hxxp://Fortinet | Triage™

Analysis

user interaction
yes
max time kernel
45s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Fortinet
Sample261003-sy2csattcs

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6800	msedge.exe
5304	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "83"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{DB7C5BE8-E690-4FC7-8125-0FA7EC22E319}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{2EABC5F9-56D9-4CFB-ADAF-27CA60A45F90}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5596	firefox.exe
Token: SeDebugPrivilege	5596	firefox.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
5596	firefox.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5596	firefox.exe
3856	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 5448	1500	msedge.exe	88
PID 1500 wrote to memory of 5304	1500	msedge.exe	89
PID 1500 wrote to memory of 2872	1500	msedge.exe	90
PID 1500 wrote to memory of 2872	1500	msedge.exe	90
PID 1500 wrote to memory of 2872	1500	msedge.exe	90
PID 1500 wrote to memory of 5892	1500	msedge.exe	91
PID 1500 wrote to memory of 5892	1500	msedge.exe	91
PID 1500 wrote to memory of 3984	1500	msedge.exe	93
PID 1500 wrote to memory of 3808	1500	msedge.exe	94
PID 1500 wrote to memory of 3984	1500	msedge.exe	93
PID 1500 wrote to memory of 3984	1500	msedge.exe	93
PID 1500 wrote to memory of 3808	1500	msedge.exe	94
PID 1500 wrote to memory of 3808	1500	msedge.exe	94
PID 1500 wrote to memory of 5872	1500	msedge.exe	99
PID 1500 wrote to memory of 5872	1500	msedge.exe	99
PID 1500 wrote to memory of 5872	1500	msedge.exe	99
PID 1500 wrote to memory of 512	1500	msedge.exe	102
PID 1500 wrote to memory of 512	1500	msedge.exe	102
PID 1500 wrote to memory of 512	1500	msedge.exe	102
PID 1500 wrote to memory of 4220	1500	msedge.exe	106
PID 1500 wrote to memory of 4220	1500	msedge.exe	106
PID 1500 wrote to memory of 2544	1500	msedge.exe	107
PID 1500 wrote to memory of 2544	1500	msedge.exe	107
PID 1500 wrote to memory of 3596	1500	msedge.exe	109
PID 1500 wrote to memory of 2680	1500	msedge.exe	113
PID 1500 wrote to memory of 2680	1500	msedge.exe	113
PID 1500 wrote to memory of 2680	1500	msedge.exe	113
PID 1500 wrote to memory of 1472	1500	msedge.exe	117
PID 1500 wrote to memory of 1472	1500	msedge.exe	117
PID 1500 wrote to memory of 1472	1500	msedge.exe	117
PID 2736 wrote to memory of 5596	2736	firefox.exe	120
PID 2736 wrote to memory of 5596	2736	firefox.exe	120
PID 5596 wrote to memory of 3192	5596	firefox.exe	121
PID 5596 wrote to memory of 3192	5596	firefox.exe	121
PID 5596 wrote to memory of 3192	5596	firefox.exe	121
PID 5596 wrote to memory of 1704	5596	firefox.exe	122
PID 5596 wrote to memory of 1704	5596	firefox.exe	122
PID 5596 wrote to memory of 1704	5596	firefox.exe	122
PID 5596 wrote to memory of 1704	5596	firefox.exe	122
PID 5596 wrote to memory of 4632	5596	firefox.exe	123
PID 5596 wrote to memory of 4632	5596	firefox.exe	123
PID 5596 wrote to memory of 4632	5596	firefox.exe	123
PID 5596 wrote to memory of 4632	5596	firefox.exe	123
PID 5596 wrote to memory of 3532	5596	firefox.exe	124
PID 5596 wrote to memory of 3532	5596	firefox.exe	124
PID 5596 wrote to memory of 3532	5596	firefox.exe	124
PID 5596 wrote to memory of 4216	5596	firefox.exe	126
PID 5596 wrote to memory of 4216	5596	firefox.exe	126
PID 5596 wrote to memory of 4216	5596	firefox.exe	126
PID 5596 wrote to memory of 4216	5596	firefox.exe	126
PID 5596 wrote to memory of 6836	5596	firefox.exe	127
PID 5596 wrote to memory of 6836	5596	firefox.exe	127
PID 5596 wrote to memory of 6836	5596	firefox.exe	127
PID 5596 wrote to memory of 6836	5596	firefox.exe	127
PID 5596 wrote to memory of 6904	5596	firefox.exe	128
PID 5596 wrote to memory of 6904	5596	firefox.exe	128
PID 5596 wrote to memory of 6904	5596	firefox.exe	128
PID 5596 wrote to memory of 6904	5596	firefox.exe	128
PID 5596 wrote to memory of 6912	5596	firefox.exe	129
PID 5596 wrote to memory of 6912	5596	firefox.exe	129
PID 5596 wrote to memory of 6912	5596	firefox.exe	129
PID 5596 wrote to memory of 6912	5596	firefox.exe	129
PID 5596 wrote to memory of 6932	5596	firefox.exe	130
PID 5596 wrote to memory of 6932	5596	firefox.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Fortinet
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9291dc188,0x7ff9291dc194,0x7ff9291dc1a0
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,2306246097585640203,403279301266271355,524288 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14084153957262880944,14282631973479431781,262144 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,15506953758959632297,1018405744701354095,524288 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,1382438960847775980,9715281732403390241,2097152 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,12309672171384472950,5656884711846862084,2097152 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4984,i,13145438748911804119,5251202999854102611,2097152 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3640,i,16812582432474593873,17979475979064477441,2097152 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,7956356258441174673,17443842573528359186,524288 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,13103726034978510294,10016204170916241367,524288 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2568586247803764263,154069677551907502,524288 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2568586247803764263,154069677551907502,524288 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6068,i,12262574822374728917,10361750084672161500,2097152 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3632,i,925483098059687134,15294281230889511771,2097152 --field-trial-handle=2192,i,12075180514646829827,15238605717138435924,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  PID:6456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9291dc188,0x7ff9291dc194,0x7ff9291dc1a0
    3⤵
    PID:6564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,553938587873650539,8091834987327485066,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,11660241985369553341,327670735804740617,262144 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:6820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,12973519695452233707,2892021996615330818,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,15862908389943907280,13428764016904494224,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,15862908389943907280,13428764016904494224,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,2766121950282473815,924989045831507265,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,11970255173130067699,5411695421489697286,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
    3⤵
    PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,6526871125551540407,14555154005632806750,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,10596648406829758390,6356045539487025124,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,12491645338085882178,12810992696263376751,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,1157778445094777887,3981953734647634988,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,14027755111238918553,11896341155221208618,524288 --field-trial-handle=1404,i,9712992611501835810,5390054923525426805,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {d33f1e7b-8048-4103-ab0f-9d116147b1bc} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {99dd459c-184f-409a-a922-1f568b08e0b6} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1028 -prefsLen 27325 -prefMapHandle 1372 -prefMapSize 270279 -jsInitHandle 2660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3508 -initialChannelId {0bb85860-caff-4a6b-99bc-30f120129665} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3564 -prefsLen 27325 -prefMapHandle 3568 -prefMapSize 270279 -ipcHandle 3604 -initialChannelId {09a44b48-e759-4af5-ad9b-0f9b7769f64d} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4376 -prefsLen 34824 -prefMapHandle 4380 -prefMapSize 270279 -jsInitHandle 4384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4348 -initialChannelId {543aabc7-37a2-44fc-bfed-785304358580} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4988 -prefsLen 35011 -prefMapHandle 4984 -prefMapSize 270279 -ipcHandle 5008 -initialChannelId {1dfbb879-306d-4a2c-98ae-7be009c3d435} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5132 -prefsLen 32951 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5148 -initialChannelId {cf361c95-194b-4e75-a330-7363bbc168e8} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 32951 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {6ef85137-ca31-46a4-87b6-7af35a65351e} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 32951 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {8443b544-7b6c-44c3-9502-6572747411cb} -parentPid 5596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7144

