55a35939bd51b67de4d419f7b1bab06a483d726c4ee13fe504e6f5a6973245cc

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
197s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SM3DW_BF-(US)-NSwTcH-NSP-Update122-Ziperto.rar
Size 86.5MB
Sample260925-1p9a2ax18l
SHA256 55a35939bd51b67de4d419f7b1bab06a483d726c4ee13fe504e6f5a6973245cc
MD5 4acc26cbd69122670d6250ff221342b6
SHA1 123a695e4ba30e6f3bb25050c211f0b9834b665f
SHA512 d77e4c3e78444f68fcc66eb3e9071866ee82ac31968261816bd4d9f8f9ccb5f8bb661d33874812c75e0158fdd3f2733e60f8a7cfc9a90f4ef72ed77cf3526fb9
SSDEEP 1572864:qV9jCu6Z3mSNdzl3mIMKDGluIOZbbl4Glz+aDU4bqft6A+tyIQbHNuf93:6mue2SN3maSluIO9bl4Q80ah9HNuf9
TLSH
T18418338AEAED5C8DDD89470435023F4609BE3AB7C18FD9151D292A34CA134CACDFED5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_469074455\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_469074455\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_661408798\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_469074455\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_469074455\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_661408798\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_661408798\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_661408798\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1009111552\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_598944849\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_598944849\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_270077682\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_270077682\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
536	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\nsp_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.nsp\ = "nsp_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\nsp_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\nsp_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{6410FC5D-EEFF-48C5-A749-E95D3521E20D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.nsp	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\nsp_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\nsp_auto_file\shell\open\command	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6132	msedge.exe
6132	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1976	7zFM.exe
5544	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	1976	7zFM.exe
Token: 35	1976	7zFM.exe
Token: SeSecurityPrivilege	1976	7zFM.exe
Token: SeSecurityPrivilege	1976	7zFM.exe
Token: SeDebugPrivilege	5908	firefox.exe
Token: SeDebugPrivilege	5908	firefox.exe
Token: SeDebugPrivilege	5908	firefox.exe
Token: SeDebugPrivilege	5908	firefox.exe
Token: SeDebugPrivilege	5908	firefox.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1976	7zFM.exe
1976	7zFM.exe
1976	7zFM.exe
5024	msedge.exe
5024	msedge.exe
1976	7zFM.exe
1976	7zFM.exe
5908	firefox.exe
5908	firefox.exe
5908	firefox.exe
5908	firefox.exe
5908	firefox.exe
5908	firefox.exe
5908	firefox.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
5908	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 5024	1976	7zFM.exe	101
PID 5024 wrote to memory of 5068	5024	msedge.exe	102
PID 5024 wrote to memory of 536	5024	msedge.exe	103
PID 5024 wrote to memory of 2704	5024	msedge.exe	104
PID 5024 wrote to memory of 2704	5024	msedge.exe	104
PID 5024 wrote to memory of 2704	5024	msedge.exe	104
PID 5024 wrote to memory of 4312	5024	msedge.exe	105
PID 5024 wrote to memory of 4312	5024	msedge.exe	105
PID 5024 wrote to memory of 1424	5024	msedge.exe	107
PID 5024 wrote to memory of 1424	5024	msedge.exe	107
PID 5024 wrote to memory of 1424	5024	msedge.exe	107
PID 5024 wrote to memory of 816	5024	msedge.exe	108
PID 5024 wrote to memory of 816	5024	msedge.exe	108
PID 5024 wrote to memory of 816	5024	msedge.exe	108
PID 5024 wrote to memory of 4584	5024	msedge.exe	109
PID 5024 wrote to memory of 5000	5024	msedge.exe	110
PID 5024 wrote to memory of 4584	5024	msedge.exe	109
PID 5024 wrote to memory of 4584	5024	msedge.exe	109
PID 5024 wrote to memory of 5000	5024	msedge.exe	110
PID 5024 wrote to memory of 5000	5024	msedge.exe	110
PID 5024 wrote to memory of 2592	5024	msedge.exe	112
PID 5024 wrote to memory of 2592	5024	msedge.exe	112
PID 5024 wrote to memory of 1996	5024	msedge.exe	113
PID 5024 wrote to memory of 1996	5024	msedge.exe	113
PID 5024 wrote to memory of 1192	5024	msedge.exe	115
PID 5024 wrote to memory of 2404	5024	msedge.exe	116
PID 5024 wrote to memory of 1192	5024	msedge.exe	115
PID 5024 wrote to memory of 2404	5024	msedge.exe	116
