cfa111e4e1bfbd6a6c66e41a87671323efac6828226b4784715dce82d957bad6

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
modified.exe
Size 6.2MB
Sample261102-bddmjsgt6n
SHA256 cfa111e4e1bfbd6a6c66e41a87671323efac6828226b4784715dce82d957bad6
MD5 340e8b5060188e4c8b0cd1af3d2ddd77
SHA1 d93b7cc3e3526116653a1b502dc59617c450ccb3
SHA512 d4262563149d253b3358ddf9079043ce36ca13b7ac6c95a3efb70c61417ab25c757c7b5d24de489b91ba18221ad94991c5bdf6cbf0c8f5ccbab904e8d96c1310
SSDEEP 98304:G1cmn6Fp7Cb3LfG+P46g18frP3wbzWFimaI7dlo:bFp7CrLHgbzWFimaI7dl
TLSH
T1AE669E52BE8D8176C91A11311B3DAF6A5229BD247B2855C3B2703F7EDC723D1283A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\modified.exe /onboot"	modified.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	modified.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	modified.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	modified.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1179854877\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4776_1205316396\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4776_1326991100\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6316	3532	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	modified.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4812	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "modified.exe"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "modified.exe"	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	modified.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	modified.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\modified.exe"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	modified.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	modified.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	modified.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{CEFD4E6E-23A5-4958-B0B4-7556EB73197D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	modified.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	modified.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "305"	modified.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	modified.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3532	modified.exe
Token: SeDebugPrivilege	4496	firefox.exe
Token: SeDebugPrivilege	4496	firefox.exe
Token: SeDebugPrivilege	4496	firefox.exe
Token: SeDebugPrivilege	4496	firefox.exe
Token: SeDebugPrivilege	4496	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
3532	modified.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3532	modified.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3532	modified.exe
3532	modified.exe
3532	modified.exe
4496	firefox.exe
3532	modified.exe
3532	modified.exe
3532	modified.exe
3532	modified.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 5948	3532	modified.exe	90
PID 3532 wrote to memory of 3808	3532	modified.exe	91
PID 3808 wrote to memory of 4496	3808	firefox.exe	92
PID 3808 wrote to memory of 4496	3808	firefox.exe	92
PID 4496 wrote to memory of 704	4496	firefox.exe	93
PID 4496 wrote to memory of 704	4496	firefox.exe	93
PID 4496 wrote to memory of 704	4496	firefox.exe	93
PID 4496 wrote to memory of 2756	4496	firefox.exe	94
PID 4496 wrote to memory of 2756	4496	firefox.exe	94
PID 4496 wrote to memory of 2756	4496	firefox.exe	94
PID 4496 wrote to memory of 2756	4496	firefox.exe	94
PID 4496 wrote to memory of 2780	4496	firefox.exe	95
PID 4496 wrote to memory of 2780	4496	firefox.exe	95
PID 4496 wrote to memory of 2780	4496	firefox.exe	95
PID 4496 wrote to memory of 2780	4496	firefox.exe	95
PID 4496 wrote to memory of 5932	4496	firefox.exe	96
PID 4496 wrote to memory of 5932	4496	firefox.exe	96
PID 4496 wrote to memory of 5932	4496	firefox.exe	96
PID 4496 wrote to memory of 920	4496	firefox.exe	97
PID 4496 wrote to memory of 920	4496	firefox.exe	97
PID 4496 wrote to memory of 920	4496	firefox.exe	97
PID 4496 wrote to memory of 920	4496	firefox.exe	97
PID 4496 wrote to memory of 3600	4496	firefox.exe	98
PID 4496 wrote to memory of 3600	4496	firefox.exe	98
PID 4496 wrote to memory of 3600	4496	firefox.exe	98
PID 4496 wrote to memory of 3600	4496	firefox.exe	98
PID 4496 wrote to memory of 3168	4496	firefox.exe	99
PID 4496 wrote to memory of 3168	4496	firefox.exe	99
PID 4496 wrote to memory of 3168	4496	firefox.exe	99
PID 4496 wrote to memory of 3168	4496	firefox.exe	99
PID 4496 wrote to memory of 5328	4496	firefox.exe	100
PID 4496 wrote to memory of 5328	4496	firefox.exe	100
PID 4496 wrote to memory of 5328	4496	firefox.exe	100
PID 4496 wrote to memory of 5328	4496	firefox.exe	100
PID 4496 wrote to memory of 1664	4496	firefox.exe	101
PID 4496 wrote to memory of 1664	4496	firefox.exe	101
PID 4496 wrote to memory of 1664	4496	firefox.exe	101
PID 4496 wrote to memory of 1664	4496	firefox.exe	101
PID 4496 wrote to memory of 5580	4496	firefox.exe	102
PID 4496 wrote to memory of 5580	4496	firefox.exe	102
PID 4496 wrote to memory of 5580	4496	firefox.exe	102
PID 4496 wrote to memory of 5580	4496	firefox.exe	102
PID 3532 wrote to memory of 1668	3532	modified.exe	104
PID 3532 wrote to memory of 5760	3532	modified.exe	105
PID 3532 wrote to memory of 5088	3532	modified.exe	106
PID 3532 wrote to memory of 1172	3532	modified.exe	107
PID 3532 wrote to memory of 4776	3532	modified.exe	109
PID 4776 wrote to memory of 5356	4776	msedge.exe	110
PID 4776 wrote to memory of 5384	4776	msedge.exe	111
PID 4776 wrote to memory of 4812	4776	msedge.exe	113
PID 4776 wrote to memory of 5384	4776	msedge.exe	111
PID 4776 wrote to memory of 5384	4776	msedge.exe	111
PID 4776 wrote to memory of 4588	4776	msedge.exe	114
PID 4776 wrote to memory of 4588	4776	msedge.exe	114
PID 4776 wrote to memory of 4836	4776	msedge.exe	115
PID 4776 wrote to memory of 4836	4776	msedge.exe	115
PID 4776 wrote to memory of 4836	4776	msedge.exe	115
PID 4776 wrote to memory of 5112	4776	msedge.exe	116
PID 4776 wrote to memory of 5112	4776	msedge.exe	116
PID 4776 wrote to memory of 5112	4776	msedge.exe	116
PID 4776 wrote to memory of 3936	4776	msedge.exe	117
PID 4776 wrote to memory of 2472	4776	msedge.exe	118
PID 4776 wrote to memory of 3936	4776	msedge.exe	117
PID 4776 wrote to memory of 3936	4776	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\modified.exe
"C:\Users\Admin\AppData\Local\Temp\modified.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:5948
