hxxps://cf[.]smooth-vine[.]site

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cf.smooth-vine.site
Sample260925-mvszcaws2q

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4764	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348068602214752"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{5C836365-9016-4B5A-AEF5-C38428690462}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	firefox.exe
Token: SeDebugPrivilege	1004	firefox.exe
Token: SeDebugPrivilege	1004	firefox.exe
Token: SeDebugPrivilege	1004	firefox.exe
Token: SeDebugPrivilege	1004	firefox.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe
1004	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4328	2292	msedge.exe	85
PID 2292 wrote to memory of 4764	2292	msedge.exe	86
PID 2292 wrote to memory of 4672	2292	msedge.exe	87
PID 2292 wrote to memory of 4672	2292	msedge.exe	87
PID 2292 wrote to memory of 4672	2292	msedge.exe	87
PID 2292 wrote to memory of 2776	2292	msedge.exe	88
PID 2292 wrote to memory of 2776	2292	msedge.exe	88
PID 2292 wrote to memory of 4860	2292	msedge.exe	90
PID 2292 wrote to memory of 4860	2292	msedge.exe	90
PID 2292 wrote to memory of 4860	2292	msedge.exe	90
PID 2292 wrote to memory of 4856	2292	msedge.exe	91
PID 2292 wrote to memory of 4856	2292	msedge.exe	91
PID 2292 wrote to memory of 4856	2292	msedge.exe	91
PID 2292 wrote to memory of 1168	2292	msedge.exe	92
PID 2292 wrote to memory of 1168	2292	msedge.exe	92
PID 2292 wrote to memory of 1168	2292	msedge.exe	92
PID 2292 wrote to memory of 912	2292	msedge.exe	93
PID 2292 wrote to memory of 912	2292	msedge.exe	93
PID 2292 wrote to memory of 912	2292	msedge.exe	93
PID 2292 wrote to memory of 2744	2292	msedge.exe	96
PID 2292 wrote to memory of 2744	2292	msedge.exe	96
PID 2292 wrote to memory of 4944	2292	msedge.exe	97
PID 2292 wrote to memory of 4944	2292	msedge.exe	97
PID 2292 wrote to memory of 4560	2292	msedge.exe	101
PID 4184 wrote to memory of 1004	4184	firefox.exe	109
PID 4184 wrote to memory of 1004	4184	firefox.exe	109
PID 1004 wrote to memory of 3724	1004	firefox.exe	111
PID 1004 wrote to memory of 3724	1004	firefox.exe	111
PID 1004 wrote to memory of 3724	1004	firefox.exe	111
PID 1004 wrote to memory of 4796	1004	firefox.exe	112
PID 1004 wrote to memory of 4796	1004	firefox.exe	112
PID 1004 wrote to memory of 4796	1004	firefox.exe	112
PID 1004 wrote to memory of 4796	1004	firefox.exe	112
PID 1004 wrote to memory of 5240	1004	firefox.exe	113
PID 1004 wrote to memory of 5240	1004	firefox.exe	113
PID 1004 wrote to memory of 5240	1004	firefox.exe	113
PID 1004 wrote to memory of 5240	1004	firefox.exe	113
PID 1004 wrote to memory of 5264	1004	firefox.exe	114
PID 1004 wrote to memory of 5264	1004	firefox.exe	114
PID 1004 wrote to memory of 5264	1004	firefox.exe	114
PID 1004 wrote to memory of 5464	1004	firefox.exe	115
PID 1004 wrote to memory of 5464	1004	firefox.exe	115
PID 1004 wrote to memory of 5464	1004	firefox.exe	115
PID 1004 wrote to memory of 5464	1004	firefox.exe	115
PID 1004 wrote to memory of 6516	1004	firefox.exe	117
PID 1004 wrote to memory of 6516	1004	firefox.exe	117
PID 1004 wrote to memory of 6516	1004	firefox.exe	117
PID 1004 wrote to memory of 6516	1004	firefox.exe	117
PID 1004 wrote to memory of 6708	1004	firefox.exe	118
PID 1004 wrote to memory of 6708	1004	firefox.exe	118
PID 1004 wrote to memory of 6708	1004	firefox.exe	118
PID 1004 wrote to memory of 6708	1004	firefox.exe	118
PID 1004 wrote to memory of 6716	1004	firefox.exe	119
PID 1004 wrote to memory of 6716	1004	firefox.exe	119
PID 1004 wrote to memory of 6716	1004	firefox.exe	119
