e7ab1578e1b8c23bd263e366760a197a9f380be8bf07cde36cb163eef8bff331

Resubmissions

31/08/2026, 03:50

260831-eecy7awzbw4

31/08/2026, 03:44

260831-eaks8scr5x8

Analysis

user interaction
yes
max time kernel
139s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
🔴 Void Tools V2.exe
Size 3.1MB
Sample260831-eaks8scr5x
SHA256 e7ab1578e1b8c23bd263e366760a197a9f380be8bf07cde36cb163eef8bff331
MD5 8db4320774f663e6db3f534c950fdf08
SHA1 f0674525c2305cf31f31fa0856c1036e26a5476d
SHA512 face17bec25a922c7a5c8bbebed40248147858b27fdce240b81856d84ff6f49cbf60165dbded0f74e7726bd103c8bd47c2b936eda29e693864e795af635c8925
SSDEEP 49152:ZQ2+tq1exZXjs9g275a8Fm8jPl7/oqhpCVjiVSXj:FwY9g6RjCVjY
TLSH
T15AE57B5AE7A841A8C0D3C0BD891A5403FA7338461375EAEB92F085566F277E06F7E770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
45	4800	firefox.exe

Executes dropped EXE 1 IoCs

pid	Process
7656	🔴 Void Tools V2.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
6	api.gofile.io
13	api.gofile.io
32	api.gofile.io
33	api.gofile.io

