hxxps://gofile[.]io/d/6HAQxH

Analysis

user interaction
yes
max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/6HAQxH
Sample260628-2vda8agx2j

Score

6^/10

discovery persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	api.gofile.io
31	api.gofile.io
34	api.gofile.io
40	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3048	msedge.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271608441478878"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{4F5BBA3B-8979-46BB-9D9F-651DC91FC359}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3684	OpenWith.exe
2268	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	firefox.exe
Token: SeDebugPrivilege	1964	firefox.exe
Token: SeDebugPrivilege	1964	firefox.exe
Token: SeDebugPrivilege	6748	firefox.exe
Token: SeDebugPrivilege	6748	firefox.exe
Token: SeDebugPrivilege	6584	firefox.exe
Token: SeDebugPrivilege	6584	firefox.exe
Token: SeDebugPrivilege	6584	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
6748	firefox.exe
6748	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
3684	OpenWith.exe
2268	OpenWith.exe
2268	OpenWith.exe
2268	OpenWith.exe
2268	OpenWith.exe
2268	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3984	2320	msedge.exe	88
PID 2320 wrote to memory of 3048	2320	msedge.exe	89
PID 2320 wrote to memory of 1012	2320	msedge.exe	90
PID 2320 wrote to memory of 1012	2320	msedge.exe	90
PID 2320 wrote to memory of 1012	2320	msedge.exe	90
PID 2320 wrote to memory of 2480	2320	msedge.exe	91
PID 2320 wrote to memory of 2480	2320	msedge.exe	91
PID 2320 wrote to memory of 3940	2320	msedge.exe	93
PID 2320 wrote to memory of 3940	2320	msedge.exe	93
PID 2320 wrote to memory of 3940	2320	msedge.exe	93
PID 2320 wrote to memory of 3964	2320	msedge.exe	94
PID 2320 wrote to memory of 3964	2320	msedge.exe	94
PID 2320 wrote to memory of 3964	2320	msedge.exe	94
PID 2320 wrote to memory of 212	2320	msedge.exe	95
PID 2320 wrote to memory of 260	2320	msedge.exe	96
PID 2320 wrote to memory of 212	2320	msedge.exe	95
PID 2320 wrote to memory of 212	2320	msedge.exe	95
PID 2320 wrote to memory of 260	2320	msedge.exe	96
PID 2320 wrote to memory of 260	2320	msedge.exe	96
PID 2320 wrote to memory of 3476	2320	msedge.exe	98
PID 2320 wrote to memory of 3476	2320	msedge.exe	98
PID 2320 wrote to memory of 3476	2320	msedge.exe	98
PID 2320 wrote to memory of 1220	2320	msedge.exe	100
PID 2320 wrote to memory of 1220	2320	msedge.exe	100
PID 2320 wrote to memory of 1220	2320	msedge.exe	100
PID 2320 wrote to memory of 4232	2320	msedge.exe	101
PID 2320 wrote to memory of 4348	2320	msedge.exe	102
PID 2320 wrote to memory of 4232	2320	msedge.exe	101
PID 2320 wrote to memory of 4348	2320	msedge.exe	102
PID 2320 wrote to memory of 1740	2320	msedge.exe	104
PID 2320 wrote to memory of 2492	2320	msedge.exe	106
PID 2320 wrote to memory of 2492	2320	msedge.exe	106
PID 2320 wrote to memory of 2492	2320	msedge.exe	106
PID 2320 wrote to memory of 3060	2320	msedge.exe	107
PID 2320 wrote to memory of 3060	2320	msedge.exe	107
PID 2320 wrote to memory of 5088	2320	msedge.exe	108
PID 2320 wrote to memory of 5088	2320	msedge.exe	108
PID 2320 wrote to memory of 5088	2320	msedge.exe	108
PID 2320 wrote to memory of 568	2320	msedge.exe	109
PID 2320 wrote to memory of 4080	2320	msedge.exe	119
PID 2320 wrote to memory of 2484	2320	msedge.exe	120
PID 2320 wrote to memory of 2368	2320	msedge.exe	121
PID 2268 wrote to memory of 1724	2268	OpenWith.exe	127
PID 1724 wrote to memory of 1964	1724	firefox.exe	129
PID 1724 wrote to memory of 1964	1724	firefox.exe	129
PID 1964 wrote to memory of 2468	1964	firefox.exe	131
PID 1964 wrote to memory of 2468	1964	firefox.exe	131
PID 1964 wrote to memory of 2468	1964	firefox.exe	131
PID 1964 wrote to memory of 4232	1964	firefox.exe	132
PID 1964 wrote to memory of 4232	1964	firefox.exe	132
PID 1964 wrote to memory of 4232	1964	firefox.exe	132
PID 1964 wrote to memory of 4232	1964	firefox.exe	132
PID 1964 wrote to memory of 5352	1964	firefox.exe	134
PID 1964 wrote to memory of 5352	1964	firefox.exe	134
PID 1964 wrote to memory of 5352	1964	firefox.exe	134
PID 1964 wrote to memory of 5352	1964	firefox.exe	134
PID 1964 wrote to memory of 5380	1964	firefox.exe	135
PID 1964 wrote to memory of 5380	1964	firefox.exe	135
PID 1964 wrote to memory of 5380	1964	firefox.exe	135
PID 5428 wrote to memory of 5496	5428	firefox.exe	137
PID 5428 wrote to memory of 5496	5428	firefox.exe	137
PID 1964 wrote to memory of 5640	1964	firefox.exe	138
PID 1964 wrote to memory of 5640	1964	firefox.exe	138
PID 1964 wrote to memory of 5640	1964	firefox.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/6HAQxH
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff596cc188,0x7fff596cc194,0x7fff596cc1a0
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,3532566069957411164,12270303305114243105,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,4573772579386941531,15152820235873037357,262144 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,2178711103332871754,13717000167693653701,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,5595681758440687928,15881936554383970696,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11037207712901659556,16945133101394966924,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,12387238964351663007,15978570415412811418,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,7909256657049223319,342556649561049211,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,17484461320140459502,6547673987944584179,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3912,i,11450041780195926460,4779519815622592229,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,3356453740980546051,8125784011574996876,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,13744994810397498034,16631888054613640611,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,5698729550107991187,7651038995509602414,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,5698729550107991187,7651038995509602414,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6460,i,5300322114936655861,17673591191201154888,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,2630327241895598476,687020426508520361,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5312,i,8899906113678853044,2762108579741306579,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,9101818909169916981,10120541865955090947,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,7887281837209735162,17547918482246493536,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=1568 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,3869109122790744822,2598631167544297481,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,12594555952946805042,1613910996224954092,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,13202027124153471975,9748044348250214905,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5636,i,12676612532748892700,16903580717123691461,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:6496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5096,i,7105055206235142886,7319844111464643403,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:6476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13961932827439094280,11101604733020610255,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6788,i,11326455789834354180,425168812566032605,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:6704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6080,i,11487672440002986818,4004203493327177612,2097152 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,2975842014464818169,67455371964802655,524288 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:6252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5608,i,2836242453724741334,2192122234780796372,262144 --field-trial-handle=2076,i,4256012113070893480,10936206646123689628,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Velocity.7z
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {207c5231-7071-4067-ab56-13d8d8395885} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {09b2000b-8455-4803-bdfa-085f128d2d61} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:4232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27276 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {e72a24ad-b35a-42bf-aed5-8e8c63628d9c} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27276 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {9d0154f2-3a27-4295-a95e-d806251f94d3} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5380
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4360 -prefsLen 34775 -prefMapHandle 4364 -prefMapSize 270279 -jsInitHandle 4368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4340 -initialChannelId {393087bf-dca4-4bd7-8058-51de1c1ac056} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5640
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5268 -prefsLen 34824 -prefMapHandle 5272 -prefMapSize 270279 -ipcHandle 5284 -initialChannelId {20e57f16-db1b-4520-8722-2f3b4255aa0b} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 32845 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 4288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {ac08f17d-35c3-4893-8e8f-45c9d441893e} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4620 -prefsLen 32845 -prefMapHandle 4640 -prefMapSize 270279 -jsInitHandle 4644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {46ea8042-b107-4e93-8495-b4996fa83c39} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6704
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2864 -prefsLen 32845 -prefMapHandle 2868 -prefMapSize 270279 -jsInitHandle 2872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {78af3ce2-3e91-4d6a-a1b0-549b3f85b363} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Velocity.7z"
1⤵
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Velocity.7z
  2⤵
  - Checks processor information in registry
  PID:5496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Velocity (1).7z"
1⤵
PID:6716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Velocity (1).7z"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2056 -prefsLen 27099 -prefMapHandle 2060 -prefMapSize 270315 -ipcHandle 2144 -initialChannelId {6ae32e64-5795-4bbe-85c1-0aefe9db731c} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27099 -prefMapHandle 2400 -prefMapSize 270315 -ipcHandle 2408 -initialChannelId {8601f7d6-0a45-4fb0-9343-27df83f6c7d8} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3956 -prefsLen 27707 -prefMapHandle 3960 -prefMapSize 270315 -jsInitHandle 3964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3972 -initialChannelId {87d7ced5-c570-4ff6-8ca1-dc9334a4ed1c} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4204 -prefsLen 27707 -prefMapHandle 4208 -prefMapSize 270315 -ipcHandle 4216 -initialChannelId {3fd5e9ff-2bf1-4471-ba0e-26ca483ed608} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3384 -prefsLen 35260 -prefMapHandle 3288 -prefMapSize 270315 -jsInitHandle 3396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2996 -initialChannelId {ff3657cc-3647-4e4f-b228-b24c193d8c12} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2996 -prefsLen 35260 -prefMapHandle 3408 -prefMapSize 270315 -ipcHandle 4888 -initialChannelId {9d1f9b18-66f0-4ab1-89fe-f9756ca44513} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360 -prefsLen 33200 -prefMapHandle 5356 -prefMapSize 270315 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {3cf033c8-d2b6-41fa-af3d-69b3301828a5} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 33200 -prefMapHandle 5756 -prefMapSize 270315 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {0f46765f-4a7e-4ae9-b185-822d1766af67} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5936 -prefsLen 33200 -prefMapHandle 5940 -prefMapSize 270315 -jsInitHandle 5944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5952 -initialChannelId {e052e618-c66e-4573-8e6d-b071c1534f1a} -parentPid 6748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6552

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Velocity (2).7z"
1⤵
PID:6384
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Velocity (2).7z"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:6584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2044 -prefsLen 27059 -prefMapHandle 2052 -prefMapSize 270315 -ipcHandle 2136 -initialChannelId {57bb11ed-5d2c-4e27-a6d1-d915d2ecfd53} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27059 -prefMapHandle 2404 -prefMapSize 270315 -ipcHandle 2332 -initialChannelId {1a74311b-55be-47eb-ac37-db3a6ebc87b3} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27618 -prefMapHandle 3840 -prefMapSize 270315 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {fdd197df-1db9-4a6d-946d-b2b0ee14672a} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27618 -prefMapHandle 4024 -prefMapSize 270315 -ipcHandle 4032 -initialChannelId {fd1bd21a-fcba-4d61-965b-49ea3d48ab49} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4596 -prefsLen 35228 -prefMapHandle 4600 -prefMapSize 270315 -jsInitHandle 4604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4288 -initialChannelId {30050d6d-2309-427d-adf8-937cddd6a097} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5060 -prefsLen 35277 -prefMapHandle 5064 -prefMapSize 270315 -ipcHandle 5072 -initialChannelId {4847c140-607a-4436-86b5-8a1ce49f20d6} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:7148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3624 -prefsLen 33148 -prefMapHandle 5272 -prefMapSize 270315 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {2ed10004-4193-4ecd-b029-22afaf34f306} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 33148 -prefMapHandle 5548 -prefMapSize 270315 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5560 -initialChannelId {1c77f4be-925b-4399-9bd6-1a5514cf8f63} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5736 -prefsLen 33148 -prefMapHandle 5740 -prefMapSize 270315 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {4529e520-3ca6-4446-bbc8-18af5ca41ed4} -parentPid 6584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 51cabc5dca1eafa1534ef87b851406bfcb54c86c4c7c081da563c31b329b7f98
MD5 173c997a2b73f8df275c305e6d216a55
SHA1 d0a0ea572f4640c5e153d8c6b3dd3ea75c279643
SHA512 14908ab425f61705700ce1339b7d129d6717097735fa0ae782e26d3883aa1e585b2377d92e048d2047965ae8c6029eec3bb8f60e4436b47ba35fbc318538761d
TLSH
T183817E3E0A4141B5F3610432ABE17E197BB34BE8F51F6CF491905EB013B57EBC096228
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1f2de012ea67e23f6f98b2e5cac62131f5349bfa30fb0f8111f8e66b3dff941a
MD5 b048332bc9ee6fb3343e1d4cb5e7afef
SHA1 6d874911a95988270c2133a8f628b7bc8ff06c5f
SHA512 1cc2cbb668de262f32f5fb5d20c085b6e094abfbfaaca3b3bd802ded3b5452b3b160c4d10fed75e90e368fca7392dd440763646bd4d4a6b39f3138986e2b50fd
TLSH
T1D751BCF7C3E8816E8D2252F4AA14AE1BCE1D1516832C7D798AE49E07A3E3861E10574F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ee6199ff17b86e43dd2ff08e7980e206f763055b97ae68d5884b9f938285a47b
MD5 2f395540e241a6eef33b8213dc5b4bd7
SHA1 7e02ec46663e73ffac1efc38ed21569d43a1f7c7
SHA512 e4bb9133a05e16720e3434fc660bc7ed37a507af0ae93cda34ebfba047883ac3014fb3563dc0f364a31b1616e77eb58e7460536cf27eaf8864fdf963d4886ece
SSDEEP 192:sxZMR7yM/jK1Ml8Mkp/fhsE2wSAIdpjlhHW6+WNesC/Yz84oRIgrJ:sxZM3Mp/fhsEdEHHbI/19
TLSH
T11652E912AA349977CCDBD209FA45BB53D6F9447392901E48A9FC9A0C05E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2db13ec8262c087fdf7c89216aba94dc625b1064dc6a1a6aee871126e274381f
MD5 b8850af09c596ccd30c0564b88dfe427
SHA1 c0806171bc2567f43d212af8ce4db363a5a58513
SHA512 d5582ebf11bcf0aa1e2c743ff3abe7f27e5e2599539f041e3b65264a8918bc9211255de930d64acbf973d9ed73b0612da3dfce596943fad75dc039fdd3d50653
SSDEEP 192:sxZMR7yM/jK1Ml8M9p/fhsD2wSAIdpjlhHW6+WNetRVYzRLoRIg5OJ:sxZM31p/fhsDdEHHbWV1U
TLSH
T1A852E912AA349977CCDBD209FA45BB53D6F9447392900E48A9FC9A0C05E7BED6207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 44e3fc1ab99cc20afcc7f891fe56e8cc6e8d19579ff0353e0f9f3d629fe123a7
MD5 a067c341b143d373e175296046fa1026
SHA1 f49e5ac51866da3a8bc6070c5e818ba2dae20918
SHA512 ade2814b20c655eb58caf33dbd1c02039cf5885aa4c47e39da76afb919781f1a620380a81043f9fa2387cdd3a15da179a53056d0fdf4521c4a28a9992ecd9fc0
SSDEEP 192:sxZMR7yM/jK1Ml8UQm9p/fhsDNwSAIdpRlhHW6+WNet5lYztw8RIg5kJ:sxZM3qgp/fhsD2E9HbGlM+
TLSH
T1DB52E846AA349977CCDBD20DB985BB53D6F9447392900E48A9FCDA0C01E7BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e70bbb67b214c85c172f0bfdcbd85f9d3a92614de3ad664edd30311b9c175430
MD5 d854b60721ff663cd1353ace35a30a4f
SHA1 735e61213168ebddbe59bc1fd871c149facc0383
SHA512 b56d06325b73c438f62a1d65f08d62f6ab07f9853303e65b3bf6c86fa38400406574aff481b86f531573a1b7e4754f9a55264138f3b20417acc27bcc455dc53e
SSDEEP 768:VcW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjFroIZi3YH:VcW7kf0Wvqidau1jaa5LA3j+yH
TLSH
T186D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3ccbd0d0270c956629ec623e5aace25634d5dfd74af73c24150370abd9fd1151
MD5 70f4ab0fcc85f666f748e1d8928d500c
SHA1 defc503c466774fd32c25fc307ad75016c5b4f28
SHA512 861c64e10059a89f9b2acb26fade15ee8b512ff132935ca4e75145ec417874ba7ec35df61a03fa29a75b762adf38bb1f39b5e2ac092ae99be6fd89ffb756b7ae
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT3MIXKZqYHyNlIJKek8SoIvKV/:KIbCKc3MIKZqS2lCKektoAKV/
TLSH
T10E91141A313B06013C7E2D4992AAD53B9F8231933454A8AF7FB910B55E66E124FFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592fb1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592fb1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bc28501a461f9a7fafb359e91910d16dea31032864a0c085f527082cf1524898
MD5 d613d720a9575e3a15ec6db9fbb94b66
SHA1 9012c36c74c8f84200cbe088e9068870e642c7a6
SHA512 d8bbbf26a0e59585553a0f3379257130731483f2adad21b2b4331814b2c856baa05b3aaa956f4c4fef4b18cffb20818c8cbe5dd726300c12deaa0ff46e3ad19d
SSDEEP 384:zFtNn/s3n9SfsNvP03gbfHLn2VFXmn15wbAjEO8yy3:zFj+9U9wDjcXmn12bfZX3
TLSH
T107928E36AC795E275EA3D545F08A230B5FAC817BA7C42F14E5EC5B0D01DB39C6316A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 66b60632bc870445775efacff4e799f5105e1a558041346d62823fb9ad1286c4
MD5 8dce8be1dc57f281ba55ba8daec07129
SHA1 78d9ef4c6e4823e0159ddc285fac4aea827517d8
SHA512 15777ae85de663b877393f4295d1e94c6a860646cf509fb852aecd710a6412092d60bdd2c91335212c72d76d64b17549ddbdff0c56994bdb521a28e4795a9010
SSDEEP 384:ypiFDtNn/s3n9SjMsNq8TUNTUlIle03gbAOLn2VoXmn15wbAjEO8yy3:yAFDj+9jpwgdwHjZXmn12bfZX3
TLSH
T1ADC23AF658D7493ADD9E8743B37D2E069EBCC167B5802A10B3D84A0DCD962BFD306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 75fc86fa52f73a297ba7009aa802d154b09691c47f00220729a07fae2c037878
MD5 b0c07a7806525c433f6e5d13b91124b8
SHA1 f539242199adbecfa7c895a09136530f80d1d987