PID 1004 wrote to memory of 6716	1004	firefox.exe	119
PID 1004 wrote to memory of 6728	1004	firefox.exe	120
PID 1004 wrote to memory of 6728	1004	firefox.exe	120
PID 1004 wrote to memory of 6728	1004	firefox.exe	120
PID 1004 wrote to memory of 6728	1004	firefox.exe	120
PID 2292 wrote to memory of 6632	2292	msedge.exe	128
PID 2292 wrote to memory of 6636	2292	msedge.exe	129
PID 2292 wrote to memory of 6648	2292	msedge.exe	130
PID 2292 wrote to memory of 1692	2292	msedge.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cf.smooth-vine.site
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffd6a4c188,0x7fffd6a4c194,0x7fffd6a4c1a0
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,16759063864242042244,9618240840773318049,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5387226187979795787,9999761157226961454,262144 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,10322957207208045752,10045205203407291767,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10497025901306275164,4578983023700939419,2097152 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,5109868890737126653,9798229255661542621,2097152 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,7885775010791771025,3298134416310304617,2097152 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,2192756022927906025,7213809545343605154,2097152 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:2
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,11892135678588153410,633925886090663334,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,3898537284043210615,569388597653024923,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,17047503170692224768,7354531639922773618,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,17047503170692224768,7354531639922773618,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,2544045202132007149,12143109013541359736,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,8753059819545324917,16642211709902804765,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:6636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,9193063166945837769,14209794746002114175,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,3182213866990772571,11485786372091091758,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,18051854367622007304,14926389386394906351,524288 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,11519534530275704906,14382869082319022755,262144 --field-trial-handle=2300,i,6830393495499522271,3046242992599914414,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {edc59da1-d012-4eb9-9940-fc89597568cd} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {c93c0b79-7123-468a-b304-66b41811e43e} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 27276 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {15d861ff-6f47-4a0e-af5f-3cf358095a7c} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27276 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {e08a61d9-4043-40b0-a775-8599029a5023} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2952 -prefsLen 34775 -prefMapHandle 3012 -prefMapSize 270279 -jsInitHandle 3392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1356 -initialChannelId {2c4516b8-98cf-4b10-98fd-89f6266eb527} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4832 -prefsLen 35012 -prefMapHandle 4836 -prefMapSize 270279 -ipcHandle 4844 -initialChannelId {e55462be-2bd9-41dc-af80-de25eebdaed8} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5032 -prefsLen 32952 -prefMapHandle 4824 -prefMapSize 270279 -jsInitHandle 5040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5024 -initialChannelId {d0404b02-8d80-45b2-aff9-26683937d307} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {85f73d12-4fc1-4699-b952-82ccb8c29a01} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32952 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {f5ed5f2b-66c7-41a8-8f3f-13639ab66330} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d17a4c25d18dd2f26e2672183546890840f41a2971d0172eb271c82fce9d1a10