PID 5024 wrote to memory of 2088	5024	msedge.exe	118
PID 5024 wrote to memory of 4092	5024	msedge.exe	120
PID 5024 wrote to memory of 4092	5024	msedge.exe	120
PID 5024 wrote to memory of 4024	5024	msedge.exe	121
PID 5024 wrote to memory of 4024	5024	msedge.exe	121
PID 5024 wrote to memory of 1292	5024	msedge.exe	122
PID 5024 wrote to memory of 1180	5024	msedge.exe	123
PID 5024 wrote to memory of 1292	5024	msedge.exe	122
PID 5024 wrote to memory of 1180	5024	msedge.exe	123
PID 5024 wrote to memory of 5616	5024	msedge.exe	124
PID 5024 wrote to memory of 5616	5024	msedge.exe	124
PID 5544 wrote to memory of 5812	5544	OpenWith.exe	128
PID 5812 wrote to memory of 5908	5812	firefox.exe	130
PID 5812 wrote to memory of 5908	5812	firefox.exe	130
PID 5908 wrote to memory of 6112	5908	firefox.exe	131
PID 5908 wrote to memory of 6112	5908	firefox.exe	131
PID 5908 wrote to memory of 6112	5908	firefox.exe	131
PID 5024 wrote to memory of 5620	5024	msedge.exe	133
PID 5024 wrote to memory of 5184	5024	msedge.exe	134
PID 5024 wrote to memory of 5188	5024	msedge.exe	135
PID 5908 wrote to memory of 4032	5908	firefox.exe	136
PID 5908 wrote to memory of 4032	5908	firefox.exe	136
PID 5908 wrote to memory of 4032	5908	firefox.exe	136
PID 5908 wrote to memory of 4032	5908	firefox.exe	136
PID 5908 wrote to memory of 5308	5908	firefox.exe	137
PID 5908 wrote to memory of 5308	5908	firefox.exe	137
PID 5908 wrote to memory of 5308	5908	firefox.exe	137
PID 5908 wrote to memory of 5308	5908	firefox.exe	137
PID 5908 wrote to memory of 5324	5908	firefox.exe	138
PID 5908 wrote to memory of 5324	5908	firefox.exe	138
PID 5908 wrote to memory of 5324	5908	firefox.exe	138
PID 5908 wrote to memory of 4664	5908	firefox.exe	139
PID 5908 wrote to memory of 4664	5908	firefox.exe	139
PID 5908 wrote to memory of 4664	5908	firefox.exe	139
PID 5908 wrote to memory of 4664	5908	firefox.exe	139
PID 5908 wrote to memory of 6776	5908	firefox.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SM3DW_BF-(US)-NSwTcH-NSP-Update122-Ziperto.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ziperto.com/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff9188fc188,0x7ff9188fc194,0x7ff9188fc1a0
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,17554015112723091973,12442347693732160877,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
    3⤵
    - System Time Discovery
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,8827207266907942111,13735207448599739405,262144 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,8372587524488094412,14098348611918427267,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2586405974909767872,17614603722208163026,2097152 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,8435315012083868162,4364845682012173332,2097152 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11672090885748126438,10006342905631640157,2097152 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,9419891640521411869,7661522261077684087,2097152 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,8036695087207581367,18349251581918546199,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,1935039276115659608,12546897725230908425,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11422518912528489981,14769333380898243979,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,4902521628647197410,6933556690752711583,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10787219523250718762,2358481536754199578,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10787219523250718762,2358481536754199578,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,2017856148307394131,14269244349481731656,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,3872693197469128953,8370188288511588337,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,12820935720029569226,3918507828438453859,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,2892153287550287678,13324228074147947224,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,15862431509976418710,12934386346882422242,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,12748686867037157382,2185226890990536265,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,1450985991922393859,601867072679590329,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,4067947017347692012,11621051574542027579,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,462026605803946742,6289896476987612673,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
    3⤵
    PID:6488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,5630094898577081542,6826129639383750492,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,9750152800431639123,10619816086313794692,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
    3⤵
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,8597052637797038506,14089140958961461818,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:8
    3⤵
    PID:6160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6708,i,14290306895672658946,376630178683783512,262144 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8351503192219422405,8809015714387171149,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1660013116347773319,12225408829751880537,524288 --field-trial-handle=2452,i,5002027283709606744,8652704626808543845,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
    3⤵
    PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\7zO8B7E3F79\Super Mario 3D World Bowsers Fury [010028600EBDA800][v262144][US][Up v1.2.2].nsp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\7zO8B7E3F79\Super Mario 3D World Bowsers Fury [010028600EBDA800][v262144][US][Up v1.2.2].nsp"
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {ad78a705-0cb0-4949-ba3f-3cda21c547b1} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:6112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {07c9d3fd-0a2d-4f76-9b29-0f9b4b7abeed} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3640 -prefsLen 27325 -prefMapHandle 3644 -prefMapSize 270279 -jsInitHandle 3648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3656 -initialChannelId {f45ea6a0-fa56-46e5-8bdb-73622378b5b0} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3804 -prefsLen 27325 -prefMapHandle 3808 -prefMapSize 270279 -ipcHandle 3916 -initialChannelId {7e204430-572b-4c1f-aee1-859f671d0312} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4312 -prefsLen 34824 -prefMapHandle 4316 -prefMapSize 270279 -jsInitHandle 4320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4296 -initialChannelId {9df9956d-24f7-4763-85df-735707330650} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5088 -prefsLen 35012 -prefMapHandle 5092 -prefMapSize 270279 -ipcHandle 5100 -initialChannelId {bab4e8e5-cff1-44ff-9725-2552ad7a890d} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32900 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {7c853d53-4a03-446d-8c3b-69ab1b96f6cc} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32900 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {b7e91176-adf1-4ba5-ae89-05e2a7528697} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32952 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5912 -initialChannelId {8a6f582f-1176-404b-be12-dc1d219aa830} -parentPid 5908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1009111552\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_270077682\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_469074455\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_598944849\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_661408798\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 387acd7885bbfbbc9c938cdba9914ef7c84aca0f93c6f66fec3ef2862fd985fc
MD5 eb70eaf63af260dc151985ef51ddde4d
SHA1 e5dbe16e8fff28673754006af5cf4e49cf4af5f6
SHA512 dc814ce73847c1254422ba79210ad51a461f69b9905d52459ead100fc1bbe70001a477a088319437a7267a5ec430ccedd700b68c3312c9766d25061d43c46119
TLSH
T19B512F90AAF08141FB70A3B291CC3D67323AE55C50730F1215B8D4F7DB22BB449897E1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 84ada4d240b5b7368e3ee7d0c035c990d88ecb2e13ec81ff438b5e0bc9ea78b0
MD5 8ca9f9064ddb5541fa4396238b0b99f1
SHA1 4c79142412192346ee1bc7a53a8f2cda113e55fa
SHA512 afbdc3ed5c63fbacd6ef4e6b8ea737efe5775c5afdd1415010037df43e7f2744ad4ef4f964bee77b2e6d4a70b94b062359e24b1cb3a7aebbd9b40bbf13c09546
SSDEEP 96:DuylxzOu6uw0uzBuxRauDBuMuUuxVeuNNueuJu3GwQ:DLXKFz0u14Raoz94Ve6TiOGT
TLSH
T15E81B1F3C3E8832DD90151F19A186E2BCE6D0A64431C3C6AC4D8EF1B63E24B1E24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7064d923fcca645dbbfecc70948605ef42fcd3fdffd3242690504d9e299f7b62
MD5 f1e5599fd0d1a2fc967d5825025bae83
SHA1 2af922ae37bc8edf0fd5d3281367dfe78a844321
SHA512 a3b49ab82c87116f2baec96cebdfeedfa855f8b566b1bbfca5748cc727e5e51ea26e2cb3a6672137877b5f24e323500a38035578b62d863d0fc89c87ea7a21cf
SSDEEP 192:sxZURRZX/f3srMnIdpBwHW6+WNLxu/EWfD8VIWatgj0oIg5XJ:sxZUJX/f3sr92HbA/sVdD
TLSH
T1F532DA5A6E34697B4CCBD61DBA15BF13E2F90032A1D51E98E6FC871C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 54652e84d435c10465677f60ac602cb6a8c508b07d72e47cc5a3005b13045031
MD5 afbd74c189530f11d08e4d2020418b56