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {98bd983e-44e7-43dc-a086-3e9d477b8132} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:704
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {84124d08-6454-4f6a-982c-76f651455e42} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 25164 -prefMapHandle 3956 -prefMapSize 270279 -jsInitHandle 3960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {e3be5748-7668-4566-b8cd-caa3a212fdbc} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4108 -prefsLen 27274 -prefMapHandle 4112 -prefMapSize 270279 -ipcHandle 4180 -initialChannelId {a1ccd505-c48f-44e7-8d8f-53047bf044c3} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3080 -prefsLen 34773 -prefMapHandle 4452 -prefMapSize 270279 -jsInitHandle 4456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {7052891f-11b8-45a9-8c84-ab7ce975ff1e} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5068 -prefsLen 35010 -prefMapHandle 5072 -prefMapSize 270279 -ipcHandle 5012 -initialChannelId {5bf63a9a-1fcd-494c-9a77-3714a6aff5a0} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 35062 -prefMapHandle 5296 -prefMapSize 270279 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {9402e872-4039-45db-8438-7896b053228c} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3128 -prefsLen 32952 -prefMapHandle 2924 -prefMapSize 270279 -jsInitHandle 2996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {063967a6-35ca-46e2-89e1-265b860a787a} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5328
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32952 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {8e35fdc3-6669-4d3c-a3e0-a3cdeeeccae6} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6044 -prefsLen 32952 -prefMapHandle 6048 -prefMapSize 270279 -jsInitHandle 6052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {69f9f1c4-6089-4b27-a364-325cd8020628} -parentPid 4496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5580
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1668
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5760
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5088
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b16
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x318,0x7ff81543c188,0x7ff81543c194,0x7ff81543c1a0
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,1735818794533134263,12516604905075729822,262144 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,2021272802137709017,4190146911870287684,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,11044887677525390707,8158809041184929328,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:13
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,16636051417842231504,7571540955310710712,2097152 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,5380587045810782329,4242137937401365320,2097152 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,447523277471300207,9838497914984779742,2097152 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,17643581192680906494,11268668651587199977,2097152 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,7598579324095326435,3951267997706773146,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,3183646510335213618,15300462178832927448,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,5453574010565306544,14087446698109386284,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:6496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15763507888590190712,1924237384492397297,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:6620
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15763507888590190712,1924237384492397297,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:6628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,257978094239868124,11322073348609081274,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,11577910877733618299,1099120314415138450,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,13676588256576224204,6467124506518426674,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,17400938427388373913,8057180755520600386,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,5553022184270515006,16293869660056876404,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,6335269196903448963,1841281708112518499,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9575803097849703977,4063978253962900673,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,13502220095805759569,1088907186581148530,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,7791684342277911991,12260410053749494380,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
    3⤵
    PID:6276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,2886248869579225592,11072302452995727813,524288 --field-trial-handle=2200,i,11081944838301778691,11254133941391382077,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
    3⤵
    PID:6876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 1456
  2⤵
  - Program crash
  PID:6316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3532 -ip 3532
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0d567722-ab75-4ce9-9825-4eb5648223b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0d567722-ab75-4ce9-9825-4eb5648223b5.tmp
Size 39KB
SHA256 a6abf8a27375b44f11ad9dc631145db77e113eb9fecdc56c7319d57ff3c1f9ef
MD5 b16ef2e6283525912966f52f59a1ea15
SHA1 6aeebd292f78b18bf8fc1afc17548d7af890b6b7
SHA512 7304ca6fe1576551787c7d232ec667062aade1a5f7fa9350a18b6b008b776669e5663f1df3f098ab274f49b4978b5d0d7447b90cc276bbec67fcddcd4b887037
SSDEEP 768:M2/UxvxjgC+j3JeHaKnJ0a5xDc9bsMSJz/Fn/T1lC:qZj3+j3iWMVQbs7JTRLC
TLSH
T1FD03C0759CA15C53DCE7A740768B7A97FFF409A3C8C52D9889D99F0C06873AC234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20f43c0b-76c5-4c46-8b41-eabccae5d8e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20f43c0b-76c5-4c46-8b41-eabccae5d8e3.tmp
Size 34KB
SHA256 50dafd103ce96a26c4b7feb399c6ca3af4dcc3c50251d134ce1fbd3eb00c05f7
MD5 bef3e3fa974cf0babec1ab560e84232e
SHA1 e0f4b5b7e5382b6ca74b482e64a900986a1dfa68
SHA512 536c3117fb1bc33460ccdf13b00821381ea7830bb9623bcd45bb50a7ecef4ea41e3743e1689c4aec19bfa65fa60288c95ddd7b97bd4a2a4a97f714217b3e3b75
SSDEEP 768:MrH3JenaKnJ0aMxDc9bsMSJz/Fn/TE75E4QLj:cH3CWPVQbs7JTRkeX
TLSH
T182F2BFB1ACA15D63CDE79741768A3A97BFF05593CCC91A84D9CAAE0C01873DD334B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