MD5 905393b8c726ec3360bd129d4421fb2e
SHA1 9d3629c9860b156ffa6af3fa692ef6b973ed1bb6
SHA512 96dc182dafd1cf39c806e03cff1249b842258823b6d86ce9242b12e3243678717ca2ca57315f496cce7a4c3206cf49a3d90a9c1779ca2bf8cf51222a31d64fe2
TLSH
T163613B8057B08472DB98A670D1F1D09B3AF459F149CBEE5235E0FEFA4713F5491E4062
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bf92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bf92.TMP
Size 3KB
SHA256 07fbfb995ba152e30e8c4944d2fda4af5310e53d7c9578f842cfc606a6094424
MD5 e00cfedf9f61096b36b0b13e461b412f
SHA1 402cf15ab9d2f28dd461c4c8c19e6ddac347655c
SHA512 a04b3c5afa109dfe188fa370787bf8a7ea6439cc33fcef2fa68386a782197cda252c71a86e9511ee1a29315042311df5678a56f421b4a415e0c44fdc4ab333e2
TLSH
T1DE612A8067B08472DB98A670D1F1909B3AF459F149CBEE5235E0FEFA4713F5490E4062
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b1b32cde6a72f8f59b4adccbdcf18df9b02830a7c072a4b17b8e1c9e317d9ec6
MD5 84f047f505c32aa0de63e3531a9982cf
SHA1 d5a18bb3b4b71af0c461a8e1f2b689242a5ac771
SHA512 993cdec9a63672d4fb53b49f5cbc0fb119a38bdda73bdbf43706fd236e7bf672b0311ac8d56196e6e416c70db420e919bb83e13213c5afe11aaf18c4a178482e
TLSH
T13321CDF7C3E596AEC91116F0AA24AE2BCE1C0A15431C3C19C5D4EF6B93E3071E002A6F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d39c6579ba57d2de16a1e694c8773650b8572d39d344af357ea2457c014c3250
MD5 c2c3b5b9fbc11ec2ede4219fcde4b430
SHA1 2b2987ef19fd07e0b3250b255367c8331eaf5bb4
SHA512 01f5e79306febe0d34a0eba7f97a743707f3c82158044485b7479e4c41723f908bef5d7094952a9de1aaac9b86a6ef9b2d7d01a937f2bad2e9477a7de7e94f51
SSDEEP 192:sxZbRmWR/f8sydCkIdpJHW6+WNGYa2T3IgrJ:sxZbLR/f8sydC9JHbGe9
TLSH
T10512B756AE28A57B8CCBD20DBB657F53E6F9503261D41E48EAFC861C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4e3c93be3c1134779f3fdf2f369ff87357dcf72dc5048a92f46d46144c6201be
MD5 938e75df58e08ce2bbc40b81f8ec74f1
SHA1 c38aa77e51745af7cd96f0bb10fb7c373fa6ad43
SHA512 5928d85e4fbdcc78ee2a42ea55a6e5369568a27be143847ba143212837e5e12a62f21b790f0691ddceb8df479ac5475dfe4905577e8b4e0275f1180e6224f056
SSDEEP 192:sxZbRmWR/f8sFXCkIdpLHW6+WNGYafT3Ig5oOJ:sxZbLR/f8sFXC9LHbGjD
TLSH
T16922C856AE28A97B8CCBD60DBB65BF53E6F9503251901E48EAFC871C05E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b2850a83c406bf2bb4e4a0749943c3bc9b42563b881d29bdc309be46e8772375
MD5 a0470524f17391434d932d402339b925
SHA1 cf5bd9c68a7af19622637605a69a48e6a9e4bb31
SHA512 34de26700918201012c29967fcd00da897753c8a026a413e0eb31bae3e4ce67cf4314538935d4bb3d62a1b32bd16c3e601cbef0562c84a2418c5178acb319350
SSDEEP 192:sxZbRmWR/f8sFXCkIdpJHW6+WNGYa8T3Ig5oOJ:sxZbLR/f8sFXC9JHbGgD
TLSH
T18222B755AE28A97B8CCBD20DBB657F53E6F9503251941E48EAFC871C05E7ACD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 29e34cc9885d43449377f16608338b4ebb54560306e23b3932c91f013ea0c568
MD5 3ce0057070d01103109cad934879bc10
SHA1 fcae444632fc1211f4052e547bf56f1d209b48cd
SHA512 d99dbc3a6c6aa34c8bdb007b2f06de62d9e6daa4a3900bb732660b2f62322193d8ef1f38f94c7cd58d53b59a8aaf2a836337fbfab0b1b7f75b8e4f4d3fca810f
SSDEEP 768:JuyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3yroELbZ1I:JuyQRbrWvvlpZu1jaXKLf33p4bZ1I
TLSH