SHA1 3557244809d1aa099ffd10407c8abfe79ac1e54e
SHA512 7e2922f7bb75226c85d484939ef49b762dfaeaf48d3cf3d92fc43dd0df30583608860b720fcb633ea5b123dfdf0d52c05200505de30c4e9aafb351c49aa59b0d
SSDEEP 192:sxZURRZX/f3spMnIdpBwHW6+WNLxu/EWfD8VIWatgj0oIg4J:sxZUJX/f3sp92HbA/sVdc
TLSH
T14432DA566E34A97B4CCBD61DBA15BF13E2F90032A1D51E98E6FC871C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1642d3a3ac0258a1a606aed65218318a1a29721364b5335b21e4385f834503a6
MD5 a861fd40a0258f47261c5fb89e423a18
SHA1 62f6fd6e74d2504171a99841cb741ffa991df3c5
SHA512 7572cbcc8307214e0169ed0cb463cc3d1573d9b82fd005c8115adf563976e23de59b66da4381a79853747bec2806dd52786efcdb26da5a1184f5321e70607db0
SSDEEP 192:sxZURRZX/f3sCtMnIdpBwHW6+WNLxu/EWfD8VIWatg50oIg5RJ:sxZUJX/f3s492HbA/sVjZ
TLSH
T1E832DA5A6E34697B4CCBD619BA15BF13E2F91033A0951E98A6FCC71C11E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b357b8919a10356396ff0501fb626ccf571d74a350035e5474dd908124cbb9da
MD5 3442fced2bdb45595ae471f5d5f3363d
SHA1 9fc5133179508a8e928d7569e5c29f31cd167dad
SHA512 2f71c5e9751653c87a08c1952506b949ca82ca6a2ffde09ef1ee2960e309f21aded99b140ab57d8aeb62e0b194131226c6f7ae8f283abd8f235d775575e4e515
SSDEEP 768:chichWQ7pLuLbrPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYUn+LlEKXzDroZ:chichWcEbrPWvPZhlu1jaNUn+LKgzwBz
TLSH
T11FE2FA7B780CCE7E4FC04A9DDD1A7F9E6DA8028B9698C94047FA945C02C7BEE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 583147b07d9c9c58ac60ab5f7aa2c369f517fb77dadbb7c3ecd1cfb0241f154b
MD5 3bd673811360a76a3857308d2720b4ce
SHA1 6e866e07de2441cb5193b2a4d403a1d53b4d2c40
SHA512 bd120be33aaa6f1e557f6495495ede1302a567afd470f6900f802de7d91fd61906ac30fefab2378cff5a473c83a2f894ca95494813a43184efb963d38d81c423
SSDEEP 48:K07+/bldd+bNglIS7+K9L1J+xTuYIZrfyL4N4s4h494P474/4gb4T4m4zIS414g0:KEIQKFW6WruKAs3bWKQMi+BiK64hneKJ
TLSH
T173C1FF4130BB064538BD294C90A1972E424231B3316CF6BAFF7D48A68E6EE441DFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0030.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0030.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2bb8e85d8dd38f14e14b56b6ce2d26a3927ddf53a46c204ae0f9520d40720c81
MD5 131ec068aa7b7166f0258b5dc4969557
SHA1 ae774ff88190f5d2ec11f5703446bcfa83c2b0e5
SHA512 4f1396917207777c2e9ac48eff45a4ba62f70eaca93c3c0b9621c5b18dea02b5589601875355716ee2d7c7a4526450fe9e39df4f8416c8ff7dbddf980085feb7
SSDEEP 192:LJON46DphmqQmiUyqRq8wGYX59ezSCtORX/kk7ZnU6:lON4619HRwGYX5EDtOxnFU6
TLSH
T1F102F835ACB87C7B8DE36E45F58B37139FA8102BAA942F54D6D81E1D00D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c6dc1b58e762869eed692cdfe90a162ce7a8cfb61b094f8e909f913fe70be59c
MD5 cac7162bb9994fe1eae01fe63a0df064
SHA1 85fe1d4c13cca7ab30b0011091cdb5f4c2001c88
SHA512 8fc877d0f8639c76ed37201fb984c88e8c0c0676b9d04b748e925703660d3ba8dd6159636f12356d4b29407f6e2a0e9f643d70c329a2a30a05da030c0070544a
SSDEEP 384:nhZcIRsNgCZuKi5IzHVBGYX5EDtOxlLLhtgOIwZOyELboK:pRuLi4HnGYuDtOTLLhXs331
TLSH
T194827C75AD78AC7718EFA145F18A37539FB8607BA5C89F50E5E85B1E00C62C8270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f3bf98c75139d690821c616b30702ac334025fc3a3b9ccdfe7058021deb8373d
MD5 ebef1e7d4ee9a303a1b9b7cd732f7a31
SHA1 e401d9c025960e049ece8fa8882736b6d54b6634
SHA512 39a6ba1c7c49ef3614bf27f52bee1a11b27ae640bffbae09f117c1720f9f091ac2b1f6be9adf798cfc7858da1464877a6f33c8cbf07f12be4329ae9c9dc6d3cd
SSDEEP 192:LJONh6DphaqQmiUy8RHnwGYX59ezSCtORXlLGkIIh/5/RU6:lONh61lnHnwGYX5EDtOxlL/hU6
TLSH
T182120975A9B8EC271DE6B554F08B36539FA82037E984AF54E6D81B1C00DB78C370B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 46f3e293cc7d56fbe7e39a802e45cc2d212f4478a3b21ab46fef8fae0418d983
MD5 6a9017463214a10d5a5dcfb1bac04d8f
SHA1 17707edfcbba93bdbef26f58c84bff5a309a9570
SHA512 1f45f803e9a54345f55a7ddba81ab270cf97514c342ad0afa29c81286e4f9ebdad560b2f8b19ff8009087829da314d75a7179f70c5b7d570703142c9462cfb0c
SSDEEP 384:nrZcIRsNg7ZuKi5IzHVBGYX5EDtOxlLLhtgOIwZOyELboK:zRJLi4HnGYuDtOTLLhXs331
TLSH
T17D827C75ADB8AC7718EFA144F18A37539FB8607BA5C49F50E5E95B1E00C62C8230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2107d3159f1822cabba36e79c9f6d98e63713ce8875bc9fd7ecf47d6246041ef
MD5 1b81e151f0b7d40b249f8c9a9924f1b1
SHA1 24ddc99aacb9583269e361bf8204c749bd641bba
SHA512 b1747e0559cdfa56ea9d8fb772bb6fe0f263fa874bd3ee5444ee6c2bf4be07a9258110b1d8b6f256d93264b79b105d1c1e64cbd1363edaf9df51b8c89d9a8c94
SSDEEP 384:nYiFoZcInLsNg8TUNTUlIlCZuKi5IJHVBtDfYmYX5EDtOxlLJhtgOIwZOyELboK:jFWLtwgQLiSHnSmYuDtOTLJhXs331
TLSH
T195D2B5F598E78936D8AE5783A33D6E429EBCD063B5889990F7C41E0DCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