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	🔴 Void Tools V2.exe
\??\VBoxMiniRdrDN	🔴 Void Tools V2.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\🔴 Void Tools V2.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7576	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	🔴 Void Tools V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	🔴 Void Tools V2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	🔴 Void Tools V2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	🔴 Void Tools V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	🔴 Void Tools V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	🔴 Void Tools V2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\🔴 Void Tools V2.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
7356	msedge.exe
7356	msedge.exe
7356	msedge.exe
7356	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	3708	🔴 Void Tools V2.exe
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeDebugPrivilege	4800	firefox.exe
Token: SeSystemEnvironmentPrivilege	7656	🔴 Void Tools V2.exe
Token: SeDebugPrivilege	6356	taskmgr.exe
Token: SeSystemProfilePrivilege	6356	taskmgr.exe
Token: SeCreateGlobalPrivilege	6356	taskmgr.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
7356	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
4800	firefox.exe
6356	taskmgr.exe
6356	taskmgr.exe
6356	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4800	4100	firefox.exe	90
PID 4100 wrote to memory of 4800	4100	firefox.exe	90
PID 4800 wrote to memory of 3208	4800	firefox.exe	91
PID 4800 wrote to memory of 3208	4800	firefox.exe	91
PID 4800 wrote to memory of 3208	4800	firefox.exe	91
PID 4800 wrote to memory of 4508	4800	firefox.exe	92
PID 4800 wrote to memory of 4508	4800	firefox.exe	92
PID 4800 wrote to memory of 4508	4800	firefox.exe	92
PID 4800 wrote to memory of 4508	4800	firefox.exe	92
PID 4800 wrote to memory of 4644	4800	firefox.exe	93
PID 4800 wrote to memory of 4644	4800	firefox.exe	93
PID 4800 wrote to memory of 4644	4800	firefox.exe	93
PID 4800 wrote to memory of 4644	4800	firefox.exe	93
PID 4800 wrote to memory of 4512	4800	firefox.exe	94
PID 4800 wrote to memory of 4512	4800	firefox.exe	94
PID 4800 wrote to memory of 4512	4800	firefox.exe	94
PID 4800 wrote to memory of 3604	4800	firefox.exe	95
PID 4800 wrote to memory of 3604	4800	firefox.exe	95
PID 4800 wrote to memory of 3604	4800	firefox.exe	95
PID 4800 wrote to memory of 3604	4800	firefox.exe	95
PID 4800 wrote to memory of 5800	4800	firefox.exe	96
PID 4800 wrote to memory of 5800	4800	firefox.exe	96
PID 4800 wrote to memory of 5800	4800	firefox.exe	96
PID 4800 wrote to memory of 5800	4800	firefox.exe	96
PID 4800 wrote to memory of 6076	4800	firefox.exe	97
PID 4800 wrote to memory of 6076	4800	firefox.exe	97
PID 4800 wrote to memory of 6076	4800	firefox.exe	97
PID 4800 wrote to memory of 6076	4800	firefox.exe	97
PID 4800 wrote to memory of 4808	4800	firefox.exe	98
PID 4800 wrote to memory of 4808	4800	firefox.exe	98
PID 4800 wrote to memory of 4808	4800	firefox.exe	98
PID 4800 wrote to memory of 4808	4800	firefox.exe	98
PID 4800 wrote to memory of 2112	4800	firefox.exe	99
PID 4800 wrote to memory of 2112	4800	firefox.exe	99
PID 4800 wrote to memory of 2112	4800	firefox.exe	99
PID 4800 wrote to memory of 2112	4800	firefox.exe	99
PID 4800 wrote to memory of 5796	4800	firefox.exe	101
PID 4800 wrote to memory of 5796	4800	firefox.exe	101
PID 4800 wrote to memory of 5796	4800	firefox.exe	101
PID 4800 wrote to memory of 5796	4800	firefox.exe	101
PID 4800 wrote to memory of 4416	4800	firefox.exe	102
PID 4800 wrote to memory of 4416	4800	firefox.exe	102
PID 4800 wrote to memory of 4416	4800	firefox.exe	102
PID 4800 wrote to memory of 4416	4800	firefox.exe	102
PID 4800 wrote to memory of 7656	4800	firefox.exe	103
PID 7356 wrote to memory of 7388	7356	msedge.exe	107
PID 7356 wrote to memory of 7576	7356	msedge.exe	108
PID 7356 wrote to memory of 8572	7356	msedge.exe	111
PID 7356 wrote to memory of 8572	7356	msedge.exe	111
PID 7356 wrote to memory of 7584	7356	msedge.exe	109
PID 7356 wrote to memory of 7584	7356	msedge.exe	109
PID 7356 wrote to memory of 7584	7356	msedge.exe	109
PID 7356 wrote to memory of 6156	7356	msedge.exe	112
PID 7356 wrote to memory of 6156	7356	msedge.exe	112
PID 7356 wrote to memory of 6156	7356	msedge.exe	112
PID 7356 wrote to memory of 7852	7356	msedge.exe	113
PID 7356 wrote to memory of 7852	7356	msedge.exe	113
PID 7356 wrote to memory of 7852	7356	msedge.exe	113
PID 7356 wrote to memory of 8020	7356	msedge.exe	114
PID 7356 wrote to memory of 8020	7356	msedge.exe	114
PID 7356 wrote to memory of 8020	7356	msedge.exe	114
PID 7356 wrote to memory of 8028	7356	msedge.exe	115
PID 7356 wrote to memory of 8028	7356	msedge.exe	115
PID 7356 wrote to memory of 8028	7356	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\🔴 Void Tools V2.exe
"C:\Users\Admin\AppData\Local\Temp\🔴 Void Tools V2.exe"
1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {7c452a63-c622-4a8d-8708-7969f68c0099} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {5a23b271-7414-435f-af3e-3eb5a10b6a8c} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27274 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {f846f83e-eac5-4ba6-a9db-2319ec0ec805} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27274 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {089f7315-13dc-47e5-8134-39c0728f1cdc} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4552 -prefsLen 34773 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2668 -initialChannelId {2a98b2a6-dfe1-4af3-8f5b-58ac2a718c59} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3216 -prefsLen 34903 -prefMapHandle 3004 -prefMapSize 270279 -ipcHandle 5140 -initialChannelId {dc7d967d-9dfd-460a-bb9e-d9421baa7ba8} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5300 -prefsLen 32793 -prefMapHandle 5304 -prefMapSize 270279 -jsInitHandle 5308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {408ef7ae-0ed4-49bd-bb78-a8d1f1348d91} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 32845 -prefMapHandle 5464 -prefMapSize 270279 -jsInitHandle 5468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {e9ba3237-5191-451a-a748-3a43bfafc62f} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32845 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {43065107-8c4b-4932-8cb5-9b02b1110682} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17716 -prefsLen 37418 -prefMapHandle 17720 -prefMapSize 270279 -jsInitHandle 17724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17652 -initialChannelId {70546339-a5dd-46ce-ba72-a4b6db299c16} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 35340 -prefsLen 37418 -prefMapHandle 35516 -prefMapSize 270279 -jsInitHandle 35520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 35712 -initialChannelId {6c97569c-92a7-4391-b0c8-c15c8845ee2d} -parentPid 4800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4416
- - C:\Users\Admin\Downloads\🔴 Void Tools V2.exe
    "C:\Users\Admin\Downloads\🔴 Void Tools V2.exe"
    3⤵
    - Executes dropped EXE
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:7656

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=dwzxex.exe dwzxex.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:7356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffaae5cc188,0x7ffaae5cc194,0x7ffaae5cc1a0
  2⤵
  PID:7388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,12737708558752349594,2648479250822063346,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:7576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,14761888185761085168,783465749223957611,262144 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:7584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,15071153363053884366,5746270778849693363,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
  2⤵
  PID:8572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,18150821278731267789,14073996606206540995,2097152 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,1248837865183898109,17812858173389464873,2097152 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:7852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,9597592093033913045,11047298621540704982,2097152 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:8020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,13573675230908492653,3298396293797513039,2097152 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:8028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,2700684191703816712,5401658682289644343,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:8428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12650066763376705076,1787867397543032702,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:9408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,12602078229984073854,13663055876626622712,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:9404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,8041598196925159626,17699835807895570935,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:9944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,8041598196925159626,17699835807895570935,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:9956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,13210511220790655012,10829809089645135017,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,3707462118081828271,8083418732173044397,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:8936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,4413074949243152034,3353739686379468394,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:10288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14106391489715778718,3632042145265604314,524288 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:10300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6480,i,9541133295249764896,8447441091411820407,2097152 --field-trial-handle=2156,i,6460443617283373770,5528736534729757377,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:10832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:8532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 2c27c5c3059500e1b651e6b4b0e072a5b1b67025319220d57b438086261956a9
MD5 3c93dcaf253616d12986ba6d984994b8
SHA1 869b7fd7a1f81ad7288437c3fc6eef039c635a61
SHA512 0e0cd37c8b4ba0b31c5038964e020c8978be5d41a518792b49346654df627fe006db3e872611764090f1d3f6afc491576be6f2f9a8228bdb29133e0e68e57ae2
TLSH
T1F5D02263930031B5A77CFFC1806ABC8FC33B20610882DEE590D098A9173A9BD4A07281
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 273d959b5841a6efbcf210ac551b01f2dcdd5cf76dd6f64095f530cd4c68c6fd
MD5 23f3ae2709f65bceafed2dac27ff2573
SHA1 4a3a98d4b8c2185f25c9edbd22d0e81d8de19474
SHA512 8c09732b07038e302c29ec7d16f4f8984a1cdb97ea815b4664f887055d5a29a83a121a7f871e154a80b396bea211a4f198290438f0e24be7925913311572ada8
SSDEEP 192:sxRHRhScBz5/frsB+4D6ZYoA8pKhz/g6+WNYkr/Yo3DCYRGWIgVcwQd3uae:sxRHimz5/frsQ4Dsbq/5v/2i4Q
TLSH
T1F762C7165A24D9378CCBD518FF35BF53D6F9502298921A9CAAFCCA1C04AB6ED120B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5b590f43fa2755dff470894b877b3697958a7d2d21a670162f4e40e85025af4e
MD5 d0e2d047170c8fdcba98fb9d9c9582d0
SHA1 f54bc8ea35badfffc036f2b8d2551864489107a4
SHA512 a08e10ff32f28ba662992773444b1e1307b4d8e696e74f077e31061af1d13f1f651a5ca68ae3d6f483b5c5dc6ec0ca84852f123a7574c38899e8295bdf317bc4
SSDEEP 768:j26HA27pLuLz6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVpgBVuwuro9Le08:j26HAWEz6RWgs2f02u1jaGgB4wlyUM
TLSH
T11DD2DA7B640DCABF4F800ADDDD197E9F6D6802CB9698CD8447FD841C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1ba751f964380a17595fd2041d394967dccebcc3e8d6f58d49a4317197354b49
MD5 8c1a2b6b25f83baea85da13d03b40c60
SHA1 ee9adb7405d5b7fd2a622a4a045cf21c1f02e165
SHA512 8571d85236c2be34eef853f85d2dfbcf91e38e101d4fd4460e98e4c06c753bc154be102be77449d10026efe286e69d3bf59f8016ebd1067e8dbc6eae439f5660
SSDEEP 768:crv+4UNbdz32zuc0/TBOWdYNtAYDtFlONXyer1IRCzni9Y0:cbsbV3FnPqlSIqnr0
TLSH
T1EE03BE31E559AE234DF6E396F10773837FB8206784C04B94EAEA1B4E059799E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 44bad1098e204526fe26450a6044011952e413e8f3b688fbbb48d2845a615430
MD5 ea0122f7ab523b38e3458e9cf23a3ad3
SHA1 3024ee6f179e15081636af2bc61899445ad7924e
SHA512 275143811f4b51a6ccca62b1acd1d63a312d707984469991a0857151be3cbb18788fcf8c97db95798ca962d0a8c802311137a88f96e36d2e9cef4008b8127e10
SSDEEP 768:nrv+4UNbdz3XG/TBOWdYNtAYDtFsONXyer1IRCzniwYeVH1SK7:nbsbV32nPqsSIqnsEH1l
TLSH
T1C903CF31A4999E334DE2E396B147B3437FB8206B85C40B90EDEA1F4E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2654fcff44fd8bcb82237626727c30b3ba182e3437cbf12a43c8dfe58e82dbe0
MD5 261469d839527e61a299396c295a21a4
SHA1 e9b3df121fbf19429af7c0a7534f515aba28fe35
SHA512 08439e4dab93bbeb681ba59078e563dbd00bf04d026bd6d127b4ace57ddc8dcfaf0aa55b7a6ed056d9e1bce97657de99bebb2daf38de237fa25d8bb6354689f1
SSDEEP 768:hrv+4UNbdz3RP/TBOWdYNtI6ONXyer1IRCzniBNeVH1SK7:hbsbV3BnV6SIqn+EH1l
TLSH
T1DC03CF36E4A89E338CE2A3D6B14773437FB86057C6840790EDEA1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 9023ada4c054db5b55dd145ca659ebba0e1ba59a21a70092bb25ba3f9e0de33c
MD5 ac1ef7b85bb2d017e412834a4e001f7e
SHA1 75c43161e521847a9a22107f7a82dd33cda80d88
SHA512 44a5498de9b9653793ee3a5a01ff24c07c93bc762b320c40ae0599549c8231ed6d20b7989833e56bff119312381830ea8250a92a3a62bf47f5031b7ae5ec26c4
SSDEEP 384:HkCjiO024YzDL84KKDL849B7SOEAd9KVRaAcP+AWRMAbEAEl:EzZYzDL8lKDL8CB7S/AmVAf+hRMuEAEl
TLSH
T1AB728D3D9F013CBC1597C0E8C4F992998D18B7A7CFE6806D21583D0DCA98AA9A0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 adec5ca9a08939285fbbeb283b0b2367a1a4d6d2a604c725dea1b5031fc4db3e
MD5 54daa41cdcc1e99dc820f649e35b3fbd
SHA1 4d0cf4c2b8fc0a6ede3f674d4ffc888ad0d55450
SHA512 55437bc18406231bb7633a53d5102e51f1d99ca489eb0aafee3f525a0d92d946348e3932fd65d2276bdbd00e9c98fae957c53f1b6c3d2e452b4a6e0cae419af4
SSDEEP 384:HXkRyiO024YgDL84KKDL849B7SOEAd9KVRaAcP+AWRMAdN7O:3mZYgDL8lKDL8CB7S/AmVAf+hRM0O
TLSH
T124727E3D5F003CAC1567C0ECC4E982AA8D18B7A7DFE6C06D21183D0DCA98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f9f5eea-40a8-4e2f-ae70-992b8542b53a.zip