T1BBC2FA2F640CCB7E4FD01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 92448b3b1c23e6c6c3aa789363694f48b86016beec395d5d2bedb178f6f3779b
MD5 5f70ab97e59dff7adad3e328ebce705c
SHA1 272057f1e1d62d5abbf3348265d317eb8cd69c9e
SHA512 ac523a43eab97993379cb66c0b4b2d1fdfa8d138bfe874696b535c377140a9862dc849c0dd1fc075abba3c55082c6f8d97c23eab3bf46870d1cc90de80f7ba37
SSDEEP 48:K0u5uIuVupuzu3uLukbu3uSuPISuBukK9uB1urukxuJu0YuyuzuJu5yLmBcBLPTd:KgBSKaEKlqoKzK1MwK5uqiQ
TLSH
T16F914A1631B7430639BD385C81E0875E8A8631A33059FB2B7FBC49A24D2BD194EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0015749-238e-4af3-b603-365a5a8288fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0015749-238e-4af3-b603-365a5a8288fd.tmp
Size 9KB
SHA256 b485fd66c7ef2f55b6396668a9f7b3dafe04bf597f99c7e317d7d5316b34b8fd
MD5 9e2d5fccffc1dfe2549b7c05737f8c53
SHA1 ed0267a56f6acf98b361926789fd19ce894ef753
SHA512 a2c4d48bec0f899e5fdd23d4ec16e4ad9d42ef683fb926e2682441d7a4a3bdbc11bb912e15a9211157b3c3d93e7b3359e2d05a70891dd98ad133062caf63ed8f
SSDEEP 192:sxZbRmWR/f8sFdCkIdpJHW6+WNGYa2T3Ig5ocJ:sxZbLR/f8sFdC9JHbGeN
TLSH
T1F222B756AE38A57B8CCBD20DBB65BF43E6F9503291D41E48EAFC861C05E66CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595b45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595b45.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cf28b5211168919afd2e9046fa526f3526a1a3eccd9ff43995c9aec7ddb81af0
MD5 b880e27a205f5059432130781ae0b32d
SHA1 6fe3b723d25f11666b3c0592e27cb31ca9b7dc29
SHA512 035d70bef7111023da61efd86402e39cf5b99f4e70b74949bccc05090f93311e54b6d0cd5c042518d837faf5e0278daff7fef3f0e13ec676633877bef20fe09e
SSDEEP 384:ZZcITsNLcOWaI0p5u8iqHt4ndf5iNc12oJ:xTh+kq6nXk+
TLSH
T10E827C3A6C78AC7A6DB79851F5473A139EB88067D7C86F84C9ED5B1D00EB294030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6d4c4682fb9b0329f23a403cd2b756eea48f42277664fcc5c8f92c2efc85590b
MD5 451d6247a86d39a80976f201e7cdec31
SHA1 92861632b8390af53e857da319ef749c721fd150
SHA512 7d4be0cf4e471885978b70b0364979d512874cf6d857532be83153773be85a470e373c77ea0bc21a899ff4b627c5ff9a77d52d6a1b922171e1b186b70893afb7
SSDEEP 384:+iF9ZcIQNsNV8TUNTUlIlBOW9W0p5u8iqHtfndf5iNc12oJ:VFlCgwgg+kqtnXk+
TLSH
T1EBA26D775C68987FADBB9E51FA4A36138EB44067C6C8AB90D7DD5B1D00DB1D8030BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8c0c6e459252237640e2941164da101ad160d01d42367aad000b863b5cc7f01d
MD5 dd95a0239943d805cf934d08dfdcc62f
SHA1 110307507fbaccd20b16d884efcddf61e074b7c5
SHA512 e7ccd5cd69ca1ad427e46aa52b70d57d7698942f428e816fa7acff0c60e4630e7870014d62f22410468d136cd202c766b6322a8c223a55b36e14a13c6136d570
SSDEEP 192:SON86iDCQmiUyQGHq5u88PLuhLSqsroU6:SON86/cHq5u8iqvdU6
TLSH
T1F102F839AC293C7BAEF3AD05B5477B235FA4012FE6942B84D9E81A1C01E729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a2cea5b567b7d86449f1537b5c99e68bf84d034cb7f27e10aa500cde30acdedf
MD5 8b3511f68d9c497f0e078bf12cca345f
SHA1 e87d6ca99555ac99e924a743c3835ff870cb8774
SHA512 7719157b2458ff9395896c146ffe77901baeaf9398c57ff5d161170221ca948538f1c85f31db152ae4122baaa2e91435483bed3b8281e06259488ef58c9753ab
SSDEEP 384:MZcILsNLcOW9W0p5u8iqHtKndf5iNc12oJ:aLM+kqQnXk+
TLSH
T131827C3A5C78AC7A6DB7D851F5473A139EB88067D7C86F84C9ED5B1D00EB294030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 daaa353a928d1b93bd01fcc421627582168025984ce08a6690e2b760981fac48
MD5 aee1c1edf837f7e1dfa97add2c64638c
SHA1 d80c9523bdbb047c4b7a78d82b7c18ea46ed5c00
SHA512 054c2117fff03bc09f00a666ce661921a7cc5cc1869c04fd11767bfc8fc77f21bb49265b4414613bfb8bc37a9ade34790a683058e2d216540961fe502a88a0a3
SSDEEP 384:cZcILsNLBOW9W0p5u8iqHtKndf5iNc12oJ:KL/+kqQnXk+
TLSH
