hxxp://17augdoomsers[.]blogspot[.]com/pleasant[.]pdf

Analysis

user interaction
yes
max time kernel
225s
max time network
208s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-de
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
submitted
11/10/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://17augdoomsers.blogspot.com/pleasant.pdf
Sample261011-p2vsmaaa46

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerShell_ISE.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1568	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{8F2C325F-95DE-4478-8275-742A9B2C9302}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5872	PowerShell_ISE.exe
5872	PowerShell_ISE.exe
5872	PowerShell_ISE.exe
6400	msedge.exe
6400	msedge.exe
5872	PowerShell_ISE.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5872	PowerShell_ISE.exe
Token: SeDebugPrivilege	5828	firefox.exe
Token: SeDebugPrivilege	5828	firefox.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1460	4548	msedge.exe	85
PID 4548 wrote to memory of 1568	4548	msedge.exe	86
PID 4548 wrote to memory of 4564	4548	msedge.exe	87
PID 4548 wrote to memory of 4564	4548	msedge.exe	87
PID 4548 wrote to memory of 4564	4548	msedge.exe	87
PID 4548 wrote to memory of 3896	4548	msedge.exe	88
PID 4548 wrote to memory of 3896	4548	msedge.exe	88
PID 4548 wrote to memory of 2672	4548	msedge.exe	89
PID 4548 wrote to memory of 2672	4548	msedge.exe	89
PID 4548 wrote to memory of 3316	4548	msedge.exe	90
PID 4548 wrote to memory of 2672	4548	msedge.exe	89
PID 4548 wrote to memory of 3316	4548	msedge.exe	90
PID 4548 wrote to memory of 3316	4548	msedge.exe	90
PID 4548 wrote to memory of 4128	4548	msedge.exe	92
PID 4548 wrote to memory of 3604	4548	msedge.exe	93
PID 4548 wrote to memory of 4128	4548	msedge.exe	92
PID 4548 wrote to memory of 4128	4548	msedge.exe	92
PID 4548 wrote to memory of 3604	4548	msedge.exe	93
PID 4548 wrote to memory of 3604	4548	msedge.exe	93
PID 4548 wrote to memory of 5088	4548	msedge.exe	97
PID 4548 wrote to memory of 5088	4548	msedge.exe	97
PID 4548 wrote to memory of 5088	4548	msedge.exe	97
PID 4548 wrote to memory of 900	4548	msedge.exe	100
PID 4548 wrote to memory of 4532	4548	msedge.exe	101
PID 4548 wrote to memory of 900	4548	msedge.exe	100
PID 4548 wrote to memory of 4532	4548	msedge.exe	101
PID 4548 wrote to memory of 2384	4548	msedge.exe	103
PID 4548 wrote to memory of 5656	4548	msedge.exe	119
PID 4548 wrote to memory of 5664	4548	msedge.exe	120
PID 4548 wrote to memory of 5672	4548	msedge.exe	121
PID 4548 wrote to memory of 5700	4548	msedge.exe	123
PID 4548 wrote to memory of 5700	4548	msedge.exe	123
PID 4972 wrote to memory of 5828	4972	firefox.exe	126
PID 4972 wrote to memory of 5828	4972	firefox.exe	126
PID 5828 wrote to memory of 5152	5828	firefox.exe	127
PID 5828 wrote to memory of 5152	5828	firefox.exe	127
PID 5828 wrote to memory of 5152	5828	firefox.exe	127
PID 5828 wrote to memory of 4424	5828	firefox.exe	128
PID 5828 wrote to memory of 4424	5828	firefox.exe	128
PID 5828 wrote to memory of 4424	5828	firefox.exe	128
PID 5828 wrote to memory of 4424	5828	firefox.exe	128
PID 5828 wrote to memory of 5172	5828	firefox.exe	129
PID 5828 wrote to memory of 5172	5828	firefox.exe	129
PID 5828 wrote to memory of 5172	5828	firefox.exe	129
PID 5828 wrote to memory of 5172	5828	firefox.exe	129
PID 5828 wrote to memory of 3556	5828	firefox.exe	130
PID 5828 wrote to memory of 3556	5828	firefox.exe	130
PID 5828 wrote to memory of 3556	5828	firefox.exe	130
PID 5828 wrote to memory of 1444	5828	firefox.exe	131
PID 5828 wrote to memory of 1444	5828	firefox.exe	131
PID 5828 wrote to memory of 1444	5828	firefox.exe	131
PID 5828 wrote to memory of 1444	5828	firefox.exe	131
PID 5828 wrote to memory of 6708	5828	firefox.exe	132
PID 5828 wrote to memory of 6708	5828	firefox.exe	132
PID 5828 wrote to memory of 6708	5828	firefox.exe	132
PID 5828 wrote to memory of 6708	5828	firefox.exe	132
PID 5828 wrote to memory of 6828	5828	firefox.exe	133
PID 5828 wrote to memory of 6828	5828	firefox.exe	133
PID 5828 wrote to memory of 6828	5828	firefox.exe	133
PID 5828 wrote to memory of 6828	5828	firefox.exe	133
PID 5828 wrote to memory of 6840	5828	firefox.exe	134
PID 5828 wrote to memory of 6840	5828	firefox.exe	134
PID 5828 wrote to memory of 6840	5828	firefox.exe	134
PID 5828 wrote to memory of 6840	5828	firefox.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://17augdoomsers.blogspot.com/pleasant.pdf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2bc,0x7ffe6df3c188,0x7ffe6df3c194,0x7ffe6df3c1a0
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,13416243890885946331,318328942315261314,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3551012931092541514,2154208278489309439,262144 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,13172036189793197623,5479658799868898414,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16445758741575199606,4049785286368633225,2097152 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16199222306583183634,14792694022007180279,2097152 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,15513731327419916747,7092888137296665100,2097152 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,920165616811349701,1264911027980093886,2097152 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4836,i,1296389034934649893,14696479814085626353,2097152 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,2465598190934449985,5632574902155020236,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,11497790086629249126,17261169159269757239,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,7940683870150754843,13844452367565765895,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,7940683870150754843,13844452367565765895,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,11877626202236570592,16662712072151159264,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,12356505876765360925,15393990323081581767,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,6290512337861853814,10653306217266875555,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1060,i,12801070499096188608,7090989026698761524,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3028,i,11315433785876971604,15570063913053317877,262144 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,7280853756202712257,16119458863870801626,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,12676579799607954027,17154605440680916697,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:6752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,10862030387893938526,6314177993330474868,524288 --field-trial-handle=2340,i,15119284183154929279,16130311925961057354,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3220

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:5320

C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\PowerShell_ISE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {bb06f2c7-1097-4c4a-adeb-c17d263a5489} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27136 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {5af5fb61-b40e-45f3-93c8-db66248a88ea} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2888 -prefsLen 27277 -prefMapHandle 2960 -prefMapSize 270279 -jsInitHandle 2968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {31d409b2-e4a8-4155-98de-af07f9a10ee7} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27277 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {bb688c35-9e20-45c6-8291-a5c7305c2b7f} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4540 -prefsLen 34776 -prefMapHandle 4544 -prefMapSize 270279 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2892 -initialChannelId {940a28e1-d6cd-43ef-8ce2-111640db72d2} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5004 -prefsLen 35013 -prefMapHandle 5008 -prefMapSize 270279 -ipcHandle 4864 -initialChannelId {2afe1323-2bee-4809-ab51-3a9d6b709484} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5316 -prefsLen 33031 -prefMapHandle 5320 -prefMapSize 270279 -jsInitHandle 5324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4984 -initialChannelId {9aad136b-ac76-45d7-9930-6a61741114a8} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 33031 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5388 -initialChannelId {901fb1a0-136c-478a-b7d3-395121f37a12} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5744 -prefsLen 33031 -prefMapHandle 5748 -prefMapSize 270279 -jsInitHandle 5752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5756 -initialChannelId {5481fa87-73be-477d-915d-a9a8832c53b6} -parentPid 5828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1fe4ffe2-3861-49dc-8781-ccc7889647c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1fe4ffe2-3861-49dc-8781-ccc7889647c5.tmp
Size 18KB
SHA256 5167edb170a2183e16d11daa2703dd7bd59529c077998ffd9540843ec93e24a2
MD5 791de09a94a8443e5f788c1fa21cb60c
SHA1 c8135965185ebff77da4464acd33462732f7b5b7
SHA512 1b8dc3ff632ed6cb49fb0506d28cb1daa6daeb29f5762f9f42c1bc6f0d3c0d3bf8cebe78dce5a795f1be96c4cde2f1a2ea484bb9017fab5a7ee9334d826b4c73
SSDEEP 384:QZcI8sNKAv9wJcYb4S0hZPbN+NKX2nxMT/:u8U6Z0HRcS2nxMT/
TLSH
T1F2826C32AC38993769F7A555F58A36138FF85027B6C46F84E1EC6B1D019A6A9030BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26d1d54b-fc66-4ca3-b50c-e00c7f5ca911.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\26d1d54b-fc66-4ca3-b50c-e00c7f5ca911.tmp
Size 18KB
SHA256 c19d6e8479465a5bcb22729e62a2a7682f6ded4c010e45f42eb5c0033103d230
MD5 426196855853f089dc1a8d04a71f74b7
SHA1 dbf9a5712ec5ddef923009be446b9d8e418d78da
SHA512 bca4d463e50dcf27cdcfee23477719135042c68abcfa4962c5910c8fb8f98e48d5f30b13c5d0314c59bf64a5640087aa1ac8bf68bfa6c8de85f8c22b9c9af4db
SSDEEP 384:AZcIhsNKkv9wJAYb4S0hZPbN+NKX0nxMT/:+hUKZ0HRcS0nxMT/
TLSH
T154826D32AC389D3769F6B655F58A36134FF85027B6C46B84E1DC6B1D019A6A9030BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

