8e49d2efb06db14065b8a9a3dc6c892b6e8a7177432da8604899fb6ef4a83ae5b276a871e510ef7da69855888139e69ace5fba6da218456c3d6366ecb05
SSDEEP 24:AuhMZm9VR0+91z089xv049B703g9Vvp0ZL9lxQ9BbsuWN9VxWATP+lz:ncEquKye3qByZpna9suM/pTP4
TLSH
T1DC4232F72B72A462F0A28FF49059B48C9C335726596C9684C744A0F702D1BD9907FBF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 10KB
SHA256 88eb04119ca252fcad2e1682d67ae55395cd7de402355998ebd05d6e5f23ac49
MD5 ec070194a2c9e059fdb6424212d95726
SHA1 93e9681b89021eaac6ebed3958b31e7f91503d1e
SHA512 cb6deb2eb13f258cdf80d7ee650cdeec9d154ccae8bd61aa3c57f24c30f0b52712e1a391b227a7b90f71014271f39eb85d470ce57607d211d4c8680fc2367c93
SSDEEP 24:XRuhMZR6l9Vvli91qG9xWT29BS69VvUZL9lxQ9Bbs:X0JlQM8swwYBUZpna9s
TLSH
T1812223F72B71A463F0A28FB49099B18C9C334726597C9584C644A0F702D5BE9D13EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 33KB
SHA256 82d49e31ee12f1f6b984660f402920c483dc27483600a6e0dc017a40b12d9d0c
MD5 bdcaf604d14ae333175dee19abb41cf0
SHA1 2a9d61f80a0483b3c853ca1844efc9c8a01e1f84
SHA512 0dd0421f36f598b31bf2a811b6c28f969b217a198e3506d29098a543083a9d8a1c33d44b6ef36a50efd971ee8e423d67bc16555c431dd3ce8638bb86284db832
SSDEEP 768:IXEAdjILNM/LRGn7KGcmhuObKDLACUbrbyHm:0ILNcLRGLb0G
TLSH
T1BFF21044FB2A913FD41512BBDCA50B142F79B886591A2F6B3A4C646C2C872DC3E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3c4593ef92bc231f20758605cd5c5602d05fb8ffc0ecb07ac049b12b839be2f8
MD5 13266a5f5facea1b995d21574c2509dc
SHA1 e12425e61d5bcd637ab137ca0b86def7f8ab8517
SHA512 83b2f14c7e2154cf73d1fc2b7f1da32c80c2d3efc2787a2a4f109f26ef946a69be0125b71047e1b145a78967ca1d10c65dac535e7017dc7e8590d93894242451
SSDEEP 192:B11d66JozGzgCl6mc0dIQcOv5zbowMxLpyjO18K:Bzd66JozGzgC1j3bowMNpyj+
TLSH
T10FD11E64EA28463FC448027BCCA61B424F36395A984E3F2935DDB50D2C8B69E778D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 26d402483c2c0ba7c92f0de5da4356fdccfbfd643e331424b2c803cd48d3b5e0
MD5 114015a31a223103a29c15e832fa4800
SHA1 9bc178d6741e6f7c2fd8ee096b946deabb98501b
SHA512 786a2015d4259e6e3c326d050beff9324550501cdbf1fa21e9fb9a50bf1b2dc3385aadca7ba9a917116fca07b6f61a2c555ac133106900f9e9f42c1d6b63166b
SSDEEP 192:dQcOv5zbowZxLpyjO18Z11d66JozGzgCl6mc0dz:sbowZNpyjlzd66JozGzgC1jd
TLSH
T137E11F64EA29423FC408027BDCA21B454F35389A984E3F2935DD751D2C8B6DE768D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5859a6fe25c6c4a57adaa5ce71ebdb0b4a5535abe195c5ca2b4e97386b5e07c2
MD5 dbb6ea9be997987add4c7d4360ed1973
SHA1 e6989ae4aa55a9a3e1fb72d19c9b45eac147d542
SHA512 3c39cea8a6d61574c2953ecae9cb1dd1e95a6fc30dbe2081e2f2bf3119c23b9a7608dd9a10772b355d3e6836e64f4076da038ceadaa465031292846b3ef1c7c8
TLSH
T1D3214F6C3AB88D2AAC87E25D744102CE63954F0715871D434D42FE8DCDD1BD9326A43E
MD5 SHA1 SHA512 TLSH