271f9aec-4def-45bc-986a-5615d6ce2c88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\271f9aec-4def-45bc-986a-5615d6ce2c88.tmp
Size 34KB
SHA256 4433484ae7eaf9c92455554a07b88abdcfe3b287cf8cc7c2138a579a921b3395
MD5 78305cba1d1101cba38ff915e979d50b
SHA1 5d1a3a7eaf9b086c992047f08848ae80146b3551
SHA512 9addaa1749ce2cb13765d01b4f510fd459acef575416ad640540bfcae0a1e1702486c33fc55e48f105930ad05423632c04f20e1a318e82944b4856e2d87f7a34
SSDEEP 768:8rH3CenaKnJ0aMxDc9bsMSJz/Fn/TE75E4QLj:sH31WPVQbs7JTRkeX
TLSH
T1BFF2BFB1AC915D63CDE79741764A3A97BFF05553CCC91A84D9CA9E0C01873DD334B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

470bba40-8e4f-457c-b099-57ea30a4d9e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\470bba40-8e4f-457c-b099-57ea30a4d9e0.tmp
Size 37KB
SHA256 bfbd9a40f4ec4b3d8d222687f17fd9eedc21556c209aa58dae4b885afc7b1b2b
MD5 5ea2ac21bca3185a522d655fe26802a2
SHA1 45d482bc4e640b400f533471bb5bb5e9e720d7df
SHA512 0f0505a64261f414416acc0874a4d16b69b6dd06a459702d1ee0543b7a7497787d5e2a9500a56567e2cafce5c743ae480a1b3e5b366407cab73ef3bb77a3835f
SSDEEP 768:z/UxvxjgC+U359KnJ1xDc9bsMSJz/FnnHSHXPyK/:GZj3+U36DVQbs7JTNSb/
TLSH
T1F403C03AEC505867CDE7A7803A8AB657FFF44953C9C529A449DD6E0D07CB3AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

251d040c-512c-4747-a054-420d53be2c42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\251d040c-512c-4747-a054-420d53be2c42.tmp
Size 105KB
SHA256 1d62e22dec5c299be491cb2f809a917a5b2650bcf6f26d1655b204a91c995427
MD5 a1423f7d471bb13fff5ecfcdaea6454c
SHA1 7ded49e29e2ee4ecada313702dc82cddf87e8600
SHA512 6e90c834830dc60cf4e69d47a842a672355eeac4f32e8a0122d66df5ce75da4ac71274dc3cb208dbb06f3cd4f506485158442b7832ede2cf24ef8c5b26c1705b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T119B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

13e717ab-39a8-4baa-9e52-5acbf413e299.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13e717ab-39a8-4baa-9e52-5acbf413e299.tmp
Size 11KB
SHA256 818c74cae385aac47602caa5db51e6e9fa748327aa5ddda580b79c966421d063
MD5 be037cbc69c58744fe3ae14ad60c9611
SHA1 3690c69af77d05df428c83080bb27580f8b75eae
SHA512 51a5844c7cef6b45a8deb566be075198685d619b37d3b84ea45b2939f1544c9c4029533ff1b97709dd0a768a390735fae58df9ed75d3cef4c3bbd48475af4009
SSDEEP 192:sxRQRRC6/f51s57ZazoA8ppEU/g6+WNYEVoy/YtkuUu+GEIgVwHJ:sxRQS6/f3s51XSU/57yy/HLmp
TLSH
T16642C856AD78A93B9CC7D21DFB59BF13D2F91032A0D11E48E6FC9A1C14E66DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20dd92df-590f-4f8a-ad71-6569e770d902.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20dd92df-590f-4f8a-ad71-6569e770d902.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58f8aa35-c7ad-4aa5-82c3-e93406deb353.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58f8aa35-c7ad-4aa5-82c3-e93406deb353.tmp
Size 11KB
SHA256 f2e3b0755782f251787a13810c6618d697d43099c5e08c83d07d14d096c04f01
MD5 6577b16670f0bdc5e078dec5e7c4d086
SHA1 efb5dad05af5a7e444e678cc18a10636d08bd525
SHA512 204b0a113bae227936729baf17dd8075611a3b1aedc03191c1130b2095506d45a1ca7f410ea104d0e7f09a4ac1c78ff77e7daeba811879955d29525136488f19
SSDEEP 192:sxRnRRC6/f51s07ZazoA8ppEU/g6+WNYEVoy/YtkuUu+GEIgDzCwHJ:sxRnS6/f3s01XSU/57yy/HLRp
TLSH
T13742B856AD78A93B9CC7D21DFB59BF53D3F91032A0911E48A6FC9A1C04E66DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e732797aa8f535143a59640e78635d56a5ae1944127b76c8ab9cdec74b6ae9db
MD5 c2aa11835650c6897d68609734fd9fad
SHA1 4525c3bf7a1cdf25cfcd3783fc754cd1945f051b
SHA512 57aa9b9f22670d8462411c460e2738ef678680d18a5a641167910dc303b4003116d3d58dca0eb41807b084989091082eddb64807385235778a2ae56ef1ec7729
TLSH
T194615E8276B5864EF7B88830DAD7DDCA7A30BF95404F1F2225A4E8F19809717F8940F4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b11605e2e477fb55dc27a4ef80ef216f88968b814191855b7b12670038504742
MD5 110ea7d73b31b5065677043f476635e4
SHA1 41d25ab317f73975e18742e729d1e14f1bff24ca
SHA512 09cf5009a77168df127b6edcb91b5586c3497ec2c9002c6a5188c392a8e17e20f9a8ebf7dff158ec3ab07aced5f24f17d2ef20e8c08dcc97e5cbf07424001098
TLSH
T135614E8276B5864EF7B88C30DAD7DDCA7A30BE94408F1F2225A4D8F19849717F8940F8
MD5 SHA1 SHA512 TLSH

Submit Download

0c1ed0be-7a5d-460e-9d4c-dcce6ae115e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0c1ed0be-7a5d-460e-9d4c-dcce6ae115e5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

0476677d-0fd1-4312-8b6f-f6017c1c2a57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0476677d-0fd1-4312-8b6f-f6017c1c2a57.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

197860b8-bb5c-4bab-989d-e050d9eecbc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\197860b8-bb5c-4bab-989d-e050d9eecbc5.tmp
Size 2KB
SHA256 518640d86fb4889989c4aac05e8f23a58d8e333eb5cd6f378db75e40cd1f2280
MD5 f29c5546067a58b698f24e7e6f8ba672
SHA1 1757af4c5bd71f8974a666bd10925e5643f250f6
SHA512 c522f637d8e40049ff2ecf7a86c9aec88e419c63625b8e5f4c18037f632bfc00a7c1788a70a2861216c6b316dadc6ff5b5c8a5f57bf2b0364b6680e446a3f025
TLSH
T19051A0F383F9852D8D1156F0AA186E1FCE1D0914432C7D9A89E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 94d8e65a68eb91d855589627cbfcb5264198d04341c6c6801324661503b2929b
MD5 408a5f11e7c916e5ee76d060256e38c2
SHA1 1810026e0e42370f2d8f8275f45c4e643ae36733
SHA512 dc82b27dcc7289b2101b96c11b016dcd272c8ec4449048c743b11bbb969cf2b0cc59b7d37ae7ec8e072052649615779b208f96d0e93142d74fc0d04fa9515770
SSDEEP 48:KssIDKRakJRIFKSYY3ycUHA0yK62MKN9Ib02KCT6e2ucmd1ONxIdKKoI/yMZs7Xm:KssAKRa4R2KSY62d6KWYtxqKKoyV
TLSH
T172B1F12232671201393F791CE5E4B79B024736A33029E52B7BE984A589E7E141DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c39cf5a5-9ee6-47f8-95cb-56a90d111d3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c39cf5a5-9ee6-47f8-95cb-56a90d111d3f.tmp
Size 12KB
SHA256 2b449f40d4e85845b5126923c2a54685f3508f510148a49c06c9cc4d7d8f8b86
MD5 9f379e2da1c05f85e52ed8cecbb1f1b5
SHA1 78853173e276ae21211dee6529f19cfd003dd436
SHA512 5bf32a06029b0eebda993161e15c61233eeefcf794824ffa30db657585643ab5e899927c8fc2b5a30e5108c5687e4ae6f86942f8401234fe21e7787ddff8af0e
SSDEEP 192:sxRnRRC6/f51sV7ZazoA8ppEU/g6+WNYEVoy/YtkeUs+GEIgDzYwHJ:sxRnS6/f3sV1XSU/57yy/HlPp
TLSH
T1A442C856AD78693B9CC7D21DFB5ABF13D3F9103260911E48A6FC8A1C14E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7cbd7fd-118a-4739-bf95-92bbe5e640e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7cbd7fd-118a-4739-bf95-92bbe5e640e9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

de40df5a-2c6a-47d7-82ee-cc954fd6df63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de40df5a-2c6a-47d7-82ee-cc954fd6df63.tmp
Size 29KB
SHA256 b1ad77b9fc1eaf11760c86a035d5cedf22b19fd863459f6c46c4ffd39a1c66f6
MD5 92cb61db400024d366026a2ff28f5f2d
SHA1 07dafd776cdf18878c69fad1184c37d257057191
SHA512 8db90b25424ea2ba825587cc5904357ff8c8ab9ad43e50cbfe4b168c5c15009f45162c4d15b47e240025109e21ddc5cd613b7db0e5bc6075ff0a2902ed8994c1
SSDEEP 768:dmGxQP7pLuLjjsWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OVAwIUGetromLCei:dmGxQJEjjsWgmMfk6u1janwIVeGf
TLSH
T106D2DA7B740CCB7E4F804ADDAD197E9F6DA802CB9698CD8047F9941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e8e4434-a99c-4bdc-b3b6-b179b45bdf71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4e8e4434-a99c-4bdc-b3b6-b179b45bdf71.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ce179431-23bf-4c3d-8869-f5d08b25efbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce179431-23bf-4c3d-8869-f5d08b25efbf.tmp
Size 42KB
SHA256 be4ee56efb12d7890d0c2bcd48ef9ddca03f7dabce0e56a8f7b271fe5eea978c
MD5 114330671988efd88ff2fd7512f6ae27
SHA1 781feffb07f705804dbec905f6c1e57dd6d71dee
SHA512 94868968be2be50ee62458f2e40e97be695d155ee6be44f2be9f52e186675d695fc11c86a1dc4fe15dabed535cbf00193cec3d99f5ee7562f5490d7675688b6d
SSDEEP 768:EfFdF3Lwg+eB90nJ0aOxDc9bsMSJz/Fn/TE75E4QLj:OF3MWRVQbs7JTRkeX
TLSH
T1B61338F198D38977D9AE5783677D3D46AABCC153B8885884BBC55D0CCC862BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01fde15f-ac30-484b-8674-cf35d109546d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\01fde15f-ac30-484b-8674-cf35d109546d.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

40e3dded-174c-4f64-b03d-837785a9e547.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\40e3dded-174c-4f64-b03d-837785a9e547.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57aac26f-a7a2-4ece-a0c2-7e26e7550ea0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\57aac26f-a7a2-4ece-a0c2-7e26e7550ea0.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

ac836526-0c12-4e90-9adc-77b53bdfe251.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac836526-0c12-4e90-9adc-77b53bdfe251.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f7f9f188-20b0-484b-9fe4-0edc0af759f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7f9f188-20b0-484b-9fe4-0edc0af759f4.tmp
Size 38KB
SHA256 be369035e7f46d123fa0b6d367f43f2c5381931a12b35d7b68538d32612aa55d
MD5 db792fa19a10ccf4fce6d9af958fab40
SHA1 7d171c38b03bc9c8ae3032dcafea6ba808dac9c4
SHA512 cd6e0bb59b7216b6ed39053a177eb762bf9651c333cfcf2e8bc679c3d068437ad55a4494fcc92e2d77665e4aecfb89fe815b06e0ed101bdb9f503eb82473f18c
SSDEEP 768:ns/UxvxjgC+U3wXUKnJ0aVxDc9bsMSJz/FnGTSHXPyK/:ZZj3+U3uWGVQbs7JTuSb/
TLSH
T1E203C035DC515C53DDE76740398BBB97FFF419A3C8C529A899D9AE0C06873AC2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.contile.json
Size 4KB
SHA256 05d1b089bdf044c66e5180602f600d06fdf96b0434b7ab8fafdae3458ec35c0e
MD5 880539410a4b95ecf15374d7cb400c04
SHA1 ed3fc289621346d9104bc58f14541f1775262d5a
SHA512 ca729e4da9ee26c0454af7f4918d7ce43607b524cf4790eaf333d8ee287b6c118a7162105d3cf6098c85d7db0123a79b29d5c4ba5027d52f38489d0138c8fb46
SSDEEP 48:YdbA45eDZkyaWM1Fpq3qio2Qnmqp4Je5eDZqyaN1ZsQRsNGjy6T+jiRgQ+nqpNHc:TAkMd9nmcTEZIT+mRB+nYgDAgxlz
TLSH
T1FC91C8BB883054120F75E6F16C0F27A8F107B406A9F08AEC7179AC60D59C7EED0D7988
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 b9f2f3fcc101fb42b863e4b1872403b433a6c8b23c430e8886b4efd8a026f32e
MD5 acb3d441c29fbb554d06d3f127d74980
SHA1 72bdb1f5892c2167f90e3327c54a131074ddd586
SHA512 a9f700fc49a5ae49c000eb5ac320db3e92c3025126f46544172436200ce33d65cbcc1545064b45d3df9e96a3866c6b8a6e0561d95e6701fdfa50813840b9c2cd
SSDEEP 768:ny7lh8TtAb/rOKF3iYxBIOkj51mPJmfIvX7+GxfOOrCkOb8P:y7zh7rOKF3FxBIOkNEcLGx5ObK
TLSH
T1427319A3A2F872BB1B9237D72C0F799B62D20555E38506CDFCE9C91C828D254433E5B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 175cb0ec6905095e22beda741e88f3762d578c2f13853843b5a85fb42d4c01c0
MD5 5cbd93247943b4a0c57f7db50149832d
SHA1 12c798f9cd300f535f134b2728af8cbb435bf9ee
SHA512 e74913fe40142000418905d306e4aea4c97b017618c161f7da7564152ecf41b00a1f4ce5d60333b9695e1fe18048693503445ff6e2ac0cd129345501180d5368
SSDEEP 384:HXwIiO024YIWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAZq8:36ZYIWTToXJWTTogB7S/AmVAf+hRMIq8
TLSH
T1BD728E7D9F413CAC175790E8C8B98355CD18B2ABDFB5C06D26983D09CA88A1A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 5319ce2022ff08093df4888a6387ef3f80214ef8e1565bd1e8bbeb0175fc884b
MD5 76795d60f6dee25e63b97d4b57ae8714
SHA1 437315a56a7b64a0da5c390a8e25580c019c0ab8
SHA512 e9fb54008c5e9ddf28cad2d65a179ba1734fa7e5fcc81737983c2615b210d54695d33f809a1907b67fc9a3da3943454562851df8439cd7f9cd11896f33267289
SSDEEP 3072:X3ltOQgN+1l7d6p3OE82wpdJDfxmLGBGZ:FtRXlMp3Oz2Ud+LOGZ
TLSH
T101B39EF6EBB2C92D64FFD41DA6C2C83EFD226400B3E72005C823635555CAFB86679248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 100ca4ddffe6ae54ecec054c5b63ecd8b024e386c9fd628e9b28a761c7103926
MD5 015892f059a364c5bc97f0d64be62316
SHA1 fa238383525e75a6d182f29c38ae69c59754e53c
SHA512 87e4189189587fec48add73a89253970801251078deb41a8f23ddeddbdd00f8ae35a34a442b94a382ce877242d58565a4ab0deac67a3d45e69252aea1fbc20f1
SSDEEP 1536:jTrliSThBeDACQgN+1ErOFStnY+NOsMijnsOE82nJqpdJDR1x/h6oSWrVaFC8/lw:j3ltOQgN+12t8OE82wpdJDfxmLGBGs
TLSH
T1FFB39EF6EBB2C92D64FFD419A6C2C83EFD326400B3A73005C863635555CAFB86679248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