466e908e-c644-4c64-a840-6f1be64ed219.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\466e908e-c644-4c64-a840-6f1be64ed219.tmp
Size 8KB
SHA256 9d5f03e21ae5d11aba43d37d10680627133d253d14174e482afbf61703722c76
MD5 18c596d78df8b5eb77a7dca715f5b89e
SHA1 e89a33c6b93a2a4634c846d6d4ee7120b25722c6
SHA512 885e89e636d7311cb1638f72fa644189f46a2ab2bca5f9cc524b5f8f9e416a14ce44ca94a7ceff9fe81b8483497c69fc14dd32f2dca2e2fab573ec0fc98fc0e2
SSDEEP 192:ZON26xGuQmiUys31D0hZ/1lrjzoY+C/icnh5LU6:ZON26UqD1D0hZPbN+UnvU6
TLSH
T12D02E935BC686CBB9EF2BE05B5872B134F94203BA6956F80D6E81E1D01C769C1357837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4944aff9-4cc7-41b5-8f26-f6f9975c2559.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4944aff9-4cc7-41b5-8f26-f6f9975c2559.tmp
Size 26KB
SHA256 ba535e076c6f3dc06e31dac3d364914824b2577e1018070e0d8cb9300c461bcd
MD5 de76a7b9ff15c8a56933de3b00d4c605
SHA1 43caa4f4cc65e3dfee9166cf971a8b4c107704c3
SHA512 40a7cc7aef8fb95eeb03f7f68fcf4cd40b2383022588a04042ef82368f55deb7efab01d95f33b88378ed77449963681ce8729c4b39c9f263d83141fede1d64cf
SSDEEP 384:UtNFPZcIuAsNS8TUNTUlIlAv9wJPYf4S0hZPbN+NKXXnxMT/:UzFHdnwg8rZ0HRcSXnxMT/
TLSH
T1D5C21AF258E78537E9AE9743B77D2E024EBCC027B5846A50B39C5A0DCD561BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f55b0be-1a10-4902-8a85-c645a268e6ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f55b0be-1a10-4902-8a85-c645a268e6ff.tmp
Size 26KB
SHA256 9732f64d003e724095d583e90b2e1df4810b33592f6d12ae1447a21603d9fb40
MD5 68ab6f8e1466052e7c2b64ff529806d3
SHA1 d3b797aea8529d66a15b4d63db21160d3986be90
SHA512 bd9e69f911977784cc6bc1c115b556c7310026b03c14e3528a70155546c8a4fdf74ced0d6e0cd9d3e46fe451a3f58582c2a2e749889d5eefd71a282876da57b6
SSDEEP 384:UtNFIZcIuAsNS8TUNTUlIlAv9wJPYf4S0hZPbN+NKX5B2nxMT/:UzF2dnwg8rZ0HRcSP2nxMT/
TLSH
T1D2C21AF258E78537E9AE5743B77D2E024EBCC027B5846A90B39C5A0DCD561BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88f59585-f26a-4a02-b89f-c3472db9d66c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88f59585-f26a-4a02-b89f-c3472db9d66c.tmp
Size 18KB
SHA256 fe558144b2d6a938da743277894b4f3848195483c1a7fddc194aff919a3bc6bc
MD5 27fac8caa63e83e077f5d36ef93bc3f4
SHA1 91510ca08aafbc63725854c05576be695804757b
SHA512 5011df69eaf88d2f629d2250b6a3f669b64eaed4f04e8c306fb069c7efb199352ee870a64ee647a0a138c9f314d93b52aec4d49744c16d410ebd4cf2788cf5c1
SSDEEP 384:uZcIPsNKAv9wJAYb4S0hZPbN+NKX0nxMT/:MPUKZ0HRcS0nxMT/
TLSH
T1BD826D32AC789D3769F7A545F58A36138FF89027B6C46F84E1DC6B1D019A6A9030BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a6eb5861393f83eb8b8016687c085da7ebeddb12e0086793cdaa97de2bf4d89
MD5 8f87b0f71fdb0e4babafb4d64f50918b
SHA1 ef9954a611e31dc1fc21cf5cdda9b032620389c3
SHA512 80b6b9a9ac529a7fa05c075fcb3af3a9438a9aa4a8462d2e9843ebf64816a6abb19f112e682567ce8c0abf07c734928796f290fd602cffbf3df31d92dc5eb530
TLSH
T1F5D02220B3038C80C8CCA0BC0F208B002E0EEC080022E2038AF000C0ACC2FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cbdecd303a7e9ea0ce94baa450d3b047a1edf586300e4947c57d88291910733
MD5 2d8c10d42a8ac6e8eb6e6d36c53591ab
SHA1 9cbb2af787af4f0174815753d1fb7231fae30ec8
SHA512 0365b2fb9fb7c3ddb4d312af474044b0160cbad1e022fa186751cfaa355015874edf8f80c8abdabc28d5fad2b69acf8c17686c8382dcb23c267475468464b67a
TLSH
T180D0222033038C80CCCCA0BC0F208B002E0EEC080022E3038AF000C08CC3FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

0c899a5d-47d8-49ae-8eec-721989f469ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c899a5d-47d8-49ae-8eec-721989f469ea.tmp
Size 10KB
SHA256 c51969987cb3fd18ca834abe994edcf1358e442ba5c285e6bb9f9a81f553ba44
MD5 25304e7c53f4e370f06b787f0d9cd0da
SHA1 bebd5b009a461e1fb0e5431f92156ecd6fbec415
SHA512 8c89ebe14de1ad3189b8c61cfd43c27671f1b4582d2cf11a4d51b42ab9fea92a7d785785dfcb2b08d02a52989bd00189f7434635f710e0d53288f4d0e1466df1
SSDEEP 192:sxZcLgV/fisdzumzoupjUHW6+WNKJfXYrbIaIg5ZoJ:sxZckV/fisZuUIHbAXsLM
TLSH
T17C22E8526E28A97B9CC7E21DBA55BF03E6F91032A1911E48EAFC861C04E77DD130744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

388d5a3b-5236-471e-a3ff-65d417a9c12e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\388d5a3b-5236-471e-a3ff-65d417a9c12e.tmp
Size 27KB
SHA256 e0f55f1ce1e2204ce9400e7346856fe1f2e1876a630d25c6d101ecb67aaef77f
MD5 e85881ab5f4da9af94c975a0936f6f0f
SHA1 454fa2308b5d87d1eacfe4897f679f01c3bee736
SHA512 a5607264539cf869ac90d82491fae8a1d86d508d806169552d57ec7a6a64393164fadd06c03bbd43544cca76d98e4b9448632617a1aa41fd75ca39ce9f83e462
SSDEEP 768:p+qqHHlWvdD/T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU4LliA1nWroHX1cM:p+qqHHlWvdD/Tu1jaF4LYsntL
TLSH
T160C2FA3B284CCB7E4FC01A9DDD5A6F973EA802C7A6688D4047F9894C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4267f1d1-9dc4-42c9-b3ef-38b517ed2209.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4267f1d1-9dc4-42c9-b3ef-38b517ed2209.tmp
Size 9KB
SHA256 d9a406a6b7276950beedaba8924bebd48c8d6d460585aad3d994439106bb1d2c
MD5 8ff66604ff6e1c1cd4306293e6ce29f0
SHA1 07e51de2f126652c944c92dd838b617808a0b36c
SHA512 6a0c07a76df0595ccc655013cad3225f22fb99d471aff99c76e04605fe5793bb5a159419b439d8c27aba4d004e3c18a78d85b119939f875bb501b30db0c1f231
SSDEEP 192:sxZcLWV/fisKumzoupdUHW6+WNKpG/Yr1IaIgUoJ:sxZcqV/fisKuUiHb9/mUM
TLSH
T19422D7526E28A97B8CC7E21DBA65BB43E6F91032A5D41E48FAFC851C04E76DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66ec9265-0bd6-4377-bf66-0773d660ef53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66ec9265-0bd6-4377-bf66-0773d660ef53.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7abe5e8b-8626-4b42-8a09-e1f00213908e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7abe5e8b-8626-4b42-8a09-e1f00213908e.tmp
Size 10KB
SHA256 2b1c8c9f6261c3de4f8f37fdc0475b10dd9ab847e0d6b01323019ef947fc53a9
MD5 d90e1b60b19499ff02f1767811f520c5
SHA1 13d2ba46c27ff421249cea3e3ea5a3bf1c92b6d8
SHA512 1f31423238b05a9ddc517522af0f197cb5cff00ab9148107bbf207ce53a0400391554cd9b9645d5ceb3a3e085b3ee9e87dfb336d7a1e56957cc64387ece7f5c7
SSDEEP 192:sxZcLWV/fisdzumzoupdUHW6+WNKJfXYr1IaIg5ZoJ:sxZcqV/fisZuUiHbAXGLM
TLSH
T1D722D8526E28A97B9CC7E21DBA55BF03E6F95032A1D11E48EAFC8A1C04E77DD130744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91fd113b-fe69-4cc0-9fdb-564929de7a8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91fd113b-fe69-4cc0-9fdb-564929de7a8c.tmp
Size 10KB
SHA256 053b3e44ca3e7d6599195007a88923d42d42e2852eb2f388d74398baafe2848a
MD5 5eefec87e535414791a431f6324a33d8
SHA1 7dfb43453d7073ba1b40b17aa9193219cbec2ac9
SHA512 ede05330e30910f0b5f513b5b41d2e094df84f74e16f749d8ae2baed8a507b77e88abf833aa4cb3d75dba97294c64df05304b7aeec103dcee16e0849900ce252
SSDEEP 192:sxZcLWV/fisdOumzoupdUHW6+WNKJfXYrsIaIg5XoJ:sxZcqV/fisQuUiHbAXlFM
TLSH
T10222C7526E38A57B8CC7D219BA55BB43E6F91032A1D51E88EAFC851C08E77DD230744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 efea44a678c757684a535558fa47b183ab22d92bac24c896359ad406b791e950
MD5 aacc9e1f9c0fe84705d78e6488ae2e97
SHA1 29ba7e2c61a64045e254cfa9f7b3321d77dc8eef
SHA512 82490ed4bc063312d7672a39f608c3dc8721378b808b39dd1bb1bbe714f17136a497027ee9a240b5c06c4e89cfa3d4b14ac3a11f622e6cea6b0e420524873e72
TLSH
T176E07DC44AE8C26FB718E6C703EC534C8F80361EF3CC6D0E1F05C5887405240B6C6690
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d56761d51997fd38138a01859f809d2fd4ed31261556ad2d1c89bba9faa5a9a4
MD5 65c8507e7c18a5fbfaaaf94d882150b8
SHA1 bb6f6a413079803de51a65dd606e454bbf4eb871
SHA512 2e7f3d8d011b6818f8060af38b2560417d62b69542dca46e878447c40132a41761619718370e902e3fd0a06541c46f3e34de1c7165d59f1b82976cc7e5dcbb2a
TLSH
T1B87181485DC24F58DFA9C1728DFCD8873A338D9950836E2E0354EA77EF823E940A8138
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4877027fd0c2260b089a7d78c10de9b26661bf8141e78f135ec2bc3028517a8a
MD5 571da97a3780e8c80eca72451dc5774c
SHA1 ad8d6dfa528115f89ec2090789b6136e51f8ac07
SHA512 dc9ddd631d60827d1825b202eb4fbee9a661656a453f92aba3cb307ec364b9cef2496ba4ec964268c1902ed72cd2f5f1e5b7289ddfa8a811e82253a1327da8df
TLSH
T1057171485DC24F58DFA9C1728DFCD8873A338D9910836E2E0354EA77EF863D940A8138
MD5 SHA1 SHA512 TLSH

Submit Download

48f61d32-1563-4be3-8468-50d27e8a7954.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\48f61d32-1563-4be3-8468-50d27e8a7954.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

24f32c6a-6c4f-45cc-af01-ff5645c4e237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\24f32c6a-6c4f-45cc-af01-ff5645c4e237.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

63ccab7e-000d-4ae7-9014-dbc17eae3c29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\63ccab7e-000d-4ae7-9014-dbc17eae3c29.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d8f16cb7-8c24-4720-9b97-aee3972dfb73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d8f16cb7-8c24-4720-9b97-aee3972dfb73.tmp
Size 1KB
SHA256 5da2deb5c442e52024aa28f3375b124a5c9367625e6640924322a1da7f8b904e
MD5 58bd7735f2dff905858b2cb7bf0097ac
SHA1 f0a1a35e2304c1939031edc126505e6f228967cd
SHA512 7784da12c40c8faad0f30d0c5e51b65fb39ffb68f647cef6c94e5c23017001f0a4399feed9cbd1a7d4a41848d8df9405cfb338ff067c4f7ce76b818a8aff0827
TLSH
T10221DFB3C3E4466ED91116F0AB186D1BCE6D095583287C19C9E4EF1B63E2471E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

37d43305-1a83-4142-acd1-06d8b680e87b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\37d43305-1a83-4142-acd1-06d8b680e87b.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89b509f1-9343-4890-8ada-66133709e90f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\89b509f1-9343-4890-8ada-66133709e90f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f6cfaf9b-3122-4f30-9fea-ff74e4b7c256.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6cfaf9b-3122-4f30-9fea-ff74e4b7c256.tmp
Size 8KB
SHA256 48c26fc65eb34e6c326d3e0bf385f1045d47ed10891551435e540ac0629247e3
MD5 d635de92e61e2b40778f068e470f0c53
SHA1 39fa4fb3fedcd7076b066a8dde8c1cfe5e99b512
SHA512 be7e286fe77b35ebce1ee7168485a96c94f296ed5b0b9fd7e945b44b2a4b0e1f7414c63aaf2ae67762624714090d01bf597dce218a39a413168adc8b9b9921dc
SSDEEP 192:ZONj6xG5QmiUyGR3ID0hZ/1lrjzoY+CcKXeq123nTqWzU6:ZONj6UXpxID0hZPbN+NKXwnxU6
TLSH
T124120C36B868EC775DE27541B58736134EA81127E688AF90D6EC2E2C01DF6AC135BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f1611bc8e6dbfb7e1bdf246c44e5f36e63437dbdc2529fc4223ac7f9818427c
MD5 f46bf90040e7449116b78ede63fdcdc6
SHA1 4ef6001de624df7252767b4413595765fffeb3c7
SHA512 403805f0bbb18050f55b977bc1c2ff02d4a897bf18b3a14c93dff5f2978323ed77189b47fdc9924c2090a615a57af90cf174195ac51f4081de600bc9f68e9fdb
TLSH
T1D8413A58B6FE1148B3B77F4AABF6A86D587FB8732E07959D00110D4E0A26B44CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\activity-stream.contile.json
Size 4KB
SHA256 377336f26d8a0d597b9f4c5c47ed39e0a62cd24b02c633b40962029e6ba4a600
MD5 5528d7ad098e4f874300dd7e2c28330d
SHA1 638e4cde7f02dc38e4d4c780a40b6f2dbb593298
SHA512 798f3a99329825f6144eff2884a26309e904df4ade068424aa8e8291f524deb845826cd9bc46a08ba3be0771d35789af706c3f11c7519453eb1864136912b1e5
SSDEEP 96:T2EMslUmN3zpsT+mRE9on4KYi/s6DVwlz:dMWUMjptmRE9o1swVwF
TLSH
T10391C75B997408161B33F5E42C1B2A98F1237107D9E5CEADB16A8C61C5B87FDD0DB88C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 46d8a60da850de32fdab612c3e7fcd8995854d9e665958642b58dce3826b5220
MD5 034667444207cbf4c165e8eb567ada71
SHA1 75638fd0709924b2661fc32844df1c75ccd47dcc
SHA512 5ae378b0f712e4eb03f19bb7420512208b6ca05f9acfcfe07be735fd0a5fe4536e2560479a8f88857b6db50f044a2dca83388358fd5150ce3fcc17d42b026ea2
SSDEEP 768:vyAE8BnVTvX40f6TzBqTKVxriR51f1fOOrsOSneXJmq8+G9:qAVc0f6TzsWVxrIx1gOSneNG9
TLSH
T13D73F9A3D6E9B2BB1BD137D73C0B795B62D20185E38606CDFCE9CE1C818D654023A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 fce07eae806d29efc8313ff4725b498a072d837c0af516c6c955a5ed6ae7faf0
MD5 f60ff24907c511a3805b9d19ab8abe11
SHA1 6e82eb541ea2232cac3e4e06a4abb59b7e205340
SHA512 5d21b7f8124fc5242e4e18c7cca24c630b3673b0b4853e9a47c0450ce4148074ab2e82e84aec2272061555af792e3f7e397781c6be6f00638969acc904eb0c94
SSDEEP 768:vy9XanHEIAaE0Z38xCw0MpgU0APmZs3QBJ9VJGj4vy:qzc8xz0ggU0ZZsgVPG0K
TLSH
T18F7319A3A7A8B2BB1B9437CB2C0BB99B62E54195F34645CDFCD9C51C80CC764423A5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

26787

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\cache2\doomed\26787
Size 52B
SHA256 13f7e582182960a2e202487a2055398608329177805edcbb7f4529bd3f2b6120
MD5 42e5de68e3c4889bb1eefbff1e5661c8
SHA1 c5d0c82d8a4930dda49b18e60621372e54c126bb
SHA512 14f9b0ea4d9ae448748f451788d6ee359310b3ef0609bcdb332200e90024b564faf2cc415b4c4d4cd053c4cf90d728c1b911691fddc7919a75c386ee92072db4
TLSH
T1BC90020445A58A51D1658174085580F514107901C9C0821278D10B510A520DB0210042
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z1fa97cg.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 4779f1a30317f2cebfa888bec64948e8ade96c6c85a412cc5b5f6ed0a37105fd
MD5 dcc2a7a6ef8442b4a4aa3e09874ecab0
SHA1 70f5fadd06047084c450678b3ccebab85470eee2
SHA512 090bc18a0c93a7eb9cdf09162e4b3c7ba7059c5e35ee42dd9cb33754a4944fa7ed220f391b057fab7710514289f188725262014d2df78f8603a54a3e6773c01f
SSDEEP 3072:j3ldjPbw/IEesBYE8BbXTnn6JqCo3o1E+nLOrY6TA:pdPw5x8BbjnnsyYakN
TLSH
T15AA3BFFADBE3CD3D64FF941C56C2C83EF9262404B3A32009D967671462C6BB86279748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wqzyvxid.u24.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wqzyvxid.u24.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3c245dd291b1ddd7ae5f6016a75afad5c95eedadd86a16d638e136518e9cd6a9
MD5 65724a0bae0cce8faa0663b95e74c89b
SHA1 db61aa9a8bcb1a87b615c7d401b7b98282a4bf4f
SHA512 75553de53eca5b00cfbc4bb8822641c8f928f0fe9a26b40e75f11944c3eaf600ff8f48a231fda929661ef277efad19e986309847c671f2b687d02a474ade558a
SSDEEP 192:cOv5zbogZ+IyjnMd41d66Joz1zgCl6mc0d:fbogZ+IyjLd66Joz1zgC1j
TLSH
T123E1EC64FA28863FD449027BCCA61F450F39399B984E3F19329D651C2C5B2DD368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4848c956a0e96887c76174754ca07eae3554860a2bb140e3d289368e7d073ae4
MD5 5a99776da591b093ea03def76cbcdb8d
SHA1 f0edcdee3274ea59ff118455f8936c68690dee28
SHA512 40390872174569b4e4d0f6d5cb1e8f5b77847c4789a1647a46ab8673f2804c1bce705655d66f6a8e3748fa5bb1e4feaf04e26b82fea7c41194ddefa3351acc72
SSDEEP 192:zOv5zboAP+IyjnMd41d66Joz1zgCl6mc0dz:cbo8+IyjLd66Joz1zgC1jd
TLSH
T13BE1EC64E628863FD448037BCCA61B450F39395AA84E3F19369D651C2C5B2DD368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2c9d2847490a018ce032ce9eb445888136b7b972581bd4c058a514ae57d95919
MD5 b35a0453618f2006a67ab893a9c45721
SHA1 d12679a5653d73e1e68acb79c6ad77b1a07dbf6c
SHA512 9b9b4e489854a2fe476b02635b484bceee83bf0f4d1a52e7d148b76ac7a58bb58502ccdeb59fad66d431fd57af904a3615260d97070c34daac8ae727452aa729
TLSH
T14121674C3AB84E6A59CAFA9C744106CE53954E8A35871C8B4D52DE8DCD82AD933BA438
MD5 SHA1 SHA512 TLSH

Submit Download

0b01dc4e-c7b4-4e56-8cdc-638cecdf7806

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\0b01dc4e-c7b4-4e56-8cdc-638cecdf7806
Size 2KB
SHA256 8222d1b32d8401269d3e1921f489506444da0c41fb407bbaf4521b8ed6119363
MD5 08aa49ee3870a0799e7077faac028358
SHA1 c053eac19e0c91bf3c7180cbedb0ceb33f6ef5b3
SHA512 f7ceb98c9d0fdf49d7892d84d3946c25c9e933f783c8e400d9b6862b84e2af63703c6246af9183fcee8d08585441b137f0b03b437ac01317cdab78ed1900c84e
TLSH
T1FF412058B9F88C779CCBE55DD482334E53648A1340862C877F55EF0C8D9269D237A42B
MD5 SHA1 SHA512 TLSH

Submit Download

48e635c7-6947-4863-9187-249df3191f47

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\48e635c7-6947-4863-9187-249df3191f47
Size 235B
SHA256 66118b4b9ab999f018a1792f0e9ce1f72e0948f7cd4caf10f710fc5596d6c590
MD5 d48fb7b41497245c9816eaea34855446
SHA1 faee143cc2f4510e402a4fffda4ed455fdd188db
SHA512 872375c5a9538b875b42feeffdd4952b5780262cd09d52ac85dcb6d8708a75889468a9348208092a1055f0e7366ce56be270f4fa2a2c4e651813aa1b78081e68
TLSH
T126D097D22CD867AC88240F07F0E168C230888C371070A820DAA10274EDF89D441A2C0B
MD5 SHA1 SHA512 TLSH

Submit Download

537f55e2-0b73-49a2-87c6-34cbe8681b28

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\537f55e2-0b73-49a2-87c6-34cbe8681b28
Size 886B
SHA256 f56a5d73faa1361b4afb1bacff45ee8fca12f7e21870e1b357330f366da3f2b4
MD5 c47773087891aa1c54a056525a1b0d2b
SHA1 4eb267c7f499fb3fabb786ac6852ec5682233f8f
SHA512 2e6927452d6c0af19bd809d5383fb9528660539be5609037c60cb8e680d4a6bd8cc3f305d7c6a037063db6e73aea13a4a55d06bf00d17ff3c84dd8bc82b02cb6
TLSH
T10211044086A4B5B2DCA8934BC8E2770647F47123C0CA55143D959B0C0CBE11E6356207
MD5 SHA1 SHA512 TLSH

Submit Download

780671bb-bffe-482f-ac2e-90a849693b85

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\780671bb-bffe-482f-ac2e-90a849693b85
Size 235B
SHA256 cff69d8b59a626a2ee9cc77d7ad9895d0235625f995e9515a8a72848a45c0b2d
MD5 e7f0356c1e60678e937496ad797042cd
SHA1 2111cd8d97ef31c5b7d8953971597562b3199356
SHA512 9dbf7d732032e6c3d4b6252eb07a8c1888aa42d543f691c869fcf0461f792f60bab926c44072ec090edbc65ab51bc34991d79a65804de7725d1d930c8e83c2bd
TLSH
T153D097C1248C631D08140F0AB0A06DC230848C3B1870A860AB9040B89AFADC80162C06
MD5 SHA1 SHA512 TLSH

Submit Download

b22c0cbd-9f46-4e76-814e-8f1159fc6bd2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\b22c0cbd-9f46-4e76-814e-8f1159fc6bd2
Size 15KB
SHA256 a08d6deebb4bf8415a6f59163258c416eca17b256153507efec2d887ab3a4ede
MD5 2884091664af9fc712a257463c3520cd
SHA1 235e75bf7da67d71432a3bbd0eb0d54849bcc63b
SHA512 2989fc7aba0b955edf26f62e0b846205ba9fb2105fcaccf40e0830298445b37a11efb163a90ce2fb410e0b8e8076c7272b76558370889c65bea029c884b72d27
SSDEEP 192:nJz11uBQCiilh6W9bYISzNnA5ws7fG/LIicrzt8AdJAGxysTp9FfhU4sjpTt/Bi:J+yC/AWltSBngws7uezt822GXaTm
TLSH
T1EB72C8162860457E8291E3A9D4FCBFC3E6F528CF4C419FCA97E4BD0859DA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8eaa061-bdfa-4bbd-8036-11bc174ef849

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\datareporting\glean\pending_pings\f8eaa061-bdfa-4bbd-8036-11bc174ef849
Size 883B
SHA256 78d3e457d47043de035ce3ae1f1af8768c3878db5f252db2fb9f7220c8e9a880
MD5 3b261be360e59c63c10c9c2150113628
SHA1 3f08dbcb7f73b853bae5e9d0c4276fcb099cdcdf
SHA512 5e3250634623eca132059e88956c84d73831d4f53b311b5918b5ec30508dbe9dae95dfd985e19c21f7e0903c8a9360317396c5d781eff0e0451d8363e64a2539
TLSH
T173110440A374F9B2DC78824BC9A67B064BF47427C4C955143E955A080C7B61D636624B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\prefs.js
Size 6KB
SHA256 77230caa7525b9e74cd067e119ad00c22835e75b6e7624b722e6a2c54e66b548
MD5 bbd5453e012c4bdaef7771500576be94
SHA1 dd9c4257a7d1e5c653145e1835a2fee58feb0c08
SHA512 868a71e6c9b8268e149f19e36ea2b03ae2b0474c91ae9564e06f2c8a3870562b89d5545a2973ea016d2859126dc3f3e21895e8ad6d6670250dc27f97ee0a93ea
SSDEEP 96:xHIUTUQqGqSfUgi1zSpSSlkdv9jqn1NHQBw88P8L4cnKHU:yrRSfUgiwSSfQBw88Q
TLSH
T179E10F789448CF7F64B6776CAC6888316AB2013BBBBF68C750B95484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\prefs.js
Size 6KB
SHA256 a5bc754f0ce268ebbe9f64c49f1625ae744ad6e0034c7f96d2359ab444a899cc
MD5 d19cdeae8f680e202e7058994c5a2935
SHA1 2eef8ce12cd8f555907047f44ac67dcb5faa0c30
SHA512 a4e310db69e0fc72c1357d4e02e3c6bc35894b7dda2f1c38d3f2f7f436b705f149ed0d98983ffb1e8caf0cd6ba8d9fa95b70ee6f4e7536cf45ce624524fbfac2
SSDEEP 96:xHIUTUQqGqSfUHN1zSYSSlkdv9jqn1NHQBw88P8L4cnKHRGS:yrRSfUHNRSSfQBw883
TLSH
T137E11F7894088F7F64B6776CAC688C716AB2013BBBBF68C750B55484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 228B
SHA256 db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2
MD5 a0821bc1a142e3b5bca852e1090c9f2c
SHA1 e51beb8731e990129d965ddb60530d198c73825f
SHA512 997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be
TLSH
T14ED0A783C6055075CE83696CB39C7B519E3E04F672640245B1AC954C187F027414B843
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 68b7a5df9a13e1e7c2b8c51cc0313a72320f8875e5c69f3690e1ed1b79aa5947
MD5 6527110cc22575047f4484564b89a9b4
SHA1 e5c960b0c11b7e05973d6a5e3b8dd960bc24cec3
SHA512 e0a6f1c912951a7bc06d1893a33ae82f3b642d797926075f93171f43aa0a6b927e4ffef918679546533149eb3921253b45a6da07cd469e95155f40bb633e4a40
TLSH
T17421F997B86B6EF1FE214265E0C54FD5D64E3432842104F091499D07B1DF49CBBC601E
MD5 SHA1 SHA512 TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z1fa97cg.default-release\targeting.snapshot.json
Size 3KB
SHA256 4bf5ac998e2a67f8cdd0d4081188a396e49eacd6cea1fdcbfa66bf0a6156b980
MD5 5f33d257cb46a5e6432ea3344033214a
SHA1 c2338d5ed8e70235d5ee695fcca00a99cccc6ae5
SHA512 961c27bde70fca7733fcc689cdd4b9835c15a4bb8c54563950e4cac4ceb4b61e2e5fc64becc2e558c4097f464757a63ae210d31ed77acba6ecdab0080b67f57a
TLSH
T14C71700CA61CA4BEA66BC3C0E6857F978BBD063370446458DAFE460C45FB5FB163621B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5872-215-0x0000000009620000-0x0000000009774000-memory.dmp

Download

memory/5872-278-0x000000006D030000-0x000000006D387000-memory.dmp

Download

memory/5872-287-0x000000000BB20000-0x000000000BBC3000-memory.dmp

Download

memory/5872-286-0x0000000008A60000-0x0000000008A7E000-memory.dmp

Download

memory/5872-277-0x000000006CFE0000-0x000000006D02C000-memory.dmp

Download

memory/5872-276-0x000000000BA70000-0x000000000BAA2000-memory.dmp

Download

memory/5872-296-0x000000000BAC0000-0x000000000BACA000-memory.dmp

Download

memory/5872-288-0x000000006D030000-0x000000006D387000-memory.dmp

Download

memory/5872-297-0x000000000BBD0000-0x000000000BC1A000-memory.dmp

Download

memory/5872-298-0x000000000BCC0000-0x000000000BD56000-memory.dmp

Download

memory/5872-306-0x000000000BC20000-0x000000000BC31000-memory.dmp

Download

memory/5872-314-0x0000000005E80000-0x0000000005E8E000-memory.dmp

Download

memory/5872-322-0x0000000005EC0000-0x0000000005ED4000-memory.dmp

Download

memory/5872-330-0x000000000BC70000-0x000000000BC8A000-memory.dmp

Download

memory/5872-338-0x000000000BCB0000-0x000000000BCB8000-memory.dmp

Download

memory/5872-264-0x000000000BA50000-0x000000000BA66000-memory.dmp

Download

memory/5872-263-0x000000000B9F0000-0x000000000BA0A000-memory.dmp

Download

memory/5872-262-0x0000000010700000-0x0000000010D7A000-memory.dmp

Download

memory/5872-261-0x000000000B7A0000-0x000000000B7C6000-memory.dmp

Download

memory/5872-260-0x00000000090E0000-0x00000000090E8000-memory.dmp

Download

memory/5872-251-0x0000000009CF0000-0x0000000009CF8000-memory.dmp

Download

memory/5872-249-0x000000000B3C0000-0x000000000B408000-memory.dmp

Download

memory/5872-250-0x0000000009CA0000-0x0000000009CA8000-memory.dmp

Download

memory/5872-248-0x000000000B290000-0x000000000B2B6000-memory.dmp

Download

memory/5872-247-0x000000000B300000-0x000000000B36E000-memory.dmp

Download

memory/5872-246-0x000000000AEE0000-0x000000000AF02000-memory.dmp

Download

memory/5872-245-0x000000000B050000-0x000000000B09C000-memory.dmp

Download

memory/5872-244-0x000000000ADC0000-0x000000000ADDE000-memory.dmp

Download

memory/5872-243-0x000000000A820000-0x000000000AB77000-memory.dmp

Download

memory/5872-242-0x000000000A510000-0x000000000A614000-memory.dmp

Download

memory/5872-226-0x0000000009E10000-0x0000000009E96000-memory.dmp

Download

memory/5872-225-0x0000000009D50000-0x0000000009D58000-memory.dmp

Download

memory/5872-222-0x00000000098D0000-0x00000000098F0000-memory.dmp

Download

memory/5872-221-0x0000000009A30000-0x0000000009A96000-memory.dmp

Download

memory/5872-220-0x00000000099C0000-0x0000000009A26000-memory.dmp

Download

memory/5872-219-0x0000000009920000-0x00000000099B4000-memory.dmp

Download

memory/5872-217-0x00000000094C0000-0x00000000094F8000-memory.dmp

Download

memory/5872-216-0x00000000092F0000-0x00000000092FE000-memory.dmp

Download

memory/5872-214-0x0000000009250000-0x000000000929A000-memory.dmp

Download

memory/5872-213-0x0000000009340000-0x00000000094B8000-memory.dmp

Download

memory/5872-212-0x0000000005860000-0x000000000586A000-memory.dmp

Download

memory/5872-211-0x00000000051F0000-0x00000000051FE000-memory.dmp

Download

memory/5872-210-0x0000000006500000-0x0000000006BCA000-memory.dmp

Download

memory/5872-209-0x0000000005200000-0x0000000005292000-memory.dmp

Download

memory/5872-208-0x0000000005880000-0x0000000005E26000-memory.dmp

Download

memory/5872-831-0x0000000001220000-0x0000000001232000-memory.dmp

Download

memory/5872-832-0x0000000001280000-0x00000000012BC000-memory.dmp

Download

memory/5872-207-0x0000000000800000-0x000000000083A000-memory.dmp

Download