Submit Download

526afb58-3764-48b2-ae63-9319e392f504

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\526afb58-3764-48b2-ae63-9319e392f504
Size 235B
SHA256 295dec181a6b42fda6d946b0f3c352edbddef9bf75ec68940888c28abb032d69
MD5 b46eab71473dea7bf7f7dbb5719f6133
SHA1 03504eeb2fc34972f698b9abf2da57dae4693a75
SHA512 e58459978aacde7d7f0bc154f4fdabf8e4a4b410024f77d53a12d3cd9234d700b57ce26b1a0635a92293364d0917b8f408c04eb60bebef862006b402b0218bc4
TLSH
T121D097D02498A7AC480C0F03F0E069DA30584C3314A0A82099508978EABD9C49151827
MD5 SHA1 SHA512 TLSH

Submit Download

79a69ddb-36b7-4426-9e2c-5942a38dddae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\79a69ddb-36b7-4426-9e2c-5942a38dddae
Size 15KB
SHA256 c3358f6748d9c1766dd08a92fef0afd3bf608b50b3017424f07f3959bff10031
MD5 f3e8e250f59186c1462acd052a2ca34b
SHA1 be52d35754f86b1fa3733622563c099c4ffe1189
SHA512 37764a5eb4a214f94824fe9f47feeeb7cbb2826226329d2cfc8c341b7f0afe0d0faffe4537999836d632bdb722c783af1af43579fd6a61b011b5a600b324eebe
SSDEEP 384:wbsTHfx7STmjCmzS1u6HO5xQ9zat80H7q/aZNbEjo6nP6HfI6BW+Ikmn:wbsTHfx7STmjCmzS1u6HO5xQ9zat8w7a
TLSH
T13E62CCFDCD12404B3E65D51EF2E6E9AB2057093249CDC7DD69FE083A26C6977122B318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa3c32b8-29af-4866-a8d8-36770f8554ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\aa3c32b8-29af-4866-a8d8-36770f8554ee
Size 2KB
SHA256 0572a8e347b9a73fcb3bc7ccd7ff90329819335fff79295f170502fbb086c851
MD5 7cf72684c02ba3e4deeeac68af425d40
SHA1 bd9a1856b196a069706e73d8221c4b24400a68ee
SHA512 0f43aaec4c46635d26cc87b538ca8bfd5f837662d42ff591a2b6c25f59d1ca3622b0a6ed8b3bd741482936a73ce0157592bdb46bb325f93ac38ead9babc6a1e8
TLSH
T12741475C36784CB64EDAF69CD4D2338E5764870340C628532D61EF0DCCDA69D236A57B
MD5 SHA1 SHA512 TLSH

Submit Download

cbda0b08-bfa1-4361-b0d7-de0a637922d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\cbda0b08-bfa1-4361-b0d7-de0a637922d3
Size 235B
SHA256 099042dbbf6b317cea76a7012d9a852af77405ae7875140229c7ff4d98db88d4
MD5 80ff12948f90bcf28849b0f534421c96
SHA1 4f80495d64f358132b45b4031473354b10380348
SHA512 9388b06e03d683261d56a7a05ba8e617b87d92f5310babf0bd6b79273ffe43a4dc3f4915082f8372ce6fb0125ddb0cb881cb5c403926647a63e83bf69bac9010
TLSH
T1A1D097C028A86B3C0C046F0AB4F069CA31844C3360B068608EA00878EAFD9C44291926
MD5 SHA1 SHA512 TLSH

Submit Download

cc6caf0e-9669-4f7c-ab8c-c80ad8408833

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\cc6caf0e-9669-4f7c-ab8c-c80ad8408833
Size 883B
SHA256 2e0808435757ea4a1acbc46a9e79c2f86d34d675ede0dae82f7e517eabf6e196
MD5 3965b5a663cbd869366c21a1fec190af
SHA1 ce97bc09c6f1bf015e20c6054a851832e37e9126
SHA512 49e05cf33b0307edeb3f78f4197b72b6840e391b48361bcb7afde0c6d400131d119563aab4877b632b415a666e3a401c4465ae87e8e2b86a48e38ed07a6782eb
TLSH
T1331100809635B5B6CD68D25FC66137068FF4761380CA44243DE2AA150CAE91ED3AA24B
MD5 SHA1 SHA512 TLSH

Submit Download

d0c5c062-98ec-4c37-a855-adc39b0efcf2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\d0c5c062-98ec-4c37-a855-adc39b0efcf2
Size 16KB
SHA256 e7c3ec96428aecc9f88c2df0ac33daef5dc7de4d149a20cc7bc8d072d10af2d4
MD5 7ecd5d5a82c314b221cd7355e31be518
SHA1 9e12eb6141e8c153c850f74e4f0f1885110a8ea8
SHA512 9f95d16cdaba75ee222cd63a16ac2dcc56de54eb70c1e2cfe2df78033f0bc2c3dd736f739c1dcf6c167e4ec3c9e489bd5c9086daeb849f018a945e9c3d255b90
SSDEEP 192:ZquyYJcKRw+iKzebLqwBoZ9+yO7H12Bn3KA50Z/WBjTvRjULydfFn9BE34LCVmeM:ZquyYJcKRw+iKibIZ9SE9B02RC8KK
TLSH
T15972E956243045BE8651E7A8D4F8BFC3E5F528CB8C019FCA9BE4BD086DDE0AD512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6b34697-f193-4cba-a7f9-ed7c799d4664

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\f6b34697-f193-4cba-a7f9-ed7c799d4664
Size 886B
SHA256 e6a4a85ed0304180589823d13ae5c15e5d0281288a10316887bb98d43ad951ba
MD5 bf42bbd172b92bc7070affa51aea20d9
SHA1 e76ea8b8d3f96af2712e8f337280912c438c1f26
SHA512 2d6f35c9418ec0199e6d5ea3d4afe408a7d26a92c7b545924e04fd6bd7928aa36c6efc653984e84d7d306b7e47bd6d068c0f923ce1510b3f65567fc80c6dac38
TLSH
T164110040A675B4F18C6CD2AB94E177478BF4312380C649247DA1AB184CEF51EA3A760B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
Size 16KB
SHA256 7f906799024d816e070c95aea6aa38b19be47d277e7f400b9d2f86ae849534a1
MD5 8d6b6c1fc885614c48c49d0d8c2403f0
SHA1 aebb814e62b06a62ac3d196ae1459cc7a5f17f06
SHA512 59767135a818946e33de09fb9a8050a33ec982070e26b3fcb0071aff5ec053cf2e41f3ec11037ae87f168831077e54639935aa3b96a51c94fad3cc0b0bd891ac
SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4HZV4hA:TI4vRf2XZ4D634q4V4c4D4/4a
TLSH
T11772511545049EB8294EA79BAA367E01C37D473B70845C78F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\places.sqlite
Size 5.0MB
SHA256 d0b707e08dfe8423e6939a8920ca242809f7ee6f4a0a19ad76355a98e94ef17a
MD5 f7cf41fe9acd6771ef192efc01e1ebfb
SHA1 3e3b99fa2bedd7ca917691dcdad51f2be82c1d1f
SHA512 ad9cb338641927a3c5af3c58290b493ac5ce3d4acd8f78673164cae924b065cf0ebcd84b5544338bb96f445480fdcb4792bc86b5727ee819bfdf74012ca646a6
SSDEEP 192:M8rJQaXoMXp0VW9FxW7aji+hz3MYW/iDlonFnGBXI6ahruRvUE:M8r54w0VW3xW7aji8z3MY5uZoXI5u
TLSH
T1F936705FAE211041C4DE9232ACE32F19583FB05696367B833EA4256D4DE0762B91DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 12KB
SHA256 0da51aa81e43040a1157f07464189cd0f829338df4760bb7ef38e90b1e46230e
MD5 da9b53fa72ab40a40d6864a70cc06421
SHA1 d5b2041b2cf9295a672e934df62a5b5089cb9357
SHA512 93f79ddda6da40b31b26dc96613c46093b2864f0f8cb5806f53969fc278f59c25e0f000e9bb3c8ff471d733636d636024b0e47534086781aea5880e918c5a08e
SSDEEP 192:L+HRgafObysDSS4LRYlfWgOBw8O9zKfI32O:LratRMmwzjR
TLSH
T1D04299385144CB3F24F6327DAC264DB119A10327B7BFBCD206B9A496445CF2441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 dbe78e9057bc63b12741680f87ef1cf61a390eb0bd0457e9ca2d952a74da5176
MD5 bbd8b68d8849487d1e6c818dccb19849
SHA1 05d6c3e82de003a626551616b0fe31e201b20dea
SHA512 1891b4aff2c7a0b009619804ab0c8aec303d61339b29d489d76c5ce1e0416d30a8c88d2ea30c8f29e3c3315478bbd3a52e0d57b068bd5bfc62e2ae9014d6b0d0
SSDEEP 96:xHi+UTUHqGqgaf0io1zSlSSlmdv9jbXnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ioQSS6w5lfWTBw88qV
TLSH
T147E13F7890088B7F74B677ACAC688C71AAB2013B77BF68D750B59485054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 8KB
SHA256 8102fffc0c4766d39729a4a97ee45a0b0a32a15c7fa43db36890ae1e1c7b6342
MD5 eb18c2cde2043469d655059cf195b2ae
SHA1 04f9f098da02eb519fda9c0f861e471ea8ce17ec
SHA512 8bd8726a5b30cb0d12ea4e4b375ecf4edd7ad159d6fc9bd92ed3a4d24c0f26924acaaa0fb0d5da49c1e3af14bfae583d0d2149aa4b3959e1211b2fc7ea4cde22
SSDEEP 96:xHi+NTUHqGqgafObyObzSSDSSlmdv9jH4nuWRa9lNdHW5Bw88PxVm8L4cn3XHAGS:k+HRgafObysDSSRRYlfW5Bw88b5O
TLSH
T119020D389004CB7F64B676BCAC258C715AB2023BB7BF68D750B99485415CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 7KB
SHA256 1a36df13df2dd2e999b5f6a6c4613e7a3d8affb5e41ce1fd237eeceee513a02b
MD5 493a2626532c8c3cdbcd6d534f2ee328
SHA1 794cd03bc1ba5d6bae7bd94003a710f53c1ec86b
SHA512 4989bb7e700e2aa4f6611b1bb789718bbb9d491c53088c429a39ac728840336d1c6d4a27cc741129393daa201c0d96188377bbf3fb17478847685d214b0bf984
SSDEEP 96:xHi+UTUHqGqgaf0byObzSSDSSlmdv9jH4nuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0bysDSS05lfWTBw88qO
TLSH
T189E11E7895088B7F64B676ACAC688C71AAB2013B77BF68D350B55484015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 14d495c797204edcb177250715e9afefd82d91e8a90fb22a4b2a00124a417c8b
MD5 b76dbe3184458b8daa6482494c9c3b93
SHA1 200879160e6f6a79740538581e6575f6e39afcc4
SHA512 faa5de123c1a8a52429b5d7377cd9367ee3feada244f2a1b66d3aebe9ea8aabc3c1776627dd84a68983a2c972ca7f71a4444925b70ff4cbdd35098fad6bd871c
SSDEEP 96:xHi+UTUHqGqgaf0by1zSSDSSlmdv9jH4nuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0byjDSS05lfWTBw88qV
TLSH
T19FE12E7894088B7F64B677BCAC688C71AAB2013B77BF68D750B55485014CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 7dee89e6eb9a0c6825ccec90dd61548ce69c2f94d9dc90cf3233f4e0dff45cef
MD5 8b93b1fdfe7e05be483a1562ba9c1efc
SHA1 488e8fe706041c9220be118af10a5cc95cc88cc8
SHA512 c6a031931e3b704740168f45c1d151dc609aec86c40ee1d957810d18d85430576f1bd227a772b72ed920bd6cdde2754753c23f7e125e3bb47d758ed0df682fd5
SSDEEP 96:xHi+UTUHqGqgaf0io1zSSDSSlmdv9jbXnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0iojDSS6w5lfWTBw88qV
TLSH
T1FEE12E7890088B7F64B677ACAC688C716AB2013B77BF68D750B55485015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 a2c958cb9265878c33d606d9761c3b285ffcfbe403d0da44e963e2566086b044
MD5 ee753082c9949c69722ba24a7e87e99c
SHA1 6f15c400a3748d5b5f58571f129c9f96fa40f6a0
SHA512 5f5a074a15534802b9e752509501dc238f364ce03f68077562fe4a28f1d979be9ce5d72d6be6d761f34536aca197228fd7522c35373c89ada2d4f6dd3898c43c
TLSH
T146516CF31C1B74FB3A75D626AC9F4FD40DC3102058BE11257669AF2242EC70A8196E4F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 897B
SHA256 e9f90b84c71736b2aea07db7450db1b71a17927e65c78dd86417cdb3ea51c629
MD5 d5c7c0c26c297561464855d385885dd5
SHA1 29e7eccceed9e4e5bcccd401daafed10364155a9
SHA512 c226b954714f9c9c63e0033f359af9fd8934175ac82cf61e2b9aa5590f69ce91d01b568b16853699d6c74d1803f18d78df725f60a747d9037b89ed766fd436d3
TLSH
T11A1167C27D0A91F55B48142F9485AFFE0ECD2533467E1990E2DD65010A8439F254B54E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 97c011ab3722eb14d375b47d8cedabe78b72aefa23c6da352d37f3144fe73fc4
MD5 42b2a8e6afac8ea1d39d81f8419df1e1
SHA1 89e4a20ae2c0670b633202cf3a94d614460c91f4
SHA512 b888e7295e3ff508f872fe761f25d4d086b3dc221a7d89f57e7212ab38bee6f9184534d89e7f855008dfcba6bc8daf1919bf71e338ae9ca2b126eae71bf30bd5
TLSH
T198716CBB1D2A21AF9474C9389CDF4ED9C9D2045045BF5149B7386F2211AD31AA805D6B
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.6MB
SHA256 d71c4a74ada041e5ce8f6f5b47d140254a997ecfa9d9f60aeb1882e6eae83af2
MD5 b71db8bdd4c6b0c7b1feda6fc6f3255a
SHA1 8b40795d27c33b30808ced73f6238c6ded822e17
SHA512 9f63bb646f61c430e26babad9b4fd138a7ffef1ab87b00a134917cd70d591b6a62400f37dbb73760f3afb5066b7588758ea74af2b05c8a5073c429fcc1637599
SSDEEP 49152:D9yWkzn/X1De7y2D3/YffiIy4lu0MPZA9IMNKdjVLQzZZZwJX62q9h/eYX4dhOcs:tDhOcjKrpakm+T2
TLSH
T193665CE420E29252F34144B3719A53EB11EFC00C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads