cfa111e4e1bfbd6a6c66e41a87671323efac6828226b4784715dce82d957bad6

Analysis

user interaction
yes
max time kernel
899s
max time network
877s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
modified.exe
Size 6.2MB
Sample261102-ba332aes8x
SHA256 cfa111e4e1bfbd6a6c66e41a87671323efac6828226b4784715dce82d957bad6
MD5 340e8b5060188e4c8b0cd1af3d2ddd77
SHA1 d93b7cc3e3526116653a1b502dc59617c450ccb3
SHA512 d4262563149d253b3358ddf9079043ce36ca13b7ac6c95a3efb70c61417ab25c757c7b5d24de489b91ba18221ad94991c5bdf6cbf0c8f5ccbab904e8d96c1310
SSDEEP 98304:G1cmn6Fp7Cb3LfG+P46g18frP3wbzWFimaI7dlo:bFp7CrLHgbzWFimaI7dl
TLSH
T1AE669E52BE8D8176C91A11311B3DAF6A5229BD247B2855C3B2703F7EDC723D1283A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\modified.exe /onboot"	modified.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	modified.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	modified.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	modified.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1128593818\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1046762445\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1695423166\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_298797361\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1589218123\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_2136331035\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1695423166\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1589218123\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1589218123\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1128593818\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_298797361\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_138478028\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_298797361\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1046762445\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_811927702\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1589218123\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_156079675\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1128593818\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1229000385\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1589218123\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1128593818\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_138478028\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1589218123\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1589218123\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1213666852\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1405319262\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1729336604\_locales\or\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6464	2136	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	modified.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1128	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "modified.exe"	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "modified.exe"	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	modified.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\modified.exe"	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	modified.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{0CB83F7F-C1C3-415C-9485-50232A375FF8}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "305"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	modified.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	modified.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5956	msedge.exe
5956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2136	modified.exe
Token: SeDebugPrivilege	5264	firefox.exe
Token: SeDebugPrivilege	5264	firefox.exe
Token: SeDebugPrivilege	5264	firefox.exe
Token: SeDebugPrivilege	5264	firefox.exe
Token: SeDebugPrivilege	5264	firefox.exe
Token: SeDebugPrivilege	5264	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5264	firefox.exe
5264	firefox.exe
5264	firefox.exe
5264	firefox.exe
5264	firefox.exe
5264	firefox.exe
2136	modified.exe
1312	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2136	modified.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2136	modified.exe
2136	modified.exe
2136	modified.exe
5264	firefox.exe
2136	modified.exe
2136	modified.exe
2136	modified.exe
2136	modified.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 4812	2136	modified.exe	89
PID 2136 wrote to memory of 2232	2136	modified.exe	90
PID 2232 wrote to memory of 5264	2232	firefox.exe	91
PID 2232 wrote to memory of 5264	2232	firefox.exe	91
PID 5264 wrote to memory of 5860	5264	firefox.exe	92
PID 5264 wrote to memory of 5860	5264	firefox.exe	92
PID 5264 wrote to memory of 5860	5264	firefox.exe	92
PID 5264 wrote to memory of 632	5264	firefox.exe	93
PID 5264 wrote to memory of 632	5264	firefox.exe	93
PID 5264 wrote to memory of 632	5264	firefox.exe	93
PID 5264 wrote to memory of 632	5264	firefox.exe	93
PID 5264 wrote to memory of 5216	5264	firefox.exe	94
PID 5264 wrote to memory of 5216	5264	firefox.exe	94
PID 5264 wrote to memory of 5216	5264	firefox.exe	94
PID 5264 wrote to memory of 5216	5264	firefox.exe	94
PID 5264 wrote to memory of 3524	5264	firefox.exe	95
PID 5264 wrote to memory of 3524	5264	firefox.exe	95
PID 5264 wrote to memory of 3524	5264	firefox.exe	95
PID 5264 wrote to memory of 1132	5264	firefox.exe	96
PID 5264 wrote to memory of 1132	5264	firefox.exe	96
PID 5264 wrote to memory of 1132	5264	firefox.exe	96
PID 5264 wrote to memory of 1132	5264	firefox.exe	96
PID 5264 wrote to memory of 2376	5264	firefox.exe	97
PID 5264 wrote to memory of 2376	5264	firefox.exe	97
PID 5264 wrote to memory of 2376	5264	firefox.exe	97
PID 5264 wrote to memory of 2376	5264	firefox.exe	97
PID 5264 wrote to memory of 3256	5264	firefox.exe	98
PID 5264 wrote to memory of 3256	5264	firefox.exe	98
PID 5264 wrote to memory of 3256	5264	firefox.exe	98
PID 5264 wrote to memory of 3256	5264	firefox.exe	98
PID 5264 wrote to memory of 2332	5264	firefox.exe	99
PID 5264 wrote to memory of 2332	5264	firefox.exe	99
PID 5264 wrote to memory of 2332	5264	firefox.exe	99
PID 5264 wrote to memory of 2332	5264	firefox.exe	99
PID 5264 wrote to memory of 4980	5264	firefox.exe	100
PID 5264 wrote to memory of 4980	5264	firefox.exe	100
PID 5264 wrote to memory of 4980	5264	firefox.exe	100
PID 5264 wrote to memory of 4980	5264	firefox.exe	100
PID 5264 wrote to memory of 2132	5264	firefox.exe	101
PID 5264 wrote to memory of 2132	5264	firefox.exe	101
PID 5264 wrote to memory of 2132	5264	firefox.exe	101
PID 5264 wrote to memory of 2132	5264	firefox.exe	101
PID 2136 wrote to memory of 4368	2136	modified.exe	103
PID 2136 wrote to memory of 4408	2136	modified.exe	104
PID 2136 wrote to memory of 724	2136	modified.exe	105
PID 2136 wrote to memory of 2340	2136	modified.exe	106
PID 2136 wrote to memory of 1312	2136	modified.exe	108
PID 1312 wrote to memory of 4164	1312	msedge.exe	109
PID 1312 wrote to memory of 6124	1312	msedge.exe	111
PID 1312 wrote to memory of 1128	1312	msedge.exe	112
PID 1312 wrote to memory of 6124	1312	msedge.exe	111
PID 1312 wrote to memory of 6124	1312	msedge.exe	111
PID 1312 wrote to memory of 5504	1312	msedge.exe	113
PID 1312 wrote to memory of 5504	1312	msedge.exe	113
PID 1312 wrote to memory of 4360	1312	msedge.exe	114
PID 1312 wrote to memory of 4360	1312	msedge.exe	114
PID 1312 wrote to memory of 4360	1312	msedge.exe	114
PID 1312 wrote to memory of 4344	1312	msedge.exe	115
PID 1312 wrote to memory of 4344	1312	msedge.exe	115
PID 1312 wrote to memory of 4344	1312	msedge.exe	115
PID 1312 wrote to memory of 2756	1312	msedge.exe	116
PID 1312 wrote to memory of 2756	1312	msedge.exe	116
PID 1312 wrote to memory of 2756	1312	msedge.exe	116
PID 1312 wrote to memory of 2952	1312	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\modified.exe
"C:\Users\Admin\AppData\Local\Temp\modified.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:4812
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {e0ea820e-2bb1-4be1-a5d7-a4102d339035} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {7ebe7874-ddad-4244-8745-f104df374c49} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 25164 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {2b65650e-0bad-47f5-a571-294f7496ca91} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27274 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {86d354f1-1689-4b85-81b2-770b2984f05d} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2928 -prefsLen 34773 -prefMapHandle 2932 -prefMapSize 270279 -jsInitHandle 2792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4416 -initialChannelId {0f844faa-b383-4aae-8483-9e3f4847721c} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4652 -prefsLen 35010 -prefMapHandle 5132 -prefMapSize 270279 -ipcHandle 5140 -initialChannelId {ec1f828b-400f-4701-9aac-d36496e7e8a7} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 35062 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {98eaf4e4-6754-4dea-b16f-ea762371619d} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 32952 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 5736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {a8d26322-45c1-4427-a58d-086ce736dd9f} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32952 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5900 -initialChannelId {34b70a90-f87f-40c5-bc2e-50e442b8b022} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6084 -prefsLen 32952 -prefMapHandle 6088 -prefMapSize 270279 -jsInitHandle 6092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6100 -initialChannelId {22e8fd54-09ea-44f0-b16b-acace62b4700} -parentPid 5264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2132
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4368
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4408
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:724
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b16
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ff8a341c188,0x7ff8a341c194,0x7ff8a341c1a0
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,248216578748580356,11808442049976274992,262144 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:2
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,6350806540985920470,4880096427219027673,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,11882097363129038755,17144694267085178499,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:13
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3316,i,14598707413974116709,5143185433061681896,2097152 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3332,i,3286629023213709555,2292677493584836237,2097152 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,15259300780631233471,797130346517882466,2097152 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,248771536483229458,11529064116750207587,2097152 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5666904502136629301,7127418017128550301,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,16300514426165932771,1509308430929742546,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,14837306979083477287,3492315367058581640,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,11426337888251949154,1401652740780398844,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:6816
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,11426337888251949154,1401652740780398844,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,14428718534096758629,17139715183092506609,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:7132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,17777582560629108471,48274786429503454,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,18205020818911706471,16291184667224777425,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,18047510270093386703,14214540502168436439,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,4732364515597614745,10284714963145313569,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
    3⤵
    PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,6003373217535544237,16918949656529300477,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
    3⤵
    PID:7104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4027138193985121495,12860225852000880857,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,2130155319127571600,5506788284386620873,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=1180 /prefetch:14
    3⤵
    PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1380,i,8564042477785639568,6868025196531110997,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,7972263295955904340,7233130938364625512,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:14
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,12577639198200775894,785538164919179410,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6588,i,10730354201974789504,5168918404806347883,262144 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=1540 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,9433315614353575924,5528198664323784635,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,6199610400774380964,10209239679066193757,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
    3⤵
    PID:6968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,14197495552689604741,4711654327621269929,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
    3⤵
    PID:6240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,18234734246150597508,6497004088110051117,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,9691243004547631063,2380334520298281220,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,16037059192920236405,153434452433923125,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15403212994753441632,935608565312753393,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,3269113526018391855,10741468422920426156,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7374880320813230800,18099508093648154579,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:6944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,4684704077263118803,6296722026417437276,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,15371425258365122139,5373866043136039007,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,4247283822054352447,15216136482818329656,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,14626015036507062227,8775686882436748114,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,12402800107105195195,13175115856423478733,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,17831284229876513087,14953995172529679934,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,6504164135393945901,5532764313855536678,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,9484839527148907928,10850950281106023866,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,676430470624293555,6708190766798564492,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,13460194327399096433,8581793999661680155,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=1536 /prefetch:14
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,946817429079428852,10017413003351340421,524288 --field-trial-handle=2756,i,10001666228964748915,15907007889622145681,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:14
    3⤵
    PID:7100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 1460
  2⤵
  - Program crash
  PID:6464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2136 -ip 2136
1⤵
PID:6416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1052

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3c2b56a4-ece8-4d0d-8d8b-948a122ba62f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c2b56a4-ece8-4d0d-8d8b-948a122ba62f.tmp
Size 40KB
SHA256 702ce448cff3d79569515812f43eecf0ca2738ac477a4424fb838f02c033e200
MD5 23f3957adfd144155108348500f11263
SHA1 86f6d41d30cba001807fb0211572b5329f534015
SHA512 adba2b5320bad52ff6d2d40868c9860806fbef555f116508f70f9bf3942e49d66f335a32858c8f7d8248ace43a222702bd6675e8fe67b6aa8dd33b6069f2ff50
SSDEEP 768:4/UxvxjgC+P3J7lOwOn6H55fgGM1TnXMqOalE75Eno:FZj3+P3pT7fgt1TnxOekyo
TLSH
T18113BF36A8999C235CF2E345B20AA6D7AEF154B7C4C51E98C8ED6E0E058735E134FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

615ccc55-f42b-4b31-9fff-4747c736399c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\615ccc55-f42b-4b31-9fff-4747c736399c.tmp
Size 42KB
SHA256 712abf2d3528aa4b8c58c11c84e52f4e04c770bee0e482e638dd5bf0e07eda12
MD5 95ae53a34c5d9e6f109e6cfb33ff59d0
SHA1 2771a0cc2dfab61bfbb9a31c09e8dfa6b4b5e4f4
SHA512 daba5cb262857c15f5e289f1bd77f457b0a84ba0dd41e377ea92f7016425f14b00dc5428dc43194808ccf95503a9a626f912f793591cb844b78683d90b3dc99b
SSDEEP 768:LFdZ3Kwgp7EUIOn6k5fgGM1TnXMqOalE75EIL7:7Z3clfgt1TnxOekzn
TLSH
T1411317F598D78937D8AE9743A33D6D869EBCC167B4881994F7885D0CCC821BFD34A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cd72564-55da-41f9-b680-a6cb5b818a4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6cd72564-55da-41f9-b680-a6cb5b818a4f.tmp
Size 38KB
SHA256 7183f2b48b32f5ef06f502ceefef5c528a1c2c76c7856399aad9345cbcbde078
MD5 ad43021d7270329289f67f6c87a23502
SHA1 0ec4706b3301275213b163205b528672b62beaf6
SHA512 e98d261bede5540e734577ae428bd9fe183aeb5b24c112da267099dacd891fd21e7c8042a90cc0d111a28ac306e9a3a166b010c05247c4425847851ec52c7198
SSDEEP 768:v/UxvxjgC+93tQwOn6Hu5fgGM1TnXMqO/lAaP8:CZj3+93Zcfgt1TnxONAG8
TLSH
T17403BF35A959AC639CF2D385B21AA3D7AEF154B3C4811DA889EC6D0E058735E170FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7317e50e-c28b-47c7-a9c1-e81993671c47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7317e50e-c28b-47c7-a9c1-e81993671c47.tmp
Size 34KB
SHA256 fb24658dd4983d9ebcb5be79439abc6cfad37eb47aabe494db38b96fef9de069
MD5 e21bb5e8179a58c55b6ade1d835ed89f
SHA1 75f82bb8ab02ffe17b3a7831265df69f475c6c3f
SHA512 d8309af0977d3d0f94093fff62df0c9966802f9d50d124d02ec2d9a3b3b38ad973ae858c9adf6202756c018898cc90349c0839ef9e1227608d608c3c09b366e4
SSDEEP 768:er3s7gOwOn6HH5fgGM1TnXMqOalE75EIL7:er3SQZfgt1TnxOekzn
TLSH
T156F2AE71B8969D735CF2E341F21A7A92AEF151ABC8851E98D8DD6E0D008725F234FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89fa6e5a-344f-4fe7-8d1f-76b690197006.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\89fa6e5a-344f-4fe7-8d1f-76b690197006.tmp
Size 34KB
SHA256 070d8ced56380d6f01ae1e43e613d13a1ebfaecfdacf8125bbaa1e67bd0c2671
MD5 b198cca8b0475b532be441303f1ead1b
SHA1 887e90b862fa80b628340f5e4b5226f8d0e6e0e8
SHA512 48a96df5c4072fedaaf8f786bfa7695ff1fb3c47ed880f4a58f2adf00c71d837b3ab99af62084ea9d63e68cdb762e4ea3d6bf97f1b76ecc30e6cf6c1b5a4900d
SSDEEP 768:Vr3J7gOwOn6HH5fgGM1TnXMqOalE75EIL7:Vr3pQZfgt1TnxOekzn
TLSH
T146F2AE71A8969D735CF2E341F21A7AD2AEF151ABC8851E98D8DD6E0D008725F234FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

01af1ff4-8ebc-4a47-a2d0-4bf7e3f79513.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01af1ff4-8ebc-4a47-a2d0-4bf7e3f79513.tmp
Size 26KB
SHA256 ad6e07a9ea868dd343b53df364263e27902d93059a1ef8fb22ff90de61fbea3d
MD5 24787368a7be5d4f238aab883c91019e
SHA1 98662c6001f4d5e887206a3c1b712e6d8ea31f18
SHA512 de91a9e562a27cb0d574953bbaa0398c118045fea760ebed9be2f7daba7fccaf31dcc9b71ed090488c198c89de8a16abd459d4bcf001517563b23d30f6b4691f
SSDEEP 384:sxRAS7/f4sq66s8qMpRiYnazAW8pZS15posJWeT+C16TJ/5Y/jkzp:ssS7/fG4Mnc7WeT+CQd/5KK
TLSH
T10BC21805A924C83B9EC3AD18653D7E33DAEC106221C5DEDE56ECCA1C019E1FDAB47827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d4ebad1-a0cb-477c-bf74-5dcad861c254.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d4ebad1-a0cb-477c-bf74-5dcad861c254.tmp
Size 12KB
SHA256 20dcbe9e408ab3fdc659754fbb9b97e700807691104184912e9526f8ba58d004
MD5 99db2b393fe2e1bf2ddb9e23032fa450
SHA1 0f2e0d3ece23816f75988cc98211bb188578b613
SHA512 c4058655e7fd1015618388833ea6501d210dbd8db54d995df83e1cf49fbe3b42926a853908843ce340e58baeaa8f8f1693032b089550d06748c98cb6bfed249d
SSDEEP 192:sxRrsRpCS8/fojsZa7Z6OB/zoA8ppx/g6+WNYyi/YRXFu3jLGpIgDQ6HJ:sxRAS7/f4sc16Tb/5Y/Bkdp
TLSH
T1F742D855AD68AD7B8CCBD21DBB557F53D6F91032A0D01F48A6FC8A1C04E76CD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

395d08e6-ff4d-474b-9a7d-3aa4acbda457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\395d08e6-ff4d-474b-9a7d-3aa4acbda457.tmp
Size 11KB
SHA256 20a19a67e852fed7ddbc361b5647e7c743e1b34974c51d999335a0f22a16c509
MD5 859b84a4fb441c6592477aa429d2b29f
SHA1 80e983d476c004109bd368be0001e939812212be
SHA512 b8efb2c0bd9bf5419f4fcb58e33b6fe9ff17ca4bae9ca2f381fd6ca94c21cce6afcda6165f0dfc1279daaa5a5a50d4fa8237fd350973c0e6350645539019d8d6
SSDEEP 192:sxRwsRpCS8/fojspa7Z6OB/zoA8ppx/g6+WNYyi/YRXFu3jLGpIgV6HJ:sxRnS7/f4ss16Tb/5Y/Bk0p
TLSH
T12D42C755AE68AD7B8CCBD21DBA557F53D6F91032A0D01F48E6FC8A1C04EB6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a948660-b6b4-43ca-894d-c1f7090a8c26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a948660-b6b4-43ca-894d-c1f7090a8c26.tmp
Size 29KB
SHA256 3eedd6ad967a7958f328a76247f233552a675bc57fd9fd0860cf1114cef237af
MD5 52191b36e6a62265362453be378d2d9e
SHA1 b8e87f835a3bbfba7c6129dc57f61ecb4e477153
SHA512 2cedbc650787a796678546ae40a8f1fbc5cfd0247818c75897df8099ba023016f435074499cdc85e92739f6b6b542841ec77413a093d0394518a85da91c503cb
SSDEEP 768:UEg+bd7pLuLjRuWgf/fXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYc+6tyLroqj77:UEg+bLEjRuWgf/fXHu1javc+4y4i
TLSH
T171D2DA7B744CCB7F4FC00A9D9C1A7E9B6DA802CB9698CD4047FE895C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6133b553-a452-4dbc-9e35-fbff6c57e153.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6133b553-a452-4dbc-9e35-fbff6c57e153.tmp
Size 12KB
SHA256 7f67b66317aabdbd31eb70b50e1c3992ca9ab35c31067f42afa3f567d38404d8
MD5 28314a98624c0cc2082f23bba7273f18
SHA1 b3e53ede255e3427dcfd4b5348d10f97d0ad1163
SHA512 5a8d31ba3fcfa14e22223be96c4ec89438d14decba28f5154a4c6260b36b0620273e09b1f5b8191ab0bad10cee52e4887ac5ee2895a8fbc08cd45ce63576238e
SSDEEP 192:sxRrsRpCS8/fojsZv7Z6OB/zoA8ppx/g6+WNYyi/YRX7C3jLGpIgDi6HJ:sxRAS7/f4s116Tb/5Y/tkzp
TLSH
T1D242C755AD68AD7B9CCBE21DBB55BF53D2F91032A0D11F48A6FC8A1C04E76CD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 1311c1e5e0ee42f2f1dc0b84a8fd0dea07d1f9dd076bc13fcb1c10c4810b93b8
MD5 4e4147a6ca74b1b4691fd3260fd69619
SHA1 3bb585861ccd18d1ed725e569e575185b691fd60
SHA512 b5df046dfa1537d1181429c7853bdeb53dae41895335db1c6b68dceb4ae2566420f48045f71d4640fe2a8ff94e5986c8a34047359e005d9ff100dd64c0e36354
TLSH
T18DE026A519CAC23EA20BB4D781EDA34C8281371BA3C4690E1B44C8C87403840A28B7B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 816eab6f836e96671ebdf9e287332c55e0d6742bf8392455a207ea07e07bf0ee
MD5 529359447bfd97481fd96b6c57594766
SHA1 8f359d333ac7764ffcf676cd0331f5fd37f04050
SHA512 5778128032f2d7a70de4f53f822e07d9fb74bb4f7d9ef2724caf99a4b28d18271eff7775136925f83c1104b213124cf5aced0672f190d187d80a9dfafb196b42
TLSH
T112E086E585CBC23EA21A759B83EC534C8290375FF7C4794E5B04C8987243588B69E7B4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 385f5f22744825f9a87ff0719e91350e087382318fe35734c62476bfacacb89b
MD5 8027c9e26c3913723aeced3f53042275
SHA1 6ad62b1471620474a48011bc9c6d8c54a02f148b
SHA512 ada2fec0353ffa2f0f4acb84586cea81a3db5fad6168d3a7c22116de784fa174886710810f1f856eb484125580dcfefbed0fbd2b70dc8d78a99137b52a8649c1
TLSH
T1D3E0CDE605D9C62EA208759F01FCA74C82B0372FD7C47A4E1748C98C7145548B7DBFA0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b0c1c33bf00bc408aefdec7bd203e2af4a16b0ee9dad9489d16369c40f7754c9
MD5 6401efc0e3c2bc954108760026cad375
SHA1 b610c1a99688ab351b63d5aa9479b01a81262d66
SHA512 affcc8bcb46a753c35a42ad9f465961181b632aca501efd965b2b237f585b01cd58856d596c8d6b0701cb255c58f4616c88bc221bb4fb0fb15c0ad1c4143765d
TLSH
T14561C95C57927465EB9C67B0C0D23CA7363DA2F27E833E428095E6B85AC7F2782CE015
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 675e00f6d4c5b3f723d2c9bc46a9d8138f72959e111ac0ad062e115839040dc3
MD5 203f2c91fd9155e73466c3d60db25c41
SHA1 dc786da995e0716505af6f5a580eeb81bb2bfbd2
SHA512 8831d86ebf16bee0c8393776a2069694d7996cfc3ade505d9eeb10d1e5739bb12c31ed883714321e962d0d9bed5b7d7c56a21285d18745b866ec20fd98b1c819
TLSH
T16461C95C57927464EB9C56B0C0D23CA7363DA2F23E833E428055E6B85AC7F2782CE015
MD5 SHA1 SHA512 TLSH

Submit Download

e6ec52c7-28e5-48d1-bc67-18f821ea843d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e6ec52c7-28e5-48d1-bc67-18f821ea843d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

1d7006cd-ea80-4980-a59e-b148504741e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d7006cd-ea80-4980-a59e-b148504741e1.tmp
Size 2KB
SHA256 8f368cd807acf1358752cba2155af9955a3601a37fed96928408fb993e84b9aa
MD5 0f6bddcc2d310dd93155d7e7a23e621b
SHA1 c0c9f50b4bc4b903dea4976daf739f8a3f364eed
SHA512 bfa3cac9ad9db3dfcea1450379fdb7be5c860ea497d926cb9b790cef3021b2680645eea424cb5a16304d4839cc76f7bdb4ec19a3371c8e44ce0bdf4b120860f7
TLSH
T1B351D0F783F4856ECA1196F0AA146E1FCF1D0514436C7D5A85E0AF1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

895d316c-ee69-4007-947c-3d067285e7fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\895d316c-ee69-4007-947c-3d067285e7fa.tmp
Size 2KB
SHA256 505bd9cb0ceb3b057a9ecd54afa833788dedb223640287c85e504cace7e4fcef
MD5 af515fa4f00d5fc1128b74f6de7ae69a
SHA1 d8f5801090be76c1e3570edf4ab44b977e4cf333
SHA512 160d5a9f5dbf910128ff2a05ec66389d838a3ef4a25a6410d0f642e4dd96723bdc0454bf4b4d44163afd8ca3b430b1b67fdcfdd778d0e524fd5d44a31a4ca3ce
TLSH
T1C341CEF3C3F4856E8A1196F0AA186E1FCF2D0915432C7C5689E4AF1BA3E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

e0c81974-e72e-4d37-bb5e-4f0a3536257e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0c81974-e72e-4d37-bb5e-4f0a3536257e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ebdfdbe2-b9e9-4764-be31-86d0eeb3541a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ebdfdbe2-b9e9-4764-be31-86d0eeb3541a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\temp-index
Size 696B
SHA256 ba0c9d9f6e883ec027700bd4723d46aaba9a95165e060bd8550df33fe9334435
MD5 8e97b24d50cdfc66971ae013631b5fa6
SHA1 23912b351efa9c33eb9f01082b73228be08b979f
SHA512 e5fb96d695cfb778e46ef6390f30229d432d5a6e1ce7ea22647fd2f81956a75b15a485a45853ac854c9d3b05c911090b76e3e28e1c83c776a02af35f3fa271b4
TLSH
T16501059E4E534F0FED551170383DB85D913915CC5340A61F61EDE63E8C53798FD02A98
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\the-real-index
Size 696B
SHA256 7aec34b2f4720d776e6bcb4d38bd20880fda4af0bf59effe16727bc3578b6239
MD5 7a7a7ff222535429049b97558af9616c
SHA1 62f0f4a2fdad7294a40f826be5ee76b2ca17601d
SHA512 0f5fa47f750d1bf17775a78ff792459d0c747809d0a09a8bd57722853ba079bc6cea88f4d4a71ea9eee6fbea0fa4c15096026c0566311569c069c7d28ac83bfc
TLSH
T1050154DA02239B47FC4442F1A83DBD54613A00049346EA0FA2EB90ABCC507C4EE43A9D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 31a217eaa923726b3b2f63872a12a44437de3924e0d5514db31bb2512d676973
MD5 b76057b0f4796278b3dfd0fc617e48de
SHA1 02689645ddd9e92ba359a7f2e5b2f3f7934bc7ec
SHA512 ec2fd840f99caf72a3f3a34563d6ac4e95d9f121aaa6c687c3960b7eea328870ef578fe59642c92eae17716276035f4c2e937f4f662b236873306281b9534121
TLSH
T14AE068B32EAB0890AD9F97C7143240A5011578C89D00AD0F803B52DB64A1258644AC20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f84891ca27e7cb239f431a6933a23f9848c39959a6cf41f47599428814bec053
MD5 d35c0a0066b74c9e56ddd312245f2325
SHA1 3496dece04b7e7855938947fb613e8c369dfa853
SHA512 c34cb3214f92332f41d28dc8d32e682d04549563c81ffa2f34cf8f62a265a4643cd3017f3c5d7370f541b581af7d72b76ae61a6d473d47bcf3d6a3d057d7c811
SSDEEP 48:KMGIPKDCk/ypFAxFvP/iZniRIo1iKjHLziXVyeKrJlI2Kxycvy2hsD3h6:KMGwKDC2qG8KLCAlZKxyWphsD3h6
TLSH
T1A291EF21327B0601397E261C54E4BA2A464232B7326CE92B7BFE45A75E6FE144CFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1cdf8e5-a236-43f2-8a51-fd621de4a9f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1cdf8e5-a236-43f2-8a51-fd621de4a9f3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f2d35fc-dc2e-46ce-a085-41d71a366def.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5f2d35fc-dc2e-46ce-a085-41d71a366def.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc730138-be59-4b90-9e19-29a349fdaaed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc730138-be59-4b90-9e19-29a349fdaaed.tmp
Size 37KB
SHA256 14ca76971a316836880cf9bf7ff5e81110dd56cc969ab2dd60964566d90f402a
MD5 1ae090567616db7432da74cab163c066
SHA1 3c9de44946d102772087d85ea73a8b4a00e5a397
SHA512 4b47ce2de0ba5fa15d8091909734602a9b811f9a6915e2267e81907f496968b7ab9cf0fd4b219bc268bc4e2485a88639ec4327f1e663368702092044372a1ace
SSDEEP 768:5/UxvxjgC+93VBwOnYu5fgGM1TnXMqOeUAaP8:sZj3+93kcfgt1TnxODAG8
TLSH
T19003CF36AC556D738CF2D381B20AA3A7AEF185A3D5C12EA889EC3D0E058735D530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0157b599-bc98-4b73-87d4-60e44007ff55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0157b599-bc98-4b73-87d4-60e44007ff55.tmp
Size 972B
SHA256 f2095e18ded6e24eb65ca55c2ae3f239e5c775c2d548fcd7220fdcc5188fd5c2
MD5 cdaab5d3d55ef7e945ba14e073457ba9
SHA1 c060396bc2ba87bcae47eb8471036bc69d213fac
SHA512 2c89b59c71d0db59eff910786b40d36df7af0a629ac64c5e119097ba6a218ee0e2834b2c8938d315aea00693ab2a8abb1303c913fb5eb9092572910e21223962
TLSH
T1911110C04C3A1AD6C6BE0EAFA0872FEC40E99563B0D4747528DCE998957E02E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

01d54864-7a90-4330-a316-a87184c031c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\01d54864-7a90-4330-a316-a87184c031c3.tmp
Size 1KB
SHA256 b87dbba9a743c170f61881264fb6f1639a421a2b19867eb7d1b16a48537f9d45
MD5 3887fb1a5e6d3118b53ff771edab45d3
SHA1 d92e625cf6166dcba60c98f6cefa3c384cba0cc1
SHA512 f15d826e3bc3a3a3a883a1a7295e6785806df7b23c68111997fe1fc98f7bcda3c55ad6c98ded536f494a9dac41628db8617ab923adbcbe620ddf6b84345dfc70
TLSH
T1763122905C3D1AD6C2BE0EBF70872AEC50E89652F1D43435289DF8AC957F42D755087E
MD5 SHA1 SHA512 TLSH

Submit Download

0a3d4fb9-f918-4430-85f5-954c8e7389ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0a3d4fb9-f918-4430-85f5-954c8e7389ac.tmp
Size 1KB
SHA256 6bfca0e6c9e54240aabefffab72616d1b2cb427eb3af3b189e1b4f7df6d0f418
MD5 8b8d458f9cb22e4751620849b0277104
SHA1 bd97879498ebd6f0d6b08959c7bd488fc3003bd3
SHA512 65988f44add1b9af2e0d1e3b51c473f6a9ff1667c133220d073f275edc3f743416f1b804f097838ac0650686a77c20904e9d1b927b282549802d35c051b24a23
TLSH
T19E11F0804C3A0AC6C3BE0E7FA0872BEC40D99653B1D43475189DF998457E42E315187E
MD5 SHA1 SHA512 TLSH

Submit Download

231a568f-ce4f-4e60-b972-e2e86687b34f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\231a568f-ce4f-4e60-b972-e2e86687b34f.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

24564f0c-8b1e-424f-bcfe-c56bc66e59ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\24564f0c-8b1e-424f-bcfe-c56bc66e59ec.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

2f126ddc-3bc7-4754-906d-6b2b495c3ef9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2f126ddc-3bc7-4754-906d-6b2b495c3ef9.tmp
Size 1KB
SHA256 53face734cbe3ee8ef4722a098ad9bb7548eb13a2d4e29309db817f8523b4dd6
MD5 6fe0c82b5ea97ea357c519d9bb76d2a1
SHA1 30c4b6d3b57eb3f3f6b7971ace0ab6a140a6ee2a
SHA512 0bd9b04b6bb8094dfa40c3fbd60962b2d62d39ecaea9144d54bb205a59572dbfd1fe0b1b629c2c3ba9634193140d0d8392346fbc571a08f5151fbdfd570e7e69
TLSH
T1164132D08C391AE2D1BE0DBF70572AFC84D98262B5A4347A289DED9C4A7F51D750083E
MD5 SHA1 SHA512 TLSH

Submit Download

2f9040e3-0bed-48d9-ac3e-cab545ae504f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2f9040e3-0bed-48d9-ac3e-cab545ae504f.tmp
Size 1KB
SHA256 ef26b6391c77a5d554dd504bdc08d6366438e1c6d17efba3743a380d7e36cc3b
MD5 6ac834ffecd5695d94a759ff83a63ebe
SHA1 d49db5c54ee193eb2d4917b4b9147eb9e230a460
SHA512 380f2fba34f436e139babb3b83ca6921c3d9c0976d8f409b8800e915c7e1d6db76b912fc43c516598283fab058d95b18b5dee1b02edbe3340009e9b7f20fc5a8
TLSH
T1633112D08C3D1AE1D1BD0EBF70572AEC40D9C662B1A4343A289DE998567F51D715087E
MD5 SHA1 SHA512 TLSH

Submit Download

3b2d6849-63d2-4e33-a752-b913f17d3f06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3b2d6849-63d2-4e33-a752-b913f17d3f06.tmp
Size 1KB
SHA256 c65a7a2a9a60ca55ae447b086e7b3cf9ed764262b6600dd95c8f62d330dc4eda
MD5 d2e7d4723434f2d1e24de89388d11fe7
SHA1 60c139618b01b5b4d26912c7a3f81587396ade3e
SHA512 50212827f5d773c582b81c5198ba0188b1dd9e428f01f03a3c1da5777a07e450ac4f8fc898dcb6b8cebb0cf60e3cde4c9acbaff52a55ed1400cf0da45f574621
TLSH
T1083131D08C3C1AE2D1BE0DBF70572AEC80DC8662B1A43439289DE9A84A7F41D755083E
MD5 SHA1 SHA512 TLSH

Submit Download

856a532f-3c29-4a60-bb33-c9504ee8c2ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\856a532f-3c29-4a60-bb33-c9504ee8c2ec.tmp
Size 852B
SHA256 8bc825a30631771ae614094fd07267a0f3350af6ac0fee62fe078d20f34e8420
MD5 5dc1393ff7ce1bc4029176ab75d81692
SHA1 74afc05ab3b0318ec85767b6e96042f2fecb0582
SHA512 c047607ebd16df9d0f2d5635943cbf0280763b2e6ee891670a636e2713dca6a933f965d3d89fb4be3ddb26abd506fbb255450e622275a71716abfe429342b1db
TLSH
T17E011ED04C391EC6C6BD0EAFA0472BEC40C89522F0D8387928DCF8A8957A41E345183E
MD5 SHA1 SHA512 TLSH

Submit Download

8a286bd5-344f-4f99-9957-28f033b424a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8a286bd5-344f-4f99-9957-28f033b424a0.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

94dc419e-8875-427d-9a58-229094668c45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\94dc419e-8875-427d-9a58-229094668c45.tmp
Size 612B
SHA256 aefe41ba49514b111597c7f1d7c4be25749a5c72259d4deeeba6393a98942c23
MD5 4979eccaf0b564a0be3a74243ff501d5
SHA1 f2eb355e1da53299417438cdbd859a325e9513c8
SHA512 84a1e794b4ba4e190cfc8fff8859eefe20120a2e923c9efcb28351a42dbe0210ffd8d1317c8de1f31ad0cce028e1348ce14ea878921aea32f7d4de5e7834b7b6
TLSH
T1E7F00C808C391DC5C6B90F9FA4032AFC40C84A26B0C8387814CEE89CA43A05F3111CBD
MD5 SHA1 SHA512 TLSH

Submit Download

d63cb417-e947-49e2-88b6-bab06f6af8f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d63cb417-e947-49e2-88b6-bab06f6af8f5.tmp
Size 1KB
SHA256 f0a9c45f936a60c7ebfb476b4ffa2d2f183e3fdff2b1a0e7a67b79fcaccbc57a
MD5 67784bf2de8093696d871f57ff245b62
SHA1 c069fda54eef0f374380fdf2db448b4b488e3524
SHA512 61cb1d328d2fe42b965bd2e5802bd4c3ebdee20dc064756203c43073f12bf3c0b53cddfb1ef5c3148a2d434ad630eeba1f444e52584a27873f54740cd67dceb3
TLSH
T1933131908C3D1AD2D2BD0EBF60872AEC40E88662B1D43439289DE8E8857F52D715087E
MD5 SHA1 SHA512 TLSH

Submit Download

d7a829b8-5f97-447c-a1b9-5a5a7bbcfd36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d7a829b8-5f97-447c-a1b9-5a5a7bbcfd36.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e8f6299b-4a73-475d-aec6-8c46e588b5c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e8f6299b-4a73-475d-aec6-8c46e588b5c5.tmp
Size 732B
SHA256 556feddcbd9b9cd3e28eadee8e310af21c5251e941f1ce8a66aeb0ce40bbe84d
MD5 3f903c66e8e6af5685738ec2bd996c6a
SHA1 ff1cc1c9d1ea1d1c6bc1afa3cc7e93a3d3c84776
SHA512 bad6cc215b7f65249116b67aa9c8b794a725c09e981cd348feac503825fcb42024848e61ea17c152337a3f12a2872061c94c448fe65855e79090db07f53f8986
TLSH
T1B5011BD08C3A29C7C6BE0EAEA4072AEC90C84627B0C83878149DED98907A01E315187E
MD5 SHA1 SHA512 TLSH

Submit Download

f04aaa58-3934-4136-80bb-ae001851b858.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f04aaa58-3934-4136-80bb-ae001851b858.tmp
Size 1KB
SHA256 bff2086537d342fdabb5d9a1fc9fc6b565dd581f0f39715247c1b64043c275f0
MD5 9e97d572bace5ab93dfe9a1b3b417f21
SHA1 2bd52bd39099a5041425c8dd1aad65130c5473c7
SHA512 2b6c9f60854b8274cdfeee67473e6c99955d281557c96019c75da82c741d6b5f7d9b3820c0827f0df569823473d06ca06a33032615a4b823766779d19138fa9b
TLSH
T1D821FE905C3A0AD6C2BE0EBFA0872BEC50E99653B1D43475289CFD9C963E42D715187E
MD5 SHA1 SHA512 TLSH

Submit Download

f5cd01d9-5f2e-4ced-9a7e-423e4f44cf9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f5cd01d9-5f2e-4ced-9a7e-423e4f44cf9d.tmp
Size 1KB
SHA256 5fa85f0e088c89e9486132d37a506fcbb46cd5e556e8cc0d8b3fc9fc64eb8557
MD5 5c57bd5aa9b935908b5949a0ce1d612a
SHA1 b23db33e2d375f27013fe9165fc6c110ad4ed48a
SHA512 40d09b6058d5f8913e88ee6d7f3788270772eab2aaca3e7917702b8f9505423f54bab27a56b8d893a18efe16e47b32e2cb16c93719e8448176a26149e3feedc3
TLSH
T15F2120904C391AD6C2BE0DBFB0872AEC50D89652F5D43435289DF99C853F42D315087E
MD5 SHA1 SHA512 TLSH

Submit Download

ffd19a20-888b-408e-8c83-dfacdc228077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ffd19a20-888b-408e-8c83-dfacdc228077.tmp
Size 2KB
SHA256 b4aa974c7da7eaa89e83d15fd16a1f5b57269659a9abe8b6214ba7c318eb66b0
MD5 6416bc50686423b956028fd402a088aa
SHA1 3c3892e4fbe8b52aa18190f83968247664cf47c8
SHA512 73f7bdf4507211e532b0e569f1a6b858896ab43cca94a0c3e54347b603d8540bab7667ed21a0720558d8b78cfe2862387a5101b263e1d462cb531b0f0a786905
TLSH
T1654151D08C395AD2D1BD0DBE704B3AEC84E88222B1E0343A289CED9C4A7F41D750083E
MD5 SHA1 SHA512 TLSH

Submit Download

2b8763c5-3535-47eb-96fa-6cb959757d1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2b8763c5-3535-47eb-96fa-6cb959757d1f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\activity-stream.contile.json
Size 4KB
SHA256 05d1b089bdf044c66e5180602f600d06fdf96b0434b7ab8fafdae3458ec35c0e
MD5 880539410a4b95ecf15374d7cb400c04
SHA1 ed3fc289621346d9104bc58f14541f1775262d5a
SHA512 ca729e4da9ee26c0454af7f4918d7ce43607b524cf4790eaf333d8ee287b6c118a7162105d3cf6098c85d7db0123a79b29d5c4ba5027d52f38489d0138c8fb46
SSDEEP 48:YdbA45eDZkyaWM1Fpq3qio2Qnmqp4Je5eDZqyaN1ZsQRsNGjy6T+jiRgQ+nqpNHc:TAkMd9nmcTEZIT+mRB+nYgDAgxlz
TLSH
T1FC91C8BB883054120F75E6F16C0F27A8F107B406A9F08AEC7179AC60D59C7EED0D7988
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 225b5abab56ff7cb21a83976d1d69308da7b611a7ce353622463c278dd4694aa
MD5 fa6c0354d781c61b10e7cbdaba708335
SHA1 01c6e9b65275d4a3864e9382e72bc01d90128d7d
SHA512 cc763b3791e9f35afe5a4ba361e330e9469b724f9b82cc2a67360c6aab3ef936adc6643fc6e4e5c87ebfd4a911a45d5699f1d136ee99a639813d9bb12cb98c1f
SSDEEP 768:NyGek08hGci4lA7uHJdfN/yCR7XgMrgM3gMxGymWxB/mN292qWKFL8dvAR:czk08hE4lA7od//KMMMQMxGym2NmgGvg
TLSH
T12A73F9E397A8B2FF1B9177D72C0B755B66D20185E34502C9ECEECA1C81CD694123E6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 1f4b05d45c4e95b518657eb41684743dc20aef7cd1f8784b9805d6613b7c013b
MD5 2687b3eac422910ee45844cfb2230e0c
SHA1 6726658f5b21b568afc02e5d00a8d2120564f676
SHA512 68fbac7b9115dde3efb0fca35f948b411b0fef73f86d2afc682f02132f5345521d8a33a9513749ef510e6bb7467be857af56fba05bb57c42f60c1d5294bfb003
SSDEEP 768:NyzAIZ6RMvYwG9Asz51xUgi7Yfdi/IO2avXuJmLSS+G19OOr1aKB:czzZywGvdHUgEYFigOZSzG1vaK
TLSH
T1BE73F9A3A7E872BB0BD137C71C0B795B66E20185F34509C9FCE9CA1D81CD794123B6A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.personalization.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\activity-stream.personalization.json
Size 1KB
SHA256 0882fda8113f33a7fca21d754450ddb61e59e3db21dcb76dce582f10284a3086
MD5 31105864c95e111a3472fb5dadba1a29
SHA1 5a048f60f2a7ebfe690b6b26a80ead0699afc467
SHA512 dbf3014f945fdf91333f2dc950af9fda55154aa3e9e10194e2f029d8c2ae757f14b2e7f4f0bfc7364307bdaa9d544c21c6b86d78c047bf8b999d7c1757deb9e7
TLSH
T1D4412719383428771BFF1FB2646F5A0532BD013AD9817264EE85CAAF49FA065632390F
MD5 SHA1 SHA512 TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 72cacfd107940cff38743fe70cfe3f31ce404d0212617d03778d8055239176fa
MD5 995eebfd17365a60f021449e585d74a8
SHA1 8988f9e2ff167c82546aa0c3d1371eb4c57a9147
SHA512 4403388ec4f55f91f9f1f14b95327fdf768511c6a1b108bc5e48423c1c1f5e2736f06b82a36d584fa71d4655f3db6eb170452cf4e550ab3bd93d2aaefd8bf6a1
SSDEEP 384:HXwIiO024Y7WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAZUH:36ZY7WTToXJWTTogB7S/AmVAf+hRMIUH
TLSH
T1A1728E7D9F013CAD175790E8C8B98355CD1CB6ABDFB5C06D25983D09CA88A1A70F984F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_arts_and_entertainment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
Size 67KB
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915
SSDEEP 1536:X0A993SJAA1p1MxQm6UjfvidqqishTLaq/HU0Y6bxdgRYeHk2OxFW:EA993SiAv+F6UjHiddpLrAGS/GFW
TLSH
T17F63839547EF4AF1A2CEF9A40CA708936FF551F52BD2229C1BD1908897B5FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_autos_and_vehicles.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
Size 44KB
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd
SSDEEP 768:x6/Mifb8i0x9bnuv97xrsEcgcs19DSr1euz5vciyxYZlhCU:x6pfExluv9NncNsb2r1lR6YZlsU
TLSH
T1062384A2A3EF4AF292CAF5E508A70C935F7662F51BC3309C07C1558C53BDEB504D6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_beauty_and_fitness.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
Size 33KB
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c
SSDEEP 768:I+ij0TAXOc2OuXvdCDF4FmthuYb495/SvSEtEYNZQytSYfT2TDkEF4JRe9VUwCJd:I+ij0aOc21XvdQF4Fmthug495/SvSd4J
TLSH
T167F273A553EF4AF3A2CAF99448BB08D75B7501F42BD3309C0BD1954C57BDEB404E6A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_blogging_resources_and_services.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
Size 33KB
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217
SSDEEP 768:0aXqUUKuXcV9gAJYQjhAlF803mM4xRdOROo4ZParFJoLNUz73:0aXqjKuXw9gAJYQjyB3mtxRkco4Zyr37
TLSH
T18AF252A143EF4AF2A6CAFA9508B708D35B3551F52BC3319C0BD2954C57BDFB508D2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_books_and_literature.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
Size 67KB
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea
SSDEEP 1536:fFj1H+dLa2mqJTVj0+bFkXfRwVSND7uEZz6YDqa9eLGRQssw2A2:Nj1edLa2XTBnbF4fRwVSxuEzT0iRQT
TLSH
T1D463659147EF4AF1A2CAF9940C6B08976FF551F42BD2229C4BD1918897B6FB010F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_business_and_industrial.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
Size 45KB
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9
SSDEEP 768:inUsWHNnOAvkuPPu2fYAE/ecNjBr0QOdt+RbK7QvsFe1AIKlREQTLGNfGfWeISqK:inUsWHNnrvkuPPuYLE/ecNjBr0QOdt+Q
TLSH
T1E52384A143EF4AF1A2DAF9A408EB08875FF551F52BC3319C0BD1964857B9BB410F3A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_computers_and_electronics.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
Size 45KB
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8
SSDEEP 768:6aSj2tjV9bSvFczWWepPoiKLYvmt2fNjods5cstLpIscqqWPCFOAfw3yON8afnXE:6aSj2tjV9bSvFSWR6BImt2fNzcQIcRPs
TLSH
T16F23869557EF0AF2A2CAF9940CAB08979FF552F42FD3614C0BD195485BB9EF010F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_finance.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_finance.json
Size 33KB
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a
SSDEEP 768:cieaDKbQMMvEfD4vFMLKqPYE1dRDz7teb0kz3lY80:cieqKbQMMvEfD4vFeKqPYE1dpzPkblYp
TLSH
T1B6F261A543EF09F2A6CAFD9508EB08D76FB512F52BD3219C0BD1518857B8FB504F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_food_and_drink.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
Size 67KB
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263
SSDEEP 1536:bOuA7D7UEWOGEsffwBSqW1cWINNwAnnu4p2sUSDTA1hma+36t1n:vuDoEWbEJoDCNNwG1p2fSDTAne6tx
TLSH
T19D63659143EF4AB1A6CEF9940CAB0C976FF551F82BC2628D4B9191589779FB010F3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_games.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_games.json
Size 44KB
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5
SSDEEP 768:aPlZWWBHj0sWoa2JBAyMemRwoF/GgQKP2Sgj2KxpxrXDUIsJBaU5Qk0NbrkOVlxh:MnWWBD0sWN2JBqemRwoF/DQKP2Sgj2KP
TLSH
T1392343A263EF8AF292CAF5D508B708935F35A2F51FC3218C07D1554C63BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_health.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_health.json
Size 33KB
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b
SSDEEP 768:p52SrX0UfFfol2F0Qmfw28ZVV5d1kVWWuFzVS7UpLNNpfmNzp:pYSrkUfFfol2F/uw28DV5d1kV/pUttk9
TLSH
T170F273A543EF4AF2A2DAFD9808EB0C935FB512F51BD3219C0BC1558897B9FB010F6906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_hobbies_and_leisure.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
Size 67KB
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d
SSDEEP 1536:ex2J49OJ2vESNyvm4q6FZ/jrmEn8eUvQPHqbsrEyZ0FavsBiwrq:ekJ4sJ28SNOm4qK7rx8pvQPHe0E6
TLSH
T12E63429492EF0BB1B6DEF9A40CA708976EF551F92BD1328C1F819158D7B9BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_home_and_garden.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
Size 33KB
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49
SSDEEP 768:OQUamVglKm5c3LOBRdNbtgdjdKbnWX1FV61u/oj/2WWa81l:OQUHWln5c38RdNbtgdjdKbnWX1F01u/v
TLSH
T1F0F262A553EF4DF292CEF99508AB08C7AFB512F52BC3315C0BD1959C5778AB014F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_internet_and_telecom.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
Size 67KB
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c
SSDEEP 1536:inLl7pDjTv1exoCMGh8Mnv8a0Z3b73AvW/BYCxnhFGLaJbPESGccXIdJ4XG4AL25:inL5NTv19TGh8MnveZ3bcvY5fFGL0ESS
TLSH
T1D563989543EF4AF1A2CBFA940C6B08976FF551F42BD2228D0BD1955897B9FB010F2B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_jobs_and_education.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
Size 33KB
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5
SSDEEP 768:yOloEjLuudxPXz9CIwFUwl5cw5zFpyIrf2vutr:yOloEjLuud9z9CIYd8w5zOIb2vutr
TLSH
T12EF274A543EF4AF2A2CAF99408EB08D35F7112F51BD3219C0BD1558C97BDFB514E2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_law_and_government.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
Size 68KB
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5
SSDEEP 1536:IwvZ+KSd2cFmpFGB/Sp1xAi6ZxaaF/VZhuthlV2+5pFDo/z:IOgKM2cgGB6p1xAi6ZganZ0thlR5fDw
TLSH
T1FC63639543EF4AF1A2CBF9940CAB08936FF552F52BC2228D5BD191889775FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_online_communities.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_online_communities.json
Size 67KB
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd
SSDEEP 1536:ZWJiPPEIYm4hGeujuImzVLA2Y9MMZm7nS83QFDBk2BrdICjt9EyO2B+AMwt0OwDV:FnEnThGequJtvR7S8gF1k21+C/u2c34O
TLSH
T19663769143EF4AF1A3DAF9940CAB08975EF551F92FD2228D0BD1859897B5FB010F3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_people_and_society.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
Size 45KB
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02
SSDEEP 768:7xHLNYPUAcQL9/5EGy6T21Rpuhfkqxceuj/jCPUwXF5YK4otABk3MTicb3twO:7xJYRcQL9x9y6T0RpuhVxcnj/jCPlF5U
TLSH
T1C22331A267EF8AF292CAF59508B708D39F3552F52BC3318C0BD2454C57BDEB504DAA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_pets_and_animals.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
Size 44KB
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c
SSDEEP 768:FLu2LJObDMMGynnlGGRgS3c95S6uqs8hbiiAUU+GFs8XAxr18+to4rN7:FLu2LgfMMGynlGGWS3S5S6uqs8diBUUE
TLSH
T1BB235192A3EF8AB292CAF5D908A70CD35F3592F51BC3308C07D2554C57BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_real_estate.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_real_estate.json
Size 67KB
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd
SSDEEP 1536:1HbzBc8oBPUqosGZzqWnp2HGmj2oEVK2rQoe4my08:pX3oBPlGdqWnp2H1j2okJU8
TLSH
T13F63859153EF4AF1A2CAF9940CAB08936FF551F92BD2328C1B9585989775FB010F3E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_reference.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_reference.json
Size 56KB
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe
SSDEEP 1536:CoUbONFuEIHoh/SzhzCb8RxLnIp4umt1iBfOowttMP5cRdH6Q1:CoUGFuEpSz9CWIpN21ihOhtMP6R7
TLSH
T17943539153EF4AF262CEF9A408EB08975FF551F52BD3328D0BD1815857B9EB110F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_science.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_science.json
Size 56KB
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6
SSDEEP 1536:LjYZHEpB1Uj1/uC+Kgaj+ZSftvIu46MOYwZ6pFIIP0:LMZSzUj1WC+BajtftvIu4Ep
TLSH
T12F43549153EF4AF1A2DBF9A808AB08935FF551F42BD3718D0BD195489779EB010F3A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_shopping.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_shopping.json
Size 67KB
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130
SSDEEP 1536:1vkMySD619DD3TjGVEcPtlGjsVLGNy9gvRa6a6ElLf2M3yi70rB:9WG6LDDjjQE6tlGBvRa6hxiorB
TLSH
T1F963845593EF0AB1B6CEF9A40CA708936EF551F92BD2328D1F819098D779BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_sports.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_sports.json
Size 56KB
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f
SSDEEP 1536:YwvnrcvFvtCkX5EAPqPaFg3GlEIwULrIHqBuH5qM:YwfAvgIrqPaq3GlE4Ej
TLSH
T1AA43649157EF4AF166DAF9A408AB08936FF551F92BC3328C0BD1914857B9FB110F390A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_travel.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\nb_model_build_attachment_travel.json
Size 67KB
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1
SSDEEP 1536:FNDkURt4oUTXolLQth8P2GHmB8+JEzoKGOcFhgywm3xXfKTvGHOym621Hp7JgET0:F/Rt4okQKoaaG7hPhhXCTvG4COq
TLSH
T1E363759143EF4AF1A2CAFA980CAB08935FF551F52FD2328D4BD5514897B9FB010F6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recipe_attachment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\personality-provider\recipe_attachment.json
Size 1KB
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a
TLSH
T16D41F63DB421186302E6676236DF42C4233402BE9EC17758FB88D49A5EFD5792236B2F
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 7bb140c3172895479f4516d04ed7a2662159f5781422823cbafba34916c8cf57
MD5 904931f9814f01cd60304dfe536d15ab
SHA1 ecd3269235733047edfd6730bcb2591d9486c827
SHA512 99229e4ed31fc4e943583fafad15df8a808914184efa96198ce924390e37f704dc4336376a97a3f650ae8d402be71f56a951eecc70d414b3e36baec6083dc6df
SSDEEP 1536:jTrliK35QUs/VFqc2LVlcX6OCUZQklvNWEd+VEB9EdFevJNPJfGvkPfE5+oXUY6t:j3lSqc85OCc1+VE7zJhJoC7jauey8zA
TLSH
T1F3A3AFF6DFA2CD3D65FFD0295AD2843EF9272444B3A72019C863271062C6FB86779648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dncgaxd6.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 072215729e196febbae2bf854ba4bb27408ab7eb69d3cc85c11d5c61ad536074
MD5 f575ccc19b38b35d0eb3a6323d745303
SHA1 7b3c4d3b31a9a8371d9137bd81c951ee2267cfc4
SHA512 b8393e93eb65dfc9962424d4f3b4873f7be6c8499892e2633530cfbf9fcc0e5dceea4db6603738bc4079f10ee94b12baee20b00b19fbf9963c71d1c06911d1e3
SSDEEP 1536:XTrliK35QUs/VFqck4TrsheXBrA3uuv9+EI1VEB9EEPBxJNNMkGvkPfE5+oXUY69:X3lSqc3kUXBTt1VE75J7MZC7jauey8z8
TLSH
T14CB3AFF6DBA2CD3C65FFD0295AD2843EF9273444B3E72019C863275062C6FB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e3be91a-5b31-4ad2-ba20-09cf403150b4.tmp

Path C:\Users\Admin\AppData\Local\Temp\4e3be91a-5b31-4ad2-ba20-09cf403150b4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b897a357-4887-427e-bd4e-83e922ba1df8.tmp

Path C:\Users\Admin\AppData\Local\Temp\b897a357-4887-427e-bd4e-83e922ba1df8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 559KB
SHA256 492dba1090e3c552cb55e71cd881ee207a8e06b5f1983f346ed9917a890c6e3e
MD5 77b699af864e74edaa3b740315010938
SHA1 1b0cfd9c69157d578e5c22baedcdf8d64aa43c22
SHA512 1b38e1135eb21b9d5c01f4aca92a7c1022ab55fae8a370c4d708f94d13545ed19c08747060c7b6e5b3951c97d1221407fc436b46a020660b9b11a334621d9c31
SSDEEP 12288:DhRe6rXczIdllPnaE6gzqtDa/bCOx7a63seVVscLvD2atJaiaW4nedwJ71u11XHb:Dhc6jczkQE6gzqZa/bCORjFfvrJrmjmd
TLSH
T1E3C401FAF3617CE3ABBE030B9D8A7EAD1B624122874EE0CC446767C24557729BF64404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_1730754754\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_575835996\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 b3595ffbc17bf6d680986c74c14d6d4ce39cb8ccd520f146bf2724816c0f49a7
MD5 3abae22eb2e64fcd41ec6f059575ed5a
SHA1 a699d62472b03eb4829c4477709fcaadb5dfa733
SHA512 13b9695fd883c570ea2e47c15937ec64587083de1d8339a38982499e8f7203c0ab2172b21644aeddbe62047dd4a2209cad1def12ba4f0fe5af87f4ca8989aa94
SSDEEP 48:dYoGAduJ5UgdwqaH5zKYzGAduJ/6BdwqaHPKYtGAduJ/adwqaHtNUYBGAduJBrqX:d9uDdyu/yb4u/idUucOtH8j
TLSH
T198F11F020BF70A55F6F35636BA32BB06AB33FD015A27435EC18162494D73B5449AEFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\addonStartup.json.lz4.tmp
Size 4KB
SHA256 6058beac5a97bfe0ec42ee79ba77e934f8314ea3f830d8838010c1749b2e9d0d
MD5 9fa180bb42ffbf32233bb33f6a9c239c
SHA1 64a78ee936e0aec86479c94abe54c93ab651a5ae
SHA512 7a62518d3ec03639f2aa57e4b61be63e7f517b63513fc518e9e5579a062d8667a54b004d135e2631b06e5e02081e5cd6c10f6efc2d8799dd0c632195284890d9
SSDEEP 96:NNoo4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:N+/52xxhD8rGvm6ApwnHUuhN
TLSH
T16EA16CAAD541EFA1FE32C04348D53FB2E696AB7410A9C4D0F1AB71294C64A736704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bookmarks-2026-11-02.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\bookmarkbackups\bookmarks-2026-11-02.jsonlz4
Size 858B
SHA256 4a9ab7a0544757315f2d42305fdc1a34c522032ed75126885b2d89874d3294dd
MD5 3586fd2cdd67afd729b8c31107b32426
SHA1 ad6d2b4288ba60b2a5901181a9fe01aa19ed616c
SHA512 79af73f61ef0ed4cc4d4d82f50f53902f404eb8c9ec50c70666c9903a1c3b12193252ae99769eef174a9c5458b263141d767fa632d32cfa991563d3fc73e66ac
TLSH
T185115609E5F218E40ED5007600015EF974B37E03CBD45CDCEBC90594207878453EAB8E
MD5 SHA1 SHA512 TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\broadcast-listeners.json
Size 221B
SHA256 4faaa7cd91251cf0e8e915f73ee40e33f8b9f5ed53201da75259e5c4c824019b
MD5 0c216a562b3906082554382068503afa
SHA1 db4e86f03d5d0ac0f4a731fe73314cef2e910aa1
SHA512 d5ca36cee0010328cecb42d45d72eecea856e490f640fa81cab11b1e0c23fc846634fb5df8bfdcf46be77f36ffc28cd99bb0cdffdc83c526446c8a1e54adfc24
TLSH
T186D0220E10137CBF4B89663DF40527858BAA204D3370903DC3AEB0940A2AEFC40081A0
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.bin
Size 68KB
SHA256 af4557ef9dcc3845dcfcffe4034b6c9f68f9e63c2c552a7fdf03b3bc12c4f710
MD5 36fbebd6636177cdbdfc0f3328649bde
SHA1 ab1e99d2b366f405c5b9dba5e49dedbf74d1e1fd
SHA512 dfb358227202815a32208d6701e06f6cb666b612a60757737cbe4fa57e9573129da380eab17a7a2ea555763feb9aa65eadfa8bde43c8c11f3c13bef1316cf66f
SSDEEP 1536:MkEbfY/wlcKTCxPAKDW/hXXhpzIajh/9thPddyvtH7:MkkQ/gcKT6ha/hX7VFnyv57
TLSH
T17E632184EB1A913FE82402BBACD51B143B39F8494A5A1B5B375C54782CC73EE3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 68KB
SHA256 5b2dbe4ddd5a080b833815abced3817ca8cbbb72d60ed4d6b005d042098a486b
MD5 782272b07112e219f859b751e86ddaaf
SHA1 cfed8c9d5f4118a7686a789a011dc491dcf494e9
SHA512 d40d3a506a8a8fdf574cf72e39ec1b5c18fb6e54142eeebb2a308f6fba45a7796af308caa10d2ce0fd6a147e48bd7eb1f44544ebe8e8d47beb5efa4ed4acea14
SSDEEP 1536:ykEbfY/wlcKTCxPAKDW/hXXhpzIajh/9thPddyvtH5:ykkQ/gcKT6ha/hX7VFnyv55
TLSH
T1F2632184EB1A913FE82402BBACD51B143B39F8494A5A1B5B375C54782CC73EE3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 68KB
SHA256 c07a9122404d6f534bee8adc836cc1e6ce792e23f8a107ba499446327488700a
MD5 3384bb121a45e7eb286a04b11ad5f703
SHA1 0899decdf2d9b36817f290454df1004c20fd6d97
SHA512 06b57b076b9b3a60181c719d9cb40edef21e6f459ae1d220758303dc1a4cadff176dacdc0628aab11f779b29638a4033dc039c3c6ee9414c57a532150ef41d01
SSDEEP 1536:lkEbfY/wlcKTCxPAKDW/hXXhpzIajh/9thPddyvtH8:lkkQ/gcKT6ha/hX7VFnyv58
TLSH
T17E632184EB1A913FE82402BBACD51B143B39F8494A5A1B5B375C54782CC73EE3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 68KB
SHA256 1c113c155b6241023fe27aeaa2561d8ce2c891e63d91e8aaae5e0407e94be364
MD5 84ad1a43c6982984edf91346041f4552
SHA1 9c6f261e3476682f8d2e637c8fc46ae32d2537b8
SHA512 de76c092b9ce615935972177828b5945bdf2653705f0c000b94ffe711620cf960f4ca1448126267bb432737f58c795577c62d31ab22897ad90af76807764c022
SSDEEP 1536:PkEbfY/wlcKTCxPAKDW/hXXhpzIajh/9thPddyvtHu:PkkQ/gcKT6ha/hX7VFnyv5u
TLSH
T1C1632184EB1A913FE82402BBACD51B143B39F8494A5A1B5B375C54782CC73EE3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 4d158e33ed9b39f56dde56320c7c7c733a84052f45a509fabe58d6c8fb2b686d
MD5 fb37c56640f01e7776df4437d5dcfe1f
SHA1 0c1fca0a1da476b25c8663c70f9fc46cde24f5c4
SHA512 2debe9caed065734fbadbf6af300a318db70a26fbb4c3c635928bbf8a25069ab7d0de081357d079bb7c86a16c70d2120f0d9730b35a72acf8dd21dd712208763
SSDEEP 768:O01tT5GD0Gcm+usUcBKl+sms29WbLb1b0bTbOT1STCI1/:O01tFhUcBUxu
TLSH
T12A036484EB2A903FD41442BBECA11B142F38F88959592F5B3A9C54682CC72ED3D4E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 2c62e7cbd42661e4c908bfd3d9d55bca871395d16ccaadc56893109da97c2eb1
MD5 4ec875c20d590d05519a61dc534d87fb
SHA1 f8413e4af4dcc6f630a308eda719b130ba9cee4e
SHA512 0587fe2d66b307a3557f683ef68ed7c0e805cd69ef01cfaa375518e08b5b53714e0ee3cdc07ec0f9513852a07a9c15f3f9c84e7509a22320b53615076e752bd9
SSDEEP 768:WvpHKvJT9Gcm+ux/BnRsQsfGOblbCbTbel1f6D:WvpHKvZG/Bni+
TLSH
T1EDD21244EB1A953FD42913BBDDA50B001F79B88998092FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 74884795ebc4942ec8b7d95cd9315686da02876e3f69722f9bccf79dc3e1cf41
MD5 64130672b17c4345110500d313f7acd9
SHA1 166b1cb77249ac396cdb77664c3a6bbdaabe7258
SHA512 8126feff551d686d06960ff0ce1acc8888a22f32287863a68e3846cfc9b2f8adb4d1c5ef8d43c2e03fc1b6e83490f5ac9b28952af44caff4b850ac51d9b82721
SSDEEP 768:X1lxvvpHKvJT9Gcm+ux/BnRsQsfGOblbCbTbe:JvpHKvZG/Bni
TLSH
T1B2D20144EB1A953FD42912BBDDA50B002F79F88958092FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 e7dee47595a0a419e8744d1cbc764171ccd35ba1d51cd3748029d66cf9bec41e
MD5 243164ab9d2675ef6bce21a0877fbef8
SHA1 36e0739aa62fe28057034fa0fd6e35d495ad2a55
SHA512 84981a9ce666e3a8e26cf0a2eb459bf3e86a69b454314be24edf7976f34a5d6f6a95e2bdf0dec2c91361a3afae167391c14fde0cbd2c3c4582ccff54ce865d7a
SSDEEP 768:lxRvpHKvJT9Gcm+ux/BnRsQsfGOblbCbTbel1/:VvpHKvZG/Bni/
TLSH
T1DFD20144EB1A953FD42912BBDDA50B002F79F88958092FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 26e78ed402660068ac6d3a17042211b87a51699292a2e642f3e62e0b0c04e33c
MD5 84f4b26dce3a436f6a5751a6d23c7e68
SHA1 897467250980058e6fc30654599359ad6b74cfa3
SHA512 c7b59002f6d8877b78457c7f77bdf9b46895510924d2e99186d2158efa3280e5f2ed9985e93f95a3ad36eda28b1ed4a4cc02099332205cc0e35e444980a4000b
TLSH
T124219A5C39F84DAB68CBE7BD7C4211CE93158E8A08571D430D02CECDCD95ADA32AD529
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\events\events
Size 2KB
SHA256 d68942a23aec89c4ead4be3b871178b66c98d5b9b9fb8f8e25372d0b46ff1dff
MD5 b4b1d1e55b0f456cf304a08b6a7ec6a3
SHA1 27b5b0f7408243769eb0a23f0fc4f5265c728c48
SHA512 67a42659b4e1da1ff7cacc2d9fc305d1116e11947c56a4ae02ca0f35d66a37fe37c863e30bbc54037a4ccd242f66299fbed284f3f556db1bd11fdce44e8868e6
TLSH
T1DC41CC1D25BA4CBA7887E7EDF801018D97455B8654A31E870CC2DE8DCC53A9E329F52D
MD5 SHA1 SHA512 TLSH

Submit Download

c2897045-1255-42d7-b701-9a2b5ec8c306

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\c2897045-1255-42d7-b701-9a2b5ec8c306
Size 2KB
SHA256 35b144ad23eb988cf57352fa8248baf9d67a033d4984626fe847219b637bd877
MD5 d8fd8a521baa28e17b3f823bb42b91b8
SHA1 1c726a4f5e4273faef5538518d99f638496b500c
SHA512 432763b845528370749df34b00ca1485c757b5777a33b7f46cdec491d210d231d8edc626f0f510d86241fef1ef530b4b0fa93b214b7f27c5bade36a3dbcd8970
TLSH
T17441239D77F84D7A9C9AF29D9882338E53A08E1204C62C436D95DF0CCD96699336B42B
MD5 SHA1 SHA512 TLSH

Submit Download

da826628-65b4-438b-a0fe-fc8ba019c6b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\da826628-65b4-438b-a0fe-fc8ba019c6b1
Size 235B
SHA256 a6ebed7146ab2a2dc5c38bdac8a6eaed5b40f62a66a74fdd90577d1179f5f83d
MD5 e22079f541ec6409be96ee59406072c0
SHA1 6cb348b42b8e674b7ffa1ac6c4654bf440a9db4b
SHA512 7d5955c32cde93542abda8ce1056858759bdc066989e2dbc7032ef31a4b473f4adb2626642e0e2099e5a07ad519e9df895d4cf53b2312f45a63222c4c8575dcf
TLSH
T148D0A5945494B77D58141F06F0A455D630458C3315645C10E5914574DDF9DC54361816
MD5 SHA1 SHA512 TLSH

Submit Download

e1dca475-d3f2-4a8c-879a-788f58276e80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\e1dca475-d3f2-4a8c-879a-788f58276e80
Size 886B
SHA256 d4dc014c0cc7edf2ea34f4872ec0a708b69142fcee60d183d48f4bd5367f790b
MD5 86381b48a108fc3def0aba7205a0fe32
SHA1 0a12e325c04363c49155ebc4d65619c4fcc053d8
SHA512 a2b8f5f5aa49b2d7169ed74f73a800206ed1a43f15b7aebe484ba97848b061486919cab6e83d36921628d306b9085a5c527534853cf3e8f92d097c13fefd724f
TLSH
T18B112390963876B2CD38D34789E237528AE4753380C54D087CE19F1C0DFB96E635B607
MD5 SHA1 SHA512 TLSH

Submit Download

e40bf050-2bb6-4077-ab95-fe343c5c1abb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\e40bf050-2bb6-4077-ab95-fe343c5c1abb
Size 871B
SHA256 8333bdf1c7be5139f7225c0373a7fbb1351390f544420515a5691b5454cbf78a
MD5 63937d0c59d2d509d7661f2625ce4a00
SHA1 f7a0a0e3f099499dd9c004c82c36468743ad9e34
SHA512 d763840ff07541d31f5f0e759b07c73399cfd52023e7a60b4d1e8155cf6e954cd20ceaa016398999ecf6371d36c555fdfe6e9b6af44c8ca391c1b2b0840418e6
TLSH
T1D111C095A634B5A2CC3CC24B86A7375647E4742380C545147DF14F184D7FA1E936A60B
MD5 SHA1 SHA512 TLSH

Submit Download

ed64f91b-ad44-455b-960a-3054e08305de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\datareporting\glean\pending_pings\ed64f91b-ad44-455b-960a-3054e08305de
Size 235B
SHA256 d5ef0bb680e03ae7294d7be988b2aced5c0d0b7315dedbf7b738d4040d0c44d6
MD5 395b63920bc781ce94b2d0b3dfbc3934
SHA1 7300d5f671800a12cc5f5481cc0246ef6fca8767
SHA512 2b0f57ec4cd66fb797c00342b7ff8bbcda5f12fddba8555aec3017652d082d2aeeeedb67461b5a8885467b2b3c45d9f84e8cfb70867f148754a8c613e7193bdc
TLSH
T10FD097C02488672C08280F07B0F029C770D44D3310706C109AE281B48AFEAC8C266C0A
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\extensions.json
Size 14KB
SHA256 81529e227f97db678f4e943a0e025041de3388f8384d9c98ba1237a019efb5a4
MD5 288956adf7187de89d7a601b4516e928
SHA1 afcd4464b9589ab1c1659afe84df74a7c3df5876
SHA512 14463148c12df76d6ef56673ab85265755d9d21081458ca2a95b8598511a1811f09315e3f2e58a558861962b98d71acd72019eb1dcc0c2bef76d5f3f4b2d73fe
SSDEEP 384:OkI4vbUmldvH8dhWI94zH96oTL4HFL4PnL4H+L4H2L4HC:hI4zRfkXF4B6I4F4T4k4c4i
TLSH
T18862521545149EB8298FA79BAA367E02C37D473B60445C78F4DC8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 12KB
SHA256 1cdaa421e445b4d36d7a2bf04cc542118f1701b043c47d1ad2bea2a63dede6bc
MD5 0af344488dda5d2d417a82d270706412
SHA1 a4bfd4ee9a61cb9a76fe274cbe8f770b56917e84
SHA512 068ebe3fc44f45d57e581e1c6b6edfce992468fe448a16e6964c8e14487625b5b8d665f758368337bcea9e09d4f147ca602cbd67fcdef76de9c2cd1c7f4099fb
SSDEEP 192:uLRofLN+xUSSO8LRUFhi7AopO/Bw88TolpgFXyz:XeUR8M7UwsiQ
TLSH
T19D42BC385181CB7F20F2327DAC2149A019614177BBBFBCD645F998D2084CF2451FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 6KB
SHA256 ca792338cb8067a8325bf712d88242f404b005db311085b8177816ff163366be
MD5 15ba0e1e704cfe50ee9d0e9dc85a1d4f
SHA1 707e6ed6074905794063fa609db8d59f716071db
SHA512 d20af41f3fd8c0aeb8a3fda06699245276786851ff5c10370c43e4ab842cc5c41354236c1df07f75a77baf0f0dedb19baaa76e13f7d3c4192d8db5cabc04627c
SSDEEP 96:xHzUTUXqGq3YfFiA1zSfSSlddv9j8UnT2HDbxYwNiouAQBw88u8L4cnCVAU:dKRofFiAySSsEYDFhi7AQBw88gv
TLSH
T10BE12E789148CB7F64B6777C6C6888715AB2013BB7BF68C350B65484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 6KB
SHA256 1c11207a844bee83c36ab0dc181648001be43adb3ce2b37d1e31cf67dbbff996
MD5 b7ea9781aa89158ae531322c2ec1a76a
SHA1 226d6add4ebe15d4731360e3f02e01f5fbc25744
SHA512 50e3a5080e3f1ca1f8b9ae6f069b3e7d4d33168175d49a0f2cc5844441c24b12d372f3330f6d0a26c05eb13dab44f76d5ec4226d53bc34fa1e3942af18070d7f
SSDEEP 96:xHzUTUXqGq3YfF9T+ObzSzlGSSlddv9jGnT2HDbxYwNiouAQBw88u8L4cnCVAU:dKRofFN+xUSSOYDFhi7AQBw88gv
TLSH
T1E0E12E7894488BBF64B6777CAC6848715AB2013BBBBF68C350B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 8KB
SHA256 a0771a7715a8ae3ae5d7e068ab130ccac07f66316c98c50d976a5c1be14ec9f1
MD5 3b95abb85d550661fc1d79d1d8ad5549
SHA1 ee12a262cd08758f7389952473af4a3370260433
SHA512 46bea7dec9f6cd6a4b0e60fedaa06a6f3c3601a2ce4a854752518544b2c0e220ab35eb5fde62a75389f6f3b2541e7c8300943f4bff3b9181b93cecffb1b03a86
SSDEEP 96:xHzlTUXqGq3YfL9T+ObzSzlGSSlddv9jGnT2WRkHbxYwNiouArkJBw88TB8L4cnk:dLRofLN+xUSSOdRUFhi7AoJBw88pv
TLSH
T13E020C389144CB7F64B2777CAC6448705AB2017BBBBF68D650BA58C5054CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\prefs.js
Size 6KB
SHA256 e0163c56e5c8ef8958cac32db9c38dc28da50734cb0e65f2b904c97b7f7ed214
MD5 636837d3676630a4772faa5f51fcd9bf
SHA1 d4fc5f52b84d123b0f710565e955834043705aff
SHA512 eaafa753f317a46cdc62b443f485298bd37b66fa249b6d189d03c4e19dc0f8bb0a91f2bc280c09d75473bf527d2ed8a352b72d3fe4282fdf1d0eb3b881e1a577
SSDEEP 96:xHzUTUXqGq3YfF9T+1zSzlGSSlddv9jGnT2HDbxYwNiouAQBw88u8L4cnCVAU:dKRofFN+eUSSOYDFhi7AQBw88gv
TLSH
T1CFE13E789048CBBF64B6777CAC6888715AB2013BBBBF68C750B65484050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\search.json.mozlz4
Size 350B
SHA256 2a317a8ff64d03538667913a28d8769f7483b207d7949590e83bce951ff9fe4a
MD5 5b0b702887315803a0d66bf23c85ff0c
SHA1 a2b7ee615928ffafab10df9dfb5e5c6aa7ab564b
SHA512 e5372c75a6e0b43982abc442e85c7d04b4051235e8854294e0a74c77b0217997237d8b3e94314dcff7c0483b860d79a21e81cd2e4c1e01650e3e466d68dac3aa
TLSH
T128E0C03F981060B6C25C05436F4F454B0F04583A8234A84C90A94D42803FF5E125C52F
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 d47a8ee6948245b88f542c4cdc9a0ba4f773cf4f2e51dbb902ee7604abd69786
MD5 139e7c68599d254ef9e8a2f1df9619be
SHA1 53925b40e275eac2d3ed8d3d6f528ba051556404
SHA512 f67ea47e3b62fb2abd4877157c54630eeff7e51a4bf88eaffe4abffd479accad9a3dc57ab1c27534082e60568664564a6707fff0a552d44a91b118cd387fe868
SSDEEP 96:dbifL9LUdeW9jILA0NjoB8kMJttn0YJZQjm:p8L9kOnNcB85JttnTZGm
TLSH
T175917D032B1B29A3FD5B8A9FEF464CE105B4314645C144E890CF6B16B66FA4B785847A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dncgaxd6.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 61e14f0a9f15a978cceddde0ba78fe044027df801fa8c5971415e5df0047ac8d
MD5 7821ccd0dd27f514a3d325a5cff7b3ad
SHA1 40f7eb1cd6553549aa405df2c39b9e161a2c31e2
SHA512 abc174020fdba91198022d9e1401f964d317a95765a01304322469401c42ca17d16cb59a80bbe8a896f0c0006f9382591ef4e6154e26971dc8cf8d46e691cb8a
SSDEEP 96:dbifL9LU7eW9jILA0NjoB8kMJttn0YJZQjG:p8L9gOnNcB85JttnTZGG
TLSH
T110918E032B1B18A3FD5B878FEF054CE10574310A45C144D890CF6F16B66FA4B7459479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download