SHA512 2edbfbd7428a23483ce18020b395d313713d6650d2e32c4c7ddedeb8f0dd3fcf10b4ef7f56cc4d41086856d4c6fb14c3c862545d0627a63db776857c58cca962
SSDEEP 384:ypiFKtNn/s3n9SjTsNR8TUNTUlIle03gbuOLn2V2Xmn15wbAjEO8yy3:yAFKj+9EQwgdwVjtXmn12bfZX3
TLSH
T11FC229F258D7493ADD9E8743B37D2E068EBCC167B5806A10B3D84A0DCD962BFD306906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed6ab7e3cc3e2ef700fc2ec622ce61dca146a02cd46e66b15f9678f737de763b
MD5 4da48987558f5980cf6a7f695f0a5a32
SHA1 0230db8f6a94e8a1e76b80c47fedf1f9d90f77de
SHA512 b23fb241d412fc33717a473189f2a576409aebd451e0f9626f116eed57b80ab06cfd723f44009bf582fe53c0ce6c717ada663b73779c35559ee72b6b96aeb23e
SSDEEP 192:MONa64BAQmiUyh14W5GBPKScC2567aDvphU6:MONa6eA2uWE2BfU6
TLSH
T1C202FA39AC796C7B9EA2AD45F48737175FA8117BE6905F40EAE81B0C00D725C230352B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c0ed44a155901d026253ff343dae25310ba3b5ff637c9dca43e3e8d03bb85f29
MD5 59d4c6058c2b2bd09998c8d01beab9ff
SHA1 2e4b742d4aae71692c9b78e814c8c859db615275
SHA512 1b2f09afe0a3f6669450d6fca9adbf03d6269d8d8ec397269cede497d5477ae32021e1cb6475403e6ea4c018035a82d1394e61b2eefd6f48c67a1b5f77c267b4
SSDEEP 384:zEtNn/s3n9SXsNvL03gbhHLn2VFXmn15wbAjEO8yy3:zEj+98JwpjcXmn12bfZX3
TLSH
T14E928E36AC795E2B5DA3D585F08A230B5FBC817BA7C42F10D5EC5B0D02DB3986316A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b7727abc24da5941327e8c02c6630ce43f7e681ce3ade46c59b214f5399030ca
MD5 5583c4083fbea5e6dd8aa62036fc0bfe
SHA1 8eb068566b12b8a5b32a2dd83603f2c509594374
SHA512 eb543389a575976bdfeee3c9ca32ff713135861a5b403736170895c75fcf9163969d747f2f5b686931eb5a1ac582a1b6ec20a8d7dd61c5d65786ec36b36143cb
SSDEEP 384:aEtNn/s3n9SXsNve03gbhHLn2VFXmn15wbAjEO8yy3:aEj+98MwpjcXmn12bfZX3
TLSH
T1B0927E36AC695E275DA3D585F08A230B9FAC817BA7C42F10D5EC5B0D02DB39C6316A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d1b1395a102a9461c554e76c25743ac68dce8ecfe9c122927df19053c6ae8b4c
MD5 0b90b9afaf8987dc80ba94bacf818126
SHA1 3d792f8ceed4dc00d9baf84bf3afd60ff95c23d3
SHA512 cd42c69bf94eb5b865a5b7a89eda951c0acf20fb7370dee7da9ab352a3ca134df059c06ff6cebe7d96873755c10e8bdfbf5cb9c37a6c4c137941803e3245c234
SSDEEP 384:ypiFXtNn/s3n9SjDsNR8TUNTUlIle03gb3OLn2VwXmn15wbAjEO8yy3:yAFXj+98QwgdwSjRXmn12bfZX3
TLSH
T153C23AF258D7493ADD9E8743B37D2E069EBCC067B5802A00B3D84A0CCD962BFD306906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3bf0533baf0c99ca255329a5e61e5b15b1e537196b1f1e5d1172ea70ceb38bf3
MD5 f5ac1610a27aed542227426a28b29b91
SHA1 77f8e2debaf5ccff42471c2606a3e8945b2dbb36
SHA512 36ac2afc1f8228e43e26bf2d043c65e82baef598e48d42b8be19a4ad40e758f5088f35df2798d5cd85deeaaf7141541b1a3d82389dc731d17ffd5232641c3fc6
SSDEEP 192:UJONS64BCQmiUye4J5GBPKScC256bePNwWwiq3U6:yONS6e+MJE2VWXU6
TLSH
T1E1120B36BCA96D2B9EA2E541F0C633075FA9413BEB84AF40E6DC2B1C01EF25C6306517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 57f5999e2b621231114f92b244fece241b39e7f1f80ed56afc2471f6332d0257
MD5 bc07ac31f46a5edb0a2cd8581df4b36c
SHA1 cbbce763e81fe14518c778a28dd89ac7b63eb95e
SHA512 cb09d3b16f9751515a7dfc25f37f37c929b71ee924f71a9031f8bd3992a542099a0eef9d776c7adb4f1d3e779b28f035a7eb8949c201e7d3ea04b8ce7e018dad
TLSH
T16F41095CB7F91108B3B76E5AABF7A86D487AB9732E0AD45D00010E4E4622A40CD72737
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\activity-stream.contile.json
Size 4KB
SHA256 587f032b920a1ae417e28ff4296ed7a2c03cfc74138e8c428931c12b58cb5753
MD5 97975ad0b5acbd77895bd94296bcc05e
SHA1 480789e18cf909aeac8373213f9ce358bff53a49
SHA512 800e6ca5dcb374a5a8cd62548cb603120bb129d9c0649da83dc7fef0ed471d09494e9fb28e36750604d1cb64dc148073e94073cae7f652c4bbe722f7593590fd
SSDEEP 96:TXXJ/8DR9DFKYZdcBnB6DwfdPM0V+tlY0F8KT+mRqtl:z58bD/dUww1PM0V+tltFAmRqtl
TLSH
T160A1E88FFD6598930321EBF37C8D37997206B146EAE98E06BA949801D9DC15F41CE284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\activity-stream.discovery_stream.json.tmp
Size 74KB
SHA256 537100273a2e74fb135356a171fc0d9181525ff8d0cbcec89c017cc43064a8a5
MD5 26ef1f03f64a6611693e5603b13b39c7
SHA1 83cf117401e2e52e2ef167052529373d81a9bac1
SHA512 7c21af3e1de7ddf898ea3c9c9ea1478b347e7a08218d2659f97dc6b7680f1089380a4aa83989a28f2f0c9d0c6d7ab5bdad7e29a01f4b7a80a1e09e9acf98b7e9
SSDEEP 768:ZByfCnPtTeyZyWp1AStT7/NKDGofx6LxvuhMMCVzp5Lwk1:ZwffSpp1vrctJ6LxvQ6j0O
TLSH
T152731BA3A6AAB1FB1B9137C71C0FB98B52D20245F78245C8ECEDC91D80CC795123B5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 0210235fcd9ddc62f2e6977deff2900a0ca0a21d6813cc7e29828ff96a3599b9
MD5 1f6dd9910903469dc299e982e515d0e6
SHA1 d317f7c9a128d415e0c7148ef487bf90208f6431
SHA512 1fe2f0ebc6459e34a4bd7b0344dc4c41cf9b707e983254c798b747ff84acc3dd5b9751fec705731f9c22f2135c760a8a8393453596a75cdd61ff371a1a263867
SSDEEP 384:HPC9iO024YFo6J+Sl1xDnZBPsac4j0lpDII+1Tj:v9ZYFo0+Sl7zZlsac4ID8LR
TLSH
T154528DBA5F0238AA1927D194D5FE6254CD04A6BFDEE2D06616103C05CA447B9F4E68CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 c34789a4a1450f70f05c86175e5ee7061d9818ede64c59029f1265b89351cbcf
MD5 dbcedd29d5ac2a3f5cb1921a1e97ee62
SHA1 3d3dd389a3bb2a5d6ef767b7b4017801dffda9f8
SHA512 de4fa5bd2d0814923d7ffdc2dd1adbdec25c646dcc2c0f5016ff24e32aef46e7dea6ec2a4839014bd5c64e6dc0e1fa7ca1f3d25f09f0f555c971cd046bc34695
SSDEEP 384:HPC9iO024Ymo6J+Sl1xDnZBPsac4j0lpDII+1Tj:v9ZYmo0+Sl7zZlsac4ID8LR
TLSH
T145528DBA5F023CAA1927D1A4D5FE6254CD04A6BFDEE2D06616103C05CA447B9F4E68CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 15KB
SHA256 f3649a9fe7c008d5d8d1fe97682f7cb3c58b02c1504da54b74abd6cda46fc7dd
MD5 09205591537fc410dd1ae0402f14cd0f
SHA1 fb973bfbc2c991535d5dc9565c25224bbdd22220
SHA512 4bc45a33559e323bf09ac51123c53c88ecca9c29eca80c6ca82f80f0b78183fac9074a19da716f7b52125df9221de25175701deadfa8a527791e043c2dbf7573
SSDEEP 384:/ym17tRASxty6PtyLhfdDE2Ba/rIVy8e6j:HRzxt7PtShfS2sDIVy8v
TLSH
T17D72AEBF9F848C4B0B41D943DCAD27946C19B20B8FE8D6C92A843505C6DD35E90FD2C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 11KB
SHA256 08ec2f56b785d0f1f19085ca59e7d197834f1aab35f2562dbef1dfb174fee83d
MD5 c3f4ea8f69149bed752c75b03e772d10
SHA1 e171e61a00ac9fac5ecdea5e1d299b955381262b
SHA512 9b5082768f2d2e72e883be44c2290945c3495381f4594cc6ed8135623b2602a1d3bc95077dead5ba04af44d38c7c5f71f6aae0eafb4ca566e7beca2f90f1b0ce
SSDEEP 192:2W7/6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDNydUM:2cvI2Efy0vI2EfnaGUzHODWoh1B9M0lE
TLSH
T168427E3AED51586E0AF19587E97C69691C05EB03EFC2D1ED2E193504D9C03A9B2B92CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 52B
SHA256 1b6fa43bba17bf506113b24c50ee8511455918643de632681ca9bb865a50ba27
MD5 c022f6e1b1b8f5cfb445586a2eff759e
SHA1 c3e42d2aeefffb7a981d29c524b85dc8535d1a1d
SHA512 da83cd3b2c781e11f1f42aaa54e8fe4ec6715ec7b2586558170e19f365b2532e5b0f507a9ce3bacc13a82a4b9818da14ec428e0512b098233855689598254ed6
TLSH
T1D9900204C7E18954E124C4750C1490B804113D0148C1021338B20B5108150E79100011
MD5 SHA1 SHA512 TLSH

Submit Download

DE5F6CB1BD71958EB146CDD974763A3115937269

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\DE5F6CB1BD71958EB146CDD974763A3115937269
Size 12KB
SHA256 d075f73ed0320473ac4c16d5a26c7787e8991b6243f678ebb28898a1ef3e797b
MD5 c6ccc773cb43524d9e7e2599af9e121e
SHA1 0c5f0970b4f0acef60ff257770f43bfc3aaac14e
SHA512 a0773d74f0787330372920aa0801c089e0e1f892cc2d969b58f328b701e7894a4c3ad54fdb454a612b828ab6f5e9291d3c75dc44b88f29dcc1a8fa447c712e52
SSDEEP 384:w4pvI2Efy0vI2EfnaGUzHODWoh1B9M0lpDIIDNY5gY5p:w4pw2ey0w2enaGUzHODxh1B9pD8K0Fp
TLSH
T1C5426D36ED6158AE0BA0D687E5BC59690C46EB03EDC2D19D3E593504D8C43A9B3B82CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 11KB
SHA256 ac683067b05bb3bf204048b9b21878a9b51e4d9459f0dd5b534d9a4fae3c295e
MD5 2c4a4388054cc9fa454a6bb92da79ea6
SHA1 3716dce9e3b2aded8fbc83c393ae829587ba735f
SHA512 cf6d20e3f2f21b4b1465102974d4293d594e4bf12087578395a4c4197c66ac3189c48dcdb8301efb8bca6d2897aea9251a564255467c61c1e2a05a642e583e09
SSDEEP 192:ttwv6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDlHdKp:bUvI2Efy0vI2EfnaGUzHODWoh1B9M0l4
TLSH
T17E427E3AED5158AE1EF0D59BD6BC59681D46EB03EDC2D1ED3E193104C9C03A9B2BA1CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6DB2CC802065A948266A380F89F5EB80BB1A349

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\F6DB2CC802065A948266A380F89F5EB80BB1A349
Size 11KB
SHA256 893f2ad3d9c450b319241ef736a9cacfaf83d5f9ea713e694272e5a585962ab4
MD5 fbc21c6b78c73b2f2f72dde6bed25e0a
SHA1 09d6ab226da614e56d30fd8dfaee5ff0173e9c92
SHA512 9425e79b2c64f949acae8b099c3e99a77605f17c95760772ed4dc6cf08cc8c9345f862e5ba13b025730eb241f74b4f821cfa1f47296a13f8f61cfb6d83a99e92
SSDEEP 192:KEjy6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDNmdYb:KE2vI2Efy0vI2EfnaGUzHODWoh1B9M0T
TLSH
T1B6427D3AED6164AE0AF0D597D6BC65690C45EB03EEC2D0ED3E593504D9C03A9B2BD2CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-child.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\startupCache\scriptCache-child.bin
Size 471KB
SHA256 665d2626e60d4ad25b229726f7606efe23bf45956df164877f1e453db0758a90
MD5 78e28c3fe581c131e0e2f19f047a9186
SHA1 d88b087c846307978abba2ce7cce3e7c0c539c75
SHA512 57f57ea82ab114e50d0f98dfa6ff86169b518868ff33eab6674c5b1ded5e552d6855b487a2f75f061ee9a7415fc83a20aec573323c200904214b35d1bb9df5be
SSDEEP 3072:2iO5Ho9UbaekRHeUwCbZ7jktcvFiTTBdtTapBCACi0uvjmHSTXHqZoNV4QWSW2SE:2FCUbu1hjktpJn2pmYXHqm4vSW2psu
TLSH
T1DDA47111EFA64E23C418037A44FB53313A31E14517EAE3276F8F7629BC673A91D8A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\startupCache\scriptCache.bin
Size 10.3MB
SHA256 ca01a8af5f6ec15e5acec50b102255dabdf549ae62afc3853fcb643d57be10bd
MD5 405c5c347a8418f58be8be2033ccda04
SHA1 5014168007ed33ca7d4914995b508accf9b2d367
SHA512 6132afd59192b355e416c1dc0fb2e000b17e1f17a498b28e51f3aae4c864302730134b4742413dd4153aee984986f1e91b3d0a206ac761581798260605e99add
SSDEEP 49152:YWkVvxWNHhlx+ADzwH6f8xbM5vU38zYPHpJFVFwo8Bt0FdhCFse/3UbSQD:YXvIlx//waf25PnRMByss7
TLSH
T140B68215EF664E23C468027A48FB53313A30E08547EAF3276F8F7129BC6B7691D8995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\startupCache\startupCache.8.little
Size 2.8MB
SHA256 2307f09fc6d7a1f7f098a7311b63711e41942587f13f5b38860a0f03b127bad8
MD5 999fee7279c11b28bb694dc0413bbc4f
SHA1 f367d7454adbdb2b696fb663249762d6f74f6731
SHA512 a70aa9d2c37d1d482f35107449e79a34f95fdb7170b64adfec8d1b247f4b912941096fca8c6df56ffa9a9c6185952f5b19e57ae656c1d5fa06342a70a010bbc9
SSDEEP 24576:S5ipsM/wkbMYZRMitRRtKWgm2pOMPHVXpwzhKxMjyBw9x5kkeDZQznRFZtc34D4d:S4/wkbMYZRTFKWgigV5cWbMk4sMMyPi5
TLSH
T173D5F167B3594697C4241D1AE87A0A3937A3414207E1769EDF38427FBA8318C0BD6F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\startupCache\startupCache.8.little
Size 8.2MB
SHA256 c2829c126b08c8b2ef22c94ea0cff43e9be373c306a125509efdcecff426081e
MD5 1f7f98a47d0bf9d3d3f07151296241b7
SHA1 60caa79ec0e146a30744b6080c18c7172f618223
SHA512 e7ffac660e4956e986afd385287a1056775623ae621ef3d9e8cf8d4074357cd2a15691f93e46d7ae1f5a57a6c813b129ee1b203b9bfccd28e0de4f871e2861d5
SSDEEP 98304:jr3/HfXMeNrk8qUzuo0iGxlwvrBcTngwVhYFGHOOR:PvHf8kHzRkvw9cD/hR
TLSH
T1AD9602B7B3550697C429191AE87A0A393763414203E166AACF78533FFEC724C1BC6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\startupCache\urlCache.bin
Size 3KB
SHA256 28374a1c280b0c406ee8e52351f17540c3f30a5d729a1615aed3976c946cab44
MD5 48c0cc14b02deb5cb679a142196b90c9
SHA1 1a58a8e123091b0accccd9a402d3b96cd7527661
SHA512 80b574b405b01450801281cbee0fb1fcc6f854e3c4de19981d9b1a3c93dfa8c49ed4f3a054e99d712bfb64fff0ecc3b0988d264b19871113632f4e4b8207f431
TLSH
T13761C392E47F203B7D62A8FB6D95C171B42049CED1CD20EDBA9663D4209E7DC034EB1A
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 a54df8a90c38bec5fb0f0b592c759febea60f8cf199b7cc47851ae696e717092
MD5 c675b15afaf3cbac06d2327b9833a56c
SHA1 18ceb557d4be80422332a1f92c671fc4df5a28ff
SHA512 b0eb7546240192d0d4e9df22f8b9244e4b94534eaf224d69e342a38dfa6825297ca587052d7f85480903f3961ce780cc2c06591290d832339d90a726733d7193
SSDEEP 3072:j3lyB2Rzw0DjDQqSe4vEW83hCG/xU85+DxjGTq:pyMw0z7Se4vG3XZP5+Dxjx
TLSH
T1EBB3AEF6EBA3CD3DA5FFD42CAAC2843EF9262440B3A73009C953675052C6BB46775648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 1KB
SHA256 fa452dd43cccfc3a8506f89c36b5f0bb4e55ec59263e656ebaff4ae7970393ba
MD5 a00217b00007004885c45dae224c6a74
SHA1 021964deb7d83b84fc84d11e279f1f99285bbe0c
SHA512 c03546e924d11da34b0405e01e0ab0da801d2786c66773319b354a8355e11e9cf745bbb42b8e43276565283d0e267a51c87880ce1fe3744b53c87d12453278b3
TLSH
T1AB214CBB52730071E0155BB8B826B014CD2B63C6ABB598491B61B0663986D9EA0EC0A1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 df36478a405c51982fdf0c6314b517befe3915dc3495cca06865173c2bf87004
MD5 2f2ee9fd6597854007f75338f9a4a7b3
SHA1 2079e5212e242b175bb4c5618d9fe9a7c6f1a80f
SHA512 33ffce507a5887a25b54960913284866cf459c74ff726422ce1528a7c8598ed9fc91e228d7e720626baea3027f63a28c89fd6b1fef11086d936f278836804b51
TLSH
T17D211233889AC527F0918A3838ADC4512CA623875173F0B87D92CAD0308AFDAA59C395
MD5 SHA1 SHA512 TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 83e2a5c9d65ed4f819fd9bd6a52715e7d92eb7665d12e9f6dc431496c2b758f6
MD5 87b094ee8bf6b3236413e045af531f39
SHA1 35b84680882ae729f75eaaaf14047adaf5f6746f
SHA512 0c47f8a39b1342ee8be869ae5e146cf2693fc118f9ae9588a03f08a26a756e2c1453c860d42060f505fc19bd47512d7becf73bf2680e233f1e7c3c10f6d88a4b
SSDEEP 12:DBl/WhnB8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLsB8akrEDE+vED8YfAlO
TLSH
T18CA3C68F0E702680EDC420B0D7828EEEAA1EC32DCB13279202A000B29D0206019220B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.bin
Size 30KB
SHA256 726f8f739b824764200e0b0094e6c79d41b15e0739dc11aae0af5449c249f351
MD5 4f0bd8890ed975c7ce14be4036090bc5
SHA1 2616276b440d0ab915695b773b6265b598ff0715
SHA512 91961cbeb3b5c8cb30c79e2860728d58fe112730e68af2908bdc89ac28633b509adb2ce40bf6eaea1e7ad567625d9bc80653a6b163ce278194977dd6e0e0e7d0
SSDEEP 768:Spm+lM1TnuGcmhurCsKDaeHsICebEb0bxbCYTKWEc4y:Spm+lMpRsL78
TLSH
T162E2EF44FB1A953FD41812BBDCA60B042F79B88A59192F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 c38c3ddda59fc37d363f0199fb001213c6be13a2c2d08457a4bee4b047ada994
MD5 0a46013b8fd084d76b81b70199e7aad1
SHA1 e6c67ebbe57d4f3e48982b4e7424b38d03ecb7d2
SHA512 ccc45cbe27884763095b9349670e217bd408cde878808b0ca5b5b6672614bea5145e6964b67671dc4e31430a0e8866cee4a6524d3dd73cf6b88995591be35330
SSDEEP 768:ZjnWaZDY1R5IkKuGcmhurz60KDtMzXbtbdbcb9bsQt+KWE/:1WaZDY1R5hz60wtL
TLSH
T12CE21040FB1E953FD42912BADCA60B102F79B88A59192F573A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 fb8c0a8ec05cafd514dfc108ebb17e3e03b2b3993756dc5bc979e408fb6784b9
MD5 0c5d4c780afa2ee9e180d8987bd5518a
SHA1 53d7a60d568e4f3689d765e1d312459b31a72d98
SHA512 88503e3bd6d1f798f70a71ae320cb39c7536ef5a5eec59af32977f8c2e0a52d203611d2cada74d367a4bd1e71fd90db9c5f622a38d74319d1b78f07f9fa798f9
SSDEEP 768:QWaZDY1R5IkKuGcmhurz60KDtMzXbtbdbcb9bsQthwTKWE/:QWaZDY1R5hz60wtl
TLSH
T1C3E21044FB1E953FD42812BADCA60B102F78B88A59192F573A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 5be451adbfa5902617b627e84f9e846414c7be3dcd2e17ab6cbbd70b0bc084c9
MD5 7c74db83891e8995223520c5d6409d0b
SHA1 8b43476566c5f2363160967755a72ab17e0b118a
SHA512 31860dbd14c07cf0bcefcc7f54e80380cc1f3c1faf50575b9ce1dedd76689a6256f0dae3994677fb17a98c611e9de1c4e41628ce8d58206ba8157c10c0f5ffb8
SSDEEP 768:7JIpm+lM1TnuGcmhurCsKDaeHsICebEb0bxbCWKWE/:Cpm+lMpRsL7D
TLSH
T12BD2F044FB1E953FD41912BADCA60B002F79B88A59192F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a9fdc1b9efebd0490ff97acd9d84b9763867fc0feaa5bbf15addcfb5a8254754
MD5 37f4f59e3521088fe7c5c7373c1dbee6
SHA1 abfb0661d26f86272116d12b6987853497ffc199
SHA512 97928d9618de7668deccd10f4d266dbf735d6fc88104bdd3a78a44f690c89af68f828cc4cc02141d208f2bb71e80eec8fb419436e5eb704750267bc8943cb7b6
SSDEEP 192:MnTKb1d66JozGzgCl6mc0dxPOv5zbokZqmyj7I:MnTKZd66JozGzgC1jXgbokZqmyjU
TLSH
T1A3D1EE68F629863BC418027BCCA61F800F36399AD84E6F25319C745D2D972DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 30c0541cb460935d974bdd42592adea7b7fa90eb27e688e8f7cf96f8b8b65762
MD5 1d93314cd76436a35a76f784a942219c
SHA1 cd2ba6d7919ae6f8e6e3f2d1daa253cf01a2ccbd
SHA512 bd06406812addc436b9e1a2462e5160017473c6aa17f04d2e1dd72e0cc6389a4a2f18c2212ad90b6e619b20581fbdcd6b24562191f73533c46c201e029311b19
SSDEEP 96:LFOV2F4FXRFXMXb/dd66JozGzgClKtmc0d/UEXPSdF95/7bkW60rvEqmyUR6rsWI:MnTKb1d66JozGzgCl6mc0dXPOv5zbowa
TLSH
T147C1DE68F628463BC418023BCCA61F810F76395AE84E7F25319C745D2D972DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 fe9adb1696646bcfc94b8b0405fe79035358801f03560a7da6934f8b0c9ecc6a
MD5 075f2d1aa10759790728a4b195410ae4
SHA1 21b3b1baec1970447e38a4fb4987aaa05ae0ad93
SHA512 74f44586c91aa13840d69bc7e83155d777f1e50dcb06371691eee990858c9ab6cc8da2469a2dd189e8d7682630a5469eec486794e8e007b78a9369711a14333b
SSDEEP 768:uKWEdBnWaZDY1R5IkKuGcmhurz60KDtMzXbtbdbcb9bsQt:jWaZDY1R5hz60wt
TLSH
T151E21044FB1E953FD42912BADCA60B102F78B88A59192F573A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 72f6e0ee43c92041354903fe3947ecc2a7e539e0a5576f1ceb3e646b58c6c8b0
MD5 c7da4e27a73dc1e62ce775ba74d58bfd
SHA1 2b153a2ab36efd23ae8a7742c5b5e7263ebe9eb8
SHA512 290367c96f294e4f522b71551409f0776944b705cd99153ebe433786d1680e7ea94b4bcdb9e30b0beacbfe098c5abe1c3eb8b576f9f14b81198adad16b62ec77
TLSH
T17D219D4C39B84D7B6C87F25C7491118E53914F0319875D430D12EF8DCEC55D9326E43A
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 812b9089c1f44a62a81b54f6704c16f17fd0dd52f6be7ad19418464f6e926525
MD5 177017dfea4d55b54a1e22c1b32ceb40
SHA1 2a97f3960acd15fc33e2e4113da2cb4fc9e14680
SHA512 887955d45701138e665562efb30886e5bd738187cc8e87fa01c67d2bbab6fc1b4d709a09e2c95a78b0f360953917dc44e253706d4aa93fd35588416857d0e6d3
TLSH
T1B631694C39B84DBB6D87F25C7891168E53818B07198B5C430D12EF8DCED5A9D326E43A
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e63054cc2e5d62704abf751f26869792669dec8e6a810b4a939d9b78df5a85b5
MD5 27d9dbac2a767a17f14aa05ad58b9e1c
SHA1 a396a8284246c4dee6110bdbc8925e733e3a448c
SHA512 17b048f8645d21c1fb06c3fb5c012d57e9ffa4cc19b6b4c91bb29a863fde12328b1606f1be58b5b3c56b92e2662769e788b83c5706f7eb3f61bf806f3ffc441c
TLSH
T1EC216A4C3DB94D7BA887E2AC7481028E63554E0369875C430E12EF8CCE89AD9326E43E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 35fccb7529d10252fa04d49c5568693230033b4eaa09b571034a4221ab5f9c31
MD5 9fe37ef287d98089eec6bb8bdd16c06e
SHA1 d52141b3fd7fb653f9b42d77475d8ba33d2353ce
SHA512 495ed230bd6418988154b8e88c9b6df2de4ccbd936d14f059868369522ebef1ac27c84f50d285730bb9f80255d8e44ace520f36656b26a1e580d724f5dec8c85
TLSH
T1EA21079C3DB94DBBACCBE29C7441028E67618A4719871C434D12EF8DCE85AD9326F43A
MD5 SHA1 SHA512 TLSH

Submit Download

07807d3b-fd12-4423-941f-05f83ca14202

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\07807d3b-fd12-4423-941f-05f83ca14202
Size 897B
SHA256 0037a0b6bb78642088032934fec83b3a5dc4874788616e464a859d54456959b8
MD5 8e2fdeeae14d9e6e717d6c5ee388cf35
SHA1 d7f109fbda276b5b3f73ffe81b755262194e2e65
SHA512 7ca82a163c4c50256b7da185841b9e9de88d395d9934ca73ef50d5d70b64f73d4ac650274ee4276f0cc8f0bd4bffe27db29491ff9076fa8241926c042f7176b8
TLSH
T108110081A570B9728C6C828B86D177478BE4302380CA44203EA47E2C1CAA92EAB5A607
MD5 SHA1 SHA512 TLSH

Submit Download

1fb55be3-4d5a-4f0c-a4f7-782640fbe794

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\1fb55be3-4d5a-4f0c-a4f7-782640fbe794
Size 235B
SHA256 9ea7a1b4bccb985f528416745bede64ac5480df88e61e5fb05332246952f321a
MD5 af6317b16ac536500b4c9361e64020da
SHA1 177aeaefb346d19523d4cde8bcb46772203a4725
SHA512 1971290e2be89c82d2cbff359569b5209c60c99396ce04aedb0f4bc340a26113cd3574faa65307d6728d03f592e12d6d18489d59047890b011663c170c51d4fa
TLSH
T1A2D0979028A8332D08280F16F0E069C670A84C3720A49C20C99044F899BEDC45152D0B
MD5 SHA1 SHA512 TLSH

Submit Download

48ce7854-21ee-442a-beae-5d5876a514b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\48ce7854-21ee-442a-beae-5d5876a514b8
Size 2KB
SHA256 90a9844c9946a5717cb70b0740b5da1b4d799add81c59dd73e93b21b58362db8
MD5 66354f711c00c0f9042a703215c21462
SHA1 e6fcad8107d689adaa34bb5725b2191854b963d0
SHA512 4eb6131f07aef84baa29313eaba57e20730dbdfc8c4eedafe3abb34bde43767b34478d2a5bb276ab1a228dc7d8798bb1fca1922c3dcff3fc2219cf3b2acee009
TLSH
T1DC51305C79785CBB5CCBF19CA4D2368E53908B0314C658832D12EF4C8ED565E736E12B
MD5 SHA1 SHA512 TLSH

Submit Download

9b3a5741-b449-48ca-9f60-7b74987872da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\9b3a5741-b449-48ca-9f60-7b74987872da
Size 886B
SHA256 d13ed8bf874edeef7f6496e5f40f2c65f39114bc92f76e41ac8276541b4ab6a3
MD5 adaeb287f99fe6331965a0350431a8ca
SHA1 1783e423b09f0bd0c29164999e594db94a97bf72
SHA512 642898d452d7aa1e1a8060f9ffea4f50f710c6492eabf13fae8ce1861e41183526507ef2f9b637ab1f92945e185cf350baf9f018dc4b0636fd2776ff1b0bc5ca
TLSH
T194110081AA34B9728C6DD2C795E17B468FD06023C0CA59147E517A3C0DAA51EA76A207
MD5 SHA1 SHA512 TLSH

Submit Download

a448c7b7-e071-4a30-81aa-7a7bc41d3e79

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\a448c7b7-e071-4a30-81aa-7a7bc41d3e79
Size 235B
SHA256 ef73e1c4bf8490b847f1ac99d1f4c1d5ebcfcfe5979e497eb7a48123f75af627
MD5 dad2531c1aee126e645be6c323ec909c
SHA1 b8a9c2b536a109b7dc2af196eabaa23674527654
SHA512 b1ba52f7755aeb7833e37dcd5194a98b882a7da09d329f073f4ec14a328f0fea2e9c35061a51c2fb540a319c44faf112265f52f2494bf225a2f634cbe5dd2306
TLSH
T150D097C264986B2C08080F06F0F0AAC330858C3360B99810CDA18674EDB89C41322877
MD5 SHA1 SHA512 TLSH

Submit Download

a718a338-287a-48f5-ab72-9ff5147b231e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\a718a338-287a-48f5-ab72-9ff5147b231e
Size 235B
SHA256 3955ea7a41d7bce0090c1a8393959f55cb81fcff2d6fd375826d42e50cab9efa
MD5 82cfc06d5f3708c68f749d770fcad91b
SHA1 82f9eefd91cc364f0229425af5ef733c46bde3d8
SHA512 bc54954e8ecf5ec7563488b35c734140240c9c07d00812bb660f5be0e0d6a22a0158ba89aa5bfc17265cf7b471cb1009154234b522f3e4afbef4dd23772dc190
TLSH
T165D09780249823AD88000F16F0E028C234944C332874B8608B98803899BCEC811228D7
MD5 SHA1 SHA512 TLSH

Submit Download

ab5b282e-d7c1-41cb-bdb2-72da42f27df3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ab5b282e-d7c1-41cb-bdb2-72da42f27df3
Size 2KB
SHA256 3c0d79ada78af5848327d5157cda383d3fd044944083e48b9e005c7992349aea
MD5 e8812d3cf1f823413e104fe8da09cf59
SHA1 e77b05165550050128d2ecc5cbab5c47a90939de
SHA512 b59757296ecb887f77974fe0c0d2882bc7cb52c65d578a3814540970a91df33cd4c85fff02f056223842273de5352d74a015c9a0177aeb35edf79e60ef097f81
TLSH
T1BF41535C3D785C779C8BF15C94C2228E63248A0364C228832E11FF4C8DD96AD23AE53B
MD5 SHA1 SHA512 TLSH

Submit Download

bcf4fb28-37d3-45cb-ae26-8532256b809a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\bcf4fb28-37d3-45cb-ae26-8532256b809a
Size 883B
SHA256 c366a5e7159f97fc65d28c6aeb35f7e7e7e9529f9876cd4ad1311ecc1683127e
MD5 182ef53da9db388667de2a39c76bd2ba
SHA1 f20561ef8a4e66a617a677b486044b25e1b7f36b
SHA512 c2eca44f30b45136f9d7cf48ec5008985ae2258cb2f0cc48374da0c983703f00ad19cf1593968769c29a08b734fc8f0d39d0ec12cabb5ed8e0460dd58daa0112
TLSH
T13E11E7C1A530B973CC6CC24BCA9177469FE46523C4CA50143E626E280DAE51D975A607
MD5 SHA1 SHA512 TLSH

Submit Download

bd58c264-4f38-4d77-8f0b-a957a5b92242

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\bd58c264-4f38-4d77-8f0b-a957a5b92242
Size 897B
SHA256 338feb8ed1906a48c472cc33cc7dcfd02ea641cdbdd580a5c86e5f04473b2b8a
MD5 38e49cbb713c6b5379130e12e240245e
SHA1 72706c6d5dde7ac0f1e78a900e61fcde63740b43
SHA512 06899d45b0f17bd9a4393a8123dceb2613eb9b6d8046035bf0b1300f5865cf899942f1d6fb5594058198ce5d0965e17bf4a1224452baacee82975ca6b95ac6d9
TLSH
T18E1140D18A30B9728C6C92C7C5E037434AE03523D0CA48147EA13E3C1CAA51E579B303
MD5 SHA1 SHA512 TLSH

Submit Download

c54a4d72-5876-4906-ba61-847413a7ba6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\c54a4d72-5876-4906-ba61-847413a7ba6f
Size 2KB
SHA256 5ee59be95953e3998e8759307d5272f0e089d7310eec36b111dc4ed227e08ebb
MD5 13464caa6299a68af869718ffbe58642
SHA1 b49b407fdf4766378a10de9a6ab7ea68571a0d28
SHA512 a8a3ac973d92a93314bd2ac1970c869e057aa7671c899ef6e5d66a4d19a8d6be9de36a7ad4254c6f105a013fcd5f702ca8d9bc9be96f6871ed8bcaa7b35c8e8c
TLSH
T1B741435C79785C769CDAF18ED192238D97604E0300C61CC37E92EE0C8DDAA6D636E42B
MD5 SHA1 SHA512 TLSH

Submit Download

cd479c79-af89-4d67-a454-9f5dc768c16b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\cd479c79-af89-4d67-a454-9f5dc768c16b
Size 16KB
SHA256 711f7027e9a7c2b29e40d3d64d9127b6767fc26f1935d8e8ef3912512a671003
MD5 6ae2a1a4f62c61631b7ff4a6103d71e7
SHA1 434a62c34b96670403307a7294ddd4c633ba2e24
SHA512 b578f639156d173dcf958a1ff9a93f640f3f44f9bd563ed5eb8e54e6ce873662ceb3b195babc782b0203d40bd4c4c1497b8887b5e9324543e3ed2d4bca07d3dd
SSDEEP 384:oWmfWGtx9qLZSl8ZrhHSvw3+lGPunM8Ogd:oWmuvl32MDgd
TLSH
T1C172D956686045BA8651E3A894FCBFC3E5F638CF4C419FCADBE4BD081DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e678d5db-ce09-439f-907e-97d3dbef4a9b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\e678d5db-ce09-439f-907e-97d3dbef4a9b
Size 235B
SHA256 64368c4ec460f5b61e37ea72f6fd7c862076085451efeac796c4eab3c8cb9cd8
MD5 7364cec877e09bcbe4fadf245184f285
SHA1 49203887fc3a536afa92fe5656dbf2e7494e6cd1
SHA512 4ac801b845b209087bc7c6c7bc7249acb98a2f1f732d57a542a9aae4bb5bfecded6b8cdbd82a08d61e6c5439504275d9e2fb5f6cda18c7b13277e8e5f0c231a6
TLSH
T13BD097841488372E0D100F1BB4F06AC231C88C3324A0A814966204348BFAAC68263826
MD5 SHA1 SHA512 TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 c7baab1cd8662625bc822a3c3c7b57973b927cd5c26192d6cda60ed9ecc0ed07
MD5 7231237395096e88196ba0ffd7ac0ac6
SHA1 d303ddfed1d4341f30ed79abbc23ce51f651bd35
SHA512 6220c9908bfa889f1db84625dc214127ee76c40c97a0d2b81df251253d4a8cc7ba6387d94f751a8f092850ce8a86d5c7e0d7938b85ef763813c4ab4a0834055c
SSDEEP 12:DBl/ATMbUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLbbv5XvtQhP8W5/b
TLSH
T1A6A32B1F1B1CB840D4C356F26D8329067634D50B8913BEF03B9D84004F066481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\places.sqlite
Size 5.0MB
SHA256 4c9dbe34b5b40e8cb5d8a4ea1347d1cca03ca731b49563060616603e58e3f138
MD5 2171bbded2595dc883e9af28d86ebeae
SHA1 4b129fcc1a48212a6030b7aa5557be5a1504826e
SHA512 6a5b6bbbfffb09cb5165011d121f7e9b32135c409f54a0f0d771415d00bdcaac292c8b1c3eb174de8ae3947bc0ab30d49e4ce00451ebc118449523c79801c11c
SSDEEP 192:M8rJQaXoMXp0VW9FxWZhQqkGk7WmeCYjm:M8r54w0VW3xWZhQt
TLSH
T1AD36520F7A241194C4EA9232EDE26F29183F7016867676933DE4656D4DD0A23F92CCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 7e0d49032c5561e5e1532ed7003e2cc83d973d0c83b3591358c35cfb979cd52a
MD5 e23b6be242490d74569010008e521ecb
SHA1 b7149e71ba593349bc95a27e2055379189b36ae3
SHA512 18dd8b6a7003a3b1c7794ee524ae192fcaa4688cc21fce703abe11030f8d6f82d2f91b6d3eebd2997f8659da50257f55ec5be24da5e5104dc3af59225ea29f14
SSDEEP 96:xHcUTURPqGqdf2DCObzSQSSlDdv9j7nERH9O+y1Bw8On8L4cnrztK:6hCRdf2DCaSSy9A1Bw8O+E
TLSH
T12AE1307894088F7F64B6767CAC6888716AB2423BBBBF68C750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 65e35b0c8ebf3ff55af4e7154630dfa211bc413e68ea33e422b184d38472b7a6
MD5 f25844bb556d803552501e9f63ad031f
SHA1 d89a32ab1f261b9790397a0436da69b3cb85319b
SHA512 a08fb52afedb3193364d34a377daf934aa64f460da798cca18288a13b67f31060f9a73a20986e374c9e7a695e1433d2d809082255f31c6c264b71e0c160b3258
SSDEEP 96:xHcUTURPqGqdf2DC1zSQSSlDdv9j7nERH9O+y1Bw88n8L4cnrztK:6hCRdf2DCNSSy9A1Bw88+E
TLSH
T1E5E1207854088BBF64B6766CAC6888716AB2423BB7BF68C750B554C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 4a4151f2dce39487dda8da86a58c8ed22603511a8cb897594e55af2d6eae8893
MD5 1131bd41891e4cd00e54a0c85fb0fa7c
SHA1 e8af287b2ccaebf8016d80d7ffa23b36c3aa8ec6
SHA512 bba8bdffcf52a887303aa3dd9178c4d205164a4ccfc027f19a43bd91b5832cf9c84b6b5ebd7ab393e1d176b04e7c3dbc6c987414500752037ae8b8e3b83120a9
SSDEEP 96:xHcUTURPqGqdf2DCObzSmSSlDdv9jTnERH9O+y1Bw88n8L4cnrzuK:6hCRdf2DCsSSa9A1Bw88+9
TLSH
T126E1307894088BBF74B6767CAC6888716AB2413B7BBF68C750B954C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 b10447dd61f248ad5d0d4b47fe8615be8540532acd3ba671d9ea47b0d183db79
MD5 8c6e879b698a30376dbb9462e039338c
SHA1 e1b33a7d9c4a7e5330f7697f1ad5234e8aa0a263
SHA512 f172ff3bdd85851fe5cb9f28397e95622976831c01030e31da4247ab2b6acec0b90b4435bac267bd75b03438b2cbb51105f839a5c77fb3fff7ca7b6adda68587
SSDEEP 96:xHcUTURPqGqdf2DC1zSVSSlDdv9joZnERH9O+y1Bw88n8L4cnrztK:6hCRdf2DCASS39A1Bw88+E
TLSH
T1C7E13F7854088BBF74B6767CAC6888716AB2423B7BBF68C750B554C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 559aa565953194cfb07fe27254c7d0d285c152c5ab218fae4c1f0597b32c617e
MD5 ee94ffbd10c3db15e3fcd0cbd031d4f2
SHA1 cb56924e777ecc1b0ef60dac92720151de106d92
SHA512 59ff48ebc8a1ca8d36b9e77e1386370a543b2c85b455aebd6502438eced26afa55f20c24d692fdbc0b3c48864d7821fd88ce2f71b049be4e6320c8ca7bbb00bd
SSDEEP 96:xHcUTURPqGqdf2DCObzSVSSlDdv9joZnERH9O+y1Bw8On8L4cnrzuK:6hCRdf2DCzSS39A1Bw8O+9
TLSH
T134E12F7894088F7F64B6767CAC6888716AB2423B7BBF68C750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 a12fa5ea73eb78c9ff8d5213ae815dce99736078131bc3dc7bc381f67d2cedfd
MD5 b76afd02f59e5dae4f76caaa70aa78b4
SHA1 cb4dd510eeaf1a4f12660344f9dd9c9d5111819d
SHA512 4314f6866d90306226f9680699f092aaa1b28a30c09752cd5f262f0460243c30fc72231e790f7d47f782c1c2fdd99a8fa08a6d53719a6b047d818a78936e8472
SSDEEP 96:xHcUTUuqGqdf2DC1zSQSSlDdv9j7nERH9O+y1Bw88n8L4cnrzBHK:65Rdf2DCNSSy9A1Bw88+w
TLSH
T1A7E1307894088FBF74B6766CAC6888716AB2423BB7BF68C750B554C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 f76d30123a1547c74a22764161f556553afa47da07d2dd5af5657dd95d72235a
MD5 dbb2fab81873e49107c77814489a7d4d
SHA1 06e908501e06b34a7e971aae8dab0a38ee4ecd7e
SHA512 946157c7cb4f7f65ff19be7b4fb494c6630b3e0cc9c514928690bad8b1473d191934b130297ac44314f98e69edb2fdad222fdf31221487d2f1d167c2905ebdf0
SSDEEP 96:xHcUTUuqGqdf2oE1zS1SSlDdv9jBnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEsSSE9A1Bw88+w
TLSH
T1CDE1307894088F6F64B6766CAC6888716AB2013BB7BF68C750B554C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\protections.sqlite
Size 64KB
SHA256 f47973dd13805200a469d534a0ec50e224f0c12ae77d93a0e5bcc267af19c145
MD5 63b6f9d979a2cd96d93c105805cafcfc
SHA1 5fc70ce8799617202d1b2a350f6d596b65d48e54
SHA512 ca475720928bd40abab686efb8b890fdccef59c292b26263d41bfd9dfe8f35d21405820e10505fa7cff49eea5ae57ffdbd6ca73d5cf6e1cfe67f5994d2823b90
SSDEEP 6:ltBl/l4/WN1dR4BEJYqWvLue3FMOrMZ0l:DBl/WunddfJiFxMZO
TLSH
T1BF53225E47387021C0891372ABD323923F3CD2FA93232E836A100C358C0A023B822AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
Size 181B
SHA256 16b7be97c92e0b75b9f8a3c22e90177941c7e6e3fbb97c8d46432554429f3524
MD5 2d87ba02e79c11351c1d478b06ca9b29
SHA1 4b0fb1927ca869256e9e2e2d480c3feb8e67e6f1
SHA512 be7e128c140a88348c3676afc49a143227c013056007406c66a3cae16aae170543ca8a0749136702411f502f2c933891d7dcdde0db81c5733415c818f1668185
TLSH
T112C080C7C5491075DDC32A5D73D47F519D3F04F776711545B56C594C187B0278547843
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json.tmp
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 557540a5221f22fcfa8962a835a03fa4f3196ee2f3e29f454dcac6b744979568
MD5 9905cf923dba7adb426d6bcc2e1850f8
SHA1 bb70cc5a13f57e154af3d3e1c05d8b8398a2de0d
SHA512 5e7f805e22ea80d33342678d3d55982bfa5088a2feab27ed9f037687338f26afce726578940536a9c7a2c69aef9d73abfa24628b7631333391bb8b81314b2096
TLSH
T1D821A583BDAB2EF57AA0115990894FFE46193032427508E0C08EDF4345ED05F275E42A
MD5 SHA1 SHA512 TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage.sqlite
Size 4KB
SHA256 1db39598ae2ee67e7a598723a6ec07a3b74ab17ef166a2614785c74c43d1c5c3
MD5 701bd81ab9bb9fb95ec393a557d20be7
SHA1 7f6d6f5a146ac2e0c5f5424da7d7199ca8b6662d
SHA512 4f6b7a82f3361c2f452f0093fb0286acfa898528a2933f501bfe627993899cc77e136c435a0cebd95457c72c604b030b46dc07fb7b2b937d67ce3dd46179fc5d
TLSH
T1CF815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B95C72EA011FACAF35966B164BD
MD5 SHA1 SHA512 TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 cb179e627d719f3cabf38f0f88bcd9eb359ae15da80015cb7e9170a62bac9c13
MD5 1f80fcf423e1b958d1f09181d0bbf12d
SHA1 759cba2e980bfab8f417ea963fd7e72d23c922cb
SHA512 d7290bc92de5ed5923b67fa225158bc720ae821b2948f0b3ea69dfa5045fd870be2b76dc20e38c7d7e3b1236604394f006c44ee9defbc4d2d4ba360168440c6c
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkB+:Oa16S6CKnqlizbxV+2xVeU7X2B0mK+
TLSH
T1C523708E3F07A511C53AF0B178A08D51BC5E321D07222AD669D0DAE4C8F215AEA5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 3d369517a70ef2078f41f81bc7d951a3cb49d52e7167a3cc029e2da28fc75bec
MD5 f026783c5b430904e0732acc6f0e0516
SHA1 0278718dd35fe8bf0aa1376949e007e4edf9ba90
SHA512 f7d4fd68065150082f2719fa401bfdf00e02dbe651cbf047f90e6c95607ce0939461e020e05f5f6dfd3f4eea0984aa5f5248794a2f3e313b0287253f538719b1
SSDEEP 49152:VDmgkuOjA5lUT2loncNeaKvgmRBbFOYLg/s:lmpuO856T2KQeaKvgmk/s
TLSH
T1F81639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\xulstore.json
Size 138B
SHA256 81ef165ad53b66d069fb647f3b801e9de87b7b09b37201943949ceba3e65bbea
MD5 20b352ea9514cb02dfaa2afcefa0b948
SHA1 16f12babd94531ff9bf0c6948065b40cc4558f0f
SHA512 2347fe24e07468c2d68f23d9c80aa1d1ddc29a066137acdb352930bf663202738f01548aecf9235a6cedae547340a9ffad60157a61d09889d152f4b09070059c
TLSH
T179C02BB0215FD8487F178FCF024D23843D2A851091C011A679C214E0008530F4C18308
MD5 SHA1 SHA512 TLSH

Submit Download

Velocity.7z.crdownload

Path C:\Users\Admin\Downloads\Velocity.7z.crdownload
Size 19.7MB
SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
MD5 34be7067f85591003987566f89d44875
SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
TLSH
T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download