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa389e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc826aaa75d7da810bfdc30a1671df54c18887a7ddc779d5b9f03835587852b4
MD5 77e198de5db1473b46a54bf11e90ef65
SHA1 d40423f0ddb590b81cb9016394df150361acaffc
SHA512 208c9def9ae2c86b2de012eeb71379c0f243edb53a958e991a05233405a4a20955e43cd9ddeb6944b19a1811ed512d3123f7d75ab4ca5b9a71dca6edca139ba2
TLSH
T1ADD08028B57C7BE4F03D353D0224414C31CD5AB156067545925417554FD155315D48E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 63883212e8d09ceae0ec4386ea47458e36fcf8b9e3037d73f148d488e3998050
MD5 c3de9665b25c01dbe5298965ad4cd40b
SHA1 ec5e1bdaadf7d3520ec2729ed48a403231cc7afd
SHA512 405f737f561d849ff733ca1ec49123aef41a49a12eea86923b2a0ca3a9f3893e3e8068b6b613ca0760443b8e1895ce425552c473172e6a4bf96d9e2286c734ec
TLSH
T120D080ACF2787A54E42A343C1515524C71CDAB707C07F440E15163642FD766111D40E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4e5093ea34dd78cbb525656f45aaddd6799dc0deb9a7f905c1c551703816860f
MD5 95dcedfe1fed66541725faf7f8ae8599
SHA1 0f6588ec7855739fb35547c5ec354edab09dd758
SHA512 e4413f75a0b92a660e63467c884562f9c06934d10ba338abb1542051581b6967011e359d2b907356467c357e09d61f8c8b23ad69c37c5a5146f1ce91fc9c1a44
TLSH
T194D080A8F2746B54E416343C1515524C71CDA7707C07F444E15163643FD667111D40E5
MD5 SHA1 SHA512 TLSH

Submit Download

01494ecc-53b9-4536-9430-92bbccc848d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01494ecc-53b9-4536-9430-92bbccc848d8.tmp
Size 649B
SHA256 4c8461ea63c160aaf4ea26fdd6e0e8d22ae9c7f2d83c66c7fb131bf1e3dc867a
MD5 c4e5a14fc68923a801d905602d1cb953
SHA1 bee7db1ba22ee5a375dd61ae8cd3d1c11c37ebde
SHA512 cf076c8610688be7897bb6e4b4e15be14431ac834b775445ccc570bcd67778c3140c9aad75d88c6bbe8a0935d8ebb407471f4cd7c19a11fcf7a6aa7c396388ad
TLSH
T153F0C8B5C921FC3B1CFD1B7960A40746F750236B2A41985B3B3E910D8FB563B8595D2C
MD5 SHA1 SHA512 TLSH

Submit Download

035801e8-438a-4d13-917c-fac5f82844fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\035801e8-438a-4d13-917c-fac5f82844fa.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25de643e-fb7d-4ab7-a51a-9306e9760929.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25de643e-fb7d-4ab7-a51a-9306e9760929.tmp
Size 12KB
SHA256 1bae7649f52a3afbce66eedb376cf7e377648c814a336f3fa81dfaf18cabece3
MD5 b611c54fc21f9c1160aaad75d115b267
SHA1 316bc90dcb32c0a35f8e58dee9a9a8ff9c8169df
SHA512 2160aa99124d72f576195f31959cdbf585d69a728f7439415a20fffcd124029b78aaea4dbd62fc8f6d913e140ea80361d367cd9372ea1d3f70d13fa68b40db1c
SSDEEP 192:sxZ8RKkd/fCsuWpVoGoZVf8fzodpNRvHW6+WNnLEs/YgYySqXIgbOtFJ:sxZ83d/fCsuWvfWV00fHbj/RSuStv
TLSH
T18A52F815AD28A9BF8CC7E619FB557F53D3F9103294811E48A9FD8A2C05E7BDD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c8262e7-e1b8-4c00-99fd-06adddaf1dab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c8262e7-e1b8-4c00-99fd-06adddaf1dab.tmp
Size 12KB
SHA256 f7952141193707b5342de7e1096f27382c884a98b52a10027eb4fdee36455f97
MD5 95f988fadeb038c7b537086e5b0d4b3f
SHA1 9ea30fc79f954f6e40844625eeca26d874ab1e64
SHA512 aa3b0449b1531471bbdfb44fb0cb59fb3d61b30bfd1058922f12f6c60e3e43f0227b6ed36d79d08d160071ffbfa127cf41f2fabe8e01b0da139f09b87789a1c5
SSDEEP 192:sxZ8RKkd/fCsHLWpVoaQZLH8fzodpNRvHW6+WNnLEs/YgYySO1IgbOtFJ:sxZ83d/fCsrWvhOg0fHbj/RSkStv
TLSH
T10642D715AD28A97B8CC7E619FB557F53D3F9103294911F48AAFD8A2C15EB7CD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

304d7aff-1a61-4417-ad7d-12766311c84d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\304d7aff-1a61-4417-ad7d-12766311c84d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 3e1ee6288419cbab93592f2ad214bb888e108e5f7ae6a23d7fd2975d073f6609
MD5 aadffce9691f3f9acc25eaf002631a81
SHA1 e3950f367697fc8a86727fedba4345e4de8ed158
SHA512 ecb4c61e8ac455b7ce4e5c10be29aaf0e8308fe470c5cd946c3fd3f7bf4c31d4a943dd904d81deb07033fe0c1f2a4878468fc08c8338219794da5391c61658e2
SSDEEP 384:CYqwa/I7lEm7qRAj3E15wUwpmdR4IDx/Hd2H:0E2A7eImdr/Hd
TLSH
T12A13A47D32873EC2F6D606BE11AB6A352371DD2CC2E49C934B32F4564B8D702296DC59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 0e94458c037a0609303342f876247d89301ae49e0b74a8eaf2669c0c8201281c
MD5 050b67bae1a4636ce4ea24a06ca19287
SHA1 edb6e0a99574ac033d1c76c66f4645697a08a421
SHA512 3c18efa35fdafe36e9d859a57720b21f1d514c2af10e1791ae24e40e91d58a9b10c3db82691c3cf8a80bcd03cb50ce2ccb9d8a82856c5b9aacdcdafbf02ccc5e
SSDEEP 1536:wa9tVL/QY3L/lUsJm3UUAAY5pGL/BL/HL/05vGZy9wfQa6HpjecEH:wStVL/lL/cY3GL/BL/HL/wksgcEH
TLSH
T12B4470F71951A01BDBA802F5D2133E3EC1BB415D2CE1E8E9E5788C952829F31B6BDE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d9d082ca1f584de6c2bf3d72017b321b10096f3080aa1a7d6c02ccc93541f75f
MD5 35c0844b99ed04611d7d6a3d24d0faae
SHA1 fa34c332d5d8ec2176fb27ef5cd90bd20ecd939c
SHA512 c1917129e1971dd92964a5301559d5652112b5335d795115e0a26407ed711049549f89961cfca6897df43b986b7ac5490c13d162a7a32bf48b2578cc74f49c4a
SSDEEP 24576:YFrLBmu4YZjXqED5iyMk9bKc20Jn2KGr7a+bMKYqT04xG:or1mul9fD58k9bB2E2KeDhT0iG
TLSH
T1EA166CEDCA6858C3DD639A30B4F0E9477C7413C3F965C1D68C98C184026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 36081881f613d1275d6d5ff56cd0c6925dfd0d2cfd102c5d0a069dd1ee17028f
MD5 35a5714e29d9d18d48575b826e886cfc
SHA1 d73f4a907c03d536879b6017ff2e1b569a12867d
SHA512 107b96b25970437edb611cb281d56f3a14808b9da5e1185e03bc83fe89dc07eba9b57c45960b72857c83ae9522600e34ab4f6033cbd30db55b8e294b71ab20d9
TLSH
T17D617F922CC27CA1FB689275BFD22D873A385EBC91B71F0537D8DC78A80EB154004C24
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e1ca9578-c706-4c89-af8c-b299aabdac56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e1ca9578-c706-4c89-af8c-b299aabdac56.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 2e90b0cb41b0a1081ac297d41b0090311c4280032db198296d37f1cff37473bb
MD5 908fa50e917724776fec1da7a4ae8b1c
SHA1 dc2a3b7752c765a9ec039b24d420fec9efe84faf
SHA512 01b96ca713aadd7af74311060e70bb6e5141ba78b32abf582beaf02b7fc4ba3e4493e36e3a9c5e91782fc9299161a2deba5be52eb621cabe53c23c3f50106da1
TLSH
T15DE0D8E579C7C11D996434C3116BBB18C3C23466E782BD071794CCC27A8A001F281556
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 c89b977dd8219716ba5935d26435ffd2759838973be4018559f2516ba07deb29
MD5 8d445c7a40d0ee3e280b1dabebe375f9
SHA1 2b0ca64f2a809802a6fa0c81c4e81e3802f5e21a
SHA512 817e88a41de43ebfcadc3fa2d726726d30004e934f29103d5371e0ee409e316bdc08e560b37b9fd137f09e5f30bbb098df78824d49a119baedf31d8dc39ebf04
TLSH
T124E026B435CEC12D915878D383AD7718C7D23492BB803D465788D8A26103241A2C6294
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 fdc3e059f9fa0522994e6306d12ec28ee3ceeaae98942f268d43fac1ece8f3da
MD5 31db9b1b618395061b8c47e99d2d8264
SHA1 2a21b3a309f4c2a5714390d9c896859bfd33c116
SHA512 5832160530a34987b7280c7a0a378e28db96631c916c31e1fb65ddd26f53ed4f514d25cb4577c91b380febf677255f6ad97f10732768e169f552300b1b3e9785
TLSH
T1A7E020B4A5CEC11D7348318702ED7F1CC7F13916F784BE055B58E952BC05444A3811D3
MD5 SHA1 SHA512 TLSH

Submit Download

4b4c30ef-3194-4536-9dd8-6bc1c25c6ab6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b4c30ef-3194-4536-9dd8-6bc1c25c6ab6.tmp
Size 1KB
SHA256 b9cfe9090f322391c1a3b099e3fcb28f12ad31ad87fe012d74aaa3765b340905
MD5 4c7e7cdd36af332e431fe3c18151c779
SHA1 44318cbe9f38e15dad6b0a6ddbbc1d2a281147f3
SHA512 d2f9ce58f13c6fa12a10e2060f5244f1ad9eb60c2cb85304c259e90dda7823462b9974e9f947703870dcbde5118d19fca7203f3f58a71bb09445f18307382bd9
TLSH
T185317DF3C7E4866E890156F0AA18AE2BCE2D0954432C3D9AC9E4EF2B97E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

97c9fbd2-6eb3-4071-a32b-ae0ed78fffd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\97c9fbd2-6eb3-4071-a32b-ae0ed78fffd7.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 ebe170329ad4397f3742e9e5ba91bde957cba506ab2effabb2c96067b4f9e960
MD5 607e830ba1305ee86b9cd7af8d14109a
SHA1 e82fe12d7443c0df286193c976be70c42982cdb7
SHA512 455b539db0e43691609dec568b0e6d850599d32f0877d7ac5a69ea08e0d46d544b0ccb77089cd173e29cf7bc6ea24f9bb6a4718a57167cc79b1c97a5dd118cfe
SSDEEP 48:TNLopFMatSaw/auUOt8BY+ojwA2kDijjwAwH:deMatUaAKEikDqwAA
TLSH
T16492130E1F306111C0B45F72EDE188672F7C101C83677659ED5460F3CD9269FF50A4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 9e1c65874b31b3aefa4a57e3820af561819aa48a106b5079a3ca49053e90359d
MD5 0200e9fba8a6bf2fda3c814da7100281
SHA1 68f08c57abb1420b7f6241afeb929c5d37ba67e7
SHA512 3f9b138d9c2732d653cd3875f224268b4bb3a324e8f0dffb2d6d36143baf732ad89aabc090c979ee862089d79e8bfdb8c8c5f904bf0535eb71138e63a22ca51b
SSDEEP 96:i/IEumQv8m1ccnvStknHc5tdtXXnKytJig:i/IEumQv8m1ccnvS+sL
TLSH
T11EF2DFFA07276105D98445F0E0009FCEAF1A004B47B6B6EC76D447E3F7A20E2B6B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 49ee80bb290ff0a3aff7c3be90b80ffdde622425a98f6e0a97e54080f5e6f0bf
MD5 dc90679be83625586efb5475a256d78b
SHA1 07f01137149d4033931045010900fb396a7b4e9a
SHA512 1e2fff5d818c08612f927a4a25d8c0033a5f51cab9ccb460e3c162e6a3d6b2d4e6dfcccc23cee21d73f1f1717a1b1006719bd5a85a93eebada8c9900692dae5e
TLSH
T125C0221180F8E4732074053A1EC06C826635C0B20090E0A1CAE6933CB0E00FB9F09029
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 4f582fce9a51aa9d566ef9e370a880d1dae032368f48f191821995cb57b90ea3
MD5 ef8dee49bd7255279c4a5d52cd29d29d
SHA1 33c3c53bf93bb083b927c0449326202b3a7b9a9f
SHA512 f83d75e05777b11f1b166ca777cfb7a75a44247b963d69325468e270fca3a8c29a5b8e1e5e943130d26cb4ac00365d955f0f5188891fab3782230ffb19abd557
TLSH
T107E0206426C5D37D605A25870159AF1883D4783BE3C47E073FC4DDC1558E64471D2160
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 b1595691c6c9c244c294cae537bfe5180a96bdf4cba8861920ca1dbd71c1d54b
MD5 20fa133d3b83efa5344d0d1f8b41177f
SHA1 5f32b792c305946f799203272ed7237caaac42e6
SHA512 48eace13c10c1364f6063a83627cd7d57160dca51a83ab2d7fdd2af879c6b5636fb3227aec8d4144e9ea31e8786a9c9b2e2189debc3e3a2f92de9dfa4db4291d
TLSH
T15AB01245B750BB17D5CE65369E7547807621E2432084A9434C254F208D2A2FC2F25CC0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 857915c52a8ad5fabaeb9db9c06a57ff387eb09df31183056003da2f87accd6c
MD5 362e52ee34cdfc468e7ffb9ba2d0ce0c
SHA1 35fdf9b319fbbcca06941d8b9d8d7c4d032d2fc1
SHA512 fdcc00ae9daad24d6e1674128df5caff95c68673ab07c39d775c70eb9f37d80ebb9d95491eab35813cb138f09e88d9851d11867434fd3912c57af41620755a68
TLSH
T14AE0D87436CAC72E618A25CB0259FF1882E27827E7C4AE173B8CE9C1624E28072C3160
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 6a355f675a2a87e066b73585eb938b2642b23894ee20d1bf9f0b702b587ff257
MD5 ee8d86371ac198ccfe27702559525e99
SHA1 6be0ca4dded030594c53ad05106ae206198d43b8
SHA512 f86585fdf965dc959780b40f9e9a5eedfce35b897efa7304eb654eb10617d6ed947e642d88307c8a2a9845101ef2add20dca02008cce2897751984062d584187
TLSH
T177E020F0B6C5C73D9085A4C702ECBF1CA3F17816A7C47F07A7888483E5412407265290
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 2c96edc1034167ae8dbcd5cef9ff93c0f24162808e439f38b7096b711dfe8efe
MD5 90f8d59bff794960a0cc91ef7e64d5cd
SHA1 fa03c944864eac05c760eff209e23b49f692e241
SHA512 4b25f6b33f3f9b86826be91f01e4a5a27547ae74937b6e838227951017d06ffd6d378abb61df2e43ef2870fd8bf205dfa60130d82d735f9c6ca652c09a90e337
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3WZHA7Xb/g:SL29ObJffppdNlrtWZAbbI
TLSH
T13AC2251571BB425038FE291D81B69B2A068235B33118E67B7FBD40B68E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e68f752b1b7bf55026659c9366930925998282ad6eb482c0fdd7da4abce00024
MD5 6d0a050cfe3227f7fe0b48ba3def3ab7
SHA1 2a8293b8fc3bca0ce560a7e710da630e39ef2804
SHA512 90d3c76f27d2d6bcfb381301b18ed93d8697a08771415947c06431aaa3defa4aaf3fe5018b8e805dc9c1b551cd8733215ee7cda946f4cd1f29e3e8c3d8d5cdcc
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdg3:ST/2dXOJhJlpfnpp3tNXVrN3WZH6
TLSH
T160B2221571BB421039FE291C92B6972E064231B33119E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 25c9da3c3d0be9b5315274568bc89702e40aee38f0d0581bc1b8d747e10ec23a
MD5 97269412497d85dcc513003117a1e266
SHA1 af3382e510ef404f5b0256c9036a1123846dfccf
SHA512 8aaa26aceb5c358ef30f723c95a0dca4ceb6d8dd9cd8ff6a3a58344b37c4b5551d09592c357c4c0862a2c24673a35a2fd29f01fbdd1cfe6aacb95bcd35323ef8
SSDEEP 192:P+xWd68EupfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxSXfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1FF24640A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1b050cf-76c3-4be2-b67d-6859db9d680d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1b050cf-76c3-4be2-b67d-6859db9d680d.tmp
Size 12KB
SHA256 99ba562f56fa2f6d7e9f2bff02ff2b54c261f1a6187060dfd7b84df7ca46e4a3
MD5 7e5a2da959f21a6e2e03e7832079f1a9
SHA1 61b6eba15fda5bd9ee608c5ded2a60fa23c77b4d
SHA512 b435f054614c75ada459de73e6cffbb44fffd04ee8f2736b5d1c0e76203f2b9d145d30b6c38623e127f83f42b80b9cc274a4d4d2dc0d41ecc4b7e52cd1a1eedd
SSDEEP 192:sxZ8RIkd/fCsHVaQZLH8fzodpNRvHW6+WNnLEs/YoxyS4XIg5OtFJ:sxZ8hd/fCsoOg0fHbj/WSoItv
TLSH
T19442F915AD28A97B8CC7E619FA557F53E3F9503294910F48AAFD8A2C15E77CD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e32372af-c662-4314-a43e-1e5b28ef92a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e32372af-c662-4314-a43e-1e5b28ef92a0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

eac406b8-dd2b-4b5c-a663-8bbb70c50822.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eac406b8-dd2b-4b5c-a663-8bbb70c50822.tmp
Size 11KB
SHA256 923d49545674d8d56ff0b551b728bd79b1bd7500cc2f75b7d12feb5ba2e1cebb
MD5 25a26a6af90df61191bdd1fa0dacbf72
SHA1 26477e5897986de1f92c09b335239eba64fda8df
SHA512 ee3b239b5001be19c40021703dd509d16e5e17463d357e56327fc95893405e132757226451024819071d86317fb4b4ebac7df16339d42b697d269f7232db8293
SSDEEP 192:sxZ8RIkd/fCsYVaQZLH8fzodpNRvHW6+WNGYoWyS4XIgjtFJ:sxZ8hd/fCsxOg0fHbG7Sojtv
TLSH
T10742E8156D28A97B8CC7E619FB557F53D3F9503290D10E48AAFD8A2C15EBACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 055a3d22f5e282905bf4fd0808febc223746085add88b1d5a1031abfba772e0d
MD5 365d17dba4868c116bda5bbdfaaa1b8e
SHA1 c840530e09a5ad6b8b7db5b5653ed5602c2dbbd9
SHA512 57fe3825cfd80dc1b51473acc272283c8caf5476645727f8d23486b7a14f59b139335d4b2f39f57077e2541d6881b22e82c914eabb5002ba76f3d07b4e8df002
TLSH
T1665171C0A3D994957EC9B942C22F691364E63EB6230EEDB1233E84F54F48C194E6ED71
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 5e3169e8370628d9c85eaa526fde4f3c132548bb96fd1c7fa71c4dfeec123848
MD5 45402d63f8f8505d7c16e1ee1f72a42d
SHA1 c5a84185c36d60160f41e7fd8ba5a0227bd9ff50
SHA512 405a2801f7232f89b8534c501fa6337e76eb63a3e1911f329cc9e3692fdc2a155b6826c07b6c3deee7ef0d29bbd8350bc66769284f74d7c40b20eb15eead3130
SSDEEP 192:8gR4OE8Aslli0wQ2sCxJnBJvaJa2DruQuIIItbtMIMfGYcY:8eEls/72sA2uQuIIItbtMIM+B
TLSH
T1B452612A260A1B33D05E1F77136A8F959BDC8C8101B3226D3162584F9DF3A67C7C92F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 fa87f29c3ed7887666c1502de70492ac4b5d5f442bd7acae313b1e80f6270e80
MD5 405c2f96c80bd2df55ab8edbfefa1acb
SHA1 59c73f160ced745f5bf10fc7cb5c0d2c0ec12671
SHA512 417630d344ffac8e67630f92c5aeab9a7a058c07e208f9b9b5db904521ab68011961f12fd9b4850a5dc2ff6da4d395314485913731ea2d00f7f60876d7aad3a3
TLSH
T142E026B0BFCBC12EA15920CB11AD6F0883C73813FB98AE0B2F48C4A6A4451A1F786191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 cdb572ee3fdb7908eef3de77452ca79db6fc41164e60a0c094b499eb6b99ef21
MD5 cb880bb7cff76953c646b7aa20fe573f
SHA1 49d939e5fe8a08556c8603d69a0aba6abbb402a5
SHA512 9ee0d2fb23503af40f479814fe2d8e52b51c16e6dbc39c1826ea0ecb24ffdaa99851fc48f4aa86d31e5dffa1fe02abce79db25795d89b71e83b1e3003fde7983
TLSH
T11621BC55F320C208E18E867DA06B97291338E8168FFCED0F847924252EB2E101E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 303af289b1f847ec0ac1af1deb6626ae4526714ce22a0f1e8738f6ca3b6a3240
MD5 c741b58808e143ee2ff332025f3a3b5c
SHA1 98da0670d131ee6f968508624d8a3be2334bfe54
SHA512 cc7cf998c340491b7139a22d45cb694901c9e381f79fc3060d538ae5cd3efc9b77f8da186a185c8647b4fea054a3427ee1d848994c3a0c082f9974edf264824b
TLSH
T1D5E0D8B079C5C11FD06530C701ADEF4883D73836FB846F062F94C9855505185B646151
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 25a76a33d5e48866211a3c42896602fb1f4f1663aadea27e614f753ebcd99267
MD5 07e60b478b5e701286f48a932f4d5773
SHA1 371b027f4010e91348a6ff666aeb6ddc6f3b1a55
SHA512 209a565abec50cf5916b7a4d58e85fefe84b1b6b0c66a5358e8954f47ad50e3ca96f0124a36364105094974cadd12144721f43ad2122b7b8a9f6c60911ecc782
SSDEEP 3:MsEllllkEthXllkl2zEflS:/M/xT02z
TLSH
T1534404047FC044C5D5501030D071C7511770D4140553574334D144335DC75504C04010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9296154f2e6473b3e13a801cc880d72588fd8e30463137dac53335b5d7204d3b
MD5 704ad08d99f8c5a2e0f01bf103f6e894
SHA1 eb259216dbf48b0bde8ad6030b87cbcf4fc12d80
SHA512 5baafe262b601a9304e98a003e57d1680a6fa8f463bb770d23a5fbefc9a8f552af38c766a0fe357c8e6b1005db1cec8cc9674c218cbd3e57a3277eafde4dac07
SSDEEP 384:n2iFiZcIZ3sN/8TUNTUlI44aKM6HQskVwzWfLBCd/lfdhkBtgOIwZOy6oygL/7IE:dFQZ32wg8boEBC7fnkBXsqGy
TLSH
T1AAC24A32DC98DEBBECEB4AD9A74A3A03DEE04163D98C9AD4D9D91D1C00D71AD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 f1dff519cf3fab2dab7dc93ef9b88f8cc478858c42ab2956590b46c174308e8d
MD5 51f4dd784b34aec020205e360682ab6e
SHA1 1fd0ca118aaf5869d81412b578f33a864cb38776
SHA512 7b96e5ba0a10c0f5a7b6f0febcc4a1c404ff662a6200e8c37d86bcec577155f4ffb3448dfe3e0ceda033fb4290db164ac314fa3cf873c6772a4221922471be49
SSDEEP 384:n2iFDZcIBsN/8TUNTUlI4MaKM6IUjVwzWfLBCd/lfdLkjhABWEon9ahmtgOIwZOi:dFbB2wgwOoEBC7fVkKBcn9aMXsqGy
TLSH
T127E21972D894DEE7A9E6CEC5A24AF602AEE40173C58C998CD5F57D3C209F5B90307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 4e352be6e7c454dfaeea242bdb3a00c2bec486bc870340a1397ad13fa1d1f223
MD5 772909affbad461eb79bc6a98057c457
SHA1 ba95950384f0f10a67419531c2193fb675413220
SHA512 81d56c3bd7ef7c284289c340b3210d619829056a66fa17f59d08673606bcd5b18eb8a5ecbfeea9ca098a20e4fcc4e94a61564ccb8260e0af3ee7e4240699048d
SSDEEP 384:n2iFDZcIBsN/8TUNTUlI4MaKM6IzjVwzWfLBCd/lfdLkjhABWEon9ahmtgOIwZOi:dFbB2wgwtoEBC7fVkKBcn9aMXsqGy
TLSH
T123E21972D894DEE7A9E6CEC5A24AF602AEE40173C58C9A8CD5F57D3C209F5B90307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b0a724668c19752881dce5ff2252c3e88bd78e7b2086a1664f99e3b85ec40166
MD5 d86693392f3a6fa8ffb560ca4bfd8025
SHA1 7a7ab79f9febe0c4a714b3f66f8a9c4e834a568a
SHA512 07eaed855816ff4fa9d71cd47af03b3cb03f932e2fd8cf408f7b6f2ec5557c39c30fa111a64e4f8d7ae12507577d6dd6c449164a3c8c7c1eb6b135e93ad5de43
SSDEEP 3:MsEllllkEthXllkl2zEflYoJ:/M/xT02zRo
TLSH
T127440404FFC04405D510103040D1C3511370D4100511574334D144335CCF5440C00014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

b35b72fb-a121-4acc-b5d1-ddd3b48c9e7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b35b72fb-a121-4acc-b5d1-ddd3b48c9e7a.tmp
Size 25KB
SHA256 a184f5038ce1f012e89dd65d95fa23a6c615c98b860de760c220f64096a360b9
MD5 52465ed32b0fd9255d5e2be83ecf9755
SHA1 c0aa47f9b1cb05e907e0b2c3730936f8a8fd8ed1
SHA512 ab9c24288f7b2baaff6b7c55551401fd8fd080b96436e3d38f1b52e4aad1f22f07487943e7a1fb1478872286f80202221729fd22d4d9e157b960640f13324f9c
SSDEEP 384:nWiFiZcI63sNC8TUNTUlIm2aKMi664wzWfLBCd/lfMXTsa+VYegL/7IzzoG:9FQ637wgcyHEBC7fMXThgTB
TLSH
T194C23A36EC98D9ABEDEB4FD5AB4A7A07DEE40163D4DC9AC8DAD41D1C008359D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 8KB
SHA256 937a2550dbd5273b563ebd5dc588024a6bf0c2c12cc054945fde39bf02b1bca7
MD5 ff9f6c3199260389bdffedf87f1e6fd3
SHA1 b69ec0ea6db93e6a91b2324b39fb841b54241a15
SHA512 efdce5bc4ffea3f9a71787b3e2c2aee8fcc2038171ca180c7d7b25e0b95224abf767efe2e4a546ae3ae4c2173469f10aa7f882826212853ad6a09dfa9076308d
SSDEEP 3:vay93llQ/8QuQll/lZAOSl5eqJ/cSFYojpuyOV9RUIATqaq5AblGKQlaWJFuQ3yU:CA4/ZlaeyEGy6qaq695fOV
TLSH
T1A50212431F51C873DCC55B3E62C640EAAFB3264C4949FD028464CC130B45689AB4857A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cf56a68aa3a2bfc2062e7a379031aea667e83dc312b3183548301ba1c0dc4907
MD5 1abbaaff2e80da13f542ae45d98d6b25
SHA1 184dbbaab69478867ff70cdc28b2399fc589213a
SHA512 627a50c50890a9aaca340ad50769b4f62565ebddb7df4c9fa1b8609cc3a37d06b43972630a287a3f8b01fc1cee52ec7129cdcfa6b33f424cded3a047bffd1a3d
TLSH
T1D241E958A6F90148B377AF5AAFF7A86E487BB9772E06D45D10010E4E0966F01CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 a0a02295fcef998647998e2705a3101c7e0ab69ccd74b5e06ad4ef74ff31ce18
MD5 03fdb0cd3a44f114f8a00313dae546e2
SHA1 f9622ef5e1df47425604c61782aff12a82b9f6d9
SHA512 205c9a8be2fbefdf487c18cd17cb6ff6371817f453903885b9c17be19d2c857fa64d8fd9e4af75c91818c27fb7cc9415761edf7f406a5f4ade690654ff91c775
TLSH
T1BE51395CAAFE1118F3B3AE1AAFF6A85E487E79232F46D45D10110F4E0622E41DCA1777
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.contile.json
Size 4KB
SHA256 278eb92137568eeed38484c7a93960247350fa98f16ed7c3d58d125842afa774
MD5 61ea1fdeb334d4ef57a1da72d3d1ea50
SHA1 20897b68ebd1a5c7d7ed7e6415bd3682f9ef11e1
SHA512 0f7b1bd4f55d616b3e49f9c1a4abe46e227803960af8e314292e30203c253e192b13ce04a5a1787755ac967b4268b93cfbfb92f79c76021b7ed5bb2cb18d6ff6
SSDEEP 96:TSJzM7yMmmA/oXD5/vT+mRvzn4KYoa7mB6DlTlz:QMpmyTRymRvzkmBwlTF
TLSH
T1BA91E96FD57884532730EAF42C073B9CF007B006D9E18AA8717EAD22D16C7BB90CA589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 a4df52625fcaa77cd21b58d2a67572836939a0133601fbc0ce9bf56f649bd693
MD5 bf617b1fbf01de7245f70096a842a2d2
SHA1 32a18d22e166891943aee3620b0da4e7713425d5
SHA512 f291041aa011184c9c70085bcb0e19684ad2d5543bc2be4c0ea5e7516b7554543fc84000f379f69a2dff9c56fa6beefab101105e81c7e04501fca6d7b10e1a8c
SSDEEP 768:6yvJnQsDA4goz2Si+BBDbjMeVCr510ifbK/eWzU+G+DOOr5cMa7rvZaV:BvJ4ofbIe+OObK/eWhG+rOtaV
TLSH
T1E5731BA396F8B2FB1B9537C72C0FB95B56E20586F38502C8ECEDC91C81DD654113A6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

6384

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\cache2\doomed\6384
Size 52B
SHA256 0f4e51fbc1ca601b7222b17d42057b7ab675d4d28b3c8e03392d59554363f6c1
MD5 a71964087f62d62fdf81add5c7f995e3
SHA1 b673b6316ed683bc877ab3a9ca7accdc7dca085c
SHA512 0da0a5f8214ea571e3b021bb7426054eeec2684652275b690d306115e7b23c857e9d3e849c5edbb82360c60d07bb45f2b8f8118631c47546e3908a3f5e6a1f2a
TLSH
T16F9004054F51C540D45CF0770DC1C0FD07153D4775C4075734D777514C150D30155000
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 72e2abe6605fdb5323effb112b8747d6d433a83a650b2b4ce59a028b46d0a835
MD5 05c98faafdebb28c0c83df05e3024f28
SHA1 7e4be4e52397f865a44dc8d8a05e7d5541cd277e
SHA512 fe8d997afb51a42328c455cc63565afd2314d26bb94c0dc37979643d015d19a63ab95d2b8aa2952a2c14d69b50f6e64a93d156c12e2330f77204d2b9f2208f25
SSDEEP 3072:j3lFP6lvV0bvFiNzO426C1ejGpU3bVtdA:pFgV0bvFWs6CYjG
TLSH
T1D4A3AEF6DFE28E3D54FFD42D6A82843EFD262800B3A33009D923635566C6B787675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4febbfc5-8192-404a-96ce-955db76cd154.tmp

Path C:\Users\Admin\AppData\Local\Temp\4febbfc5-8192-404a-96ce-955db76cd154.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 7855db315b348b92e06e0ff5a0ddbae40a48d557d3db5a0dfe62b91780e3c993
MD5 9d65fd66525bda83bc665afe79d6c7ff
SHA1 0461fb1a43b0edbba0930bec4d685a86819a2f09
SHA512 f94669f5af13ed445e4f0070c1ec730b4759c7e49cbd830408d1aa672c2e5928aff36d2e370150eafe9cf18533e1eb1c1dde9e9354e9817781261805ed8323c8
TLSH
T1D651AAD03935B73F8BCB4BC4A0A60C842561E5A1132EAB1CEE165474FD6CEE2572E7C6
MD5 SHA1 SHA512 TLSH

Submit Download

9720441b-88a8-4b82-8ec9-395a4ee2e190.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6456_1177717921\9720441b-88a8-4b82-8ec9-395a4ee2e190.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6456_1177717921\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6456_18860541\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dea3ce96604806aaf72997ebdc659a5ed59f00dd2aa8414d38222ae7214b94b7
MD5 0fe93f07262e982a0a963891466ad165
SHA1 51b417b819276956ae4a6eb9fbb5fcec5279db03
SHA512 2d3a3315694bbf68a01ff11b14d6018bcb75b8d140213caf40231a59caa8f49d83ad455649f1798925231ff91df3d01c9fa6a0704ce6f2fe3d1113775ba0c8d6
SSDEEP 192:OOv5zboP2oCyj/+u1d66JozGzgCl6mc0d:Fbo+oCyjdd66JozGzgC1j
TLSH
T1C7E11DA4EA29863FD004027BDCA61B410F39389A9C4E3F1935DC645C2D563DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 36b6841d915b1b68e3ccd04ff70c5685d7bbcdb75eb0a40cb809f02af07047f8
MD5 335eb8525926b3f581179e94797549e7
SHA1 0d9ba9a5c9efe1af1d216fb44c764908e5441072
SHA512 3af327e6cb119b5448e6334914703dd031a49e29df025135f15a8f153050d3f9596951ba307a7aa3d1f3aabe78668a41261071ebb311fd2f60f09a0a9a86aa14
SSDEEP 192:7Ov5zbowboCyj/+u1d66JozGzgCl6mc0dz:kbowboCyjdd66JozGzgC1jd
TLSH
T15DD11E64EA29863FD404023BDCA61F410F39389BEC4E7F1935DC644C2D5A2AD768D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7565e62e6ff98679b2e310c8474ac179aa6bba1dcdcbecc771d7da353ad65840
MD5 e40c2694cf4ca6bc3dc2da44f0bb1bd0
SHA1 6715c54f679bd969434ff40efe5bd2b50663a1f8
SHA512 135aa39fa16f3ede3e32cd07b62e816bd65d93891a123c6fc46d8d97d6b160c4b6e1becd5091a6a77f01aad9b0982356427535c817a2d5a46c6258c8ae83381e
SSDEEP 192:E1d66JozGzgCl6mc0dHOv5zboPkZoCyj/+o:Od66JozGzgC1jqbosZoCyjh
TLSH
T199E12DA4EA29863FD004027BDCAA1F410F39389A9C4F3F29759C645C2D563DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d340d94ffc6f03709e8d732d872363cc1afb021ac7f44aff2b0cb13c0734424b
MD5 ac7ef7437851ef69ac5bdfb77b4b0bf0
SHA1 0888db5592b25afbddff325af65e9996ba5bc994
SHA512 30f3c85fdcea7d3caa3e06cbb0385faab45d11889611e71eafe9845fc4fd82952ec2e2a160d88c7b8b10afe79bf99bac5ce627f0b1fee6f09839759e7be67408
TLSH
T19611AD9C39F94DAAAD87E69C7482068EA3158E4A14471C474D12EF8CCD90BEE336943D
MD5 SHA1 SHA512 TLSH

Submit Download

03b725fd-3cc1-430d-98ea-bda3d3a0d7b4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\03b725fd-3cc1-430d-98ea-bda3d3a0d7b4
Size 883B
SHA256 ea507be43001baa54361bb4bfeec34f0f23d595a676e57cdcf0d9c2a5ce91d66
MD5 3e79364f0a5c1b40ed3f498fd939f8cb
SHA1 7fbda521c0e51361f63d0fb26786e43fa0f8c0f7
SHA512 68ecc826cc4e3fd8b2dbad45967ed454313d8b8f3fca6ef846293f000ac4962da9ef5eea5cf6d7a654b1013ff0d581f652fba78a73da7346ff3a4ef0747b84b4
TLSH
T1C1110081A231F876DD68C24BC5E5370293F475A3C0CE85243DB049180DBEB1DA367257
MD5 SHA1 SHA512 TLSH

Submit Download

09ff8230-9575-4220-808d-c38c39233597

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\09ff8230-9575-4220-808d-c38c39233597
Size 15KB
SHA256 98afd717b182cea77485bde51d2093bf59b188dd8cceef72763d4638b5049999
MD5 8ef575dba22173d674c5377bd0b176a8
SHA1 30e07e248ad71b15833a6340b95f190b235a0718
SHA512 b5e4fed1fd846f2a83b39e5942ed3bf8f84c6b8111e7788a5ba1fedfa255f569c645ff18b5fca98d79927a8dc6818dd733e7bf1f349050c54b399ba719f79c54
SSDEEP 192:aGkYzFg++jD0znE/5hyU3bfRzxcG7tohVKVRqqRPoW9XZmWS02SCB+K4XT16Pn:nkYy3RlcG7tohVK+AHMWS029ELI/
TLSH
T16A72D956283049BA8651E3A994FCBFC3E2F528CF4C418FCA9BE4BD081DDE06D512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

196624db-32d4-4930-beae-6d947d6f08f3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\196624db-32d4-4930-beae-6d947d6f08f3
Size 2KB
SHA256 c98b4218f66d071476e3845d6ff74568fd5c495dd5b2a21f03926dc43a022b72
MD5 d439e6f785d7faf2aa5e9f4e2bfa4bcb
SHA1 9e208342ab4fb224cf9139530e88a6d2532ac1d1
SHA512 1a8fe9192bcc0d98f185bf261317c003d153e486e84d7c41f6b7b39f89f2f16d57c27d4d31e83a171cca5b82f3d36cfe715271779164d6af6fbde6d3d7ccb4e8
TLSH
T18541735835B44D36ACDFF28E9181234E63748A8340CA2C836E91DF4C8DA6769337B567
MD5 SHA1 SHA512 TLSH

Submit Download

1c8726ac-7786-42fc-9f06-40f090c8e15e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\1c8726ac-7786-42fc-9f06-40f090c8e15e
Size 235B
SHA256 db081cd0400aaf7362e629c70308af1247f91ac8583a69269403a180c3caa730
MD5 ea85cea6a8c8fe02b1f608ba776edc9c
SHA1 574e29fb4fdc540a6e87854d4db45f243050ae73
SHA512 6519a9082258b998790b0aede1b234331d442211ce701dfbc9ad52098a704408102183cecf34205b8016a19a91f2daec52c69e13d0ccef598ad4b0268a95d3af
TLSH
T127D097802498333C4C104F02F0A038C2B0888C3320786C24D9A145788EBA9C8819285B
MD5 SHA1 SHA512 TLSH

Submit Download

c1a54abe-996e-48aa-81ab-a6cc3ffcee3a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\c1a54abe-996e-48aa-81ab-a6cc3ffcee3a
Size 886B
SHA256 386c90a11c4dab8abdc31ab6dfbc75fd00ee4f88002be481a37aa2c5efcb77b7
MD5 d7ca6b857fdb0f9097aeec6b432aafd1
SHA1 ba93061ee14824a352048df30ea7c175961825bd
SHA512 93067ceb64847bcc8e3d41d4e2baf3818b295249cf8009109daf72bdc3e0a34e124891d31959003fdaa4b26983d409c4d9a7ade3a6f6f6263b9ecb768c7f4589
TLSH
T10C1100828521F972DD68828B95E57B0343E470B3C0DB49183EA15B180DBA71DB3A7347
MD5 SHA1 SHA512 TLSH

Submit Download

e88265be-6c69-4399-9a90-b907211cca03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\e88265be-6c69-4399-9a90-b907211cca03
Size 235B
SHA256 1748aa74340bb3a48ba9beff2d111b12da8dadf9676565f2ac39b808ac660056
MD5 d4f275fcd80e778d7717a7e341421098
SHA1 da1d981970bc2d7f92e6820f7e9852533c3fd515
SHA512 6c1104af1db8dc4e391d2b8bbd149761d47c6e4236b29eef8e6c765fa0bfca52d39b49918aa8ace447e2afb726566c8cae400c77005d0e078afbb0b0e4330074
TLSH
T19BD097C1588C2B2E0C105F0FB1E029C630C68C3B20A15820CA60063989BDEC48321A17
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs-1.js
Size 6KB
SHA256 6135a5b4f55d70e9e82979c49453db1cc14fd0630339703682aaf9b7355bcc43
MD5 09b6d2f259dbce2faae0ea10cd5d631b
SHA1 d6f92a8f848e77b37ca16ed18394acea3e9625cc
SHA512 2902f46e6a550bf6b7e47b57eded3d5c2903934a6c2460b718de17279c281eb4f10fc6f3cc4b409baeaf965c86c1a036ee8db6379aff502e2addbf763f1c633b
SSDEEP 96:xHlwUTUnqGqEfxBA1zSuSSlSdv9jbRSnHRHZlejyiBw88n8L4cnihK:0aREfxBApSSgs9ZTiBw88k
TLSH
T17CE1207894088B6F74B6766C6C6889316AB2013BBBBF68D750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
Size 6KB
SHA256 06070eea39dd6f02ea6e0d2accee886ea942f6892fe45a54dbbccd8147cff90b
MD5 dd2df5eaacee9262dd2c3c163ebcaa26
SHA1 77fc94075aded66ff274358d631377acf1ab5e21
SHA512 9f464aad11411eb43f6d380147a9a1695a7c2270af8abeb2d12bfcb346bc94c8ad607e5d42065a64ca751d39fde336ab2c2a6567c6a214395f6c5a4cb0837ba7
SSDEEP 96:xHlwUTUnqGqEfxVQ1zSpSSlSdv9jbRSnHRHZlejyiBw88n8L4cnihK:0aREfxVQASSgs9ZTiBw88k
TLSH
T1E8E12F7894088B6F74B6776CAC6889316AB2023BBBBF68D750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 49e7fdf2cb2b136b19ce7e420961cdebc6321b37dfbcafdb8769f19f4ccad798
MD5 1c05a83e927e834f0d55b81faaa989d2
SHA1 67d361ece7c9c3006ea6a639271f797137d35439
SHA512 3d9e437e9998ba575ee30806fa3b910ad2970a92d43f95a8e17e7f33b2653f5b4960f2930a9dc3cff1d44a8ab1a8136070bb90c6ad8fb8365d4bd3a6c57b89a1
TLSH
T1C821C6C3A87B1EF6BF618115E88C8BFAE9193035845D44B0A0ADCA4362DE04DA78F02D
MD5 SHA1 SHA512 TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\targeting.snapshot.json
Size 3KB
SHA256 78561bcf1d9af6aff972306bb71db83552e94399463bdce5b07dbbfb8f82fcdd
MD5 8d2975f3187ab50b6dde853d2106a9bf
SHA1 fa3f13efbcbdb2de1e558d40f6f5c0dcf0d19d38
SHA512 6bb27b8ae5c3776696ff3bc498923d579d2ea041d1112e3d081ab05eb5d53845fcf7bb04f86fa493615593813beb28eecb51bb02a87b4c8197bc2b9e6f198ba2
TLSH
T15C71820CA61CA4BEA66BC3C0E6447FA78BBD053370446458DAFE460C95FB5FB163621B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3596-207-0x000002A3BD410000-0x000002A3BE410000-memory.dmp

Download

memory/4384-1188-0x0000026300000000-0x0000026301000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads