5c69bd838a2b6afff58135b1814b27826de282f3ce4303a00b5979f704d6f870

Analysis

user interaction
yes
max time kernel
131s
max time network
268s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
icons/app-icon.svg
Size 867B
Sample261023-1arsfadf76
SHA256 5c69bd838a2b6afff58135b1814b27826de282f3ce4303a00b5979f704d6f870
MD5 f2e8645e91bdc85f2c901e4a8eddfd60
SHA1 e0eb22c17252c42033c52953185caf2ba7706d41
SHA512 e15e4aa1cec60a6832344a1b93d543a914d3b432433f53977473042c9ae2fed0f9668bc6c345c2915cf1dc38e8e7bf89b941e38d1832c5a6050c96e54c8e15c2
TLSH
T13511AFE5062843DDB2158F51FBB7A044F11F64E5C68A93E86319213AC6420DE59DEEFC
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
77	2108	firefox.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\windscribesplittunnel.sys	Windscribe_2.24.13_amd64.exe
File opened for modification	C:\Windows\system32\drivers\windscribesplittunnel.sys	Windscribe_2.24.13_amd64.exe

Executes dropped EXE 16 IoCs

pid	Process
4112	Windscribe_2.24.13_amd64.exe
6020	7zr.exe
4316	Windscribe_2.24.13_amd64.exe
4792	7zr.exe
2556	WindscribeService.exe
2324	devcon.exe
1488	devcon.exe
2308	Windscribe.exe
4112	Windscribe_2.24.13_amd64.exe
6020	7zr.exe
4316	Windscribe_2.24.13_amd64.exe
4792	7zr.exe
2556	WindscribeService.exe
2324	devcon.exe
1488	devcon.exe
2308	Windscribe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\SETFF26.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\SETFF26.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\ovpn-dco.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\SETFF28.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\SET13B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d\ovpn-dco.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d\ovpn-dco.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\SET13C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d\ovpn-dco.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\SET13A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\SETFF27.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\SETFF28.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\OemVista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\ovpn-dco.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\ovpn-dco.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\SET13A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}\SETFF27.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\SET13C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\OemVista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4499ba26-99b6-ea4b-87d4-273658eb0bad}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{34db7a21-caf0-954b-8fef-cd83f0bf4d14}\SET13B.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windscribe\uninstall.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribectrld.exe	7zr.exe
File created	C:\Program Files\Windscribe\wireguard.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win10	7zr.exe
File opened for modification	C:\Program Files\Windscribe\amneziawgtunnel.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribe-cli.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribewstunnel.exe	7zr.exe
File created	C:\Program Files\Windscribe\tapctl.exe	7zr.exe
File created	C:\Program Files\Windscribe\Windscribe.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.cat	7zr.exe
File created	C:\Program Files\Windscribe\devcon.exe	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.sys	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribe_service.log	WindscribeService.exe
File opened for modification	C:\Program Files\Windscribe\Windscribe.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\qt	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.cat	7zr.exe
File created	C:\Program Files\Windscribe\qt\qt.conf	7zr.exe
File created	C:\Program Files\Windscribe\tapwindows6\tap0901.cat	7zr.exe
File created	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys	7zr.exe
File created	C:\Program Files\Windscribe\tapwindows6\tap0901.sys	7zr.exe
File created	C:\Program Files\Windscribe\tunnel.dll	7zr.exe
File created	C:\Program Files\Windscribe\windscribeopenvpn.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\wireguard.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\InstallHelper.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys	7zr.exe
File created	C:\Program Files\Windscribe\open_source_licenses.txt	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.sys	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribeopenvpn.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\WindscribeService.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\WireguardService.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.cat	7zr.exe
File created	C:\Program Files\Windscribe\WireguardService.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\tapwindows6\OemVista.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\tapctl.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\tunnel.dll	7zr.exe
File created	C:\Program Files\Windscribe\windscribe-cli.exe	7zr.exe
File created	C:\Program Files\Windscribe\WindscribeService.exe	7zr.exe
File created	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.cat	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\qt\qt.conf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.cat	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.sys	7zr.exe
File created	C:\Program Files\Windscribe\wintun.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\wintun.dll	7zr.exe
File created	C:\Program Files\Windscribe\amneziawgtunnel.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win11	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\splittunnel	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.sys	7zr.exe
File opened for modification	C:\Program Files\Windscribe\config\WindscribeWireguard.conf	WindscribeService.exe
File opened for modification	C:\Program Files\Windscribe\devcon.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\uninstall.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\tapwindows6	7zr.exe
File created	C:\Program Files\Windscribe\tapwindows6\OemVista.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\tapwindows6\tap0901.cat	7zr.exe
File opened for modification	C:\Program Files\Windscribe\tapwindows6\tap0901.sys	7zr.exe
File created	C:\Program Files\Windscribe\windscribectrld.exe	7zr.exe
File created	C:\Program Files\Windscribe\windscribewstunnel.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.cat	7zr.exe
File opened for modification	C:\Program Files\Windscribe\open_source_licenses.txt	7zr.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Windscribe_2.24.13_amd64.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindscribeService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindscribeService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Windscribe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Windscribe.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5872	msedge.exe
1976	msedge.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
564	taskkill.exe
5368	taskkill.exe
2112	taskkill.exe
2632	taskkill.exe
5620	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Windscribe_2.24.13_amd64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4316	Windscribe_2.24.13_amd64.exe
2308	Windscribe.exe
4316	Windscribe_2.24.13_amd64.exe
2308	Windscribe.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4316	Windscribe_2.24.13_amd64.exe
2308	Windscribe.exe
4316	Windscribe_2.24.13_amd64.exe
2308	Windscribe.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	firefox.exe
Token: SeDebugPrivilege	2108	firefox.exe
Token: SeRestorePrivilege	6020	7zr.exe
Token: 35	6020	7zr.exe
Token: SeSecurityPrivilege	6020	7zr.exe
Token: SeSecurityPrivilege	6020	7zr.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeRestorePrivilege	4792	7zr.exe
Token: 35	4792	7zr.exe
Token: SeSecurityPrivilege	4792	7zr.exe
Token: SeSecurityPrivilege	4792	7zr.exe
Token: SeAuditPrivilege	4944	svchost.exe
Token: SeSecurityPrivilege	4944	svchost.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	5368	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	2108	firefox.exe
Token: SeDebugPrivilege	2108	firefox.exe
Token: SeRestorePrivilege	6020	7zr.exe
Token: 35	6020	7zr.exe
Token: SeSecurityPrivilege	6020	7zr.exe
Token: SeSecurityPrivilege	6020	7zr.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeRestorePrivilege	4792	7zr.exe
Token: 35	4792	7zr.exe
Token: SeSecurityPrivilege	4792	7zr.exe
Token: SeSecurityPrivilege	4792	7zr.exe
Token: SeAuditPrivilege	4944	svchost.exe
Token: SeSecurityPrivilege	4944	svchost.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	4316	Windscribe_2.24.13_amd64.exe
Token: SeDebugPrivilege	5368	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2696	msedge.exe
2308	Windscribe.exe
2308	Windscribe.exe
2696	msedge.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2696	msedge.exe
2308	Windscribe.exe
2308	Windscribe.exe
2696	msedge.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe
2308	Windscribe.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2108	4264	firefox.exe	81
PID 4264 wrote to memory of 2108	4264	firefox.exe	81
PID 2108 wrote to memory of 5384	2108	firefox.exe	82
PID 2108 wrote to memory of 5384	2108	firefox.exe	82
PID 2108 wrote to memory of 5384	2108	firefox.exe	82
PID 2108 wrote to memory of 5808	2108	firefox.exe	83
PID 2108 wrote to memory of 5808	2108	firefox.exe	83
PID 2108 wrote to memory of 5808	2108	firefox.exe	83
PID 2108 wrote to memory of 5808	2108	firefox.exe	83
PID 2108 wrote to memory of 3900	2108	firefox.exe	85
PID 2108 wrote to memory of 3900	2108	firefox.exe	85
PID 2108 wrote to memory of 3900	2108	firefox.exe	85
PID 2108 wrote to memory of 3900	2108	firefox.exe	85
PID 2108 wrote to memory of 852	2108	firefox.exe	86
PID 2108 wrote to memory of 852	2108	firefox.exe	86
PID 2108 wrote to memory of 852	2108	firefox.exe	86
PID 2108 wrote to memory of 3556	2108	firefox.exe	87
PID 2108 wrote to memory of 3556	2108	firefox.exe	87
PID 2108 wrote to memory of 3556	2108	firefox.exe	87
PID 2108 wrote to memory of 3556	2108	firefox.exe	87
PID 2108 wrote to memory of 2596	2108	firefox.exe	88
PID 2108 wrote to memory of 2596	2108	firefox.exe	88
PID 2108 wrote to memory of 2596	2108	firefox.exe	88
PID 2108 wrote to memory of 2596	2108	firefox.exe	88
PID 2108 wrote to memory of 4648	2108	firefox.exe	89
PID 2108 wrote to memory of 4648	2108	firefox.exe	89
PID 2108 wrote to memory of 4648	2108	firefox.exe	89
PID 2108 wrote to memory of 4648	2108	firefox.exe	89
PID 2108 wrote to memory of 2420	2108	firefox.exe	90
PID 2108 wrote to memory of 2420	2108	firefox.exe	90
PID 2108 wrote to memory of 2420	2108	firefox.exe	90
PID 2108 wrote to memory of 2420	2108	firefox.exe	90
PID 2108 wrote to memory of 1744	2108	firefox.exe	91
PID 2108 wrote to memory of 1744	2108	firefox.exe	91
PID 2108 wrote to memory of 1744	2108	firefox.exe	91
PID 2108 wrote to memory of 1744	2108	firefox.exe	91
PID 2108 wrote to memory of 3028	2108	firefox.exe	92
PID 2108 wrote to memory of 3028	2108	firefox.exe	92
PID 2108 wrote to memory of 3028	2108	firefox.exe	92
PID 2108 wrote to memory of 3028	2108	firefox.exe	92
PID 2108 wrote to memory of 3336	2108	firefox.exe	93
PID 2108 wrote to memory of 3336	2108	firefox.exe	93
PID 2108 wrote to memory of 3336	2108	firefox.exe	93
PID 2108 wrote to memory of 3336	2108	firefox.exe	93
PID 2108 wrote to memory of 5688	2108	firefox.exe	94
PID 2108 wrote to memory of 5688	2108	firefox.exe	94
PID 2108 wrote to memory of 5688	2108	firefox.exe	94
PID 2108 wrote to memory of 5688	2108	firefox.exe	94
PID 2108 wrote to memory of 3108	2108	firefox.exe	95
PID 2108 wrote to memory of 3108	2108	firefox.exe	95
PID 2108 wrote to memory of 3108	2108	firefox.exe	95
PID 2108 wrote to memory of 3108	2108	firefox.exe	95
PID 2108 wrote to memory of 4112	2108	firefox.exe	96
PID 4112 wrote to memory of 6020	4112	Windscribe_2.24.13_amd64.exe	97
PID 4112 wrote to memory of 4316	4112	Windscribe_2.24.13_amd64.exe	99
PID 4316 wrote to memory of 2632	4316	Windscribe_2.24.13_amd64.exe	100
PID 4316 wrote to memory of 5620	4316	Windscribe_2.24.13_amd64.exe	103
PID 4316 wrote to memory of 564	4316	Windscribe_2.24.13_amd64.exe	105
PID 4316 wrote to memory of 4792	4316	Windscribe_2.24.13_amd64.exe	107
PID 4316 wrote to memory of 2324	4316	Windscribe_2.24.13_amd64.exe	110
PID 4944 wrote to memory of 5648	4944	svchost.exe	113
PID 4316 wrote to memory of 1488	4316	Windscribe_2.24.13_amd64.exe	114
PID 4944 wrote to memory of 2644	4944	svchost.exe	116
PID 2556 wrote to memory of 5368	2556	WindscribeService.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\icons\app-icon.svg"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\icons\app-icon.svg
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {b92459f7-f8b5-4425-95da-7ec67b25a502} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27133 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2356 -initialChannelId {fa868f70-1d6a-407f-be66-e51e7514afc7} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 27274 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3908 -initialChannelId {061ffad7-d4d2-4a6d-b9cc-dbc5d4760d5d} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4056 -prefsLen 27274 -prefMapHandle 4060 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {28ef3372-49bc-4fe0-8123-a8afebe3d8cb} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2908 -prefsLen 34773 -prefMapHandle 2912 -prefMapSize 270279 -jsInitHandle 3060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4536 -initialChannelId {bbea3398-3574-4bff-8239-277d070f242d} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3132 -prefsLen 35010 -prefMapHandle 3060 -prefMapSize 270279 -ipcHandle 4928 -initialChannelId {5269993b-4a3a-4fb9-9ccc-6af5c39c4f67} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32952 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {b8bdb7c6-ff7a-456b-9ac1-df74c20090d7} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {73d462c6-c8b5-42ba-a06c-2fd10d01f8da} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {dae33dc7-9856-4545-92d3-59ae6aa2f965} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4072 -prefsLen 33031 -prefMapHandle 6456 -prefMapSize 270279 -jsInitHandle 6152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2908 -initialChannelId {ca1ac88d-3c5b-46a2-8111-2463d39665b4} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6004 -prefsLen 35158 -prefMapHandle 4808 -prefMapSize 270279 -jsInitHandle 4748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3068 -initialChannelId {5d8f165c-9249-4b2f-b93d-80b3f9c41eee} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6472 -prefsLen 37045 -prefMapHandle 6460 -prefMapSize 270279 -jsInitHandle 2676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6476 -initialChannelId {96ef4509-7a7b-4f61-adc1-a6f0f847f1fd} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7156 -prefsLen 37045 -prefMapHandle 7016 -prefMapSize 270279 -jsInitHandle 7012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7004 -initialChannelId {9fd61d0b-98bd-4746-8adb-dea867ebc374} -parentPid 2108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:3108
- - C:\Users\Admin\Downloads\Windscribe_2.24.13_amd64.exe
    "C:\Users\Admin\Downloads\Windscribe_2.24.13_amd64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402\7zr.exe
      "C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402\7zr.exe" x -y -bb3 -bd -o"C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402" "C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402\windscribeinstaller.7z"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6020
  - - C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402\Windscribe_2.24.13_amd64.exe
      "C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402\Windscribe_2.24.13_amd64.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im windscribeopenvpn.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im windscribewstunnel.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5620
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im windscribectrld.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:564
    - - C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402\7zr.exe
        