64df8c82-33ad-49cd-968e-215d90ac67be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\64df8c82-33ad-49cd-968e-215d90ac67be.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0ab6c31bd0770590cdf0b859651033986cb2d6ad890fdf9cf0c858813638b4c8
MD5 5933dc661c1ec87ef7982b43baae4a1a
SHA1 5a2c02720a266e94dd0599c9123d6e8ee351a489
SHA512 081e28849eb984db801f640ab0e29627b2cd693f91815f666d7bc608dba64fa5ae12afc7ac3b28175af081821a34f7ffcd0381fa04b2158802fc8121eda1b24c
TLSH
T1AC41494CB6ED1148B3B7AF569BF3686D487FBD372E06D49E10110E4F4626A40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 dc45100cffa19b09c58f1693b77bfd00a16786a58277193d3a6e2bb2215c7b7f
MD5 e3c95a7888398fa0ded861f899b588df
SHA1 0cd08cc6d4c56c7e930f4f2db26becb14767a3cf
SHA512 e9fe55bf96856dc9fe00ddb6d94889a3fd81d05a1962be54a3005f6756e6b06f791b1cd770bdbe23cba4a122a977c8e30b1f44f497c71011ff0e8616bc8d7935
SSDEEP 384:HalwSiO024YgWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA8L++S+U:6l8ZYgWTToXJWTTogB7S/AmVAf+hRMlq
TLSH
T16A728E7D8F013CAC265790E8C8BA43658D18B3E7DFF5C06D119C3E09CA84A5A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1
Size 23KB
SHA256 f09b35b103cd6e0f322474b3263cbff2ae9db6a2869c9d4c99599acf5a1c88b6
MD5 08b05a14bf6138dd9703ecf8010f3100
SHA1 4b98a304fa42e76c7e6183d617242c8a6ae2a7e1
SHA512 de48c23724310e71b7401ad01630c66a865e6e8eecd32db1bb38c10787f0bab361698e5533dc76efd346c7fcd8d678eb3ba1e00dd25b959fdf12cec3e36fd6d9
SSDEEP 384:kjbMegNp7L7KCopFDUtCZvjU73zqFiubIJo+S1To5xfnh2zY0DE2Ba/rIVy8eOez:kjUp37K7D4CZvja3+Fwe+iToPPh4Y2sN
TLSH
T1A2B2C0BF1C5684DCDDD754F398AC709AA83DBA730BB82D2E670C14060549FB452F68C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47532afb-4362-4b2d-af86-d18a30bc5b9e.tmp

Path C:\Users\Admin\AppData\Local\Temp\47532afb-4362-4b2d-af86-d18a30bc5b9e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a92aa57-a0d9-42ba-9d27-9b99b85371d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\4a92aa57-a0d9-42ba-9d27-9b99b85371d7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_1619276751\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49691200-4541-4f60-8f9c-05131ae89c16.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_881520734\49691200-4541-4f60-8f9c-05131ae89c16.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2ba004eb8b8bd0d057498c51988ec15060d0afb40ee04e8abd48ffc7dbab8b92
MD5 043bf2999a63c6a12f2713d6919c6597
SHA1 7b20f57b323bc08e40bfc04696b30bc817135933
SHA512 f91265f3ff7317445684988d4a8b901b86bfb7943c10834db71db0528ee02fe45ecb851f20b124bb45bc133708f4fe5081542264a4420f886aa3bdb3983ddfb1
SSDEEP 192:xU1d66JozGzgCl6mc0dBX9Ov5zboaZOVZyjifOQ:Ad66JozGzgC1jSboaZO7yjW
TLSH
T112E11164E629863FC048027BCDA21F440F39389B9C4E7F29359C65482D577DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 b80e31eb2bf30bb03781a278fd6f073e7a3afe0689d47eb092db83499a392797
MD5 7c2012e2874154d2e0b11ac8bae32cb4
SHA1 9206789f0942929163d3019fcb148011d6ccc53c
SHA512 805f8419701de77091fe8b7735f1cc83c84544d7ab904e6a798ddc827c16fbc9a3e2ec42dc6e5f4015c1f14b31f8def81204912b1498ffd65d711569d65df8ae
SSDEEP 384:Is9Cmi+OveGcmhur0a7PeHK+K+Knb5bDycDDborO7yjvd66JozGzgC1jd:I4oeGcmhurrGHK+K+Knb5bDyA3hdE/
TLSH
T191C20F84FB2A953FD41412BBDCA50B002F79BC8A58196F673A4C64686C972DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 0b969ab525f980ac4ac5229b04f034e3b6f6eb6f1e8077090d5f689b88b43c6a
MD5 43d63bfa13f84aa3a8f95d5beadba5df
SHA1 e46d8376c3fa655ecbd8ba4a16019f39716d555f
SHA512 f330bf8d840f375362ef5c40920941774819957beffd24db0de123b5f0190a064cc762a0930c5f05e5d2246f1930cd5897938420a7e256839a529ffe81c78a7f
SSDEEP 384:HborO7yj+s9Cmi+OveGcmhur0a7PeHK+K+Knb5bDycDFd66JozGzgC1jd:7hN4oeGcmhurrGHK+K+Knb5bDyAyE/
TLSH
T155C20F84FB2A953FD41412BBDCA50B002F79BC8A58196F673A4C64686C972DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 a6c016d13d4876bd0342f163b9cf614772694a61aed1e1a2be0c91bf3f9cd86f
MD5 9128c066d90a19837f72b7c09af6867a
SHA1 cdbcf5f9ab63abf3f13a88841f0aa506dd53019f
SHA512 6debc880beb458effe9694b6f3ebb571b7cefd34a1ef664ca9defc26bcc5699156017e667b8bbc0ed5f510850a841b47817d46feb819f88a161b8e86e84daf7e
SSDEEP 384:hd66JozGzgC1j8borO7yj+s9Cmi+OveGcmhur0a7PeHK+K+Knb5bDycD:uEGhN4oeGcmhurrGHK+K+Knb5bDyA
TLSH
T1A3C20F84FB2A953FD41412BBDCA50B002F79BC8A58196F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 37c2a46a6ea718bd07b474c36e0e480678ca1769b4480cf6ea58f18da7e575ac
MD5 2325881ed5fe56185a48431850a72d9d
SHA1 04f7cd75b13703a34a336dff5a64ccc80fa02a0b
SHA512 b64253ac3f35215e14adfe6577435730a7b2d15589ebbd63775c63ef1b2b03d11f172a92c7b080825e25b745631cc33292173cc3929870bc8dd8ba4536c204cb
SSDEEP 192:xU1d66JozGzgCl6mc0d7X9Ov5zbowbOVZyjifO+:Ad66JozGzgC1jkbowbO7yjM
TLSH
T13FD10F64E628863FC044023BCDA61F540F35389B9C4E7F29359CA5482D5B3DE768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4e7197bff62e50aef4b07e14cccc016b521fd8014eec5e7792d932bbf05a9f3b
MD5 f1d35c0bb8288d6a1d988fd52f5de565
SHA1 037d5996f3359f62184b153f73aeef67bffadaa6
SHA512 948d53586b938a0dae06146760cce9950c2c2da5510a5368ed723bb5b2ad9a3ccbb59f6b3b7b20ced0254ceca033607e57e80e0c2562d2baddd6400ca6e3f68b
TLSH
T16411C04C3AB84D6A98CBF69CB445128E63D14E1B148B1C43DD02DF8ECD80AD932AF43C
MD5 SHA1 SHA512 TLSH

Submit Download

09440283-8188-4743-9398-f6a1277f31b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\09440283-8188-4743-9398-f6a1277f31b1
Size 886B
SHA256 13fa41a3bd7d985efc3cf6b7d54ec207a883a3ef3b358e684669240652dbcc80
MD5 faae5fa44812e74ffb7bdd3e39015514
SHA1 fe844dc671637ee3eafa489f97d2c6cbf1076dfa
SHA512 35782e5e70af42d60357b672f4f40fa9b4653183f022ae18a0a38b3992dc19f8a6b51931acdea614462540b2fa055a12a5b12b92a676eba98e2fedf76dcf880b
TLSH
T12E110044A63979B38DB8D28FCAD137518BE0756380C699147F688F084DBE60E936A607
MD5 SHA1 SHA512 TLSH

Submit Download

4cf2c9d2-4d16-4367-9bca-24ea34049440

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\4cf2c9d2-4d16-4367-9bca-24ea34049440
Size 15KB
SHA256 2e3aea72e5559ccc9c8ab2b9e9efcb4280e0a2700b903c105e7cbc64bba7202a
MD5 e82b9d2b77296b329664f1e966f94728
SHA1 65cfd7439ff5ddd40474d5ca5d30418dcceb2f21
SHA512 907555d19cf46914c61312f059b2b7434008320d37e1a204c544ca80917e418c14a72a78a563e78b10737392f6941f8178ec93184d66d987f9203609f60bf529
SSDEEP 192:uB+gf2hXohCdIeABWYBC/xhN+HRrk1kHU4BQoT1yPzxDy70Dc+xFXFtUvVXRdHe4:uBv2hCeoD04yhlDyQDc+x1WNbHaE
TLSH
T13472DB56286045BB8251E36994ECBFC3E6F538CF4C419FCA8BE4BD085DEE0AD112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bf8d280-600a-4c8d-8130-deefa0c58037

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\5bf8d280-600a-4c8d-8130-deefa0c58037
Size 235B
SHA256 2da6abcd961097efb340e092e6fd3b1a1d383c75115441c9580c3bb1d330b5a0
MD5 9c38f8d34fd59f9b62a3cf84eedcd666
SHA1 4b7eee90044790ff42d37c0876b8fe142f19b780
SHA512 5b199ef3f32715dbcc9b2327156c503ea591f3f9968dac6a1420a9a8cf838f604646065d031b46b36a7b91908b4f69ee8c0fbcfaa18437a0b0f0706b020abcb5
TLSH
T1B3D0A79124E8675D58144F0BB0A06ADA714C8C3764B8B815D6A24678DEBD9C8429186A
MD5 SHA1 SHA512 TLSH

Submit Download

63c6101d-a065-4e2e-b1b4-9fb23c280a10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\63c6101d-a065-4e2e-b1b4-9fb23c280a10
Size 235B
SHA256 afb60d6cb07b78a493f43ce1e768328a5eb20ea1bc66dce5341aab0252c4ce8d
MD5 8efafa8eda64fe809e38560a4398ac04
SHA1 91659e63050f621f149310ef1a57301bd01bdcbf
SHA512 21f1464c0ff9db86de4490a4a5130b843b64f6f9f7b1311ed75932f184569dd2f35252baefaa409b4a64e2c9debdfd1008e528782205a430ba865299fd145825
TLSH
T1B8D097C838DCAB1E0C240F03F0E229D230AC8C332060E8209B6046B899B9EC44151856
MD5 SHA1 SHA512 TLSH

Submit Download

93bdc2c6-7aca-4621-b7c2-6c194c8a2f29

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\93bdc2c6-7aca-4621-b7c2-6c194c8a2f29
Size 883B
SHA256 549393a6a80948f2adbc80da7ef54ed689fba4c8ec1431e21caf8733b75708bc
MD5 1bcc2d3332924c28f0e320545f2dd62c
SHA1 286dc162270ab9b464e73ee1bfa2ec2eac856381
SHA512 4d4a27b9f525144c4e1f5619d41efe71c3cdd0081082f22c181b7ee295edb87c49625e116c7d734393dba0282005789d46cd54e29a6f845b5a7bc7cfce8ea430
TLSH
T197112380A63579B7CC7CD24FCA9137158BE4783380CA91143FB58D040D7EB0D93AA24B
MD5 SHA1 SHA512 TLSH

Submit Download

b502436e-0818-4811-be4f-7a983e04fe53

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\b502436e-0818-4811-be4f-7a983e04fe53
Size 2KB
SHA256 9592dd7041ddffc0bf9e6d35f0eaf8147e284559e469985c6e4bf80f45a0c73f
MD5 4bc0d6d099811ec045b74cb902f05875
SHA1 446aaacffcd947cc5e314ae1627ee5a6e4f72bf9
SHA512 86e88cc383e080cae1793bbe97f107d7f7c390d22344080712bc83b247e0ca10a36091c7a39b46a2d39027c080d26ad0958fac6c6d39e6af9755ddc94f168e39
TLSH
T17741335C76FC4C7658DAF24C9581238A5BB08E9710C62C436E51EE0CCDB679E336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extensions.json
Size 16KB
SHA256 bfafa7dd8d02956d64769d4bb44f95fbcbdbdb7d66ad4197bf1ec0e5104cdd16
MD5 4b698072dcd286ceaca792ca03aea9d0
SHA1 0d0d0614e7cc069d3d2e61045bc91d462f13bc05
SHA512 8d1e0ef4f3915f7a5d9936f28d50136887b3f44028c56862e15e5b69d927eeeaca105ae03d3483a0fd34bf9080d4950e90c7f9d13de0fd85da9932cafd50d0f9
SSDEEP 384:mkI4vfUmldvBM8dhW+94zO96otXL4HpL4P1L4HDL4HTL4HOq4hl:pI4XRfbXT4e6Yb4h4d4P4/4143
TLSH
T13872421545448EB8298EA79BAA367D02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
Size 6KB
SHA256 a1f7db360b4a0aa7d64dacc6308ec033dcd4b59d824703a19b01e7b00699f9ef
MD5 968377b21e8923eb262b427059ce8d90
SHA1 89a3a4eb7a8ad1bec5071937869b7f94cd583785
SHA512 a6e1c45c2fa8ab098781b8f91aaa95fb0aa733b689fb02c5183630895d452afb8f198ded1b94c0908df28b347800a8e9c40b5662a270701b4bbebf19458715bc
SSDEEP 96:xHYUTUzqGqZEfUog1zSa1KSSlSdv9jhnvHhW/YBw88n8L4cntGUI6:KORZEfUogx1KSSGo/YBw88n6
TLSH
T10FE120789108CB6F65B6776CAC688C316AB2413B7BBF68C750B584C5015CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 4644ee1e8b0c1f56ed98452392884ec29b3cc2cd39630d2e54f12323d229f71a
MD5 4f161c480a9b18826419478218c8f8e4
SHA1 65b80aa3e272c2dd3d2b00fe1dfcca75e6d85b71
SHA512 eeee87f89f44d6a9b9cb3711339ee1137e1b22a04e615269735a526e01ef7595b7bbec8189046199667ef33f2d18e9066edfeaea009aa7127b0873748f342ba0
SSDEEP 96:xHYUTUzqGqZEfUogObzSa1KSSlSdv9jhnvHhW/YBw88n8L4cntGUI6:KORZEfUogE1KSSGo/YBw88n6
TLSH
T1D2E1217891088B7F65B6776CAC688C316AB2413B7BBF68C750B584C5015CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 7KB
SHA256 7e155fd5987d90451f094f205aad79d8a154ef16c7d8e58bea523003ccefce37
MD5 7e1172b15edb2c0f6a866d142c05e109
SHA1 d7ebdbb7648fd7aa69ee6ffff28ac90d8d41f7ff
SHA512 04726b460ff54bf23917711f1dacb2a1eec8448ee6d3f30cac466ce4ff2f6b1df119b5705aa2fead0d5017cd82fb6d11b9c630e7b6d53b590fff5dce4fc17396
SSDEEP 96:xHYpTUzqGqZEfaogObzSa1KSSlSdv9jhnvHhW/xBw88ps8L4cnt2I6:KvRZEfaogE1KSSGo/xBw88Z6
TLSH
T197F1F0789108CF7F64B2766CAC6849315AB2413BBBBF68D750B944C5011CF3845FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 50a6e0c821f41b5e1e292585793d931fcd008b361935564ad31b2df68a412e7a
MD5 2721a153362c8d3f10db2224714d8a13
SHA1 c7038a7c8a4c7a521ed9d6f100f599fb2bd54853
SHA512 a1376069a38361e9276c75501849fd5370fa8d37b77c5e2f735fd446f75fc24c7c28f0d949addc7662c3827c23c36b1455b8a571a9ba2dc8a68b288c203a129d
SSDEEP 96:xHYUTUzqGqZEfU5N1zSco9DSSlSdv9jdnvHhW/YBw88n8L4cntGUI6:KORZEfU5Ni9DSSCo/YBw88n6
TLSH
T117E13F7890488B6F74B6776CAC688C316AB2417B7BBF68C750B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 ea879a34d509310f1667b69d287ed0d3c20267a3df0de3e49c1fbb6198777590
MD5 76362ee92dbf8a34f9cbc21f14c6363f
SHA1 056a46b9de34300ade1b5d46ea80b96944ff03f3
SHA512 1695b093263aab19f9cbd23838b8f7f5535e6cb2091dfa30feda305f6159821558144c2521a9d68c9bb808ac094a5465d2e2db169e5d52c8627a2725cf3a9f28
TLSH
T1CA31C9478C3B7FB6BA45E2C5E44C4FF14A252025847C58E0816E954666CE4D4378F02D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.4MB
SHA256 a9dfeaf2579c9428cadb11fc509d764718c5af361923fd9f761a58bdbca22d20
MD5 3b95a6488add46a9d856b387b1e3b6bf
SHA1 2eecda6f8e18a267ee363dccb45f08dce2717507
SHA512 d94da5f9820c137e85d3808c5141ac8b9e73235c085ff0ce9124ea241175e5ceeb88a6d255b05d1118e4d348c0fe74be9cac12d2c9bfaba299fccd97bc689f95
SSDEEP 49152:keCBWkMKV2v5OeD2D3/YQxjz+4lmEI/dgYcu5d+SB3xTTZW9wTgznvWG1YVYzbR+:/dmbR7IQ+pPsKZ
TLSH
T14A765CE420E19253F38640B3719993FB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download