Path C:\Users\Admin\AppData\Local\Temp\5f9f5eea-40a8-4e2f-ae70-992b8542b53a.zip
Size 3.8MB
SHA256 76d655f2324ce86c374773a54f1ff15d66d7bed44637cc23f0dbb2de25236bcd
MD5 0e2ea88a63a4064061faecb514ba5a21
SHA1 f55d3e1e28c7de5999bdf582332b20b526aa4f64
SHA512 df035ebfe714052cd4919ecfb72c8f07f5a3a59937c3d7f41c8b51c6b2275e6b53b6b78d69730157ab0d0a61645325ff3e17356b996248d82abd98389e979c3e
SSDEEP 49152:D9vjLYAb9Bu0lH8uD2apVmN/556OmqFM7291I6H6ot2oyVdfcfGzeaRCe6tSzw2O:BvjD8Xcm55rX46H6I2o4cF1wzw27y
TLSH
T17006E075D65E1709C9CF83FEA50C2FC3984C4FAE8074ED7F6A6A95716FA31A12B84840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3dc1b8b-6b5f-49e8-980a-47ade6085e28.tmp

Path C:\Users\Admin\AppData\Local\Temp\b3dc1b8b-6b5f-49e8-980a-47ade6085e28.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7356_1320642107\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b36379f6e9babb0a75b3655a3d2454f5c0c6b6ef50d665ffd7df2db772fbb200
MD5 1346f2e04e2865cbbde24c9cbd4f81d5
SHA1 b40e162843c8849e7a4edba1826c536fea1d0079
SHA512 de25aef4d7c2f4fa6fb987921e92c8a3c9760325c2c88c14ff364093359025cac3ea658a424872f72c62ad11af7f0c4e8a8cc8ca3375855578065b4d58f89c69
SSDEEP 192:GOv5zbo7YZJnyj11Hn1d66JoztdzgCl6mc0dz:9bosZJnyj1d66Joz/zgC1jd
TLSH
T114D1ED64F739863BC418027BDCA61B900F35398A984E3F1571EC641D2D563DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b3166f358ffe52a67bf828578442799e665a7e62a21c48c60bd58aea3d5dfb45
MD5 6faa929b55bcaec03a027c8f4f044337
SHA1 a3fe27f1de1e0344126a928b52893a96121b7505
SHA512 6d65272111874f8d1ab3ffe8c24f2f073d4815cd0e5e5d1df679318ca342338a28cdfe9f06383642f743b862773fa8e2a8715608f24137c70c3f1697e6cbdfc6
SSDEEP 192:NOv5zbo7YZJnyjbx1Hn1d66JoztdzgCl6mc0dz:ibosZJnyj9d66Joz/zgC1jd
TLSH
T1EFD1EC64F739863BC418027BDCA61B900F35398A984E3F1571EC641D2D563DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9a932ccfc590a8d41d89938beada61131a50d76de09a82c401fcece60b9b5ee9
MD5 82fb991d13c748b0d79ecbaf9c812214
SHA1 456cbd6bcf9a17f5fb22c569f657fc45c26618ed
SHA512 b4f760d5c9dd4b295d6d85b7b9b8a5458d7ecdc0fdaea70407fff60129f3d48ffb83897ac3be3a20397b35821085e869ad48ff825d8543ba204be85bfac95d1b
SSDEEP 192:3Hn1d66JoztdzgCl6mc0dLOv5zbo7YZJnyjLdqv:ld66Joz/zgC1jWbosZJnyjRu
TLSH
T1A2E12EA4E638863FC418027BDCA61F454F39398A984E3F1971AD640C2D573DE768E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2418b655b527a2bdf2c4538d16cfc7bdad125a3b27e54b4a47e704ee7493347b
MD5 5932f011e5def7f805f88e673543e3fa
SHA1 6978580328ac1e5283d5959e8e41de17ad4f331f
SHA512 590ec9324dede0b96cba1cad21c7e99d0514c90c5953908a0f0e970dfa43b27b1ed3bdb8eac962d3de9a64ae2f380c60b694e746cde6065da99ccfd32ea5bdbb
TLSH
T147217CEC79B84E7A59CBF29C7450018EA3644E0304875C834D62EF8CCEA5ADD326A438
MD5 SHA1 SHA512 TLSH

Submit Download

20d30575-1ce5-4ecf-a25d-d405c540e23f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\20d30575-1ce5-4ecf-a25d-d405c540e23f
Size 235B
SHA256 8018a929a877bbb33f02e72a63a73ec7d18a6e2022573b0347adee0efc94cc76
MD5 348078a1dc0eac939a60586a82296259
SHA1 10131443d83ee0b4f99e2cacdb392a500040c7d1
SHA512 49959ba3d217292654f76d6766a3e6e0098c7d11af0cb8c77ee13ae8cdff27b075cfb9420b5f6d2824f89d4559bf7a2b3ab1bbeee821a62c5e70fd07028cecb4
TLSH
T12ED097D0A488679C48042F02F4F078C630988C3720A5A810DEA045B499F9DC901B2C2F
MD5 SHA1 SHA512 TLSH

Submit Download

76dc82e3-1822-4022-9959-9660e11fd75f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\76dc82e3-1822-4022-9959-9660e11fd75f
Size 235B
SHA256 c60ffb9524d080af7edf8d5a079992bbeae1ce72962d1985aeb5dc85b7783f9b
MD5 dc155654e7ece73c477bd0943af250ce
SHA1 978de5e72c95934e91baba40746d27452edc16dc
SHA512 5eb64168f310855058e4906d9c5d8281210a06e8310d66df23fdebb4903cc4812ef50dd260623e3a4a80aac17a47c38e2cb44aa19adc24c172033aa95ebbcde1
TLSH
T169D0978014D8635C0C180F0BF0F02ACA34A54C3314646810D5B00174EDF99C84165806
MD5 SHA1 SHA512 TLSH

Submit Download

9c3df3ba-91f0-49f5-9ba1-0c949d669242

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\9c3df3ba-91f0-49f5-9ba1-0c949d669242
Size 2KB
SHA256 44eb60f0f83d0f01fb6b6c258a80ed531a41f37bceb706e6ff826a9b9888ea5d
MD5 811b3058178820f493aaeb73b451f080
SHA1 a54df8805b31b1f1a183522b24aa23321a46025a
SHA512 9bda7defac8b35278648bc1bbfb52c67389064384a496801411f3148a608bde085df9328b3336f3d5ac78b09fc90baa84e4f0a81a7ff5cc4503ffc1d449241b9
TLSH
T1AA41365C76785D368CCAF34E94C1338E97648A03148618836D51EF0CCDA5B9E336F42B
MD5 SHA1 SHA512 TLSH

Submit Download

bd03ea15-59df-4418-8b5b-f597d83bfa29

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\bd03ea15-59df-4418-8b5b-f597d83bfa29
Size 16KB
SHA256 f56e8cc764546a2e781bfcd616410f185a8ae8dd2ee7a0ec9d6bafc3acb8157d
MD5 76813f855a178fb0e49e9b2131275209
SHA1 3bc8ae0b724cb41d012f656b51e08356568730de
SHA512 95de260eb53a0a552d06ad6c03e04a70531a142a8bed9a3fd9cd7e540c3c762d432417747373298cdce65461c75caeee8b4c281cb44e40d12fe0f8bccf6683db
SSDEEP 192:IaVRJO/lgxoH1pygdNmYH6pZY2KjQ5Qzd0m4H827yeAy71YuBp5ut2y5SEqyrJiZ:jO/qpZnKjQ5QB0mO827yNyjJg2y3H4
TLSH
T19772EB56686056BE8551E3A9D8FC7FC3E2F538CF4C019FCA97E0BD0859DA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cba4702a-1120-49cb-a514-a6d884a00f36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\cba4702a-1120-49cb-a514-a6d884a00f36
Size 886B
SHA256 505e3139385c008c797b30c5265b9e3dbec83144f66031cafae2a5ae7838084d
MD5 0655c2b680f4b2b16dfa9bd49cc166fd
SHA1 2499f1e9ebaaaac931fb5cfbb8bd8669ef44d940
SHA512 1f23623c30eb06f5e3b9513b423c0304873bcdffe4eb3916d69ffe6eb23054be59f78cb859f86f31908f32c161a88667bf4972eb91cf8c300c5288ddf0f98be5
TLSH
T191110080C675B972CD38838FD4E17B468BE4B51380CA49147D659B0C4EB965EA7A7107
MD5 SHA1 SHA512 TLSH

Submit Download

eef8b230-9aa7-4edf-a176-a262bc3ac183

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\eef8b230-9aa7-4edf-a176-a262bc3ac183
Size 883B
SHA256 90b6ca1ac0556df4b58015e86ac3ee7cf9ab2d6a246edd2d73d32421e23d15bc
MD5 436183db38015bcf2132a023cd23941f
SHA1 c5631e195db632805279a4f1ae9f847bc246bb04
SHA512 460709f5b681a36cd9a72780cf48fcf4a456bda3e1101b0457c0ab19c317a121e90f394df9dfeee8821bc8b12b3856613f8fb44d34389b8424326d2ec6e5e1fb
TLSH
T1A4112340D234F572DC38834BC99577569FE4B92380CA85147DE18E180E7A75FA7AB24B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 b50bd913fd2b97d28b517332d126bb23d79ac7d49ba34a674a3f2266e3756854
MD5 c818885e1dd181f20bff279129b1e1f8
SHA1 16e0023d13c638e65f1d97ea4e219a920b42a18a
SHA512 35c19a3f170ad9a1ae8c6ce35e055a49dbbd764f8990c9a7042262b189a2e158d7d46f2fb523fe2c847371ef600ba66bd8634431984bacb001e58200e0e3317d
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4HW6L4hq:NI4fRfsXH446+4V4Y4N4Q4F4E
TLSH
T1EF72421545448EB8298EA78BAA367E01C37D573B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 10KB
SHA256 ad653f705d8980867d0c81468a65305f9a21aae946446ccf264f5f3c6e20a452
MD5 7f3c969996a0fa8d872642952bb83c6c
SHA1 b2868872ec11fcbd0b2718339dc79c470aa13900
SHA512 b4cb17e05c0a98e29a2173dfc9a86b93efe1853faf4556a75220cefdcc0f539bb2e589240567feaaa67b96978cfa41a95441eb24721c67523e0fccdc554b546e
SSDEEP 96:xHydTUWqGqPfNu03yObzSkSSlvdv9jen+cWRs/CapRdwOBw88k4BEXFy8L4cnAVX:sQRPfNu03yOSSzRQ7COBw88lEXFuJ
TLSH
T17222ED7C9044CF7F65B6327DAC6449706AA2023BB7BFACD344B95485045CF3441EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 8KB
SHA256 04b5e90e27a665f689c1a6711daa96c897012123aef1227048ee71510ead32e1
MD5 cb6947996c37b658e41f382e6c88e059
SHA1 b86627c74a6f541fe506624f2513c3e74128fb00
SHA512 877375af452f1789965f5a4da1b2dabddae73f37564b67ee85da9d830f98b411d28465c38a864ed884ec4eec456637115f1172d63b6f7efcec000a7816f505a3
SSDEEP 96:xHpdTUWqGqPfNu03yObzSkSSlvdv9jen+cWRs/CapHBw88pV8L4cnAVrb:vQRPfNu03yOSSzRQ7pBw88dJ
TLSH
T181020D789004CF7F65B6767CAC6488306AB2023BB7BFA8C750B95489015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 12KB
SHA256 4a3027aba5591ce12099ef4615f9e927abe2bca74d193e6f8f733395cf87fd4d
MD5 5e101622140c9814232a2f676c85358f
SHA1 3fd5ea6fdccc3327ed57e4aa13aab3e130b78eea
SHA512 ad3d8d40b1d4335a5986d78bb5fa32889e4f1b2fd6dd3178417bf3733d5403abbc57feb17cae0185c6aea73a125db733fb6d8e5c889e127617eb909ede95cd29
SSDEEP 192:sYCRPfNu03yOSSSLRQ7COBw88mKrHmXLYC:I+RQJwvmj
TLSH
T10F52CE3CD0408F7F21F232BEAC2149B01AA1426B76BFBCE345F99486445DF2545E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 590038b90a1e7866865b349bf6576a52ee67a09e0208b3eb8458b7df67399314
MD5 f74195926067cc455e3d8a52a5b285d0
SHA1 ca63b14299f8c31ff672ca4eaf862693e9597530
SHA512 35aafb25a0ebc3ce5f281cbb9ccdf3b641d1f57567a802badf70e933cae9fb6ab8a4e29cf88ff3802b10d225dae08aff3e77227430f33302a82ae93eec6d0890
SSDEEP 96:xHpUTUWqGqPf2B3y1zSkSSlvdv9jen+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B3y5SSWj7/Bw88qU
TLSH
T1E9E1217890088F7F64B6777CAC688831AAB2423B7BBF68C750B95484055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 35463a99d53c450b2e27a1b4a18f588649fe036fda0f6bd1ce05d2dd736e459c
MD5 3876b49255182fe8cfb82c8f5d7c8a75
SHA1 f6338a2dc7bb9e09e69bd1566ce57c4f987fe5ff
SHA512 b285b71af1ccac2a456cfdc4055549e85857dab221b70dafe10bc2cd5bb48cb844da4b158a93306c08a1503dfa82609d07ab39e5c11a1b3c4f50817adf4a97da
SSDEEP 96:xHpUTUWqGqPf2BDW1zSDSSlvdv9j/+n+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BDWGSSaj7/Bw88qU
TLSH
T157E1107890088F7F64B6777CAC688831AAB2413B7BBF68C750B95484055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 81ae23fcdaa71ee34a9f5955a224edcf2b89b0b227e6c6a487dad97cafc3bcf9
MD5 a169aa0262f7521f38a32ec9a1e5def8
SHA1 2e3a3fb760354abc0a750e3fbfb08f30f95235c3
SHA512 16b3b414d8a1eb4c455a196b652b7f000d7db2e39a1c59dac316851081a2f4d3a4f4bef4c25dc273ba93f0fc2e4b29ab4aedf87ad0ca335eec7eeb272b1fc34a
SSDEEP 96:xHpUTUWqGqPf2B3yObzSkSSlvdv9jen+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B3yOSSWj7/Bw88qU
TLSH
T1D5E11F7890088F6F64B6777CAC688831AAB2413B7BBF68C750B95484055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ff18e7613c11dacdc4a436ed99bd929887e2e57c78af7ac9cb16b159c368d6c5
MD5 4a7e5a1a72489fefc1de2cfa6838ab91
SHA1 270670957611a55872a8e0b3db197ad1542876a8
SHA512 0ba7b9dfb0bb606d73b1626316f9ac786ef0441b50c1d82ff6ff4415b420a8000aaa8ec5be27a25975187064d55d2971edfd2d5a0da585e39cf5c9dd6067f052
TLSH
T1D7412CC5DD4F207ADE48D408A6463379C3BF702756BD0840E7496315017EA9B64AD9EB
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 da52442f337918184d43c0cc9eb99d7ce03e8878798b4325a30486b7008e0810
MD5 a5fab7a2002fdac6460edee7bc90b82d
SHA1 c22e7d9cbd5af00aac21526289beeec18aae9ab3
SHA512 1ff3f0f7e5da7b0534e631d7c2ccb5336db3f3e307ce84b6117ad3feb45bebf9c6b1fbf27297bff164a1b29539f7727d0bbf4cad25d5e652a8f8c2eab1fb380e
TLSH
T1DD21BACAED9F1CB11256D04FC0C51BA4DBD55052833CB4F1DCD57E5122DCA1976D9249
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 a132d45cbdc59ba6ea2cfdc8e6a8f5229eabfe3ae5e653dfdbdd6bed0b5ebbe8
MD5 27c46348a2a85d1e74872fc52776c816
SHA1 637875d67a78e8add4f599661314b2e78c132744
SHA512 e689d4c2f1f079e0ddbd6e1158e4b53d3d161bbc08659ec492d4743361e59929393f052a26f75a6e2d3d7818f11be9055e896cd77caeac7d1e4d7b95f6427541
SSDEEP 49152:iQZLL7RjjSRvYcU3Y9nS9fj05p/JNocMp:bLxI9nS9fj6p/IcMp
TLSH
T165362AF820D1A257F3814033664593EF21EFD00C6037DA085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

🔴 Void Tools V2.exe

Path C:\Users\Admin\Downloads\🔴 Void Tools V2.exe
Size 3.1MB
SHA256 e7ab1578e1b8c23bd263e366760a197a9f380be8bf07cde36cb163eef8bff331
MD5 8db4320774f663e6db3f534c950fdf08
SHA1 f0674525c2305cf31f31fa0856c1036e26a5476d
SHA512 face17bec25a922c7a5c8bbebed40248147858b27fdce240b81856d84ff6f49cbf60165dbded0f74e7726bd103c8bd47c2b936eda29e693864e795af635c8925
SSDEEP 49152:ZQ2+tq1exZXjs9g275a8Fm8jPl7/oqhpCVjiVSXj:FwY9g6RjCVjY
TLSH
T15AE57B5AE7A841A8C0D3C0BD891A5403FA7338461375EAEB92F085566F277E06F7E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3708-1-0x000001F620680000-0x000001F620681000-memory.dmp

Download

memory/3708-0-0x000001F620680000-0x000001F620681000-memory.dmp

Download

memory/6356-8469-0x00000271991B0000-0x00000271991B1000-memory.dmp

Download

memory/6356-8455-0x00000271991B0000-0x00000271991B1000-memory.dmp

Download

memory/6356-8453-0x00000271991B0000-0x00000271991B1000-memory.dmp

Download

memory/6356-8470-0x00000271991B0000-0x00000271991B1000-memory.dmp

Download

memory/6356-8466-0x00000271991B0000-0x00000271991B1000-memory.dmp

Download

memory/6356-8468-0x00000271991B0000-0x00000271991B1000-memory.dmp

Download

memory/6356-8467-0x00000271991B0000-0x00000271991B1000-memory.dmp

Download

memory/6356-8465-0x00000271991B0000-0x00000271991B1000-memory.dmp

Download

memory/7656-8452-0x000001FC56070000-0x000001FC56071000-memory.dmp

Download