T133927C3A5C78AC7A6DB7D851F54739139E788067D7C86F84D9ED5B1D00EB294030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dd0ba32959364271fddb56dc27fe5be9d2896efb2e1bd44dc7b5b9cb5b1ed9c1
MD5 98ea46bf15bb1f0f74a4538e244060c3
SHA1 e27f9b9fc427000438a972fc7883d76f018321f2
SHA512 90e884286405210df5f4f77c46d13dcd53be912ba3409d64211165741c837aec3111c076e366b73f3e0aec7949de932e6c9ebc7cb52f2f2ad05e3e77ba3355c0
SSDEEP 192:SONO6iD0QmiUyyGUq5u88PLuh1tetGiuZt/hU6:SONO6xcUq5u8iqHt1nU6
TLSH
T1D612EA3AA8686C7B6EA3A861B58736135EA5422BD7C86F84D5DC1A1C01EF29C130B523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eb42d91-92d1-4d7d-a2d1-abc8d8583167.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9eb42d91-92d1-4d7d-a2d1-abc8d8583167.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2e6f78c7fbad15723006352a183d1484195c7786bab5ccfc873022f7ae7783a6
MD5 88cd95851e07870ec56529cd39dfecf2
SHA1 bcfb50e6739e8473f36600b7fb3c953cd2c0294d
SHA512 8b230113564127d1d2c25e83ab4b54fa9d66369e990947e909cd0ce11a92c3cea24de5dd03051ca7b58a0e13d112269142ef44202f6c94c4aa4a2ece2d1aa717
TLSH
T1DD41165CB6E91148B3B76E4AAFF6A46E887AB9331F17D05E00110E4F4A22B00CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 4f6e9c70d7fbd85afcd053f82bebf3aedd230dd61f6034de12081dc682b4f242
MD5 bfc3a4d70075326bbc83e85ef50f1354
SHA1 6ac530724cf5f79c81cfd10d37b25c40361953cf
SHA512 6813ba367b77e7a8133fd09df033c455468aea669d773926d3ba8f2593d3f633f99c976f4c942585619c011bb6968d0bef6d69aa6628f3373be1f2262c0c16f9
SSDEEP 384:HalwSiO024YaWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA8L+6S+g:6l8ZYaWTToXJWTTogB7S/AmVAf+hRMl2
TLSH
T18B728E7D8F013CEC265790E8C8BA43698D18B7A7DFF5C06D119C3E09CA84A5A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 2142f449388bd5a9e973bb480e47729073753115195b81328f3804884ba891e5
MD5 55419310bd03302b77c2256176c0f770
SHA1 b0f5ee50b47758c4637866de8ecd5eef40eb714d
SHA512 f728a3d769aa7f145447d7858a4a9b4c0c90f006a57e6da5527cd9c674c2c6d2d26038f89731c69765bee6ad176c10e6c0cd42cd009d6855002141f209770c93
SSDEEP 384:0rJ+CiNG6hF7BXGcmhu0R/XUKq7edFbzbPiEnd66JozGzgC1j2bo8WYyj1:0rJ+HVGcmhuEcKq7edFbzbKEQE0V2
TLSH
T120D2FE44FB2A913FD41552BBDCA547102F79B886581E2F9B3A4C64682C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 2bb8c9496700679b6c285c4781cee9fef7c5f8685b95f1848f09ad0f1fddb457
MD5 f24366d0592ce43b2f91b0443fdf6f51
SHA1 ab49bf70da1d96bc802b822660c1d7344b9c6feb
SHA512 1f1063f6c9ee2bfe1c5c632cd203a9878e6c17792949434c68fee695b53adaf11e79794f56bfe6a780d14d6da6831faa38d28f645fd444e922b8a821620febb9
SSDEEP 384:fd66JozGzgC1j2bo8WYyjdrJ+CiNG6hF7BXGcmhu0R/XUKq7edFbzbPiEa:YE0VwrJ+HVGcmhuEcKq7edFbzbKEa
TLSH
T1B2D2FE44FB2A913FD41552BBDCA547102F79B886581E2F9B3A4C64682C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5bb14817f69356312f912d81d01ee78921aa44156acf6d5958beaccc737481fd
MD5 13645cd966c8d9c5b9cbd2816fcff3c1
SHA1 c9762c06af71aca9146616fbf1a7afe291d8c481
SHA512 434401a86cd52df127a5156392a3d959c0abede5ddb1a1204d68f20615d70a67a0b8437c2534c98d8818fe06d381f00eb2180d26a62fe8cbc896da9ca18ce0d1
SSDEEP 192:vTM1d66JozGzgCl6mc0dFOv5zboFZWYyjL+o:6d66JozGzgC1jsboFZWYyj1
TLSH
T16AE11E64F628467BC408027BCCA61B904F39399ADC4E7F29359C640C2C472DE7B9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\events\events
Size 1KB
SHA256 439db86f5b0fe547a6a56b5a61a1109561a0bcd90cbf032475891186ac73123b
MD5 4f2f8297ece8176462aaea12df44245c
SHA1 f78a4d5e5174d0e8da7c2af2f493d23bc1e44074
SHA512 9985cf9cfb3ebf2fc2c6dadaa166e0a3ee4828b74e84d609469a375848c818d55a3cf38bbb66844eed2cf96fe27632a50177dfcc1b377f5d8554c1a40e936dbb
TLSH
T15721425D3EB88E1E5C86FA5CF480119D93D58E0A448B1C839E52DF8DCCD1ED932AA439
MD5 SHA1 SHA512 TLSH

Submit Download

0dcbe240-b24c-4d36-8900-55b8c02835a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\0dcbe240-b24c-4d36-8900-55b8c02835a3
Size 235B
SHA256 70d6f5c1462a6071228ed972cca1fdcae9f93c9c4ca08722e61608fadfd462c6
MD5 ac81569e4d219a768aa873497d10d36f
SHA1 24a5622116f4af2608a91440e594d58df30fefb5
SHA512 db5e8b63788bbce32a2d16b430ec0832ed6affd9c82e455b5c4bf6b80b0140bb67827cdb3be6dbaaf0d10411de98f052f9acd0c66036b92bb4647e5779473d46
TLSH
T1E4D097C1788CA3AC08202F0BF0B028C2B0498C33906568108A9008388AFDDC44153A56
MD5 SHA1 SHA512 TLSH

Submit Download

4be70a6b-16fb-4f3e-8738-6aef13af266a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\4be70a6b-16fb-4f3e-8738-6aef13af266a
Size 235B
SHA256 ac6eedb7549cfeefa95f18cf8b3bb7f9f5b730f296241df1d01b010dbed383a6
MD5 964fff9f2fe5f0af2e1a964dd4b3bb90
SHA1 2f3a6c35cfb115f33a4c6328cc5bf5645116ada7
SHA512 36bfa97bb643f7c108f5419e395122ac2af1edc57f0e871ca88d1fc1c9043cea5484d0caabdad0991bca78d48363a20adbd083ca2572f2571dfbf1b1dfd57c71
TLSH
T1EDD097D11888332C08140F0BF0F06CC231648C3324B49850C5A30074AAFAFCA012282B
MD5 SHA1 SHA512 TLSH

Submit Download

7d6f7918-b5a8-42a7-96d5-db6a053e3e30

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\7d6f7918-b5a8-42a7-96d5-db6a053e3e30
Size 16KB
SHA256 15c513a25d69aacf5984240b767a527ce06e2eb9656eea57e68c9f0c876abb21
MD5 16582ad4e282f19ac6d62cb6ccc75744
SHA1 ce89aaf4cbaee7ca99690e914e7c3e4aeb7be11c
SHA512 6321bbb20486376f54f6bf6313f5242396985d4545f00c893c834c452a2fb875750345607cbfcaeed09dfdb6852e06cf296e8dad1d28fe4fe06364a028e5efdb
SSDEEP 192:8ZHKbCSZWvRgMs4KGV76Uh1QUiYPqQEpZFHgm11/uB+byzofOk/Szu6dEuxqfK1q:+KNItQTYHWg02WooTSy6dLxqfK1QWwf
TLSH
T1E872CA16687045BB8391E36994ECBFC3E5F628CF8C418FCA97E47D046DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2057f40-b9c1-4c2c-a3d6-b7155a61d568

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\b2057f40-b9c1-4c2c-a3d6-b7155a61d568
Size 883B
SHA256 2c40d2c30dbe7fe9ec31684d1557200f37f3841b10e09c0dee5d95e499dd5ccf
MD5 06e8c1f708452c57bf9518fef1064d15
SHA1 b57756e7be697869889323c7b1705c90777469ce
SHA512 72151f9bcc26dc47f19a57fe9cc7fca2ec2666d899c14c8dc75611f9d1d4b76440e3e71cf48c9ffbca8269855f62dcead47d732fe67f727679614a5d240796dd
TLSH
T1F9110040B679B9B2DC6CD38B84A1375197E47923C0C988243DB54E180DBA51E936621F
MD5 SHA1 SHA512 TLSH

Submit Download

bde16bb9-8871-425a-895e-52ff2b9645c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\bde16bb9-8871-425a-895e-52ff2b9645c6
Size 2KB
SHA256 d009497e6d5bc6c98a7d0a3ea8c9ee498e8272adc7ca2eb5f2791f25bf017381
MD5 9c68fa4d62337e987b4b0196c5a991ba
SHA1 68f1e7a8f09199e00ed76a4e7936b15a66db0796
SHA512 0972b9abb97cb16da22b120337c5601ff5cd54e2963793f499be6824b856e88107926f11c341aa0b2e54b13b0a20d1862b531f3417d18aa0989c132617dc4c66
TLSH
T1FC41331C36B85CB79CCAF29D9441278A57B48E4380C65C837E51EF0C8DA279D336A43B
MD5 SHA1 SHA512 TLSH

Submit Download

db923926-b0a2-4e6b-a539-b357b72b60f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\db923926-b0a2-4e6b-a539-b357b72b60f7
Size 886B
SHA256 9ae481f643cba0917829b1d80c90b3ded1ab18d8aeccd3fb4572c79148bae599
MD5 d225da42df8d034b2d9b216dcaa51bf1
SHA1 d4a68eb832501eb51201790737f49e067a4a21d3
SHA512 b21f1e9686de15c57a02e1a7e3ec2a343e764b1a92f5b7d2b11462cea36a89e90f61e0165cee1708e11c50ddadc5b9dbe89f36906afe7839fdd2ff31986cf5ba
TLSH
T1B6112740967DB5F3CD28D38B8490775247D47523C0D98D247E904E1C0CEB11E936731B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\extensions.json
Size 16KB
SHA256 69e699cfdc4ad1a45336d8fd3395650f26bfd15959bcdd2e79ac0c198879791d
MD5 d282effb847bf4e0b0dd2b40e02c9716
SHA1 d1cee3078aaa5d91e16de337cf2e0a3f22a18bcc
SHA512 4979d741f71d4ed31ef63d7003b73918b3cfd74c832da7f22175cf62a82d1dbc94eca2de351bdef00c65925dc4a81a5a198d81b4656707bc41d975b0cda788f8
SSDEEP 384:EkI4vgXUmldvc8dhW+94zh96oOL4H3AL4PZ5L4HiiL4H8iL4HmE4hH:LI4aRfVXj4D6/4Xi4hx4CQ4cQ4H4d
TLSH
T10E72511545448EB8298EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs-1.js
Size 7KB
SHA256 c062f0614a35558f5343c64b7d0d287a069eccc5ac12830d8a56036397a74eae
MD5 9cc4630c7a387365761dccc6679ef3ce
SHA1 05e70791d3536b4d1fe33dcebce83eb22dca0662
SHA512 e256b1afb300666133118d27e0ccab4a9de17714d5c8e76a111d44e0cfad362e277bc4f8b80c80414c15d6ba096abec7cd12b11e56f71c9ad573a8c1d7e12a03
SSDEEP 96:xH3hTUJqGq4LfiyCObzSlSSlSdv9jannH5mrUBw88kJ8L4cnG+EoGS:N5R4LfiyC3SSd5vBw88T
TLSH
T130F10D7891488B7F64B6776CAC64883159B2013BBBBF6CC790B954C4055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs-1.js
Size 8KB
SHA256 4a51627056b0bcb55173a15c2661200e8908231e1001284f84c6f669e13baace
MD5 212fe3a4fe355040df2f635bdcae8f13
SHA1 da98b311f7ae03dc6b7fd0be668a0f52869e585b
SHA512 d923f6ef6c57ed9b82a5fa978b1c5d546bd0b9222dc22443ae4c96851289b29d448e89cc0c3e937ce20a92dec869e99e75e5318427195e280285c621d31f0ed4
SSDEEP 96:xH3hTUJqGq4LfUyCObzSlSSlSdv9jannWRf1h09mr4Bw88kjZ8L4cnG+EoGS:N5R4LfUyC3SScRifBw88z
TLSH
T1FB020F385108CF6F64B6766CAC64493159A2013BB7BF6CD790B944C5055CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 a4b51bce666fc3a1800502b5e9ba52843a0447d06a31e85995ebd0685274256a
MD5 9251f08de1c84776e2ca551e9b8165b3
SHA1 908bdf304ad514da5020eeb7b2fde7dedc44859f
SHA512 08929e05d496ed44da6f5b8fd57496a2c4d2b2c51676942edd17cc4eb98842eda2409aab02981cd4afde4d724eea459f67c92e6be30e020925d39de3d2c5727a
SSDEEP 96:xH3UTUJqGq4LfiyC1zSlSSlSdv9jannH5mrUBw88n8L4cnG5EoGS:NkR4LfiyCkSSd5vBw88Z
TLSH
T1C4E13F7891088B7F64B6776CAC688C316AB2013BB7BF68C750B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 0f71fa7d2d6b9ff0aab59abab35be4381599a3d3c9796afc41cf650d7886446d
MD5 8f1be73888b7e32621919ae83317be46
SHA1 73f3f4143c3ec181eeeca72fe77b8da7151553ca
SHA512 a5aa78d54e9e433cdd5f131120d562974988c400e064b75be7f4a3a30d6d12f7b838e403687714798799413ceb4cecab1c74f53fb42fc9d50e69ffa5569cce97
SSDEEP 96:xH3UTUJqGq4Lfiy51zSmSSlSdv9jHunnH5mrUBw88n8L4cnG5Et:NkR4Lfiy5bSSc+5vBw88q
TLSH
T1E2E13F7890488B7F64B6776CAC688C316AB2013BB7BF68C750B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f65751104fe921d2bd0d6ee682f58182becf26afc81c64f9e7ce1e7532a1480d
MD5 9067ccebb1437a19d3b16fbafbccc946
SHA1 a1d34f5d1c56775d6464b7d4475a5c0a275957c8
SHA512 79c72a8fc200a301054a019d065759fd5ac6b0b929c7adbf45a58b67c8bf8d68aae1d2c5dbc7af4b957f4e0dce7de24ac6df6a2d66f69147882cd02d160d9ee7
TLSH
T11F210A9364AB1FF63E53C11AD8818FA197863035882944F0C2CEDB9242CD44A778D225
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 1139f4a410e4806e5157a8d43708a7477f6e3cbc60ba9d15ca6b7cfdc589bb4a
MD5 c2c385d10193635c18298af89cf4627b
SHA1 51122923f92840d108d05b40f7dabaa5d8ebeb25
SHA512 821a3c7b9846dee9a0d8904d4fc5812fc5e5b61cc8395bc872ca7cb30da7b3a4a1a09d0f3a8fa27d7d17d33998cc02946272a92b759575c6c0a01aa54a6753b9
TLSH
T10121EA85FDAF14B62B97C04A50C45BD4BB913030C61CE8F0CD99B55107CC049B28D655
MD5 SHA1 SHA512 TLSH

Submit Download