761fce1d-e861-4860-b3bf-89a68a39140f.tmp

Path C:\Users\Admin\AppData\Local\Temp\761fce1d-e861-4860-b3bf-89a68a39140f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e99ba599-29f2-4188-8a99-4422c0f21c05.tmp

Path C:\Users\Admin\AppData\Local\Temp\e99ba599-29f2-4188-8a99-4422c0f21c05.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4776_1112478920\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4776_2039849850\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\addonStartup.json.lz4
Size 4KB
SHA256 235f37d60df37db5caf9e6c938d1030306e8764abe8d0445da3e5c392bc57c4f
MD5 d7f9d980a91fdb279a8783aaef653d87
SHA1 c05ae59ff5bf03734f8de0385c5b8085b4c28bb0
SHA512 a765e3b94c62d5d4cdc2cb2b0e883070341fbb4f2d32c70dccfe1dc1ace7e58d57975eaca53bea179ec3f321b073eb1e69e42176328905571c4cc8348f7698b0
SSDEEP 96:N0w4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NU52xxhD8rGvm6ApwnHUuhN
TLSH
T1C6A16C7AD541EFA1FE32C04258D53FB2EA99AB7414A9C8D4F1AEB2294D64A735700340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\broadcast-listeners.json
Size 221B
SHA256 4faaa7cd91251cf0e8e915f73ee40e33f8b9f5ed53201da75259e5c4c824019b
MD5 0c216a562b3906082554382068503afa
SHA1 db4e86f03d5d0ac0f4a731fe73314cef2e910aa1
SHA512 d5ca36cee0010328cecb42d45d72eecea856e490f640fa81cab11b1e0c23fc846634fb5df8bfdcf46be77f36ffc28cd99bb0cdffdc83c526446c8a1e54adfc24
TLSH
T186D0220E10137CBF4B89663DF40527858BAA204D3370903DC3AEB0940A2AEFC40081A0
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.bin
Size 29KB
SHA256 a39cb9f40cdb47a991362d502e3fd8020b260276fae84b7a0162d1e374d68e15
MD5 4aa0a3e17db0b6cdd991fe1a4455c8e9
SHA1 c0b9343622d6a56fd60c4741dfd571632cc50d3e
SHA512 a1e50f4566207a1869261ef218fd2cda8403524bd2c80d9e709a16662604758e777112645f0e2a4b251b9285cfffe60ae728de59221b3fbfba99cdae2fbb8058
SSDEEP 768:h/ArGTTNGcm+udARXAfwYXbBbNbDlb7o1lWV:h/ArGTSAu5T
TLSH
T1CBD20184EB1E953FD42912BBDCA51B001F79B88959092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 ce7308f14d28e4e7efb4900af9864749c03b0fb99253977d07c73e9b3279d27e
MD5 9871e975818ff685e6b21bbbdb636689
SHA1 ded5319590f87d64b6189853fe7134d45ffbaec8
SHA512 ab4ca9b61a219188d5a736203c053bba86db53a1b169d8412672372f03b69c43f81359e6d27b726fbf87b992c3831edd2cbdddce0e8b61f2a77e6f3046678c06
SSDEEP 768:01/6cQNR041rD0Gcm+ukVXKhBDof5TGbXbmbNbDlb/T1S5A4:o6cQNR0UmVXzhxU
TLSH
T114035280EB2A803FD41452BBECA51B141F39F88959592F5B3A9C54682CCB2ED3D4E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 d363fcbe5ad30796e92415726dad9c9ba245678c76da6cc13c4d5a672ab3df89
MD5 d7301d833d96af240d70c92d4ae865e3
SHA1 a1609d25c71d306bb971a35da38b54cf45dd2e6b
SHA512 394f57ce5734a69ac64a9162f1046b42629dcefc6ef20b5fbbad6aae2cace5e4986e5fbda57c6d9664fb477fba437d0a7576e08f3e095fbfe87bc57c1dd24a19
SSDEEP 768:fAC1/6cQNR041rD0Gcm+ukVXKhBDof5TGbXbmbNbDlb/T1Ss:L6cQNR0UmVXzhx5
TLSH
T101035280EB2A803FD41452BBECA51B141F39F88959592F5B3A9C54682CCB2ED3D4E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 71d16b327074ca09e2b97b788a7cefcec47042884f016c480d0ad5e93ee5ddbc
MD5 719e293687638ff06f604384cff89a6b
SHA1 c5e9fee6c6bad16850ca26e508f95ce8e907346c
SHA512 1b6af952f373a7567c31434c383e266d499f8a9787b34dcb5cb66a62e49ef6d859fc915e8f7dd85d06f8245ffbde2af0066de93a9176c043fb451a1d92f05e4f
SSDEEP 768:o6cQNR041rD0Gcm+ukVXKhBDof5TGbXbmbNbDlb/T1S5AC1/:o6cQNR0UmVXzhxY
TLSH
T11B035280EB2A803FD41452BBECA51B141F39F88959592F5B3A9C54682CCB2ED3D4E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 e8cce274cd46c8dca49e3ef65d431617cb3a27affd5581a0ff7a4fd4f0b56318
MD5 e3b51bf2bf9232230992ac8bdc19c080
SHA1 720bfbe3877678a18283d34f0926b078e3ed156a
SHA512 d49753264cb8e38933e3208ab53e99f61377ceed6176955c5a7244ff10d8bc31a8b7733727fb07afa4bdebeb6820f6d0a0b683167ebd6feafd125c337ab122a2
SSDEEP 768:01q/ArGTTNGcm+udARXAfwYXbBbNbDlb7yq4:h/ArGTSAu5w
TLSH
T1E7D20084EB1E953FD42912BBDCA51B001F79B88958092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2f20484f452051c5bee1118c98c5512bd0aa262a7e80f9441bfcf91219054197
MD5 7f9c26fb1522e4f7144183cc1006fd5f
SHA1 c20e49a71dcf8577f9117afb4d8e91d88e86e335
SHA512 329910863418d333a941d65f01d3b57bb870caab737e554b1cfce541b034686a5f7099d3b40d8cb68f49e96c5a29c81d4d8c79e0df521b5c65d46ce8281f9501
TLSH
T17B219E5C39B88D6A6CC7FABC7441028E9B914E4B04871C474D52DF8DCD85AE932AE53C
MD5 SHA1 SHA512 TLSH

Submit Download

4ea64387-54ec-44d2-8177-40926f176e21

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\4ea64387-54ec-44d2-8177-40926f176e21
Size 886B
SHA256 5991b88b4517ebeccbd338f96caa77d9f7ad50b3a9d847fbba168ccedec57222
MD5 13f0d8289cb24281346ce9d517e88c39
SHA1 7c257789f02960605506cd290a77a5f428c0ded6
SHA512 5d92c78c0635f9b5a0046773da95dbb5b8d691d26b0f3abc2703104de6764c53d1fb6360b2a68715e9d7e70c5c991e1e107607daa6d53a3465eac374c6c5ae89
TLSH
T16B11DC905765B9B3DA2CA29B85E077024AA8713380C588487DA58B1C4CEA92E63A6207
MD5 SHA1 SHA512 TLSH

Submit Download

5eec40c4-51a2-48d5-9e30-8f5e517546c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\5eec40c4-51a2-48d5-9e30-8f5e517546c5
Size 235B
SHA256 1fbced542a0cca30be9a88772a706119fa0ed7de8b40623db9b94b25b281a261
MD5 38df1c783ab3bb8457e2ca292144245a
SHA1 55805bece485940e57e4b32841fa8344bed6f843
SHA512 b906e3243a7006c330e8abfa498d6971ba6cd84d03dc9539a27c97dbe0e5f217c39c08fe3cf4c65e55f5c2834f77e48dc39e4e4e25e404c1c4140c0d9c7d043a
TLSH
T1A4D095901498135D04144F1AB1E168C630944C331070D810D55117344EB8DC44151656
MD5 SHA1 SHA512 TLSH

Submit Download

83bafee0-3bf3-4e4f-975e-f15cbff37788

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\83bafee0-3bf3-4e4f-975e-f15cbff37788
Size 2KB
SHA256 781d84b2e7961b24b5208355e7ea38fa02476019c655a6d22b065da792525206
MD5 a2b602e380c35fc0c42ee421b118beb6
SHA1 de5113f02c9d23fb48bb7ad308bbf36aa7f4d4c0
SHA512 6625e364d5acb1bdd4228e0f12ae648a7f936f6598b257fb06c03ef199fa3327fcebdd9af2872e437fddeede07a93e1493b6ac07bad0e16a23326f26f29955e1
TLSH
T1E841216876B85D7B5C9BF29D9481338E53608A1300C11C47AD81EF0CCDD66AD737E52B
MD5 SHA1 SHA512 TLSH

Submit Download

96e71b4a-11f7-48b2-8e77-5528cf0d67e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\96e71b4a-11f7-48b2-8e77-5528cf0d67e3
Size 871B
SHA256 15889c0e46d9d8bd1a2e64eb7187af557c94635a1256e8daba08af5b6494ab07
MD5 4bfb764294c3c27c678ae9b5d391b459
SHA1 f1bca9bdf57767f0aa0742af13279dad9cb93cc8
SHA512 377ac7c11d30e9ce43fbd15a02ab0138880d3dc9f900932a829735ff0cc0565b7558cfa771cf406a9090cb127846b5f881de55e0f98e884de7fd6d08dafa0040
TLSH
T17C11C090A725B9F3CE2C935FC5953B124BA9753380C584087DE18F084DAE91EA3B6347
MD5 SHA1 SHA512 TLSH

Submit Download

c9c693a1-55ab-4610-98b6-b7c764a77c36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\c9c693a1-55ab-4610-98b6-b7c764a77c36
Size 235B
SHA256 106c534ec3234d325a15ee1ab9f57b54084282c9c3692939f062fbeb542d30f5
MD5 338c33b77f67abaa5eb91c1fb10b725a
SHA1 600df0b0a2c01f4272db89e77c055ef878ec1eb6
SHA512 0cbe4d675deb7c61a164f755cc8c26b80d3d2c11011f98191a4f7b415c1a9bb0372edbd13875b74780771d7b0ae4a70dcc8cb141d9b2a375729cd1f452d71597
TLSH
T116D097812888A75C0C002F06B0B0AEC630484C332464A811CA6249BCDEFCAC4016191B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extensions.json
Size 14KB
SHA256 a2e21f6b1af114d61328e7decb2a1b15d63ce8587e88f19a3b4a1f892427f15e
MD5 eb42279ff4647b48313ed77da5cb2fc3
SHA1 4676e0f62974562ad107968f96a6998a66f12eb1
SHA512 45b21007b29d4f064adf99862235fb9c0eab1bf146de534ca9f565fbbe7a0cd8e60f0e37598f2463d71895f6fedaee8f09d293eb834498d66de9752f56f45877
SSDEEP 384:9kI4vyUmldv98dhWY94z+96oBL4HxL4PpL4HJL4HnL4HC:+I4qRf+Xp426u4J454B4r4i
TLSH
T13662432549049EB8294F578BAA367D01C37D573B70445C78F4DD8FC842FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
Size 8KB
SHA256 9104492002aba694184250c9155b00e7db17be0cfa4a185c34cdf5a841d6e499
MD5 3d001e1508b8ad0345c77cfc25ae9cd1
SHA1 bb32a16998180c20f048f9c34ee2871f07979cf2
SHA512 0c8c18979e84992374047d50210e7dc6974aca72c86801ddb971216a59c8a447a21f6fb9383da616509a62042823a86b1becfcdd5121fdfc0766c347bcb623e0
SSDEEP 96:xHeFTUDqGqTfc1WObzSktSSlXdv9jJnNWRGC/C+yBw88xM4LBvJ8L4cnEtjI:83RTfc1W+tSSURj/C+yBw88xM4FvW
TLSH
T17D02EC789104CB7F74B6777CAC6448715AA2013BBBBF68D650B948C5050CF3852FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 6KB
SHA256 829a4dceaf450b00cc1315306dd04d7f5055ed49908e60c513d0bcf86ef73987
MD5 7f678ef42c260a47b6587f58af96df61
SHA1 810cb0d7ccf19d095893ec43b58ad231dfde3e5b
SHA512 f267228d361b714ddc2da0cdd0ce6943abef5e3cdfbac42c3156875887c77d44528323eb4e05ecf91df4c902f56803fcb4bf2afb16ed56609f7e53531cba9af0
SSDEEP 96:xHeUTUDqGqTfXc61zS8gSSlXdv9jdnNHG/C+DBw88u8L4cnEtjI:8eRTfXc6hgSSNG/C+DBw889
TLSH
T12AE11F7894488F7F74B6776CAC6888316AB2013B7BBF68C750B55489054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 6KB
SHA256 ca068003bad4966df8d92b9547db6dd89e40f01b292d971ee63a6f38189a1bbd
MD5 cd10a4e618f4984b3c1c4f41011be217
SHA1 96bf9e2fc6f3161dfbb51916a4714e0391b21f1e
SHA512 f92b2aeb278b04946a5382df33bff7637d5af02c667a6cfcc3b83d03b6be1834bff67d65d2010e28d2fb3d38a285881e8ccd599f50b8309fc13dfe6e744d0ed6
SSDEEP 96:xHeUTUDqGqTfX1WObzSktSSlXdv9jJnNHG/C+DBw88u8L4cnEtjI:8eRTfX1W+tSSlG/C+DBw889
TLSH
T167E10D7895088F7F74B6777CAC6888316AB2013B7BBF68C650B55489054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 6KB
SHA256 f965f7e50c9ca68fcce95917a28a25d04f2dafe2873ee34d1b7cd4435d015d69
MD5 693a51b153148231c815ca940ddf40f7
SHA1 65d1bf2532a642d787f3a9fd1bd924a927220c71
SHA512 bec13e74161ebaccd34639e03a6edf48b9abf334b94d8b5dc81c3ae858fc9a19aa2b2d2a5a4c55acf95f10a17c90a8789bfcba78e9828090515cb41d80500beb
SSDEEP 96:xHeUTUDqGqTfX1W1zSktSSlXdv9jJnNHG/C+DBw88u8L4cnEtjI:8eRTfX1WxtSSlG/C+DBw889
TLSH
T12CE10E7894088F7F74B6777CAC6888316AB2013B77BF68C650B55489054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 ce4946f67e53fea25811d66ec30f5f15e12919ddf2be117f5197e4493660c15e
MD5 c71e997ba59863001ba8f0c73ecbbfd8
SHA1 47ac67a458343602c45f179dffab6c80cf75de67
SHA512 86698faa75452df0bb8a4fd366e78c07c6bd284d8384df7ff20320184439eb9486831c52418288bd992c0dc39dc080170ff533d07f07286b7950a95d1b62708c
SSDEEP 96:dyfnx9F6joKeW9jILA0NjoB8kMJttn0YJZQ2:ix9R6OnNcB85JttnTZR
TLSH
T117918D46260B3D63FD9B859FEF0A8CF24564300A55C144F8D08E6A16775B78B394807A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 0881e442e55180fb79737a7054b8ddbaa82fd593738e33ec8d546e3319688801
MD5 6e274e661c76a51c8f6b3df61aa7c5fe
SHA1 ff5602255c75dd271cb07e67194265b6b1ab2272
SHA512 049bcc5a07911c0650be4f204ecdcf1952b68b0f09d21435c520ce7b0e6a5104addbacf506705f032e141781fbf36edd88f1c02a677ecff5cf80c8150eee0e36
SSDEEP 96:dyfnx9F6jobeW9jILA0NjoB8kMJttn0YJZQy:ix9R7OnNcB85JttnTZ/
TLSH
T12E918D46270B3CA3FD9B899FEF0A8CF24564300A55C144E8D08E6A26776B78B3958076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download