hxxps://rebrand[.]ly/14je6oz

Analysis

user interaction
yes
max time kernel
135s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rebrand.ly/14je6oz
Sample260930-wh4prastdz

Score

3^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4388	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe

Checks processor information in registry 2 TTPs 60 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost\ = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\NumberOfSubdomains = "1"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost\NumberOfSubdomains = "0"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\ = "0"	TextInputHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3562044790-535044693-348086427-1000\{0594907A-FD9F-4C09-AE61-073768E6DE40}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\MuiCache	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\NumberOfSubdomains = "0"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CRLs	TextInputHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2636	TextInputHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2636	TextInputHost.exe
2636	TextInputHost.exe
1748	msedge.exe
1748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	firefox.exe
Token: SeDebugPrivilege	244	firefox.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
244	firefox.exe
244	firefox.exe
244	firefox.exe
244	firefox.exe
244	firefox.exe
4864	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2636	TextInputHost.exe
2636	TextInputHost.exe
2636	TextInputHost.exe
2636	TextInputHost.exe
244	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 920	4864	msedge.exe	80
PID 4864 wrote to memory of 5072	4864	msedge.exe	82
PID 4864 wrote to memory of 4388	4864	msedge.exe	81
PID 4864 wrote to memory of 5072	4864	msedge.exe	82
PID 4864 wrote to memory of 5072	4864	msedge.exe	82
PID 4864 wrote to memory of 1192	4864	msedge.exe	83
PID 4864 wrote to memory of 1192	4864	msedge.exe	83
PID 4864 wrote to memory of 1440	4864	msedge.exe	85
PID 4864 wrote to memory of 1440	4864	msedge.exe	85
PID 4864 wrote to memory of 1440	4864	msedge.exe	85
PID 4864 wrote to memory of 2012	4864	msedge.exe	86
PID 4864 wrote to memory of 2012	4864	msedge.exe	86
PID 4864 wrote to memory of 2012	4864	msedge.exe	86
PID 4864 wrote to memory of 4572	4864	msedge.exe	87
PID 4864 wrote to memory of 4696	4864	msedge.exe	88
PID 4864 wrote to memory of 1704	4864	msedge.exe	89
PID 4864 wrote to memory of 4572	4864	msedge.exe	87
PID 4864 wrote to memory of 3332	4864	msedge.exe	90
PID 4864 wrote to memory of 4572	4864	msedge.exe	87
PID 4864 wrote to memory of 4696	4864	msedge.exe	88
PID 4864 wrote to memory of 4696	4864	msedge.exe	88
PID 4864 wrote to memory of 1704	4864	msedge.exe	89
PID 4864 wrote to memory of 1704	4864	msedge.exe	89
PID 4864 wrote to memory of 3332	4864	msedge.exe	90
PID 4864 wrote to memory of 3332	4864	msedge.exe	90
PID 4864 wrote to memory of 4904	4864	msedge.exe	93
PID 4864 wrote to memory of 4904	4864	msedge.exe	93
PID 4864 wrote to memory of 4904	4864	msedge.exe	93
PID 4864 wrote to memory of 3896	4864	msedge.exe	94
PID 4864 wrote to memory of 1284	4864	msedge.exe	95
PID 4864 wrote to memory of 1284	4864	msedge.exe	95
PID 4864 wrote to memory of 3896	4864	msedge.exe	94
PID 4864 wrote to memory of 4444	4864	msedge.exe	97
PID 4864 wrote to memory of 5096	4864	msedge.exe	98
PID 5096 wrote to memory of 3768	5096	msedge.exe	99
PID 4864 wrote to memory of 1648	4864	msedge.exe	100
PID 4864 wrote to memory of 1648	4864	msedge.exe	100
PID 4864 wrote to memory of 1648	4864	msedge.exe	100
PID 4864 wrote to memory of 2596	4864	msedge.exe	101
PID 4864 wrote to memory of 2596	4864	msedge.exe	101
PID 4864 wrote to memory of 2596	4864	msedge.exe	101
PID 4864 wrote to memory of 1656	4864	msedge.exe	103
PID 4864 wrote to memory of 3776	4864	msedge.exe	104
PID 4864 wrote to memory of 4492	4864	msedge.exe	105
PID 4864 wrote to memory of 5988	4864	msedge.exe	106
PID 4864 wrote to memory of 5988	4864	msedge.exe	106
PID 4864 wrote to memory of 2072	4864	msedge.exe	107
PID 4864 wrote to memory of 2072	4864	msedge.exe	107
PID 4864 wrote to memory of 2072	4864	msedge.exe	107
PID 4864 wrote to memory of 720	4864	msedge.exe	108
PID 4864 wrote to memory of 720	4864	msedge.exe	108
PID 5240 wrote to memory of 244	5240	firefox.exe	123
PID 5240 wrote to memory of 244	5240	firefox.exe	123
PID 244 wrote to memory of 904	244	firefox.exe	126
PID 244 wrote to memory of 904	244	firefox.exe	126
PID 244 wrote to memory of 904	244	firefox.exe	126
PID 244 wrote to memory of 5992	244	firefox.exe	127
PID 244 wrote to memory of 5992	244	firefox.exe	127
PID 244 wrote to memory of 5992	244	firefox.exe	127
PID 244 wrote to memory of 5992	244	firefox.exe	127
PID 244 wrote to memory of 5416	244	firefox.exe	128
PID 244 wrote to memory of 5416	244	firefox.exe	128
PID 244 wrote to memory of 5416	244	firefox.exe	128
PID 244 wrote to memory of 5416	244	firefox.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rebrand.ly/14je6oz
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff972bcc188,0x7ff972bcc194,0x7ff972bcc1a0
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,15141982561691401278,16630366687735013681,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,11363196898846955519,14212178455089878807,262144 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,16466089704908497517,14136883595975256603,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3324555317244152448,2720485191480480162,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,3942985960364146732,5951774384611545802,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,9155959402374838246,16345219179823312672,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,9832578777323804500,9738412917249425691,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4120,i,3945569979727790847,2164213368349625891,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4132,i,4923498682235460989,11008132742543923982,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:9
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4828,i,148656517238587374,2847506313125725039,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,1969440303082463010,10736779231808708874,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,18417833107086796553,2150549666291796147,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,15909877791497906098,2354558014687722872,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,15909877791497906098,2354558014687722872,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,5861389380227628794,8075831268391951674,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6692,i,10756346828922837344,8135364408900507235,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4784,i,18408069756695850677,8330874203856717938,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,17128457891371986322,5036949764903644495,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,4592317972101724495,4416174797024819508,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,4471945897152285240,5836112699300139679,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,12102051479312293012,1956594355432142070,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2940,i,13238601422294951245,16833357672976645398,2097152 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,4291258640280294958,2606968642515948392,524288 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6624,i,10406927191288891593,13333092132868954648,262144 --field-trial-handle=2180,i,9215216502967327927,1928705188859169759,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4996

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2636

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:5680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc
1⤵
PID:5912

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:3716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27097 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {a92c803c-14fe-4d5c-a63b-316226a1e12f} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {af5eedec-dd6f-4361-a4ca-f6fc18b18736} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27274 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {671390e4-6704-4903-abdd-42baf0589942} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {752e3b1f-ab04-4176-9144-b83dc5169c1a} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2736 -prefsLen 34773 -prefMapHandle 4320 -prefMapSize 270279 -jsInitHandle 4332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4340 -initialChannelId {5729a651-1df4-433f-b679-942b72cc82ce} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2604 -prefsLen 35010 -prefMapHandle 3168 -prefMapSize 270279 -ipcHandle 4880 -initialChannelId {9df37ac6-7ad5-4200-9c1c-70466c37b372} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4948 -prefsLen 32900 -prefMapHandle 4952 -prefMapSize 270279 -jsInitHandle 4956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1672 -initialChannelId {b4758207-7240-4cb1-8e5c-d7b71effbb69} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5256 -prefsLen 32900 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {a7983875-0794-4056-ad33-cd092a3aea7f} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 32900 -prefMapHandle 5296 -prefMapSize 270279 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {49938fca-9c76-47b6-956f-bad480408994} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5160 -prefsLen 32952 -prefMapHandle 5164 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {68c32a55-90dc-40e8-ae1f-4c36b5766495} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4936 -prefsLen 32952 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {943ea581-4a5a-4ea2-81d6-abce532c59a8} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4160 -prefsLen 32952 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {653ffecb-c469-4e25-9e40-4b6928c9da2d} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4840 -prefsLen 32952 -prefMapHandle 2604 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {900a374b-c5cd-493d-b7f0-4326c30afdd9} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:1516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {4f3ffe3f-6f8d-4ae7-8538-c71d88920c20} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5976 -prefsLen 32952 -prefMapHandle 5980 -prefMapSize 270279 -jsInitHandle 5984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5992 -initialChannelId {867b77a6-f643-4e89-8b41-4556f1dc5f63} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6140 -prefsLen 32952 -prefMapHandle 6148 -prefMapSize 270279 -jsInitHandle 6152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6160 -initialChannelId {6a0087a1-fc21-4db1-ac84-980b23ab3880} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6332 -prefsLen 32952 -prefMapHandle 6336 -prefMapSize 270279 -jsInitHandle 6340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6348 -initialChannelId {6c539a5d-bf0c-49dc-9334-8dfdd43ebbe5} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6544 -prefsLen 32952 -prefMapHandle 6548 -prefMapSize 270279 -jsInitHandle 6552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6556 -initialChannelId {e6734b6d-7f27-4b47-abc8-ee259527fffc} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:2336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6752 -prefsLen 32952 -prefMapHandle 6756 -prefMapSize 270279 -jsInitHandle 6760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6768 -initialChannelId {dbc26c4b-ecca-4edf-811e-6c55032ec47f} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 32952 -prefMapHandle 5588 -prefMapSize 270279 -jsInitHandle 5592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {3023ea66-7399-4e9c-9c22-d1b211bc44be} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6892 -prefsLen 32952 -prefMapHandle 6896 -prefMapSize 270279 -jsInitHandle 6900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6584 -initialChannelId {a4743f05-6a78-47ff-9134-c1097306ff1e} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:2920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6108 -prefsLen 32952 -prefMapHandle 6104 -prefMapSize 270279 -jsInitHandle 6100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7060 -initialChannelId {49eb698a-07c1-4083-93ef-f4e3ab8e07b0} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7160 -prefsLen 32952 -prefMapHandle 7164 -prefMapSize 270279 -jsInitHandle 7172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7180 -initialChannelId {60c97f0a-1a94-425a-9dfa-c0c3e09fa437} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7372 -prefsLen 32952 -prefMapHandle 7376 -prefMapSize 270279 -jsInitHandle 7380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7388 -initialChannelId {4d4aa47e-b608-4a5f-9dce-45cdd015bf44} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7560 -prefsLen 32952 -prefMapHandle 7564 -prefMapSize 270279 -jsInitHandle 7568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7576 -initialChannelId {6100780a-e90f-4358-a52b-5d10e8eb98c0} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:4976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7748 -prefsLen 32952 -prefMapHandle 7752 -prefMapSize 270279 -jsInitHandle 7756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7764 -initialChannelId {99a740b8-1da6-468b-baca-3f5a385b5e6e} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:4704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7936 -prefsLen 32952 -prefMapHandle 7940 -prefMapSize 270279 -jsInitHandle 7944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7952 -initialChannelId {adcaedfa-d84b-4dde-a17c-5779957b2554} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8124 -prefsLen 32952 -prefMapHandle 8128 -prefMapSize 270279 -jsInitHandle 8132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8140 -initialChannelId {e8a841c5-a6d2-4370-83aa-ea62cd9922bd} -parentPid 244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:5596

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 72d46989a95bf72ba8dd6bd7c103ed98f260bc4cd752291ffe0fe22ebe19ab9f
MD5 60b4b0010bde0a90da634b59e1cb3907
SHA1 cc222b898cc2c0a26787374e6d4beb3f730138c1
SHA512 fd728fee89e141a7515870d1f29e536b5420651941b86a563f1295b15306d28e8bce82285f7940c352d628f7ed9d42f20d2edad22cbf26376d8f5602ca287a88
SSDEEP 12:sf9iXhV0xosfxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxosfxWMk8xVTeYWI31BtXP
TLSH
T136254C85B34494FFC8835E7189BD27903774F6DF1F02966B6A77760E2E271C84B44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c159157b0e79e7b46a891e8afe68807c4e711f82964d04b80dcddf1d39eda259
MD5 94dc53892052e6d2db9f8b5550a4b43b
SHA1 29ebe8501640ce4b863ac0649c205fa162e24128
SHA512 5e174dd65b7b3514eefe1aeddfedb95e15f93bea92c1841942e97f8d717b896b0064539e74f7bb947e9e6a169d4427e3dfb7aea428ac47f5f7ef07fce464f22e
TLSH
T16DD08014C9FABAF6D03B257D02354705719C955365431305E0810D550D562C706E1EF1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc97280e46f7440a45ca3d2a51a46ccbb21ce65970031831397544d067fcd39e
MD5 87f523fa1a8097da3fde9c71dbb969ff
SHA1 7375fced196b7c9cce63a3345a696821addfdc92
SHA512 a94bf6eafa51a7b6313466d304e63e375b1cea0b04977cfda8012d4caa95bc0dd63b71901be89e02b766b5371ccbfa9869b8ff1599483dc18a36d6c017ae936b
TLSH
T1E4D02B18C5FAB5A2C0372938112A4309718CD01164431200D0810591084335B02D10B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 70982429a94c7f5dd6771982ccb678db478417c7823f5314a8ce85f4a72ea496
MD5 dfb696b1e6808f46315e2c8c5c490abd
SHA1 eed8ea23066b3749e52e643f4324c70d274c6e27
SHA512 746adb56bac7e6958650c3d0d518b5083955a4fd952fc98e6a5d9afa120b58ed181711f9d8797d55a5873c62e5525749aaaf733913575d7e6f10d2eba443d3f2
TLSH
T129D02B18C5FAB9A2C437293811294309718CD01164435301D0810591084339B02D10B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2b79a799e9945de3fa2bc5d533697682d825e6672664ce295670c5b94a9b23ac
MD5 5da8ae452c036e0688adc4e9677549bc
SHA1 ab9d537fe9bb906f20fe13c5c0b178d585125e4d
SHA512 4e815322b873b39f93dd6066957c73d75c9d1288af346fc538858b0c61397cf4b4236e47a609ab424c214c69c6bb0c1457dd40c696effdb5f237676a68295591
TLSH
T194715083A8E544BBD7AC223C9D87668733FE6E8EF4875F160510E837BB926D4034AD41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 64c0fb88b524f18606ca54c8e0bb7834ae45b06fc37b19964fbd5af5e80af0fb
MD5 7ff84ab09556fb0727d16d8bf0e5d761
SHA1 3365f0333e599bb9daed8509daab91034106a260
SHA512 a2428a6e57b6b141ff6e456d96c542d0a73eab80eea379f1ebca59ae5e874f349e1bd2e0d75bb4636eb5e545e862ba6de3b336b725f33be3faba0d3c79c6e390
TLSH
T13A716183A4E444BBD7AC127C9D87A68733FE6E8EF4835F160510E837BB926D4034AD41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593fed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593fed.TMP
Size 3KB
SHA256 e622b65738f54b30bb7a435000df1a1c07d10b0791a62c5f0c369d0b9621cd30
MD5 0d5e776c4e52a4b926abb441f83062bd
SHA1 31ae8e44979b585c1e190c533b41691aa93477bb
SHA512 82c6fd2ec623318fea106de62879b6914b3fa212a50621fed6a2bacee9a4430144d28cd4953e0e699ada4a15e917cf873f03002b9fcdd8a80445b43185744a21
TLSH
T1A6612B8384E844BBE7AC12788D8B118337FE9E8EF8835F590450E877AB627C4134EC45
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 691555c0a217a908653f3adcb354bf316ccd8fdaed63b7637f4c1ce845afea6b
MD5 7a40f93dd5f0886659f48d21d6749af1
SHA1 794dd74aa9d0cf701ed601f4171f50faa1a017dd
SHA512 a46345329ac77b6858cf49d77e457507206a7c378f7cb0eb6e5fe8637c82f9d16b61482ae824331be95c07124fd01b97f5a6e7540ad5bf1ce7e60d1a36086e68
SSDEEP 96:DqOoeB7BxfWTzBXVtEtyRZIzSBTZrwYGi59dWl:DZoeB7BcT1XVtEtyRZ6STZrFGiDEl
TLSH
T1AF91ACF787E48AADDD21A2F4AA14AF1ACE5D0914436C3C19C9D8AE17E7F2470E14164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 31b67ff992c5ca3d55abe084956e3d958660e2ad4204e15fa985eb09aee944f9
MD5 fd74f9f9417e3a437feff8d61e5ff3a6
SHA1 b40a5c77d45dee2ad7c3ac7b89574d98ed7e97aa
SHA512 d116dfef2435d905ce638c90b9760e03bdb503b64ef2d4c73188b803d20e1c9784883cfcf0c11151eef02d6f0b922d848be0250cc24ae825556d68fedee704eb
TLSH
T1A4719DF787E48AADDD21A2F4A914AF1ACE5D0511436C3819C5D8AE27EBF2470E14174B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3dbed261e81b67aaadaba0ed9d57a41f3ef5c2000d449e627ee5782cd1994c2d
MD5 688b8bf6812900e5de282e269bae4553
SHA1 a184d7cbbd7ff1195b0286b606d00407020ed2f8
SHA512 016759048deedca67250baa74b15fc46c43e08ad1e71d47f5bd6b8c91ee7e1766139541cce6b5767d21b3832e78e70f13118ae833aeb79d4d597661baeeaed47
SSDEEP 192:sxZKkRHbQK/fw/scfpIdpq0l/W6+WNPtpo/Y0tKSI0IgrJ:sxZKk5QK/fw/scfiP/bU/5VD9
TLSH
T15D22B9516E34A97B8CCBD219BA29BF53D6F9103291D11E58E6FC951C04EBADE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a998235c1c86fd23a707a7be87b78d8af89455f0ffa670c6919b02afa2a30bc1
MD5 12d74eef8d06b589d5c7af3a9ce11a15
SHA1 39f8436c103992255e034ced5cc3d4b640a90b77
SHA512 1dede9bd13245a0349e5bab7db26c23882551650d1b35eb4f78e89f1e174d95d0be15cb449c76dfad9800d9e6beef659f08aaf4f3f9ba15b43f261408a9dbe01
SSDEEP 192:sxZKkRH4QK/fw/s8dRpIdpX8e0dR/W6+WNCRAtpoMeCJY0tvSI0Ig5kJ:sxZKkmQK/fw/s87i2/bMoJ5kDS
TLSH
T1A842D9526934697BDCCBD219B655FF13E2F9203291D01E48EAFC9A1C05E7BDE220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f6dfd97f473137ba61100748c0d2cc2f2b8c240e33abc4760f992b7a24179a2d
MD5 69dcfc59115cf451293a81288bd6b09d
SHA1 923f3a813c125c909b8b12d4ed77ceb9cad804a5
SHA512 dc3079b047df13337efe2016dcf9e4b70f1c5760fb09666d7870f788753e1a9d7b555cdae77136985e92d51de3db7ab407d1fa3609f18467a85b7cb44b5a0f8f
SSDEEP 192:sxZKkRHAGQK/fw/s8BopIdpl860d5/W6+WNCDtpo/Y0tCSI0Ig5kJ:sxZKkvQK/fw/s8Boi0/bj/5NDS
TLSH
T1B832D9526D34697B9CCBD209BA55BF13E2F9103291D11E48E6FCDA1C04EBBCE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 099ad8aa0d26ca226778ed3250e9d8b2ef68f39bb84a20a7b9c9726ea1afa4a3
MD5 1a29e06737ca5afb6d7a9cd389771e15
SHA1 2695259d34a43dcec8ca146b397a4fbb4c1efd90
SHA512 b9d888f5f2af3984556760f640c73bf7dc2f82af92dd8b2b4ae40c67891a24440136425de1656b932cce6106c2cedd4e5cf6b5eda2f7cbb92b52d4d8cf4b8219
SSDEEP 192:sxZKkRHuGQK/fw/s8EpIdpX860dR/W6+WNCDtpoMraI/Y0t2SI0Ig5kJ:sxZKk5QK/fw/s8Eii/bj3I/5tDS
TLSH
T16042D9526934697BDCCBD21ABA55FF13E2F9103291D01E48A6FCCA1C05E7BDE620784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bc489d2b0cd2958a4179874476a9c291f7db08411bae3e6e0f9432232b3015e3
MD5 859da07c4cf660e59524f0b293abc76a
SHA1 c3c5a03f3a697ac66867d728387a2471912238e8
SHA512 2e23116f72b29f47ef397fa9ab82d6be378d40ac25b55c6d994b133599c5522bb7e897e219116ac9dbf4aeba7d3424e8bd55641bbe56ef304db4593f74632a73
SSDEEP 192:sxZKkRHbQK/fw/sqBopIdpx60l/W6+WNCDtpo/Y0tKSI0Ig5OJ:sxZKk5QK/fw/sqBoi5/bj/5VDo
TLSH
T11B22C8116E34A97B8CCBD219BA55BF53D2F9103291D11E48EAFC991C04EBBDE520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2edb26db4be3d8212b6afa2a34c4515af64c910f258d0e540898c15670ef2674
MD5 ad4524fd63d887757cbe194d0ce1fe1a
SHA1 9d30bafad95aa3a35eb0ea1823027b9c141ec8e5
SHA512 6b8975a2b10c328ae95d1419168d93f5ef0e9a607533b3059d73e187929725691a618fab54737117d5d505de629963e90b86a02781a8d26e1b6d4235ecef1bc3
SSDEEP 192:sxZKkRHAGQK/fw/s8EpIdpl860dR/W6+WNCDtpoMca/Y0txSI0Ig5kJ:sxZKkvQK/fw/s8Eik/bjS/5+DS
TLSH
T1E132D9526934697BDCCBD20ABA55BF13E6F9103291D11E48E6FC8A1C04E7BCE6207C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 5aed5e95b0b011ebd24713fa2b266106beec43e866180dc9a7d305b21eefed19
MD5 62409253066b6e9c713ff3c4ebff1ed7
SHA1 679810fad854662ae8f27e1e0943d71bfc18f6bc
SHA512 fc526245a94a64ca0a741eab3cde8415bf43d2837877724fc087cb073cbdf37558fc8905c380c3f35fdd72201bfefb1adee1bac03ef0079ec5ae52a8399bc6d2
SSDEEP 768:oHWwy89q2pdWRm1rQ/78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nQLl/CE0MM3ronx:oHWwy89q2pdWRm1rQ/7u1jaKnQLpClMJ
TLSH
T154D20B3F240CCB7E4FC04A6DDC566F976E9802C7A6589D4087FE894C02D77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 79bdb7615db886991c78a3772e3947f10682de800e583ad7d8542dc8fec840a8
MD5 b43ec2c842e1641ec1896b854bfc3a37
SHA1 fbbe9a33302809cee84315ea49055a6625c13191
SHA512 c2dbe489f6fc4bb302d2a981fb7c1a107bd03c31ac700e259e1c0b39f555e95cb106ea7ffe69a1c4f7f8450bd640a8dd307ccec33fd7605a339c35a3db437e8d
SSDEEP 24:Kjd+B0dIfK5ha12SEb/yXmFeZc1IPKZha1KS83TyXahGtk9I/Kxhq1GSU72EfTUo:KsqIfK/aADyB+IPKfaMjyROI/KXq4l
TLSH
T13791D414367E42D139BE3A08A179972F028131B77058E63BBF7E00654E3BE144EBE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593b2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593b2b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f84c9a08-afdb-4505-826b-68cbf38b2962.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f84c9a08-afdb-4505-826b-68cbf38b2962.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ccc0d1b6330368b0bde6bede16ca76e34c70a7c14f9f9778900c58667548f448
MD5 e472e30bf9a684945ce95820cbff26e6
SHA1 8ff3ff275931d2545c6e8bb8975fe4cab5df3196
SHA512 6c6ac38c5f6b956f57e1dccb65f79ccf39821bec729abd2fb3089d58c2d6903a9c02d06f30f87890e0f582649cf4f36cec19c6a5f99f078b466f3d130596dc45
SSDEEP 384:eZcIh8NugDlGW7xNjJTsgx0oWctgOIwZOyF8LSoW:chqIuFWcXsG8Gt
TLSH
T124828C3188F8AC7A5DF7D554F48673139FB48067A6C89F44D5EDAB1D01EA9E80317C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 87e1e789ec8b1e02a8d894fa136d8f71fb5b508e6216dd21d11373acbec4a1e8
MD5 2749915bc4c9336ca5da3e42db07ab36
SHA1 967721ffb3da23d99756ea7cf56c81b5f85135e5
SHA512 3df738471d353a1911cfdac6c9c1fa9992b65a0a65a7377a30688040892e0e7c5800859e552da6b4c3d0d2d63b807d002a04a73da8a87427190f26cf2496876b
SSDEEP 384:wiFiZcIz8N+8TUNTUlIlNDlGW7x0sBsgx0o2ctgOIwZOyF8LSoW:LFQz7wgN6uF2cXsG8Gt
TLSH
T184C22BF248D7887ADDAE8B47A77D3E128EBCC067B5849A40B398560DCC965BFC306C51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e97950752e21029270914b623e36dab4010ad6d1c2901fbcb68fb8b044b7f4bb
MD5 8b0ae54c9fa0d686379c5ebf39913282
SHA1 215d375d687e29b2e7ca2899aff75aa5f541b2f1
SHA512 bd33ea4cdd96b99823960535078a78caba980afadec0f9bf2241068d38291d8c17d7d7261df40a0136bbe82125b5b8882d83ecae793d21dbc01dc2a6234e945f
SSDEEP 384:nZcIc8NuNDlGW7x0YBsgx0oWctgOIwZOyF8LSoW:Pcr6uFWcXsG8Gt
TLSH
T166828D7188F8AC7A9DE7D544F48673139EB48067E7C89F44D5EDAB1E01EA9E81307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 426f511a1917d5788b55ef4d72931d91ded816c78b3cb41ebd71467bbb424215
MD5 712e0dac2af23995006a28ef16511490
SHA1 27428fe87321a38f46d03ad7205d1723485afa80
SHA512 bb17c7a5217ac879b307952b4121d9599a7a3f09e87d23e11e2277506f8f7285e2e70d7564e4a94393dcb30de15cb27ca8f5e4417f917a67cb2bfb4ef94b0b0e
SSDEEP 96:DqGNklQsjpf4eEE325ih/cIPURHl8h4otop5F1iD3mB3PnvQixdZuP7inyib35xo:GGNx6GeLQmiUyDEG/9e7J/90/v2U6
TLSH
T12002D934A8B96C7B8EE39E55B4877713AFA1112BAA952F44D6F81F1C01D769C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 86818ae843405fb7940ea9f1b0cd1f83ce3f3bf54822b362cc0f828f4a4cbab9
MD5 3e8526161f752ab348fd696fcf62e093
SHA1 929d6acc4e082dddd8ad0e41bf0740ee8d0f5aa2
SHA512 2bf19f508627957774dead07a00619f21e357fd21fc4a75f0fd050120df8d157630833370da82c4b91487e27fc9fca4472946d2d4846f20f3d9256f489299b2a
SSDEEP 384:wiFDZcID8N58TUNTUlIlxDlGW7x2sBsgx0oactgOIwZOyF8LSoW:LFbDWwg/6uFacXsG8Gt
TLSH
T1B0C22AF248D7887ADCAE8B47A77D3E128EBCC067B5849A50B398560DCC965BFC306851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad3eabdba2dece3166d0f3af3b96074874e5215f589930f26b72cc4ef1ec1288
MD5 79f1187b03587fe6df55b62342723752
SHA1 b8c36da6dd1c5a952b4e3599aa86f0ae21c5bf39
SHA512 e6bce70f0b0cdd14ec05f6d7a476935970573bf465a2372afb205f3284db640e2f297d4e1dbbffcab93df127a0d3d1b5af127a3db972386e27f229efe0a75ff6
SSDEEP 192:GGN/6GeIQmiUyQGB9e7J/1xJM9o9wEGqgU6:GGN/65o8B9gx0o3cU6
TLSH
T1C1120B31A8A9AC7F5DD3D955B4473623DEA14127DBC86F84D6EC2B1C01EF9AC5306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 907c1697313de6e7e2b2f8c41334d916ceb17e305fcc36a390695855c786ec44
MD5 9b3f07f0087894305441d047f1575af9
SHA1 4cea8149322ffbd062ad803c12fc2264dd05de81
SHA512 b5069e45630e1923f1f0be5d8b1e722563bdfcf60569f1d768d34041fb8bd1470711d870a705d2daf391000f94a10a56e6333f7ff55694c9d70dcb2aa4f921ec
SSDEEP 384:wiFPZcID8N58TUNTUlIlxDlGW7xksBsgx0oactgOIwZOyF8LSoW:LFHDWwgN6uFacXsG8Gt
TLSH
T18AC21AF248D7887ADCAE8B47A77D3E128EBCC067B5849A50B398560DCC965BFC306851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5c0f3dceb16142215a049588dbe9cf6de0f587e37fd691ac62c380b56f475797
MD5 74c257c7c6ea84e293ae79e8248e4ed2
SHA1 97ca73e5137ce92f7f63357514537f93bdc74bbf
SHA512 a66309015ccae2e749faa90437dd14d4550f53a97a9c65dab482f5c46ef04200dd177e7f0b4f6a62d57b024351ae69f6c71c8d5a5fa5657d4d11cdc047eff441
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e5ab09d1181efeecff9aeaa988a1f3e4959b760307184c8fdc447b0f50c03ea7
MD5 4c7c41fbee9b64443c728e05b3182f84
SHA1 43f5f1dcea10f7bdcf7c9dc4e7db16e32fa31822
SHA512 411d7afd0714e78cd2b332f058c87bbf75d8ce4a17f0fa0cf85c4621b2e2e1e02130c1a08fb6ab4d17af323c1f8d84a2155d5ceb0d2ba1bd14048ddb62e80036
TLSH
T146E00201D700016BC118033001C36B243BB1C02003A2034656B012783C6330C3D60940
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a29d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a29d0.TMP
Size 392B
SHA256 5f2babe52ab831ae6c5edf58f750c46dbc620f9e2eb7015b4f683d3bfbcb17cd
MD5 44fa4cea682116f01600f11ccdaa770c
SHA1 e5baf5e5f1aed3b78bd87938554f94276101ee2d
SHA512 2a0ab9151fc4e8eaba9ff8d55faa87c393b8e9f7aff91d97c7b38be301908774045b0cdf09f477b443301a01bc1c2a89d21336f5a69fc9217a8cb507aad076f8
MD5 SHA1 SHA512

Submit Download

17ba8f89-af06-4b79-8fbd-88f5a38e9083.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\17ba8f89-af06-4b79-8fbd-88f5a38e9083.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

APPX.ckeqhlbxx061eczrzvj_bx6gc.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.ckeqhlbxx061eczrzvj_bx6gc.tmp
Size 9KB
SHA256 92a7d7d3b0bfac458ddcef07afcdad3646653ba7f4ad048fdd7a5ec673235923
MD5 24ebdb1228a1818eee374bc8794869b7
SHA1 79fc3adb42a5d7ee12ff6729ef5f7a81e563cd2d
SHA512 63764d99a0118fac409327d5bf70f2aa9b31caf5277c4bc1e595016a50c524cd6c3d67924321b0fcad12cd968de1a62bd292151e35fd907034efd0f40b743d6a
SSDEEP 192:vWULwu0Sc2HnhWgN7aIWuAE/uuOiqnajls4v6:dD/HRN7q1ilm4i
TLSH
T157124AD28D6C8847DD673C4053E8E89B7C3C93C72810955B196EFAA51DE3BC2E72862C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.v7lle0sh0flx3dooxbbidmi7b.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.v7lle0sh0flx3dooxbbidmi7b.tmp
Size 1KB
SHA256 b64efcb638291c1e1c132ed5636afbb198031cee44384f3ecf67d82b73accecc
MD5 4085b7b25606706f1a1ad9a88211a9b7
SHA1 31019f39a5e0bf2b1aa9fe5dda31856b30e963cc
SHA512 9537559523839e3e708feabe8c04f40236add7d200ec36bad00c10a69337a15001103c17093dcc0d8cadb4713d911f39a6411624c1db4cbf1ea1af272a716168
TLSH
T126210046F0C40AB046B3646517759657F73E93C7346D0184FCED724B2F6938A0227364
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.ziigbkyq5yi61gsi6ywkxq5n.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.ziigbkyq5yi61gsi6ywkxq5n.tmp
Size 2KB
SHA256 4112d529734d33abda74478c199f6ddc5098767e69214a00d80f23d2ea7291ff
MD5 530f1945913c81b38450c5a468428ee6
SHA1 0c6d47f5376342002ffdbc9a26ebec22c48dca37
SHA512 3906427ffb8f2dfea76ba9bb8cac6bd7dece3ebee7e94ea92da5bbdb55d8859c41260a2bda4e84fab7e1fb857ad12a2e286694ea64d00d0aa6cab200fbbf64f0
TLSH
T14A51FAA0163DBC36418D4BFD8F94B1002C7158372727AE5ADCAF91B618BB9A34F630E5
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 751331aa0131f32f62b0bfe74e21a446566fff91fa3c8e74e6a54ab23130b8f3
MD5 8198c7fc9397e4674174fc0967d422c4
SHA1 9cb4f54cb849f73975d19bc600164d3afeac0bbc
SHA512 347aded46890c2fddbf6b9e639e9e8225431547542a18a8af0691f27c4a95cbca033fd97bc228604362f52dfadea9e4250025193b203b2b0710e5336e9a600d7
SSDEEP 192:ROv5zbooMj+yjq+y1d66Joz0dzgCl6mc0dz:ObooMj+yj+d66JozQzgC1jd
TLSH
T17AD110A4EA28467FC408437BDCA51B410F35389B9C4E3F19369D64082D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 30a74f8d1f4bc6fab6732402d15824eb8cfd7a099fc367e7b464adde68703523
MD5 a78bd3b8f4ac43bc364c02472a641dd2
SHA1 640ca97313febdd42917ac3aac5ab9bc6f0e0c03
SHA512 5f0cbf6197b32b04ed62cf46bb56e2b3b33e49f1196b66b37722925990c6b2c3fb32f89954c55d8ed495c9adaaa6e41c68157856c6f17f5b67b7b9b650742e1b
SSDEEP 192:V1d66Joz0dzgCl6mc0dDOv5zbobsZj+yjq+:Td66JozQzgC1j+bobsZj+yj
TLSH
T1F9E133A4FA28467FC409437BDCA51B410F35389A9C4E3F19369C640C2D572DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 04d6d61d4a5e655812c9353a1f7991d7c5515a6564ff8abea0483d5634f57695
MD5 35467f54f321289047eaddc3b884033d
SHA1 f18c5b8a9b430b29d54caf48adaf15aceb95fbd3
SHA512 988d2298da3b05c1f4c19f8331ba613138638bec8767755caaf0f859c532d6edb4d54deb2394c4980947ddcd63a0875440cf8df0e544030c75a131802a7d1bae
TLSH
T1B021674C3AF84D2AAD86EAAC744102CE53D58E0A28871C475D13DF8DCD81AF933AA43C
MD5 SHA1 SHA512 TLSH

Submit Download

60126c04-d9b9-488a-babf-dc70c6a67667

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\pending_pings\60126c04-d9b9-488a-babf-dc70c6a67667
Size 235B
SHA256 123e1f66796cfcb1d2866599c5a902e38e892b4a44b1567e18e7cca20c662924
MD5 df54fbebe70d5fb8260646eb715cac89
SHA1 b15c4e0dbbd19f2a265333858f944188e31a21a8
SHA512 49f71b5f284553b72ed63fece9372c893e7d48157d34fafb8956d8504b584fc51526fa299280ec8c7c4b7df4ea2132b30c5c93ce55c32d3c6a7d8701c07b6c72
TLSH
T166D0A7C4149C679D88145F07F0A46AD63085AC3364B9A850D6A1457499B9EC851A195B
MD5 SHA1 SHA512 TLSH

Submit Download

7686d257-5e75-427b-b396-e8907c8de628

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\pending_pings\7686d257-5e75-427b-b396-e8907c8de628
Size 886B
SHA256 f5225a75976f705198b6e7e56ebf37971873064b7dc386ddf0301ab336a093c3
MD5 88a938a1a42c61be7fe75c5c1ba65cbd
SHA1 725792a564bc1f54c762e0b4f41f2e9a564c0c2c
SHA512 bd20aa07f44834faba4f4ad0f70e55b3a92b0ce1b5c1e855d50252f3a32a0ee2471b6d09a3122c2bcbfa67d5fe9e9855193e5bd3d1ab14f6278834ed555d8bd6
TLSH
T17D1100818A7476F39C2DD34A84A1B7464BA0712380C69C187FA55A180DFA16E6766607
MD5 SHA1 SHA512 TLSH

Submit Download

c8c33516-cb00-472a-ba52-dec1d53cd3de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\pending_pings\c8c33516-cb00-472a-ba52-dec1d53cd3de
Size 16KB
SHA256 2e1d09fb677d0c8b8f2f322a97a36f009ee5a4c7c369f70d7389d646cc602e97
MD5 db2789c348238cd77229198413789d61
SHA1 f751a01e426c8aea3133161a834d906486ed13ea
SHA512 6bb4f48bb22c74eaa4c762c9d05ce81164fdb928b022fec276597ffd9e4b7c390ae99faedf59ac6ba1884391f7db0d30a6c870e1b8dc69454498c7e88faf16a2
SSDEEP 192:a2OGUXQR7ptkuBzxP0XwHT114VyBddnQQetLwCQH4frwxawTdGdeWnhzKK4NNF+c:F7ptrBlP0Xw344VdaLfRDw/ZNTp
TLSH
T12272D916682055BA8291E368D4FCBFC3E5F538CF4C419FCA8BE4BD0869DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da71c839-37ec-4317-b1cc-684a86f2c25e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\pending_pings\da71c839-37ec-4317-b1cc-684a86f2c25e
Size 883B
SHA256 cdc375da598ea8bfc7abb52ba1a2331d91bdc7431f2040da9137b5dbb31b9946
MD5 46dde536f5680edfe34bd6e95cf16257
SHA1 eb4a4b9f8e3f21822705a1514ae5a7d069d010a5
SHA512 694baaf070b4c8e5d34e2be406afc134f1287fa4d8aeaf8a9312f90f210700f0ea053b8ec525797fd835294c5c2693b8f4843b4a52679dd118375ecf59bf51a4
TLSH
T126114C80EA31B5B7CC2CC30BC4A537064BB8722380D9C8147EA549140DBE91FA72A30B
MD5 SHA1 SHA512 TLSH

Submit Download

e60bac72-43f5-4c4d-b5f8-03ff231db418

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\pending_pings\e60bac72-43f5-4c4d-b5f8-03ff231db418
Size 2KB
SHA256 ed8b108d4cb93865f6b11c7d49cb0158b4b7f5cbef82b782bb3b11c8e5e8d1bd
MD5 f2130735d890bb89c892da7be7c2899c
SHA1 f57eac87022303e37cbf609490f6fc1d3dbd85fe
SHA512 19f714777805a8d505c67e1579a1c0ae89df78f0aa5f79f8974f15b86fe8722a84e82ae25adae07b2c309cdd4e490c39fd395c58cb1d3bced0ae10e9db1135f6
TLSH
T1B941335CB9B84CB79CCBE25C9492338E67704A1340C62C536E51EE0C8DD679E737E52A
MD5 SHA1 SHA512 TLSH

Submit Download

e647a5f0-e078-4452-b96f-c27441ff939a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\datareporting\glean\pending_pings\e647a5f0-e078-4452-b96f-c27441ff939a
Size 235B
SHA256 4808f8813f8120dccb5f65ed58c42f9eea351d2dc2a15f1afae06a918bc6a11a
MD5 6829edd2bc58ea73e461c150f3ac3f2a
SHA1 d33ab3ed4bed6ba56a8594e0fadf0e04dc923e1b
SHA512 05ec2be10048e020277f15acd04b902747ec2e8334f9e882c27e7a5441b55e827879c7bfa8b906bb6997eceaea80de7cf8a87fcd654b21b202f2cf13d661da6e
TLSH
T13AD0978018A8E35C0C040F07F0E038CA30494C3720746C10AA62553489FDACA4212A27
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\prefs-1.js
Size 6KB
SHA256 4391abc3df9286fe4938d1c4b85cb70db94079f713cba4c89ba082cef54e43cf
MD5 91bf1bef0c0b26723cadeee03fe32afa
SHA1 8ce669f0c43ff37a31ded6127a0f5a1d0ca5b5ea
SHA512 1155da48d964cdc3d9c1d9eb179832a8ff15184daee0ba2e78d7b32f80e80282684d13526933cb0d868c9d6e1061577654e881a3945bcb1f3c592de12c6c8131
SSDEEP 96:xHQSUTUakqGqLFrfNHw1zSjSSlcdv9jsnyHgmnLVZ4Bw88H8L4cn6ea:tERLFfNHwKSSOPLVmBw88V
TLSH
T159E12F7894088B7F78B6777C6C6888305AB2413B77BF68D650BA44C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\axxisef0.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2636-539-0x0000026F1E8E0000-0x0000026F1E9E0000-memory.dmp

Download