        "C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402\7zr.exe" x -y -bb3 -bd -o"C:\Program Files\Windscribe" "C:\Windows\Temp\WindscribeInstallerf6a9ef13bf204edc952416c56f393402\windscribe.7z"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4792
    - - C:\Program Files\Windscribe\devcon.exe
        
        "C:\Program Files\Windscribe\devcon.exe" dp_add openvpndco\win11\ovpn-dco.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2324
    - - C:\Program Files\Windscribe\devcon.exe
        
        "C:\Program Files\Windscribe\devcon.exe" dp_add tapwindows6\OemVista.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1488

C:\Program Files\Windscribe\WindscribeService.exe
"C:\Program Files\Windscribe\WindscribeService.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /t /im windscribeopenvpn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{55c4dfe1-1d3b-5649-b2ed-b3c190d1a06d}\ovpn-dco.inf" "9" "4df7dbc87" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Windscribe\openvpndco\win11"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5648
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{90bcc2bb-7245-3c4a-b42a-90c1e6f1e530}\OemVista.inf" "9" "4c577662b" "0000000000000160" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Windscribe\tapwindows6"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2644

C:\Program Files\Windscribe\Windscribe.exe
"C:\Program Files\Windscribe\Windscribe.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2308
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /t /im windscribectrld.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.windscribe.com/installed/desktop?5e04ava0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x348,0x7ffbfc29c188,0x7ffbfc29c194,0x7ffbfc29c1a0
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,5812883779887428632,7025275805963882041,524288 --field-trial-handle=2200,i,15878083569971042855,53707034847642481,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,4238116926516154030,4767362621248516296,262144 --field-trial-handle=2200,i,15878083569971042855,53707034847642481,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,8520875004907884020,17597279487463737287,524288 --field-trial-handle=2200,i,15878083569971042855,53707034847642481,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4342009839510651731,10553195275230182519,2097152 --field-trial-handle=2200,i,15878083569971042855,53707034847642481,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,15461196653426973411,5128460594550120803,2097152 --field-trial-handle=2200,i,15878083569971042855,53707034847642481,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffbfc29c188,0x7ffbfc29c194,0x7ffbfc29c1a0
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,17152109234202629950,16869690265970227853,524288 --field-trial-handle=2332,i,5483582473458693121,15660107195181798198,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      System Time Discovery
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,13547575843929302783,14374388140193896396,262144 --field-trial-handle=2332,i,5483582473458693121,15660107195181798198,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,3028008721711037486,17376463903934344717,524288 --field-trial-handle=2332,i,5483582473458693121,15660107195181798198,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,15921272877681880494,2142330697789298679,524288 --field-trial-handle=2332,i,5483582473458693121,15660107195181798198,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,15921272877681880494,2142330697789298679,524288 --field-trial-handle=2332,i,5483582473458693121,15660107195181798198,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallHelper.exe

Path C:\Program Files\Windscribe\InstallHelper.exe
Size 495KB
SHA256 f7faa3fc217b73c75bd4ce0aaf92d61d05c5a1375b34e8e11812c41a6c828190
MD5 7fa275a1b0ffd6b2c76ce2ff73a63d19
SHA1 48eed5eacaff8dd84fb77d9cd97d218a9639b553
SHA512 54f31b11c4e0cd91abaf9ec01f06f7ea4a8f899a9eac7efbb25efe3d4e7a67125c6f4d2f8f51b1e2e37a460ba0bf79073a0323c008489f51d70191bf38e47931
SSDEEP 6144:kcOmsIoPSOgHA2HUhdXZrGenHTHHGX4iHDq9CYbDptsGQQTwLQzE:qmzgkApVZG0bZCgbsGQQTwLX
TLSH
T153B48E99E29842F5F167E238C9874502F7B1784A5360A7CF03E09AB62F677E15E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windscribe.exe

Path C:\Program Files\Windscribe\Windscribe.exe
Size 42.2MB
SHA256 a14fa677d60c108090dd9b5c27bb03825bdf197500d23011e692ffe5c4811b5e
MD5 5f4ef5ddc85e148bec787a5e435bbc51
SHA1 b1418f9ce4ba5dddf165da2b2256185812047a18
SHA512 3d3eaff24dbab8de42906f8259e1aa44014e94c1ddf4fd9a050adca4c6bec6f2c44a12008fe169bada7473bb524a6fc399edd81c8ab1f166e65e35ff289e76dc
SSDEEP 393216:Xw0yCZStFWixYT3feg59Ozv+8SZ2vhH5SRxhjRHslQRNrjy7rlpKFdu9CwJsv6tZ:g0BXUSR+SwJQfRjAmxKbaiLDtMuCG4C1
TLSH
T1E6A79D5B63F401C5E5BBD138CAA79123FBB27896177096CF026496A91F33BE05E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindscribeService.exe

Path C:\Program Files\Windscribe\WindscribeService.exe
Size 8.3MB
SHA256 64b5f082bcc224633bab209f864e00401d061ed22c57fc7c42d7a02840178a69
MD5 f0e3a99553a058fded3213a82ef06cd1
SHA1 9bd496e77a5f867b5632c5cc4c3019237d9cde53
SHA512 d63ee836b6b21ebbc40dc08ba17cd8cea7f5cf1c2dc18b24cf81fd1c8db26dc6ff7700b0712cb4ee29dd6ea7aba5592f84d7bc1aaf284392cc426761f00da90a
SSDEEP 196608:RFvX0GqyGFxKjXADMLL5QG/deyZFCRKQ1VnKpij:vkGqyGFxKjXADMLLmGFeyZFaKQ18cj
TLSH
T1B7969E6AA6BC00E9D47AC1BCC6865217E772B41517B057CF1AA086FA1F63BE01E7F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WireguardService.exe

Path C:\Program Files\Windscribe\WireguardService.exe
Size 596KB
SHA256 18ec6387536a0c19339240b0768fceda2e75b473326221d37e9623e2255f0d13
MD5 3894b1f2bd7acae5f9ea3ccef9a6a6b8
SHA1 a073ef610e4ba8c9bf8a0393991203bdd431b509
SHA512 e8b5aff58d34684b5f6f541b06492c4e1f9332b7e41d3a8ab82577c3a5332c97edd662f4fc3480521c41bd90f616f46ba323be231f52e8f07bdbcc333f578139
SSDEEP 12288:zurP1PBa+oWoYaxuD9MALPx0Sl9f+AlF3lIjGKps:zuG+oWoYsuaSl9fRlQy3
TLSH
T1D5D46B6AB79813E9D17BC17C8A468506FBB2780647609BCF17A08A972F176E05F7F301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon.exe

Path C:\Program Files\Windscribe\devcon.exe
Size 91KB
SHA256 238b835561bf5e3c2ba187eabf57871d059f1e890aa751ddc626b23e6c5590bb
MD5 2e44f6f7097127c653e273ab7b1647a2
SHA1 dee53f8b6a80896e3d0b6b356bd82cbfb2d7e655
SHA512 0b346ed6560925533bf4eb41fc833b691de4fcdbfb616d6973ca362f722f098158c5ca8635273c24bd1c76eacd71b2180570a58c89e6d001f12b0a0c81d6c686
SSDEEP 1536:81Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WH87G:81M2fAggGnD89NJ1cPZCM3Wca
TLSH
T1FE93E70263E81649F5F37A3469B552355A737CA1AE38C69E029C912D0FE3EC0DD74BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.inf

Path C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.inf
Size 2KB
SHA256 f4ad125570e5e96da38ca0e6f35cb6c614b59d7d7f9844705595db78c29706a5
MD5 2892ed63170b894aa7e7d0b2a82562df
SHA1 2da352f5bb5fe4c67e70d0007ca936fe20cacaca
SHA512 3cbfb2d8322ec20717502608f09243fa146751d0e10a581bc292d1b4ea895584dd4be7ae3177e637c435c5a3eb9f7b462fd6c94e2e57d1894b72820075ab4c8f
TLSH
T1C441F14A52C20FF93B432D7596077BA2B9D6910050C8152AF48C96468B8FF99B31B7FB
MD5 SHA1 SHA512 TLSH

Submit Download

windscribesplittunnel.sys

Path C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys
Size 30KB
SHA256 8d76267f9c632801b64ccab24584e2ab60cb9d358c281a81cc80813b49426b3d
MD5 369453e845de704ecbd9a6625bdd08a9
SHA1 69095a663f316e83be7d1755673257e28475c613
SHA512 7983716b87ebe10bbacb54e570eb14e352733764321aa154dcc5714f9b78f54ede2b47715bf6fcee61c7c104d85991b6b5074c2fbbf2818c75cb0de0d3cc1d48
SSDEEP 384:B2shShMzcvNyThIYiC52afky8RbmL4nNyk0P3h3fifX7R9zwjm/t:B2shyMLCYiWxk5ALt3KF9zwq/t
TLSH
T187D27D9385801882CD079C30A1D5D657FEBD72C22BA081E732A9C5551BE33CA7F3D6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tapctl.exe

Path C:\Program Files\Windscribe\tapctl.exe
Size 159KB
SHA256 bda5e45f83af99bf5c6b8a32626a1a9d021c7e74c3ae3ca02b8bc9a1b0ac35aa
MD5 12cbe83f011ab5effd2749db81318634
SHA1 0f8e984ca6550d5c5b45a6d73cbdddeb1dedb3e8
SHA512 78da6712911da89593c2383a9c0d95b0534fcbe80540cd8bc6af2445ee67918afb95d410d288acb07e2580821cfa002b58c2f7de013242a77a682ec37c34748b
SSDEEP 3072:nj3q17ql+2OlkDYZek/e45PUiJevg1oGiC:WVlHZek/FPpn
TLSH
T13AF34A53B7A430F9D577863889620506EB73783117709B9F03A8427A2F277D1AE3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Windscribe\uninstall.exe
Size 858KB
SHA256 d9773b121663d3b5d3ebe4406f08fac5b532f98ad979a403784eb44814ca719f
MD5 8e911b44dbf8a7bc75957440de70d5c8
SHA1 04cbea9342c5483608a79a10e14b46be8d6515a2
SHA512 4b14ff117528bf6bb92953f12b366236264537d960167b400fd8e19b006b628b4ae91f4fdfe87585d4712a7e888b8e01d04a6034f8403f8aebb499e65f5763a7
SSDEEP 12288:W9lIEojLkLozrBlNRxM2ZdqrNezJvxZgB4yzpg6GS:W9mrlVM2ZdqrNmRxS/p
TLSH
T17B156D1AB79D02E9E1BBD23DC9565543EBB17C0653309ACF17A08A5A2F276F04E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribe-cli.exe

Path C:\Program Files\Windscribe\windscribe-cli.exe
Size 9.0MB
SHA256 53194323ba054d5ea5a3c79aacbfe37034d7112261aecd8fca985a7ec3d76c9f
MD5 3ac426b1eb4f4732ca3fc6a7c93132e2
SHA1 861c32545bc3fc492a1274349078fd07960137e8
SHA512 7602f3242934250a02d3ca7ced0c208527b0dec2654c051d353b877433d4ce7232e298008d4b56f36fcbe5fb3efbe5b835c14f6aca8d63fddef19accf47ccefb
SSDEEP 98304:npBHaxVBy9oYdKFdu9CwJsv6t9JMAAmpQ:r4BsoaKFdu9CwJsv6t9SAC
TLSH
T11B9639076AFA0141F6F7DA34DABA5162DB727C866B3096DF025472281D336F09E36327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribectrld.exe

Path C:\Program Files\Windscribe\windscribectrld.exe
Size 7.1MB
SHA256 247793c693172b33978d8982fed1c17583c2658adcd5002689320580b8cd888f
MD5 77be28359a7185693bd46dcbf31d304f
SHA1 797d43e53a34c69f849befb5edc305be7d854404
SHA512 3b4659c6c1530fc9aa9b44bd82982039ef441eb82146e782231465f14bcc63cbac97f82a4e428b2b8519baa9e513afb7a19e39a806088e26e1b2732c415c784e
SSDEEP 196608:/D2Vohgrkbmh3PgXgfsuaXKYqAF5LUZ3BHcL:/DaLkmkg8XbFd0WL
TLSH
T13676332B909A0C356772C5FC30BA167EA185A87FA1F98015B5BE8F82C677F504ED10F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribeopenvpn.exe

Path C:\Program Files\Windscribe\windscribeopenvpn.exe
Size 6.0MB
SHA256 cc171daa6f9fdfb0b27c0acee7588045ceb66023ee980a92d5f4ec5801328cd0
MD5 fed7fc69de8ac34898d4705a04788a4d
SHA1 a3f41295b6ebfe0a88181791ed342cbed875ed5b
SHA512 c4b758211502d51b460212d911ef5f8ecd3e78c4558fa9380c4dbee02a591a22b4f5e2e6ec3a6c40c497907940e5219c90f9746d0dd09b64b1d34b9212654d3c
SSDEEP 98304:cUO+QXh0cpf1tWt6l1eO6iwVrVoSqNyLwvD+mv42M:c1+QX6cpf1YclQO67VrCSqNycbpi
TLSH
T1B9569EADA7BC00E5D8AAC5BCC2865123E772B45513B157CF29688AF50F63AD02E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribewstunnel.exe

Path C:\Program Files\Windscribe\windscribewstunnel.exe
Size 8.0MB
SHA256 70ccb29c4a56ea1da11d2c606a54b662a62e8fe73db36347b8c2541c51dfa859
MD5 9eef7b8c20a73209dabf8e68da879ed3
SHA1 144ed38224316f6e6d3bb2b0a84c7d3679c4fd89
SHA512 7e8b986c5699488917ab38fd44172afcaa5b53649606daf47552a99a4f67ee853d37460bfddb6e24e043c7938cd184041644328470a5bc2330a495551dc40651
SSDEEP 49152:gmfd03nZDbO3d6yNjQw6a2t/qZYiLrpqQL0cOxdSyLfVlTvmu1eR0F1ips6+dfOz:ge8DKDYihq5CpT7b4ET
TLSH
T1D3863847ECA141E5C1BED1308A629522BF723C460B3127C73AA4B7646F77BD05EBA394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.log

Path C:\ProgramData\Windscribe\installer.log
Size 2KB
SHA256 ba6720874e08149e450b37f6b81b38ed779ccff720696deac5a05ee62aae015f
MD5 7db25a7273d8745434a3db7e267a33cc
SHA1 49f706d901434fbfc4850898f5708515bbd31e2e
SHA512 fc7c5e88790045e671989b804b89fc3075ce1a96a824dd7e085538b66b25c96ef91af8fe6b67d0e921fb5ed2c32007b34742ea80e536611dd5c30cdf27dee896
TLSH
T10C417B041E7BB27FA2D0075C72BA1D928A1AF03412D466BC1BD95240E29E27D6FF75A3
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 7fa7c5749452bece2b7b3d5f0cae66dbf4de42dafebca2e1882d59ac93df0510
MD5 5e26df5ffc0e519e80f1d953b832644e
SHA1 a3af1e8998a2d031231a6c8bf3132af6c50891b3
SHA512 a84c5ccd791e1c1996743ebd7d25607ea6c00577d6bdbbcc7b75372596a85180fc0ee48f3626737f6f23df905b1ca4a5c4fb23bce7ddb6c96e509173b00fd4ff
TLSH
T128F0D4F3057E70E2220F5CB85BE887902496616C14E3885128757FF42D47BD1690EC2F
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_09FFDB98C21C3A56600C52F2C4999496

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_09FFDB98C21C3A56600C52F2C4999496
Size 727B
SHA256 57c2c097a6c800c6e80bf7c2edd8df4b315f1a6da0f6a1da94972071b241b75f
MD5 a4211cc29f5fa77cbea34cc22ff1f9e3
SHA1 d2852b89439d8928f81d45cc97b3c45ee07afbe7
SHA512 2ccfdd6bf6951ff5d1a7e5b3973ce905d0f4c6b5b095031749c831f5a5cf0c7121323020a8ec178dbb2cfaa6640ea1cfcc89a38efcda0f6794fff45b32f1d02e
TLSH
T1CC016507A31A722DDE43CC487FA896547710A18059CCBDAB27B8408295C8B7A2E02025
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 bd76d6729ade01c2f3f2c1b03ee9b9b877521e73a668a58cfac63e7684aad19f
MD5 74700b6f42358773d7f90406e6420211
SHA1 09b235f714b2b90ef876fc42eb4ec547c2e3851a
SHA512 66510aeb34e50cb646f936d9dcff365f44715998eceaedf2c0b7e869aa2cc178723968482c37274244e544ccff57eb51f9469328f3a427047f8f5af1d9e56be2
TLSH
T1130199E3DC58D6F03D502F268BBCE5507177D45E31E582713ED4408F547E0351E89544
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 d84361b1dcbbc9fd1e5e9e893408091d1dbb390fff09b6c4301d5de03a2f4efa
MD5 1c4bf3c4e2ecd7a3703197cbcf1128cc
SHA1 db32a0e559f410b6d1da21665de00f2004907e72
SHA512 883389c7dca1246a2273931efe4c2be02360a454f331c59fb4f29a4d4d22c3f32d1506e9859583a2e549976ce49d918cb5eceeefc466ee5f117373722a05c245
TLSH
T117E0C02813FE401EF270877803D5E09A5F36F0022C15627D0D81502CE91AE001CA2C32
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_09FFDB98C21C3A56600C52F2C4999496

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_09FFDB98C21C3A56600C52F2C4999496
Size 408B
SHA256 baa41e13099c5d388d8e58acf9524841c91eeaaaaa45402565ab82102898c089
MD5 6a0d332112611cc8305af01f52758c64
SHA1 47e3abd6663a2963571a185306a34f28ba7ee5a1
SHA512 e47c98685d38aa2392939b147eda8c1f5f27f665ca4e4ac9835481129f8fc4d738410a6b5f2fab88913c9f4e35565fed4cf2b9f905276a1773238b8d4bb37c4f
TLSH
T10AE0C03872F58758F0F1E4380AE299231955F21E0941C76505C09309FA19B409DE6674
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 583781c928cda802490604d1269cd0372729f15ec1019788d8f8f8e274b81d64
MD5 070e23cfd0c843dbcecf204c9e4fd524
SHA1 f6c04d25d21007e02b00ae05ce5f8bcbd515937d
SHA512 24e77978bc2c7f2100b2b5d91c683e6983072a1f167eb13e212e882b1414f63735d1ca3ee220541a1a986536bcea000b8150a06562832d02cf855699f81e8f7e
TLSH
T11AE0683C11EBF50EF060893582F5A1711D4CE7111400D3B90A90030CBB0EF409D209F1
MD5 SHA1 SHA512 TLSH

Submit Download

02f2f30c-ed29-462e-8227-043e1c23a6c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02f2f30c-ed29-462e-8227-043e1c23a6c3.tmp
Size 29KB
SHA256 9d6cfed0dae0a72d397b2e1f6f3ad83f7c0f4cc6f0829d957f3b83bcf8c84fc8
MD5 164bf91039c82a113bd7c56727a4ae73
SHA1 f54406959595599996152412401b1c940dded78d
SHA512 797e44cbd4b9a04f00336878b549e1cf143d39d4ae57db8d03b04e9ef992c76525c5e4077df2ce1f8c22780cf1a95cff702f38cc79bcbfc55f9337cdeb18ef6e
SSDEEP 384:z4iFRZcI28Nq8TUNTUlIRQQnhx8titzTfoBu9D+sfdXVUxowT+owUPxswgL/7Izr:vF52Fwg5ho8UBSKatVUnT+owUPqVu
TLSH
T19CD2063E9C64C97FA8EEBB98564D6612DDE04233D5B896D8D7C80F0C80B649DF30B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60fb10e6-60a6-469a-81ac-8d33c9781331.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\60fb10e6-60a6-469a-81ac-8d33c9781331.tmp
Size 26KB
SHA256 468243cc4c0fcac4dc4b84e770f7d1c1c80bb4cfe5e668f00f0e3b40c61ed58d
MD5 8ee2f991be8912f40cabc117c597fb6f
SHA1 c5b015c6ffe17c922a95297450e696de78a40863
SHA512 70bce5c4ec3bf79069d51b0ca2cda9e4da9ec2a273973bad2576d41f04be60530be303fcd278724885cae158a19203bb65f31fb4e6a6ff66499ddb6af29faa12
SSDEEP 384:zeiFiZcI638Nu8TUNTUlIxBQnhxLWTtzTfoBu9D+sfdXVKLsa+VYh0gL/7Iz5o0:JFQ63Vwg2hM9UBSKatVKLhgh3
TLSH
T1EAC23A32ECA4D9ABF8EB8ED9A78A7613EEF04153949C9AD4D9D85D1C008719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a119d9f-5607-4d85-8ad6-f7d6c6b23aa7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a119d9f-5607-4d85-8ad6-f7d6c6b23aa7.tmp
Size 25KB
SHA256 0e6815412dd7a95ffef84ef143161a5c85b9af8652c7e76c97826c79885528d4
MD5 3143d17e7de3f2910583ba221f18687a
SHA1 43212b6326c9c7ae3162045e09bec9f56fc42a0b
SHA512 7a2e3ef11168a6116261462b222af0a306507c76eb35f99687265ebed25fa5bb1ff0aba4a2bf9d83268ca0f813a429b8438f5170837a89b7f965c8f8dcdb6c50
SSDEEP 384:z3iFiZcI638NZ8TUNTUlIxBQnhxqClitzTfoBu9D+sWtsa+VYh0gL/7Iz5o0:GFQ63Owg2hll8UBSKfthgh3
TLSH
T176C25B32EC94C9BBECEA8ED9AB8A7602EDF04153959C9AD4D5DC5D1C00DB19D130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dce5c4f1-575e-4515-b49e-9cce93b4e52d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\dce5c4f1-575e-4515-b49e-9cce93b4e52d.tmp
Size 105KB
SHA256 70186446beefb5f52a8af72dc666f019127ca772ab346b24c242d8d83b3dbd41
MD5 8d16574ea95ad59e658fb6fff1145f82
SHA1 42a86208229e0acc976e3871eed70b257d3c129f
SHA512 ebf403f83599040727e9e64202ac06775ca09653730607a6ba8c761b4cae67d1081bcafb880105f893dabfba290a649f0680da526b9ba72be3a3764ea147eb6e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83eeb6fb69147b86d59db93f6bef3b9700e1a01b1e16b7737138a14705b925ec
MD5 1261625a6979743cb430cc1e4a6c87ca
SHA1 3447cdabba89527c05d21de5b837debaa8dddd5d
SHA512 81eea7d5abc59ff723b0b7dcf56140c4ca4b98afc852eb03d6c02eb17e7ee2a4ed4c221a99cd4babf2c7e6721d787537a34f58357037ab616e168d5434558f41
TLSH
T13DD02B80ACD56104C0031437006161103F9894440906E012D0C0027E09C5AD30755062
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d06c655b2480a29ad334636f95a35c5bdce83a66295adea08a8856dcd298e39e
MD5 5dab4062f87d6ffd5dbc44ebf48fd8c6
SHA1 bffdeffc524afddf1ff9a0fbcfae676c4de6a3ac
SHA512 df19db1241309a372c6eeb5a332eb1a5cf13caf28f98f4b9727e26379c541aea8e4d6c5acea40f3adbe049e1527b086f83b2d59149638912f8c9f6d02fd77d74
TLSH
T15ED02B84A8D97104C0131437002161103F8898440906E012D0C0027E0985AD30355062
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23c0c8725265dc38d2585d79464cd2555edaf25d784e2ab6029faf34bdea2dea
MD5 113ce15722a691d6f3892a26aa5a3c3b
SHA1 8d04ac93654e4ce7e89abe2dcbcdf9f598574f17
SHA512 5f9956e906191837370644e431878c6ea7d621d81fa8aed8db6c53cfcda126665a3c6bbf6905a967717159798ffde26df324c7de763b82b79a14f118e03c4ea0
TLSH
T1A3D0C0005CF976E4D032103F013010003FCC544307026106E080003E0D941C306918F3
MD5 SHA1 SHA512 TLSH

Submit Download

2b8cd386-a494-4974-b272-275de7f10ee0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b8cd386-a494-4974-b272-275de7f10ee0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2c518978-1d20-4d88-8325-e3e27c1dcc81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c518978-1d20-4d88-8325-e3e27c1dcc81.tmp
Size 33KB
SHA256 7a77bab0f3a63c0c90df7e4775c392c666f158d5af941b2154b96b89790ada25
MD5 f90de8a6bb0ab048d1232f6442325b4e
SHA1 aaf08cc89c2ff7d8109e4702ba35eb3dd4c188c9
SHA512 17636c43206d5cc6837ff499eaaba1ae22e9793c30ef3a1dd082e011e765cd819a41dcee4a298c2f6adb518ff121e00dac1e203b9d696fbe2ba8e564697992d3
SSDEEP 768:WJ6E28xO2dF7pLuLMV5WRmp3QX/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3kC8sLl8:WJ6E28xO2dTEMV5WRmp3QX/u1jaKkC8X
TLSH
T1FFF20A7B380CCB7E4FC04A9DDD667F9A6DA8028B9698C94047F9885C02C7BEE51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

549d05ce-92be-4314-a988-c766b6213fc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\549d05ce-92be-4314-a988-c766b6213fc2.tmp
Size 13KB
SHA256 da127eec2c92399b61d369f4b13f366060614d1369f5c19d8b1263e8530fe14e
MD5 72c55129793b7fd6bfa9a61ca71ae3dd
SHA1 fe75391f56c3ad4f9496d26221ee134adf54e10f
SHA512 c1aa0d1791295d6eeecb2838c8102a40852926c5c1a130b4e4b7c12c4b86d3cfdb44081a60e98dfcb8887522ed650d5c7de3107abb67d1f7cf27aa56ae7673cd
SSDEEP 192:sxZiR0cZ/f9suWpVsQ705sGUQQbsf7zodprb/W6+WNZ6SQ/Y0VQwRpIgZ4J:sxZiRZ/f9suWvs35sdZNP/bS/5LXZc
TLSH
T16252E715AD24A83B9CD7E21DFB56BF53D2F9153290D11E44AAFC8A1C11EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 39KB
SHA256 056e4e2459f57a0033c8c9c844ff19d6e42ac8602027803d4345823bcc939818
MD5 d28498895ed7050c37c94ddd026a4670
SHA1 6148594dc0d91d9285222f8ff1349f5aed19d8a9
SHA512 3f24ada81c8494d3c1b0738f68c3131af4e91a583613d65c9d97e7664dc19966c1462cdf4a752e9c3c4a2113513ca20651719d03a602cc89f61fca65e324c504
SSDEEP 768:WnQ4J2P+oyj4PpKH1tsFxgaBmrSAE71AzkPzBOgLtXrVvJ:Wnbs+rj4ICfdYXE7u4PtOWLJ
TLSH
T1E103020E8A613D4DF74C253EA89E52DCEC4CF98DDCBACE4D902B5117CA8A9B1B141467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 26KB
SHA256 887afac83f47c93f25c721fead152d0c5572b9830bdd219d33b03143269820bc
MD5 73f96a07957d1cab487c79363d7baa04
SHA1 8761ac05ba5c615f3df9bf1b276b2500304ebf00
SHA512 4b3181b1eef0f662658d69c503f5553ee8023564940e79ebb0c2085dce38eafc121646dc3425b265a0ef91cf3745675594439766e5c3531582df134863fb7642
SSDEEP 768:neeC8WWlDiZ0Y7rfmau7VGOgWSbl7e1+ePQSML:neeyN7zmLUOgWSle1+AQSML
TLSH
T1B1C2F16A55CD10CD5F5A0D58CFA2EC34F29AE04CDC7D12FCD5AD0F82264E7686BE8191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 22KB
SHA256 bb3ef7e3f7359a355816dde70353e6b9c07b12f78900e7ec9ad27cdb9f889c42
MD5 ca0d340ed148626ed7c73cd15c635891
SHA1 a065d718f6fbe3934963b754f269e8f1cfae6725
SHA512 e7897604c1cd021ec57f64cd7d7692a6ad392f21aa7aa6d81afb94931b96dc4dfce672d2d1b691bd4543275ad56fb8cc9d31eb87e4b697186f3bce40272f02a5
SSDEEP 384:sQORX5IbeulZeKZ9XhCiehdgYmOs0WMZos/GtWu9/O38vYtDA:sQO0bsKXhCirYVs0WG7/GcA5vD
TLSH
T11DA2D067C6103BF4DD53F46CAA38676D729AD34A6B6A344C458E1C335BA6CA01C934E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 16KB
SHA256 f1283cb593b107bcbe40b6d5f7a086cd838d44ff7f700af9d7460f8cff8420de
MD5 4e84e29a4ba480d5c11534cf7bc93765
SHA1 ed92821888b7bb21b9678aaeefd52736b00c353b
SHA512 0bf841e6707d89d8c97af01cfafc05abbaa90396a25255296d4f2c2eb8e31a5cc043d673d919140041ba3091251dc321848fb34d6535a26664f71e024acdc09c
SSDEEP 384:vw9hu5TwpzaV1LSuqT5WGKH2biNNhxmFA/ymG+U3RlB+9vVtY1C:vQY2pmbmua5W5WbrFA/ymHUhCBVtcC
TLSH
T19D72D0925F8882E6E19C8C6119AB56A17DE95D6AC87D22BD250F3447C0B4D0CF411FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 28KB
SHA256 cd05236dd194331bc87eb503d0bbe961f089ed565ddd64550305c60446ba14af
MD5 b2279ba610790c5a92950bc065d3f520
SHA1 5ef576f3974dcb15ad9207eded64604abce80258
SHA512 ad411c465341840c25876857b8b621c290778d5f224076c6d42ecd4a70d11a2f939490c1669abc51226d7307359e8a6d6dc2e6db0a7df3977a22dc2f0ff1a4d2
SSDEEP 768:oMywt9UJBee+XNB13BnP7KjUkFjjhqbDoMkG4VlRd:oMZ9v5PWjUktIDq9d
TLSH
T1FED2E1495E04BF26155D026EB4ACEFFB2C910BC6E1D755F6C184AE76B910B086718D83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 41KB
SHA256 e0aaeb9db306b565f8c017b94f0d780dea7ae30fac71ece698b5ad383795cb8f
MD5 cdf72de3bd36e95fd650ad6a68152424
SHA1 3f77159c36698a798dcfac5b1a3168dfd3024a53
SHA512 5fc39e3a5c67136b0dc25e794b29a9a7deacea922ee879235c3ecad90750a42bca330ac5c132ebd2b88b372cf6ee3c23de514e77011fe1466a06e484bdff84c3
SSDEEP 768:PGBIQmoeDm6fUP6Fa62sh/aJKCJv5BeRRxtvADYKwmas8/zBLxGeca3:PP20fUyoEUpF6xBOnJsBlGeh
TLSH
T1AE13F170DD5BB3B2E2E95274A516A5ED878EF1B6CEB4B5DE0ED4CFD10548AC0B010272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 59KB
SHA256 0c6aca31b2e4692b6ce777360194ca49ea204b9f7231b132ea8d788fb3b45a36
MD5 c600427c0a891aeb3f52d1845b9337f5
SHA1 4b02e2477ef2572a86c841b29a70eaa6a1f94e8a
SHA512 006f27793c62ddf31998486cd6920159cc194b156ed1f3602f64058cfd6f1fca303c13e68914a0e683f8910f72e1cd083f15ee8a2d48a12fb33b047c3ee9302e
SSDEEP 1536:PtBMm2mlmOeRXH/9q7fKmORll7nxzrg25B1SJt/k/Ml1Qr97:nTDkqzK3PNxdje/bbQJ7
TLSH
T15E43F2BB326883033AF7A0F957B35FA3337113617DCD1BE015DA9CBA5A600969E10656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 03fdf6ae868a02b1d3cb099dd1f2913f5cb6f2de9d019c9af0787f78fec61774
MD5 af74c6f75785adb68a086957223e2599
SHA1 606e0b18568326e9cc34265361d04513e3bd1862
SHA512 28db24bc643dad65305fb4471506ec155e4c7636bd179a2df1638bb7fbbc3cab6fe2f6fed15315795d1f4ee12e7b5411f061541f998d2d0c4c5cfb8c3a1a2060
SSDEEP 48:bIKJ20P8QTsjGGg0ELFtFTaJ67zF3DcaolNjZyRNG6u63avyOu3E1vxHVydlCnrr:M420PBTgTSZTaYNYaNHF3ak4vtVyCH
TLSH
T120816E8D844085D2FB9841BB95DE268737F3B8CDB983BD4381AAEDFA7D023E16024084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 af0aa33e1d75dc6bf36afa8862354b6ccefecb957b3d59fb55498eba9919b581
MD5 6ce64c32dba1a96e64cee13760f8a5ee
SHA1 74355ecba37cb802fa86690c8c2160bb8e6bd416
SHA512 69072d0a3c4b9ffaea91ce38d5d70a0f0ce262e54f5b0f7eb16193e4c08772871c48f11c75e37d748a0e450e246652f0cd4f313730bc88272f0198452a03ccf1
TLSH
T1A051528D145081E6EBA850BF55EE228B77F239CD79839D0216FBFCF978173E15104084
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

9ae8ebeb-f1f3-42f6-9098-3dc0cf83ebb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9ae8ebeb-f1f3-42f6-9098-3dc0cf83ebb6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 e6cb971ff47d33ae0c637358747fb3eee0867aa1b37aaf18c292a417a96d7757
MD5 0fc81be16a74458672db1c47dc412a77
SHA1 a39eea1a48ae979ca35adb3c890f5d9d7255e616
SHA512 f39f4349b51902787d2bd7f72d00c9bf545d84ff15b95c58a16db2edb6b1cf6fd8a869eec92b7ecc72d53b3741bd0c99818ed0cee7cbb6a6c1f86ce37e3dd204
SSDEEP 96:UBCxNX2EomNnNmGG0PuZYzhycm5e9VWxMPegVEOeI:GaNXtJNcaaY4cTK2eQEk
TLSH
T188B2F68F8D757801EB002EBA123368B8DD7BD17CAF929C917E5410919CF517E90328AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 6a87092238d4be5207c62c4cdda56a609272fc0346cfa9bded958ceb3a5bf55e
MD5 8d513ee8163a007e61072a03c6d49b81
SHA1 8c5174ad0dd01e1c9569cd4409bc75a2d307ae4f
SHA512 f401345e49d1fb0ac9f8c854d75e56c51066ac4efcd4b662712d0ec88b990c7fff4fc8ab304bd962d7f5097bf4769aa37f91e9f853f53a3b6484b20845f724b8
SSDEEP 96:8qOmZTHU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jXUEbjBHMsDETT:x0+G83uxXBBK31GkSJlEJH7DNspUy
TLSH
T16D14204F5F742712CDBD413668E644A39D7DF03FCB5366DA68A104B0CEE3756A02C8AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af943a0b-47c6-4514-a592-60e1e97f6b2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\af943a0b-47c6-4514-a592-60e1e97f6b2d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c2c1f0e4-6c2e-4161-ae50-988206ed034e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c2c1f0e4-6c2e-4161-ae50-988206ed034e.tmp
Size 1KB
SHA256 4b51b07e34e31cacb08da645a10ae97568a1eb654d93e536db881711e3d66239
MD5 3f64aa0434f98075d26e288354f0bb93
SHA1 c6e1ac3f55d24f65552c0f5b308a218ccde30702
SHA512 620bf86a7c565609d478c12fa19c5a4c12032903380e5740efa28d2dac6165fc4efc20d8f3fd23784e72d735a2bf4922ca83762fa3a69240324adf91ae9ff259
TLSH
T1BE419DF74774856E9A0195F0AB18AE2FCF6D0424476C78EA85E0BE6783F34B2E14174B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 5ddc423c4988ba0bb7b7a0c10110d5b316926d613b38bacd7ec637bb12ee80b6
MD5 517045cd84ab362b8478561e56c654b5
SHA1 9c3bc1673de6589d92d35f278956b6e09a5683ea
SHA512 95efefdb5075d741f640f7759b53bc6de9dcadb46357bea11725c4f2604174782cd761f27c6b02a0d0a19ec118cff56fd6ad230d380ee25c9c5519effab1add1
TLSH
T12AE0805076DDC23F71ED208303B9971C9FE4B41BD6C63E552F44C9C49146546F592961
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 3cda02a8c21f33be0f819fe043c0087b12c00c4acf2e976d04f6bd5f95ef67f5
MD5 75aabb51e4e5a4025269461ddc3e7f2f
SHA1 f6146d8bc6a3419c6311a876144d91e0d026fc2f
SHA512 485ec2e7a45c92c14239716dce9acddb3ad3787fcf5ec544ad8755109933e8b30d6c17ce65bfd8f24e33bf06a3664b8027368efecd2daa24f9a6c52de631398f
TLSH
T1C8E0486076DDC32F71E924D70379E30C8FA6B856DBCA3E753B08D580620E5457253961
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 2b15192d37f26d20f982d09db5c52525df935177f53915fe0123c2aaa5c62b34
MD5 bdb4c6233aeb0a63a050ea063ebe4350
SHA1 7e66ae0354a03f96009c55c72f7802a75b5a6c54
SHA512 24ea36e4bd687dedbbf99387340aaf03be679c668fcf717e1bbffdf6b907df05f2e4fe02c3cfea1e75012f06d538706deed09ef3b7f73c83a689eff78261a05a
TLSH
T15AE0D870B6C4C33F60E460860378A7298FA0E81AD7833E656F0C8440654150172659B1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 03e7e9579bf1d2ecf4037474dbc90a810d589be78e69a5ee16584dbdbcbd8a0c
MD5 e7d961461845e2bd404ed84f511cde5b
SHA1 1d04f3aa61ee6ac01eac5d90a2288b9bbcb2ffd2
SHA512 a80d8d118a0d87f3e6d7b88e8cb1749b1ef1bd65977f1d42a7a0202976e45ec8ca67d1aa453a5fc27ca6ff685fff4cde5f7f96d42f284d66b1c4a638184e3c58
SSDEEP 96:KYlWKmcrGr2KosTUwK5e6SmIKT64ygKHK2qOcKjKIrSK4oiOHCKIUzj+fzptB0BC:80Z/jH0TnaJxzh/Mrzcp3wHbc5BF
TLSH
T130B2221131BA12053CBE290D85B49B2F564232B37159EA3B7FBD00B68E6BE441DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6d16754-a096-44ce-af6d-05dd309c7969.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6d16754-a096-44ce-af6d-05dd309c7969.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 bf310059e3557d7b9501892836be2390891acdc0fa02c4f08a78fa9e4078238f
MD5 228a9bbd48e024b012c7703b4fd776f7
SHA1 17958ef4ecd10bc463915295d5d40db45d5929ca
SHA512 1de91af94a5128ee5c2f43c3f97e041ba8b2356e472b6275ee96bc93868387e1d61d88670a8774484666fa55fd3089602aa831955dbb562c5967e74dcc1b35ee
SSDEEP 384:z4iFRZcI28Nq8TUNTUlIRQQnhx8WitzTfoBu9D+sfdXVUxowT+owUPxswgL/7Izr:vF52Fwg5hb8UBSKatVUnT+owUPqVu
TLSH
T196D2063E9C64C97FA8EEBB98564D6612DDE04233D5B896D8D7C80F0C80B649DF30B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b6d8cc48ba74f47cdadcfb281dcae9835130a1edc24e999eea7b290a356220d5
MD5 fea5237903d904dd15fb850eb976f1d1
SHA1 5b4c563ccf5adf2087dea2a07edccc59968fa7cc
SHA512 2e009d923d5e543ad4a10c2de8ed331965d27406e7e6eed54dc7e39b3b0092b475e9fd1baa322e84900e81d392c3a7e4df78b6f7f2ff84105812d8b1ece8e755
SSDEEP 3:MsEllllkEthXllkl2zEfleV7l:/M/xT02zrFl
TLSH
T1424404047FC01405C51010304057C3501370D51015175F437DD144335CC75504D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\activity-stream.contile.json
Size 4KB
SHA256 5a19a38321d1525e3048f1a5bdabd7482641270dd1c0928076e4a43e907c699e
MD5 b23575a16c4f17a3e54c1d5f0e9e273a
SHA1 385afdd1558e21f42653651bad1256a56ea0d510
SHA512 8f77776c0c6a8a69d4e0b03722d4f6e216a89636b5ddaf72e75d7cf27c607f9d4b12321331df5bbcfca025393cc2a31cd39ce377ee1dfc9cfe0d7a41a78958b1
SSDEEP 96:T49ai8Ma97DamK9AireyST+mR/fnyx9iisIGwElz:y8MIa1reyvmR/fyhsIGwEF
TLSH
T10EA1D7BF85B184161B31F6D95C4B239CF0237006D9F0DF7C7ABA8D9141A87AE80CA989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 2ce1d0659e0eff9228dce9068d59f9ceeef384d5a4af91cea1a6e5b17d9c4f73
MD5 c02d9e9ba9cff77377c90838898c3f0f
SHA1 0ea532e03cc4282dd2f6ef0c10fa46909afb19cc
SHA512 2bf2c4b6ecd0cddd12ed3650fd526422f16f2ffea0ec845f045c54c13ab1ed5408e505a2ce28392c5f5dbc5510627226c93a1028a13bcc7b6e32dc487947d737
SSDEEP 768:Uy5/ym8KGn6AybQJiW851bWOOhdpSOOrdfS3qiCLsVg2:P5/rRAybQJT0gOO3p+fS3gA
TLSH
T1127309A3A7E8B1BB1B9037CB1C0F79AB61D14256E34606CCFDE9C91C81CD754123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 fffa497529d7f829679d5074efcd26efde1bd333b626219c896b7c6f58aba464
MD5 dc82190c5c2ab3c8608e68fb09ee8a8b
SHA1 541bac42217b461a835596c13e99ba8ca99e9a3c
SHA512 0697319584cddef0062b8e16bad773348d304146fe42c05a50367d35c977c97c71cb70dfda81e4a8cc6a24e6902cdd1b03cf2977a9df3b3848fadf982f89e3e1
SSDEEP 768:UyrfxVvnTIhUZ+gMA6FXWgkYRLuaPnoYQosP84/UN2s3UAGxpxuGskwqMU:P7xVWgMA6FXKYRDPnbw84/UN2sOrYu
TLSH
T1FA7319A3A3E9B1BF1F9137CB1C0FB99B62D24199E34605C9EDE9CA1C90C9650113B5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

12866

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\cache2\doomed\12866
Size 7KB
SHA256 cc02bb115dab013b559c426ce2e0d2e3c3b79b47e3fbcef5479f51e1f093836e
MD5 fe240446b9f5ff08a8f8d7d1a261446b
SHA1 5c0d1e646e3702747d6bb49490486ab8e09482f3
SHA512 233d06487583764f6e51c0e7be697153b826601b87ea663a53b1a335647269cb69b8c173a9e07457d69199a8d2a14c331e34c7eef827c6d376fe0ad2eb47df75
SSDEEP 96:CH1utoRgbxV3pkYctoRgbxV3SivjCfgp+fY3G1bmwgGLxnbmwgGLxMi31:6Rg7C0Rg7CWXp+fY3O+Oxn+OxMo1
TLSH
T1CFF16C3F8D0935050ADA4AD2C04A274E6C51F607ECCBDDEFE2882352DDC82B4A76D19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21678

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\cache2\doomed\21678
Size 52B
SHA256 34b0c021b790e8e73042be93eef21cfeb6957b018e37344ed0c03f4a8ffb451b
MD5 fbf39e32c063b0e01c6dc06ec042b69f
SHA1 7a2554fbe6f686364ff3187ccbad55166335e3f3
SHA512 6a3c7674eaaea8076e557a6ccbe4384e66bcfc1e7f546cf8a1213dad78c33f2b3b97658840c5a087fad861518b414a84c9abe8b3bf385c30dd06e525a3ce11b4
TLSH
T19690024442E2894AD15AA471080081F815107E01EC81431235D5075208151E30805200
MD5 SHA1 SHA512 TLSH

Submit Download

8810

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\cache2\doomed\8810
Size 7KB
SHA256 072104a5407c0d8c00496343a3dde6dc8a938c8c908c6d28a2daa75a32f606c0
MD5 187a40d345a97fa1f71ac29bdfeff600
SHA1 712431ab55184e1ea590e3e61f14f92dd8db95e2
SHA512 cdd59602493427c0eb60dfa531ae76e319e7629c2fbde3a636f3d811602960d88a86e31afcde6f32f035c5f6853d3cdbcdf18f2777e2908acfc1eb858d3c839c
SSDEEP 192:S7g6O3wLu9MOtvNaluMP+m65e3uOCCdjI:SbOOVf349
TLSH
T1C8F16C3F5A2D2E2589F36083CC9F9B483D14B183CE8194FC7C642506DEC8666DCB19D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

733849FFDF119F55FC621850508A6E493C2FEC79

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\cache2\entries\733849FFDF119F55FC621850508A6E493C2FEC79
Size 353KB
SHA256 745111e3c1cf4c11856768ddc53e3d06a66ce347da76377bf59d7339312e9014
MD5 3c873277750080fb1edf0e8df52297e6
SHA1 1b62c0af8339fc28f3843e9cb19ba9589bf9d6d7
SHA512 583c5a220bf3240e698c815e52e91d42c139c4deee81c4b77fa6ca469e018c0374595f220c55b25c79cc50b0c6da5139b01697d07be1b43f7fa653250bb14daa
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqG:ktLWrGDdlMBhSoAxU033ScoNFWMmgnE9
TLSH
T12774231B2E0DC93227834796903E391889009A1B4FCF66D51B6847E8853CAFBADF51CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 81a222e81410e570759cf9ca220379b602cdfae3ca775993f0746af3fb8e6db6
MD5 4919bfce50bd3c9813c849f9fa4c6216
SHA1 0fdc1887e763081aab431fe32cb390e51808291e
SHA512 eed9b0e31f7ed78a8d7fe888ca9f125e011e53836933d14a7573257bf2fc5d0a3fb6a2c7d5c856a3ed9b51ade652fd75d35caf87fb2bdce7d19cae51e6d1e6e8
SSDEEP 384:HGNQiO024YUWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAb:mDZYUWTToXJWTTogB7S/AmVAf+hRMK
TLSH
T105729E3D8F013CAD2B1780E9C8B583588D18B6E7DFF2C06D269C3D09C984A1A71FA44E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 7821744ceb2092e6ab556f6bcda1fe30b5c2fb2b52ac22003628b2030da26fb0
MD5 b0814a9e747a473acdb2914c56603ca5
SHA1 d0bf0a69dff66960788c70bcb0d9d195bd4a4ddd
SHA512 652cfbfd4bebb7be956f67a027b7baa8d7725d47688f783f6c93a4a456d38e92442f374e5ba3ba375f183465b5f0c68105153a7e77f1b3ffe1a4543cd499e689
SSDEEP 3072:j3lhmmOx6rMUZFlD7qyyVzr8v/gyVvB6o2vF9MK0:ph664WFlD7lylmPVvco2vHMK0
TLSH
T12DB3AEF7DBA28A7D65FFD42D6692C43EFD262400B3A33009C9532754A2C6BB87375648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 d8d8d21ba8dd2ddad3d350a6bbf433ce88cf692960da22a4292cfc5621234b6c
MD5 494e0d4dab622a1cd2951dcb65fcf9d3
SHA1 fb4ebf2e2a5abc2013a7b3bcbe6f5013fe09ed2b
SHA512 afe6ccf3744ad58d7aed8fcfd970dad4b17776ba5c53739a938f5b7c44e45ab80b02bf4ea640a75e754f8c9d4e883ccdd451c2f78857191987dd05b77c870ffd
SSDEEP 3072:X3lhmmOx5jFpaokX2ALr3y8v/gyVvB6o2vF9MKM:Fh65JQokX7LmmPVvco2vHMKM
TLSH
T1A4B3AEF7CFA28A7965FFD42D6682C43EFD262410B3A73009C9532750A2C6BB87775648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.cat

Path C:\Users\Admin\AppData\Local\Temp\{55C4D~1\ovpn-dco.cat
Size 11KB
SHA256 fd66051a004582a47190503e67c4d2ad67e1312ea8b166536a04f3999f6b7be2
MD5 3b2081410b8c42085a40fad73780d4d8
SHA1 a55f58c377712bcf5367de708c661bcb892aeaf3
SHA512 f5a4e1d6b7a2b67ada6d67f7b9aaaaa49594f5dd66314927f73bd95a8864acbec26fbb1e638505224bcd5833f62e45d54f23ab52cfc2deaadf3fcfe88a6ada2f
SSDEEP 192:CuFTN6maJCHpPXWEwGJhYCKSUHWX01k9z3Az3E+QlHnr7:Ce2spP3h3/jR9zmAlHr7
TLSH
T1EE323BE2549C81C2DD87BC6053E8E8477C3E37CB581059A922DBF6195DA73C4FB2826E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.sys

Path C:\Users\Admin\AppData\Local\Temp\{55C4D~1\ovpn-dco.sys
Size 143KB
SHA256 4c677a57efbd2cbe40a9c29235446a8c2eaa0a4e32f648c7f195e0e660495392
MD5 499bffff683abdf3df9d06d468c39f34
SHA1 7a93d22428b068350070b7f6c19b12c639b8afeb
SHA512 cfe1c72e32eea59e61d471f7e411f408676367ba6a2c20654606531ca2b8ffc792b39584b401834b33bdd5255120c5a71bcf4a10cbbc1e57fb434a0a52386038
SSDEEP 3072:5+H8w0ndII2ZwfjXC9HJfFXwd1S2AxZox:5+Hm/2ZwbSTMA27
TLSH
T122E32975A5D010D4E43BD1B89AB64E41BFB0BA523F3295EF05008AA80F36BD8FE39755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tap0901.cat

Path C:\Users\Admin\AppData\Local\Temp\{90BCC~1\tap0901.cat
Size 11KB
SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
MD5 71ecece58bb00bdc1e728ee28d7a5332
SHA1 4305889415cf95662a30d024f1138f1af224cf42
SHA512 9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
SSDEEP 192:HxDuDjbfXJCKnEwKUNhYCy1QySaI8HNsAX01k9z3Aqcp9wdGEC:CXaUNh3auatHNsAR9zWZEC
TLSH
T1FF322AA2942C52C3ECABBC7043D4E9977C3E2BCB1950506A269FF7141DA73C8EB1516E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tap0901.sys

Path C:\Users\Admin\AppData\Local\Temp\{90BCC~1\tap0901.sys
Size 40KB
SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
MD5 1bb9772a05517e227d1dafd3936e8f66
SHA1 d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
SHA512 3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
SSDEEP 768:EGvByM5JLLvslmdu9lsECPURPNkilzdCH3C9zySb:EfM7VE88fkilzdCHOzySb
TLSH
T112038DD16AA814D1E8AA9874C7EBCE43F7B5B1430311AAEF0764D6691F23BD05637328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OemVista.inf

Path C:\Users\Admin\AppData\Local\Temp\{90bcc2bb-7245-3c4a-b42a-90c1e6f1e530}\OemVista.inf
Size 7KB
SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
MD5 6f5ffb58a9e406ab1643c890e2a198c6
SHA1 3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
SHA512 af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
SSDEEP 192:wr8tW9yCTi314vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGBdkkzo3DcNSj6jvKFkPs7EQTXvtk
TLSH
T1F9F150681C83EE3A31FEE58557565EC7E24611823A172800355CFC549BBDD9FE33C92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\AlternateServices.bin
Size 17KB
SHA256 539aa766a1354b266242f4584c3f47e51e695c9e44f702f80a323f7a736c8fff
MD5 c46dbaa91760265838e9cb22d64895b8
SHA1 c3178afa79240d03566c95a069028beed95ddf89
SHA512 3300c636ab96e3faad5e0658e6a687e576a6701d199341453afb0b51dfd83a3d6ee3115ff0044d998386d4cae7af97cb0db7fc018676bc4ab54499683112f0de
SSDEEP 96:aWbWj4OYSUAOWxBz0I56g5J1t7XCM/p/kGDyx2b:plQB22
TLSH
T1FF8263F72FB26463F0928FB0806D748D9C730729586EE184C65590E712C2AA6917EF7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\AlternateServices.bin
Size 11KB
SHA256 2ce703275a2d59b1231c2f3c3b8ff100795f2fa570aa5989cdd10838285be90f
MD5 11fae8f0fbca143bb4993bd6b0b7b98e
SHA1 d144f3fbdbb29eb93bbea844ec01629cbe7b8e27
SHA512 e381b9efeba50b12af3bc5cf0f54bdf151d54df0674b694d62a1a6a3fee68e95d45ca28b80308903a2a1fed2ff41a0e71bca6a255520589596fd92829abdeae2
SSDEEP 24:jPuhMZYLqZqWVjqAWAq+lzsX91dw9BUq9xWK9VvYp5q9F55A5n7K9lg:pgWYAWj4Ef6GIUoBYXI56n7oO
TLSH
T1DD3295F72BB3A062F4968FB0805D748D9C330729496DD1C0D75190E302C2AA6907EF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\addonStartup.json.lz4
Size 4KB
SHA256 5f70a988f10ffa2706a941f9ddae0840253b49b70272005ade07ed2a1c1cdd79
MD5 3e7923d75c1a893f7320701eef254a1b
SHA1 973861ff3eaec93d1c88e2f7309f4734e3579102
SHA512 931db80eb887678ac4650d0d1a67dcad4a2c6462b627e1b090a863a3f1555b416d5b6e1ecb94adbd963fde74664b7601d27e9090cfebdf0cfffa421d78d8d3ec
SSDEEP 96:NT84sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:N352xxhD8rGvm6ApwnHUuhN
TLSH
T156A16CAAD145EFA1FD32C04358E97FB2E6DAAB7410A9C4D4F1AE71290D64A735705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\broadcast-listeners.json
Size 221B
SHA256 49bce944f28e356ebbf5da7010c7bab101c51cb742494561a010cabc8480f80c
MD5 02eba8a68cf071c1228ef3c7c2ee46cd
SHA1 d9e5188eddf5abccba807a5863dd3f1ada78b209
SHA512 c1684802e6ee35a196f6a11a0e487c193beca0b695dc7da8ac5e1cc31e4825a48257b969248267539b672d76815b378708952c034b8f7cafed9610eb85d6b183
TLSH
T17FD0220E25237CBF4B89B72DF00427C60B9A20093270903DC3AE25540A3FAEC40081E0
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\db\data.safe.tmp
Size 46KB
SHA256 8ce2edc0edd92a81b9f12de0b0ec1de2a8d7034141ff69be8b326359edd4e29e
MD5 be7870ce2ed7f8644d444d5a4b988916
SHA1 ef33a6ea6a269b669dcf9139bf55d13e5bd455a1
SHA512 0133688ad2da59a44070c5b4ed8c1ae30e70dcc5372bbdc91bc143dc7e98273713d432a8c7b430c084c5706efcad929413f9f1615ad3932fdb0685662e3b8670
SSDEEP 768:BmwNk/yIWDGcmhu9XxGXKq8HkNnEy53EIL0SbSbBbKbmbpbEbsb+bnbobubFrvd4:zNk/yIhXDrFD73pygRIam
TLSH
T1FE230144EB1A953FD46802BBDCA21B002F39F88959192FA73A5C54786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 de195910d514b54471583507b01cc620a87d8026f38c62acb54441d188e34cbf
MD5 8648eec85ac4105f9c4ea3ac3f3a4da2
SHA1 10279d93d1c4a41b8221ba3eb9758b93b054580e
SHA512 3ef916a4eb41b2bd5754ccaa9fb77b710381ed3f3a265740a04c3a7387cd30c001be12c7d89bcf58d1bd179c5043728caf7246c5eac69799bfb8b9919f253a3d
SSDEEP 192:pGDOv5zboHgbiSTyjvPA1d66Joz0dzgCl6mc0d:BboAbiGyjad66JozQzgC1j
TLSH
T149D1DB68E728863BC454023BCDA62F800F35399B984E3F1935DC64093D5A3AE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f8fc642c44f6c272e13885a6ba45a278dd3d4c21ce58d8ae8e4438be17fee724
MD5 0db73e0af077d96d29b568bc0c98c2ed
SHA1 7dbce15609ffb96dab4c0386f4cc63224b1d6191
SHA512 90889a7354e7bcc25e483935b574b2f9a33b318f9021974daf6f50ff5d3f141acc42547350ce78f8efb28d22ff7ca65569746ec682fd0a983028660e97d223e3
SSDEEP 192:6GDOv5zboHgZiSTyjvpcf1d66Joz0dzgCl6mc0d:mboAZiGyjsd66JozQzgC1j
TLSH
T1BFE1EDA8E628863BC404037BCDA22F410F39399BD84E3F1935DD61182D5B39E768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 bd41fe9c1af431c37265e6bbc8a43558bbeb765e3a43c53f029416a480b89779
MD5 33e9f6ff45ebf37adf4c16f6c3ea53e1
SHA1 94c61dfb43fab76c7be5c513b0ddb640f16d5ac1
SHA512 9049b1fb28ff2edd395b33cb3ea634f979c01606b97773baac647806e1ec4dfe70bdaeaaf6717e8c8dddb48203ecd4f750a91d992433f3c0deda9aca598d0cdd
SSDEEP 768:pmANk/yIWDGcmhu9XxGXKq8HkNnEy53EIL0SbSbBbKbmbpbEbsb+bnbobubFrvdh:9Nk/yIhXDrFD73pygRIa/X
TLSH
T1A1231044EB1A953FD42802BBDCA21B142F39F88999192FA73A5C54382C872DD3D5E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7e90d70297c3b2300f39ef419cd63b3713dd3e2a9414d1a8b56a62ac12ad20a7
MD5 b135b156dd533b38b342ce03e78089d4
SHA1 13bad75984e63bea3119bc1c2616f60d33c9a1ff
SHA512 348fe74d9747e161f24ad275cc603b2e08707cac8d0c5f74d9787e34c0ef9bf8ebd468bce791354d979bda0c0924084cb5c2600a2ebea4fcdf8561fa957ecb63
SSDEEP 96:cwGDSdF95/7bkW6QXjrcEiSTyUR6vUWZCF72+ysH/dd66Joz0dzgClKtmc0d/UK:HGDOv5zboobiSTyjvPm1d66Joz0dzgC/
TLSH
T160C1AA68F728963BC444423BCDA62F800E35395B985E3F2935DC64093D5A39E7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e551cda86134ea403eb827e72dba5aa4f2cedd4a7b721b3e8dee0d4d30280ef9
MD5 6dc14cebae94dce00c46fb4b28f6911b
SHA1 d9b2e390888daae09cd23617769e9f36ea19d017
SHA512 34cb08fc7e0b123c4aec9744e16f550784114592c1832022031b2826c4d93389172b8738b06bcb1bf0f025999204495c8752ba58c51ddb2184ab5a50da7d335d
TLSH
T1BC21285C3EF94D2E58C6F7AC745212CF57554A0B44871C430D23DF8DCD92A9932AA82D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\events\events
Size 5KB
SHA256 ef20f6244484686f9c9309f95c2f49f70e33af3e734e8c048a6fe5ed5add3af7
MD5 c86729f1f6d5ab0a833f9daf7f8a7e72
SHA1 45b56174fe9ae9672f02865d0080703988e9cd03
SHA512 b9de30397973e5a80321f47bbb4e805fa07e4840022c12cbd43b917dd17207e269dd4b4f523d371cd11acb8088f09fa5ffe2d92ec9ec83ba831ff90f4e659140
SSDEEP 96:MrMeM/P0rmhQIqHl2/z52HR7aHY0bbB49:MrMeM/hhVqHl2t2Sq
TLSH
T1D4B1E11D7ABA0CBF69CBE7ADB44242CD87D9470284871D834CEBCF498C47A59325F529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4789de22-5c0c-4207-a26d-4f2f18d42ce3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\4789de22-5c0c-4207-a26d-4f2f18d42ce3
Size 883B
SHA256 deb556be1f7885f6c7328786222b02e2d69d4ef515aa62b9747f237e3ed4c4f9
MD5 7adf8d7e3b18badab41625744e5f64d4
SHA1 209eb8f29a3d775014313cb01c09469767387c49
SHA512 190305a518894f614cafc308276e7a91e64de244a7960fdb901752218bed4c5437e52ca591ba82cfcfd1ab17118806d56fc2e8a848d02caee27d1ea3626d2ad2
TLSH
T1D8110084D630B9B3DC68921FC5527B824BE4793380CE54083EA999184DAE61FA3A6707
MD5 SHA1 SHA512 TLSH

Submit Download

4b7703f6-6bed-451d-90a1-857c2a3f76ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\4b7703f6-6bed-451d-90a1-857c2a3f76ba
Size 26KB
SHA256 fb3841e5bd322e73ab2df5bbcf9b3af4f6a5191b6deb2a87b48535e108162afe
MD5 bf2238ab9526ca10948173317a1c94af
SHA1 3cc63516321805a8bcf9138f8db349bc2adddbc5
SHA512 8b01435fe02ba1d0cfdda4941e5c5655deefc2e962f6ee85c38b3259c4bb5bf2822698acbb6e6a77ed9c8e5cf31c18793d903f78e882aa8d673141dd351c523c
SSDEEP 768:52tfLxC1JPSQrIh1rh2BSzGHfp5EyZO0xXJVmdI5EBvyZeH7cWQhICCWMQ:JrIcB8MEaxXWI+6tdMQ
TLSH
T1D2C2DAFDCD1240473E65E51AF2E9ADAB2057183209CDC7DD6AFD483A27C69BB1127328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a6f34cb-07a1-498e-9a21-42906de52019

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\9a6f34cb-07a1-498e-9a21-42906de52019
Size 235B
SHA256 e83446881d7aa15b4327b00b3ab9d58834d46ebd3508608cfe421142a168d6b9
MD5 abda827509ed682aa6501af6d4c56489
SHA1 ab416d326e561ad08f0fade1cc725b1193b44d03
SHA512 52fc888a39e99c7b0fb9e58d6ef182c4595ffc48a570063f10a2ae35086553e315ca12e8b0bd0484ab63564f4ff2cda7735f71f56e44f0f2bd4a62539e21d8ff
TLSH
T18AD0978A28A86BAE08040F0EF0F07ACA30484C3310B0A820C9600A3499BAEC8022182A
MD5 SHA1 SHA512 TLSH

Submit Download

af8b174e-8ec1-4988-b28c-7d4b921bede9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\af8b174e-8ec1-4988-b28c-7d4b921bede9
Size 235B
SHA256 c6ef8256f1b70d5eb4423226a089d141213f9ca59a32c0982bc7ffc8edd0b1a7
MD5 ea8643309409a14d992ff2736843da93
SHA1 9d2450ab7f1c68cb596cb648ba6eb6453b6fb7be
SHA512 a48f2d949808995b2b8d99342ee74cd8d2c21edf60d16a084c4704aa2c8069fb06fcb83f701a5d706268456809bc8e1fef32d199110517bd3ef273a8b1d888e7
TLSH
T18FD09780288C677C08000F4BF0E069D630868C3314786890E69085388AFDAC8031293B
MD5 SHA1 SHA512 TLSH

Submit Download

b15078c4-dec0-4d79-89bd-3b699f0f1b60

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\b15078c4-dec0-4d79-89bd-3b699f0f1b60
Size 2KB
SHA256 59d3e7b2fd09a5bbe0c88de3583d51a98a8027d1a9102c20051f6d36d29edaf9
MD5 e7c893d9972d40f29d656418a0ffb289
SHA1 0cf01c8a182f581885371454284179aa82d7ebb1
SHA512 98276c9f4e0fa7a2a7074912d5c02ebb6890a7fe902b39a6c1a7ee65f48e813a3f212a33050d331a8ee1f484e93324337b38e41c740f4da7c88153b2a3face5e
TLSH
T18141215C76F89C779C9AF55D8492338E53A08E1380C63C436E41EE0C8D967AE336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

d1c99a44-2353-4263-b4ee-557e9074f5b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\d1c99a44-2353-4263-b4ee-557e9074f5b6
Size 886B
SHA256 fa58745939d0a8a3ba19da857523aa80575ee8023642f7d320fb0c1b2bc2910a
MD5 8c79c796b43664c13ca3fabde5dd57ec
SHA1 adad7cbf3cf449415d92d5ae90e76450f3f6a278
SHA512 ed2936b3b0338881e363337a198b5572eaa21ce582a7f5e0c3c0182f86048b3a6fe6d936747d68ca8815a11476cc7151fe3ed7b6ea083b876d5881444ae4ec39
TLSH
T18111C050D774B5B2CC78E25FC6917B824BE0753384CE1D183E959A184CEB21F63AAB07
MD5 SHA1 SHA512 TLSH

Submit Download

e8879a72-62bf-463c-a8d6-26a054832ffc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\e8879a72-62bf-463c-a8d6-26a054832ffc
Size 16KB
SHA256 f7f6dd2f79bebe6fd4e293d908ce9e606a256f233b251eee183e40a80cc671b0
MD5 690c53533f6877beefdb3308904565cf
SHA1 35147426c1baa568886d66572d07659721240558
SHA512 4c2325da2ef10be39a1009fce016076689176a8f491ffa2a1fc74729fcfae788e3e92f74d324326243110adb683d2d56fdb9b7c2baa390478775d718bd1bbf82
SSDEEP 192:dxj18eG1Xqv9VdiKReR6Kzibc8RuzrcKu7yMJaoJ3F9hhZllMTfW4axcqzkoNAKc:dxjazSVdiWeR6KWbhR3lUOGf0u
TLSH
T1A472FB562420497E8391E36994F8BFC3D6F528CB8C419FCE9BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\downloads.json
Size 777B
SHA256 f3cc18d4751d98b2eb5aeed5c929bbc8bd36d7b20381ad05e63e326af42f78f4
MD5 5559304df6df459ac729520cccf9c53a
SHA1 be55b69a0ed49a82f81f24df9d3a08ac6a6272af
SHA512 3c3de4e9933f640037d6935fe811b6339437876286a2eb6e6049c5ba90c49c9d156c9561a7994ad4a56ad0b2b453cd641bcc7c44615c6ff168079adafb48721c
TLSH
T1920120760A13CCF4BD844E3513AC7B139E6AA10780E0567CB2C896A0C6E54BD183CC5F
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\extensions.json
Size 14KB
SHA256 395e2ef398ed185d767d14c0a5533caf592c025610e49fb3698701ac4453e160
MD5 c9d8c3f0534c1c7b0cdc0686e3daab50
SHA1 b12cd59e1c69fd8ae7f7c4f646d82610ac8fefe3
SHA512 bcaf3750fadffd231b3c2d21e8789537315c1ec9d68ddf1a2f2cebff33dadcbc52df85c2e1fe15de88960c3d43eb90af4e92418cd3dea82bd903ae16033fa2fb
SSDEEP 384:iBkI4vsUmldvu8dhWj94zF96oI5L4HFL4P6nL4H/L4H8L4HC:9I4URfjXG4H6Dx4F4CL4D424i
TLSH
T1E962422545049EB8294FA79AAA367D01C37D473B70445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\places.sqlite
Size 5.0MB
SHA256 b1966010bd6ab8cb83ce1bc5cc3c7506aecef6929ea6a5dbadbde174d746de63
MD5 83c180cf92fa815ffdbbf163adb1badb
SHA1 4a41a0c34ec3d40ef94baaabd38ddb13da2e4313
SHA512 637599a19b4a38dfe7a9ce51c36e26f09b095b483a4fdcf068fb52f6323aa6c2153ed25ec76d9a771ecfc2558abcb31d899664e12df266b29f2fc940d5256e86
SSDEEP 192:M8rJQaXoMXp0VW9FxWKghSV1icxvJ5mFRgnJEEYT/dH5QdF1NV4mEnm:M8r54w0VW3xWKghSV1icxvvmzgnOEww
TLSH
T1CC36835F7A205192D5DA9231ACE26F09683F711A8936769339D0252D4EF0F27B81CCBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 6KB
SHA256 27b3f5006a4e1c0c3e32f7250f6efed6bb04ce205de3736e7b0d831f2d2f196c
MD5 e541a55fd138d004113df4f433fc18d6
SHA1 713cf7a8dbc94de8cd89ce7f9727fa983206dbd1
SHA512 7175b5f31bd5588ab60ebd1d5465a88effdf712433e4e17ffeb29f0ff4f8efd594a0a6ce901ac6582ad2cf5924d3dc48accb4dcffa002907af4326f1e097862c
SSDEEP 96:xHiUTUJbqGqYxfnkG1zSwNSSlcdv9jAnuRHUuFhBw88H8L4cnAzlQ:A52RYxfnkGBNSS89d/Bw88LQ
TLSH
T15FE13E7895488B7F64B677BCAC6488316AB2013BB7BF28D750B954C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 6KB
SHA256 7b296b815fedd0044834e67da4af175d1d4a364a15c55516b4f1580ade3e9fe4
MD5 0fe1b665664606c9fcdbf18c893a88f2
SHA1 d0a0aee9b7c2ccb340d5d7ec173d156368e7a047
SHA512 9cbdd7b455f033d33aeeca46cdc0c7f42ace06dd85e96c1e79fd26579ecb5c417cfa7254a4eadf66b96bfaa37364729f72de90f655c1421fe49fc1615dd67b0a
SSDEEP 96:xHiUTUJbqGqYxfneF1zSMBFSSlcdv9jAnuRHUuFhBw88H8L4cnAzlQ:A52RYxfneFpjSS89d/Bw88LQ
TLSH
T15FE13F7890488B7F64B6777CAC648C316AB2013BB7BF28D750B95885051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 12KB
SHA256 aa42157dc5624589d11338992c4af5d071a7ae52581a1adc6f46843fd741b89c
MD5 c006bf5a6d6edae8cc25882355c2673a
SHA1 a80956a9f6619fb050a98ce284a8ec62edd870c8
SHA512 1ed2d0c5c6948145aac66b6a9544f28d0ab2e2474391b8b968c7ecf5aecb9051454f7efc4d5fdc4ae4ade5047d087caa5bc49aa24122ff9a2e4cbb1da9ff4eab
SSDEEP 192:xCeCRYxfMkGFNSSTXLR7CO77OBw88tqamHQfH3:LyR7CO7wwY0P
TLSH
T19142EF3C62528B3F24F2727D6C2549B01AA102277A7FBCD745F985D2094EF2442E7AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 7KB
SHA256 c2dc5e092a63ad287e97fbf67b41741a470e5bf0a466f6dbc315ba14fe5c419b
MD5 a8aedef81fbdd85f9b8aa6c279e3fa21
SHA1 0b6f62f1832f15e9a1c62fc773b0da825ea72d1d
SHA512 faea6d748b25e661a4b0ef3f441483124d1b5c7f3f78321bbf3a9db012146cbcfeeb777c3b265458c5814f6a4978cf350404b629d102f0788c334f08d8416fa2
SSDEEP 96:xHiUTUJbqGqYxfnkGObzSwNSSlcdv9jtnuRHUuFhBw88H8L4cnAzlNGS:A52RYxfnkG+NSST9d/Bw88L3
TLSH
T1E2E1417895088B7F64B677BCAC6488315AB2013BB7BF68D750B944C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 7KB
SHA256 85e0a800bf91c8e963fb5a03764c3ab8fded7498db785ce5f3d11e5e202596b1
MD5 770437d428c1679c936963d31d145dff
SHA1 7634dd8cb803a606719e048ae688324f4b8f8d16
SHA512 d0092799fbd5737284e8400688a4de2093e7b7bfa2681b9b92f42bf3abd697eaa737e2e89cfeb2d635be5fe6b8af2c8079c98a46297f97498ea86ccb127ca3d7
SSDEEP 96:xHiZTUJbqGqYxfMkGObzSwNSSlcdv9jtnuRHUuFMBw88Io9w8L4cnAzlNGS:AC2RYxfMkG+NSST9duBw88JM3
TLSH
T1D1F12F3C51158B7F64B277BCAC2489715AB2013BBABF68D750B944C5050CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 12KB
SHA256 37a6bf42eaf1646cc87a3ad8a704afede39429f7e681d345a948516ac2e0ac71
MD5 62f6d4ce14490c0431a2ccc8c4299165
SHA1 aa7a5c83012251d48beadfc8cecd1d8857775d3c
SHA512 b8d5e18208e7ef43798682e616f290ac15f94a177ee924c1c8805f9faf9ffa0e29ac778fc542655ccf3a00ea5e0569cc911118a5a60c9553ae7331c6f2fac28c
SSDEEP 192:xC2RYxfMkG+NSSTXLR7CO77OBw88tqamHQfH3:QpR7CO7wwY0P
TLSH
T1D142EF3C62528B3F24F2727D6C2149B01AA102277A7FBCD745F985D2095EF2442E7AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 12KB
SHA256 567004fc013d7eb0a0aa9f542a82d3563f6b1286d72ff262885d4450e6508a9f
MD5 f5b873d0f3f6f770ad71f48cac8dff44
SHA1 53b905a598c16c2889b04d61082d83509ed18358
SHA512 6d9d2f1830e3f6c5086c21053db42309e491b232d6594df7974fb0bbe3ed6d763b2bc6ccb9338918c75e3d78c5feda78d41686b8ac3c3b7c2957fbe5fb434ba1
SSDEEP 192:xC2RYxfMkGFNSSTXLR7CO77OBw88tqamHQfH3:QyR7CO7wwY0P
TLSH
T19A42EF3C62528B3F24F2727D6C2149B01AA102277A7FBCD745F985D2094EF2442E7AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore-backups\recovery.jsonlz4
Size 14KB
SHA256 29a991f1b0d0fd0c50f048e15a45d682d04e5b4c5503c18887372c339f606f78
MD5 834231c64f99e328a223b1203a0655ae
SHA1 751a11f0ac9e49287cccebf3056bad02fa4dd585
SHA512 323537d13ed06d531af826986cf95ec6e1e57f2cbe7412b85a6ccc61cd3585d607cd4e830d364e54decf7a585e8b5dfb15f95bdc188668721c13ffad89090406
SSDEEP 384:zoqrhMbbTMvsjAQq0AI33upOgKoFFKBJTV:znO6I4e334OAgJB
TLSH
T12462AF47F5B67BB5A9255041E4CD0E1163E2049899EDFECC6E1D922BECE99C00BE932C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 11f5b016d97ed5eeea89097e501dc5f8aa92246406270aecb87dd42df53ad022
MD5 0f7d7c3ef6b9a9a0fa1b1ca41369a33b
SHA1 bf6b2bb36323ff166be1a9225375034c8259d6f7
SHA512 6d4ac9352082a16217aa953f33e99be6969b0328f0d6daf6e36940b810c5bc951c591516284ecbc74be4b84f5f032d3e7bacc8a29202d5336058424ec5d60d8c
TLSH
T1003118436CFB2EF2F732428AA4C86FF981B22072C0F118F09065C6D144CD4863A8860B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 bddd89714b0efac24cf53e60e2b51a7d903d6c869857e0d43e5c84b6d13075a0
MD5 087d8ab20f346a5a9e54b49a7c70936b
SHA1 027778e47cf775f4f3b817d015c04da76a386fc5
SHA512 a9840ee5647350292f8a9c5b20e7efe98df01858bcb1054280ccdfef94336c5539ef67aa2ee527c08a5c4bab024f64e367b2562400bfffd8cdd37ec218e59e9a
TLSH
T1F03118877CFB2EF2B7224286A4C82FF992F22072C0F158F0D095869104DD4C2368460B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8cf1d2b23489928b114559b1fd676ab3f376d4c0bbf9cd03597e65180230f87c
MD5 71d00d6910ff20ca2e9921af65f7698f
SHA1 07af0f2bcdc46e8c346919bee5f318c39593e35d
SHA512 26799b349e077cd7c31f75b1a801d28a92010ae9ecbb27a4401a1555d39844ee9985aa21e178eedabd750c027c4c2e7fb6b864ef5b2667dbf536348365bc0da5
TLSH
T133312B8328F72FF1F7A6418694887BE585F16433C0F510F08059D69944DE9D57BC060F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore-backups\recovery.jsonlz4
Size 14KB
SHA256 bc80de6435d445ea5e693daf11c3a1131323fcb7bac8cb024702f809502f6615
MD5 1cdf6094d36b09bbe0b87e665a9083a3
SHA1 32ec4454c8be8fd9f703e40972bf189a16df9329
SHA512 43ccab026d008b677c2c5c49e0b7fa9aa04c3b9da207346cd485e633614ee1d740b4916f413f642b7fb0d43623bf714ebaba377246566afdc15cbb9642968197
SSDEEP 384:7oqrEhhJTcrhLrAQq0AI33upOgKoFFKBJTRXH/g:7nwrarBr4e334OAgJJH/g
TLSH
T1FD62B047E4A66BF5A4255401F4CD4E1463E604588DEDBECC9E2D922BECE998407E933C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore.jsonlz4
Size 14KB
SHA256 0056e6c8949f7c80f8753eeee741221eac5a1d1150a32581bf5ae752a6bb6ac9
MD5 bfbaf89db8ab4ca2a35225318bf02d15
SHA1 1f97372ca79c4062a19df10168c14655d5f8d240
SHA512 bd83b8620fe7c6cd92326a6eec409e749932cd82564f3b551581eb7f7ba595dbb4bfebc8648746b3d08d510bc8b26fe5b4bb284e6a31c2c9875dcedb01a4199d
SSDEEP 384:BoqrEhhJTcrhLaAQq0AI33upOgKoFFKBJTRXH/V:BnwrarBa4e334OAgJJH/V
TLSH
T17E62BF47F4A66BF594255001E8CD4E1067A6045C9DEDBACC9E2D922BECEC8800BF933C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download