211c0e658f975a04d6ec73aaa5beb265bf55f43fd53c168b69a57f587d4989f1

Analysis

user interaction
yes
max time kernel
223s
max time network
324s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SonaPoke.exe
Size 151.4MB
Sample261024-bba4ms1yat
SHA256 211c0e658f975a04d6ec73aaa5beb265bf55f43fd53c168b69a57f587d4989f1
MD5 a20431265ba071ebc0bdb3bd87d63487
SHA1 8ed9e357f1d10e97801676c619333510c066599a
SHA512 253819e9275df16759b438f19b2f107804eba585500268ad8d491ff2099328c164e61aa5a96511e1fe375990a0cbe6ff79ebf32acce66a9b52dd50d1587ff2ee
SSDEEP 786432:8heAiSEOVoFI+UoleeeyFJaOH0n5ff5PC1PaJy7jAwYan/E0zhkByrQ9Tp3U3Myf:80xSEFFIXOFJcZogNBan/EQzrETpkJ
TLSH
T15D78CF01E3D84B2AC52FC37DC1A38612D371F4865766B7CB0498D9652FA37D16B3A2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
136	2020	firefox.exe
178	5428	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
2520	SonaPoke.exe
352	SonaPoke.exe

Loads dropped DLL 12 IoCs

pid	Process
2692	SonaPoke.exe
2692	SonaPoke.exe
2692	SonaPoke.exe
2692	SonaPoke.exe
2520	SonaPoke.exe
2520	SonaPoke.exe
2520	SonaPoke.exe
2520	SonaPoke.exe
352	SonaPoke.exe
352	SonaPoke.exe
352	SonaPoke.exe
352	SonaPoke.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
122	api.gofile.io
88	api.gofile.io
91	api.gofile.io
100	api.gofile.io
121	api.gofile.io

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2872_1747786169\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1765563124\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_290986742\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2872_1042009812\_locales\hi\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\SonaPoke.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5428	msedge.exe
5044	msedge.exe
3484	msedge.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{D246F08A-869C-4CED-BBCD-6E33DBDC0535}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{1C730A2C-A822-4CC2-BC27-DD141CD39C04}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\SonaPoke.exe:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
364	schtasks.exe
1632	schtasks.exe
4444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	firefox.exe
Token: SeDebugPrivilege	2020	firefox.exe
Token: SeDebugPrivilege	2020	firefox.exe
Token: SeDebugPrivilege	2020	firefox.exe
Token: SeDebugPrivilege	2020	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
4608	msedge.exe
2020	firefox.exe
2020	firefox.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe
2020	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2872	2692	SonaPoke.exe	90
PID 2872 wrote to memory of 1692	2872	msedge.exe	91
PID 2872 wrote to memory of 3484	2872	msedge.exe	93
PID 2872 wrote to memory of 1776	2872	msedge.exe	94
PID 2872 wrote to memory of 1776	2872	msedge.exe	94
PID 2872 wrote to memory of 5848	2872	msedge.exe	95
PID 2872 wrote to memory of 5848	2872	msedge.exe	95
PID 2872 wrote to memory of 5848	2872	msedge.exe	95
PID 2872 wrote to memory of 3396	2872	msedge.exe	97
PID 2872 wrote to memory of 3296	2872	msedge.exe	96
PID 2872 wrote to memory of 3296	2872	msedge.exe	96
PID 2872 wrote to memory of 3296	2872	msedge.exe	96
PID 2872 wrote to memory of 3396	2872	msedge.exe	97
PID 2872 wrote to memory of 3396	2872	msedge.exe	97
PID 2872 wrote to memory of 5168	2872	msedge.exe	98
PID 2872 wrote to memory of 4356	2872	msedge.exe	99
PID 2872 wrote to memory of 5168	2872	msedge.exe	98
PID 2872 wrote to memory of 5168	2872	msedge.exe	98
PID 2872 wrote to memory of 4356	2872	msedge.exe	99
PID 2872 wrote to memory of 4356	2872	msedge.exe	99
PID 2872 wrote to memory of 2304	2872	msedge.exe	100
PID 2872 wrote to memory of 2304	2872	msedge.exe	100
PID 2872 wrote to memory of 3464	2872	msedge.exe	102
PID 2872 wrote to memory of 3464	2872	msedge.exe	102
PID 2872 wrote to memory of 3464	2872	msedge.exe	102
PID 2872 wrote to memory of 4268	2872	msedge.exe	103
PID 2872 wrote to memory of 4956	2872	msedge.exe	104
PID 2872 wrote to memory of 4268	2872	msedge.exe	103
PID 2872 wrote to memory of 4956	2872	msedge.exe	104
PID 2872 wrote to memory of 5052	2872	msedge.exe	106
PID 2872 wrote to memory of 5112	2872	msedge.exe	109
PID 2872 wrote to memory of 5112	2872	msedge.exe	109
PID 2872 wrote to memory of 804	2872	msedge.exe	110
PID 2872 wrote to memory of 804	2872	msedge.exe	110
PID 2872 wrote to memory of 4608	2872	msedge.exe	111
PID 4608 wrote to memory of 2884	4608	msedge.exe	112
PID 4608 wrote to memory of 3248	4608	msedge.exe	113
PID 4608 wrote to memory of 5428	4608	msedge.exe	114
PID 4608 wrote to memory of 3248	4608	msedge.exe	113
PID 4608 wrote to memory of 3248	4608	msedge.exe	113
PID 4608 wrote to memory of 5936	4608	msedge.exe	116
PID 4608 wrote to memory of 5936	4608	msedge.exe	116
PID 4608 wrote to memory of 1680	4608	msedge.exe	118
PID 4608 wrote to memory of 1096	4608	msedge.exe	119
PID 4608 wrote to memory of 1096	4608	msedge.exe	119
PID 4608 wrote to memory of 2840	4608	msedge.exe	120
PID 4608 wrote to memory of 2840	4608	msedge.exe	120
PID 4608 wrote to memory of 6136	4608	msedge.exe	122
PID 4608 wrote to memory of 6136	4608	msedge.exe	122
PID 4608 wrote to memory of 1852	4608	msedge.exe	124
PID 4608 wrote to memory of 756	4608	msedge.exe	123
PID 4608 wrote to memory of 1852	4608	msedge.exe	124
PID 4608 wrote to memory of 756	4608	msedge.exe	123
PID 5696 wrote to memory of 2020	5696	firefox.exe	126
PID 5696 wrote to memory of 2020	5696	firefox.exe	126
PID 2020 wrote to memory of 2432	2020	firefox.exe	127
PID 2020 wrote to memory of 2432	2020	firefox.exe	127
PID 2020 wrote to memory of 2432	2020	firefox.exe	127
PID 2020 wrote to memory of 1296	2020	firefox.exe	128
PID 2020 wrote to memory of 1296	2020	firefox.exe	128
PID 2020 wrote to memory of 1296	2020	firefox.exe	128
PID 2020 wrote to memory of 1296	2020	firefox.exe	128
PID 2020 wrote to memory of 2328	2020	firefox.exe	129
PID 2020 wrote to memory of 2328	2020	firefox.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SonaPoke.exe
"C:\Users\Admin\AppData\Local\Temp\SonaPoke.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.microsoft.com/windows/apps/windows-app-sdk/downloads
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd06e3c188,0x7ffd06e3c194,0x7ffd06e3c1a0
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,4615531249281026112,17734365171499224818,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,7929489849582666140,2225382783538823079,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,7454017275697889300,15353396406738488687,262144 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,1120600498633376801,15123212612414776453,2097152 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,3725378297636347646,14490135984480761791,2097152 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,15630360134632824035,9060674062334733891,2097152 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,1441193402587646058,10130406418065042150,2097152 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:9
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,12402600547786254070,13240166492295063416,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5252,i,2890625205518591666,8255890429295434448,2097152 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,13082542832321393738,6509700351034387821,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,6435352842157681857,9618008745868318182,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,11640603144168340656,17210094481673952619,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,11640603144168340656,17210094481673952619,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,1210572233963696651,6928619962252898661,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,5968614245503090697,10802601462578843770,524288 --field-trial-handle=2488,i,16755973504922877039,13028458835155772923,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
    3⤵
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x234,0x7ffd06e3c188,0x7ffd06e3c194,0x7ffd06e3c1a0
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11631454822848314472,11641369796611008122,262144 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10776401196364515393,244708822594274240,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,18178748952070559279,3173797772956704438,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:13
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,10438469913380966400,6112460691167498033,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,10438469913380966400,6112460691167498033,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,15215174375354102758,15632069043700374728,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,709919677146370519,7034929080175830638,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,16237661360190441478,17722206578119134113,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,5058187954183136043,15223305342849039991,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4567611015097681759,5383260267870870784,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,9149108443676404163,16878411373626671353,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,12798197301058438362,1737398656783247682,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,799603147352435397,16390866429683845851,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,16207180052085182452,8779496197803317456,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5240,i,13501064330849259388,14931017920981190121,2097152 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5212,i,13755604549090045860,9151521309939553654,2097152 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,2344236958413289071,14449674550048447908,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5139829446695179995,5845361328019721659,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6200,i,7216040101920313566,15695459959553862229,2097152 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,478352459830817454,13908140725202612950,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6516,i,780277821853885976,17418344119492272519,262144 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6480,i,1488263047391813667,13994485162003845594,2097152 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
      4⤵
      PID:6368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,11338882945944764714,10081717227049192427,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6804,i,2706154074726567805,6473021375252169287,2097152 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,9643374054371396328,9882520976613963779,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,2007360287615397603,6987985083784962544,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,2303648961861243674,9816475002935545003,524288 --field-trial-handle=2292,i,9977470442617057984,3897696784856659576,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:2960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffd06e3c188,0x7ffd06e3c194,0x7ffd06e3c1a0
        5⤵
        
        PID:352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5608115645162554946,8672986446714796797,524288 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,17171783985355532292,10264211144799089297,262144 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
        5⤵
        
        PID:712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,17789026921864656830,15998837565816966147,524288 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
        5⤵
        
        PID:7016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,9424678626866675743,3396250656185662163,524288 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,9424678626866675743,3396250656185662163,524288 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,10543936968596191638,13764143170229058619,524288 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
        5⤵
        
        PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,3297443309338074618,18139249973667526171,524288 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
        5⤵
        
        PID:4696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,12675684697551027229,5388380318542689742,524288 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
        5⤵
        
        PID:6472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,12848224467295749124,17956741977574890673,524288 --field-trial-handle=2584,i,3577776937664692671,2693174557370174076,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:14
        5⤵
        
        PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1924 -initialChannelId {05fb99c1-99d8-433d-a882-218e5e984e02} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {0881e62b-c46f-4e21-8ff6-50d2db447249} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3524 -prefsLen 27274 -prefMapHandle 3528 -prefMapSize 270279 -jsInitHandle 3532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3540 -initialChannelId {f1832444-06d5-4c32-a3ce-e7d1d55b5000} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3688 -prefsLen 27274 -prefMapHandle 3692 -prefMapSize 270279 -ipcHandle 3768 -initialChannelId {32792592-f1f3-430b-a74a-67a460abc244} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2788 -prefsLen 34773 -prefMapHandle 1604 -prefMapSize 270279 -jsInitHandle 1608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4324 -initialChannelId {f55eba6a-836e-468b-88ca-df488c3f7630} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4900 -prefsLen 35010 -prefMapHandle 4904 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {87f4714d-69fe-4ccb-841b-21ee508d3ef2} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5160 -prefsLen 32900 -prefMapHandle 5164 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {e776ae6e-b920-4698-b8d2-bd70dccc8d85} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 32952 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {2e267c1a-5149-4293-b1ee-8b31f8b754d0} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2920 -initialChannelId {c97c0bc4-af2e-4b65-9158-7ee870b52a4f} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4224 -prefsLen 33870 -prefMapHandle 6404 -prefMapSize 270279 -jsInitHandle 6408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6416 -initialChannelId {3d96e404-9ecd-428b-bf51-224f9f5298ab} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6768 -prefsLen 36845 -prefMapHandle 6772 -prefMapSize 270279 -jsInitHandle 6776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6784 -initialChannelId {52a83df7-3576-459c-8863-6bd44b5e6720} -parentPid 2020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3336
- - C:\Users\Admin\Downloads\SonaPoke.exe
    "C:\Users\Admin\Downloads\SonaPoke.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.microsoft.com/windows/apps/windows-app-sdk/downloads
      4⤵
      PID:6180
- - C:\Users\Admin\Downloads\SonaPoke.exe
    "C:\Users\Admin\Downloads\SonaPoke.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7052

C:\Users\Admin\Downloads\WindowsAppRuntimeInstall-x64.exe
"C:\Users\Admin\Downloads\WindowsAppRuntimeInstall-x64.exe"
1⤵
PID:2500

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.2_2.5.1.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.2_2.5.1.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.2_2.5.1.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:true
1⤵
PID:1156

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" uninstall-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.2_2.5.1.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /unicode:true
1⤵
PID:476

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.2_2.5.1.0_x86__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.2_2.5.1.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.2_2.5.1.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:true
1⤵
PID:4612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:3588

C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_8002.5.1.0_x64__8wekyb3d8bbwe\PushNotificationsLongRunningTask.exe
"C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_8002.5.1.0_x64__8wekyb3d8bbwe\PushNotificationsLongRunningTask.exe" -Embedding
1⤵
PID:4732

C:\Users\Admin\Downloads\SonaPoke.exe
"C:\Users\Admin\Downloads\SonaPoke.exe"
1⤵
PID:6172
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SonaPoke" /TR "\"C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe\"" /SC MINUTE /MO 2 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:364
- C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe
  "C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe"
  2⤵
  PID:7148

C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe
"C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe"
1⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4240

C:\Users\Admin\Downloads\SonaPoke.exe
"C:\Users\Admin\Downloads\SonaPoke.exe"
1⤵
PID:3248
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SonaPoke" /TR "\"C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe\"" /SC MINUTE /MO 2 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1632
- C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe
  "C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe"
  2⤵
  PID:3188

C:\Users\Admin\Downloads\SonaPoke.exe
"C:\Users\Admin\Downloads\SonaPoke.exe"
1⤵
PID:2684
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SonaPoke" /TR "\"C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe\"" /SC MINUTE /MO 2 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4444
- C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe
  "C:\Users\Admin\AppData\Local\SonaPoke\SonaPoke.exe"
  2⤵
  PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0032bef6-a8cd-4d98-a3d6-7aa2d2273cd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0032bef6-a8cd-4d98-a3d6-7aa2d2273cd1.tmp
Size 35KB
SHA256 97bf2b7e54b59cff64de06718107d9addcab123d586f728699014d45ccba4fcb
MD5 1a34582515c8d9ec46b767c7706942db
SHA1 d42a5ebbadb3d551413d3270eba426a8b4eaba66
SHA512 01ab0725ecc4cfa7144dfb75d5fa325c429b68825885679759abc26b702bae3e4d89196f405c6fca737692856103c2959176afd00d1a75b7802e4d3e37674965
SSDEEP 768:aFI8C3ewgeCE9fuVHqn+3z02Kgw67xXUEL6t:jl3NQCOI2Kn67hUE4
TLSH
T167F2D5F998D7993BC9AEA747633D2D5298BCC163F4A44994F7891E0CCC921BFE306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16d1b0d0-26c7-4682-b02d-0b2f0634a467.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16d1b0d0-26c7-4682-b02d-0b2f0634a467.tmp
Size 37KB
SHA256 ccb5dc7b4a0b6c8e2ea151da45d596f577826c0309dd77049f4b27b7e1055767
MD5 e0a915b08aa3586737b08b40ba6eefe2
SHA1 3fc1bc15ddf94998db98795c7398fe7a7a38df4c
SHA512 90f22c1fbfa8b399686fe8ac48427c091f8945a7d7c641f093157e9466babbd78cf36a6818eb019fede770efce90a12295dffe52e99eff2b63e7fc63744b5fc3
SSDEEP 768:Z8C3Q0hk0nJEyYzxDc9bsMSJz/Fn8tIKgw670XUEL6t:Zl3QYP4VQbs7JTAIKn67qUE4
TLSH
T169039D7CDCA1DD7B8CEBA3806749B957ADE40163C9E84DC8D6CA2F4C01D329D6347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22835ca6-cb09-496a-9073-752e50f2f02d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\22835ca6-cb09-496a-9073-752e50f2f02d.tmp
Size 62KB
SHA256 c5edd13ad8d96577f931ba7d72a09ac6e7c27f85adea15ba61806401daa61d68
MD5 cc0297bf96450eb614ec3667af375d1c
SHA1 21569ba0686d37b58495ed55a608e5ab872a7c87
SHA512 7ea522d0b4baa5ab919d35f4874dc7d920263e86b00085955cc395bc2a5745d260ccc2ea2315421a3ca44072d88045e79f74c0951b57df086129dcffc7064749
SSDEEP 1536:ul32MVQbs7JTUvZyOh5njA8OOIKn671UE4:22MVQOJTU7hpApOIKn67uL
TLSH
T1EC537AF988C3887BC9AE5787637D6D1699BCC163F8A46984F7851E4CCC921BFD302806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

233bc336-cbdc-4e44-a4a4-3ab98e5e05bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\233bc336-cbdc-4e44-a4a4-3ab98e5e05bb.tmp
Size 38KB
SHA256 01eeb897e79b02d3a7c63638818f7d72517a04776fd1d60dd1f6e3bcc4d235c8
MD5 66d89788d99dd244d0893e3baa651a36
SHA1 1c3f676f81c612fec67c4002c995ab1c8e9851c4
SHA512 89b51890b23fdf9c730a550a0a27934c14c92badad4c66cb92c086ca8231a94a488da43b4cde65222453ae542d998f3a07babd29d8f3993a7ef3dc38e601158f
SSDEEP 768:08C3dn/vKnJEyYGxDc9bsMSJz/Fn/GKKgB9wdLL6XUWL69:0l3dqPNVQbs7JTAKK69ALL4UWM
TLSH
T189039E7CDC909C7F88EEB740664E7A66AEB80273D8B44A48D7CA5B0C817729DF347416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49268326-fea6-430f-b7ae-a6846aed8fc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\49268326-fea6-430f-b7ae-a6846aed8fc2.tmp
Size 34KB
SHA256 6aac084ca05f3af09370a436d5b2139b4df35b91995d81564b559fc48b9d2365
MD5 914e9a6ddaea1d360f22fc35b6b03527
SHA1 370086d7f346a95c3346d645ec58950c5ce393b1
SHA512 39fd2504229dacc7e5cdeac69fa452676bdde315fac02b8c853d1cac76d58038d4099909221a65dc1c9ee38678d2d01db86e7e84956135b4716c24a05d9ee4bf
SSDEEP 768:w8C3Q0hvKnJEyYzxDc9bsMSJz/Fn8LO6XUEL6t:wl3QNPEVQbs7JTcO4UE4
TLSH
T13DF2BF74AC919DA3CD96A780778A7A93BFF44553C8D51F48D5CAAE0C02873ED234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a4fea5c-50b6-43fe-bb11-ccef92430652.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4a4fea5c-50b6-43fe-bb11-ccef92430652.tmp
Size 30KB
SHA256 dd9eae6db76ed5bf7cb5a712c71b802eab2335466110ba2f71a914eff76a3797
MD5 2c799f94bace12c2fe12c80ace8d290a
SHA1 412d55ff55013c509014295a689b59ec87b5aadc
SHA512 4e37e58e19e6d2e87ce79158f4527f0e480540d977f097f39237ac769157bfa22202357a58a8742b65fe229c8a978fe7f0c9ccfb6d5728737b5bc8619211effe
SSDEEP 384:nPiFGQkUSv8C38Nx8TUNTUlIltvsd+cPEfk4fp99GEnKgw67dICMtUlI/7IzKIIc:aFm8C3ewgo5E9902Kgw676XUEL6t
TLSH
T14DE2B4F998D3993BC8AE6747633D2E5299BCC163F4A45994F7891E0CCC921BFE306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6407a33f-366a-4b56-b565-3bc90d4c8385.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6407a33f-366a-4b56-b565-3bc90d4c8385.tmp
Size 35KB
SHA256 bfe42ce3ddde74bf0f03b17be40e245b3d32955ab2c5069b4bd6df254a577f6a
MD5 57df5260308f57933faea531d746b666
SHA1 ebe7b8adcf6f934daa2efa617912503e81860eaa
SHA512 33a14d6b490b494003f21da0d015c71776983b4a51229dd05882428927db54551ae2a23a75c707c619015d7922bc33a8bf5ee6b2672af1018b6071a5a25e4a69
SSDEEP 768:aFmF3ewguNE+fuVHqn+3z02Kgw67xXUEL6t:7F3xMCOI2Kn67hUE4
TLSH
T104F2D5F998D7993BC9AEA747633D2D5298BCC163F4A44994F7890E0CCC921BFE346805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85ad9672-f630-44b2-89cf-b23fd0e71934.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85ad9672-f630-44b2-89cf-b23fd0e71934.tmp
Size 39KB
SHA256 bf3d459296e15f02620ef6c1fc344ef34309cb6b13d53e86d1aa24f735e62075
MD5 925cec43cda47ef3a6cd28a6e916a4c7
SHA1 77332a10f4c84ed23d34d383f931493b8e7be846
SHA512 8d15d7e9bf2db89b78bc407c559887457f9388f1800b30ad27c42fb3d1941658da4f90e62feb568fca3fb12e5fdfbc9684beacfd87cdbf8a35eb633223d1bd54
SSDEEP 768:W/UxvxjgC+AC3dyAvKnJEyYGxDc9bsMSJz/Fn/ZHoqJ:LZj3+Z3d0PNVQbs7JTXoqJ
TLSH
T1DE03C079AC905C638DE7A340778A6B97FFF809A3C4C56D9885DE9E0D06873ED1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd6961d2-7209-408e-be10-8ae78268344d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\dd6961d2-7209-408e-be10-8ae78268344d.tmp
Size 105KB
SHA256 c232ec974e0782cd13a8942d319d172253ded086c99dd896db4bd09ec5006e8d
MD5 0a841124514bc95bddf295e0991715e2
SHA1 0c7f8d71116903710115f6bcd7457435319e2456
SHA512 f0411e7fb7b1b65af2901ce74beb7aae12751e5f298888551f71344040955011ddcfaae5bc0a1a0e03678f7366a807beeaeeecc467babcc548116b11f29e166f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T17EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 999a1b5579ddec09098fbd452982b7bfea545b3e93747faf37a7ad956711c1d3
MD5 8304ab5b501db10696b6bea802a8c9a2
SHA1 210a510578f028eb2589d500bb7dbbeeb7d3a7c0
SHA512 4cbefdc28cf2ee81b13fb03c6dd270d0ee8e6fbae2dc269f54729d03c56efb0342547fd0bf40de6de206ad5b310b419b89b97d8ae36a4aee5f06fe6a4617ad31
TLSH
T1F2D0806425163DE9C5AF71744524998055549E23B554531015030E595AD81B22CD2FFD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c39fd6267221b374efa774d6c41041e95d177305345c377cbb8b77e0db62d277
MD5 1d6b078e52d7e6721724ea245b9cac80
SHA1 1ca3fcb9b524273352613526376eeb4ddd351052
SHA512 93178fb60b7afa1887923b803249f4fb5206da62fc123ac1f189e0956002b1cc51bcccb8c27a6d867f51a61464095150594bd5eb761fec112f3d0a1c3de2d7d3
TLSH
T111D08078334B3D1DCF8F71711A14969155019E17B545973024135E5455C41791DD51FD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 952edd1c70766686fc85fe929cac60f1d5fa1769b2cef6001ba3628c338fd2bb
MD5 803d1d44c527bc5035008e4b492b6968
SHA1 58e12bf69a53ce0a53219220bc7f8725ddee88f6
SHA512 9501465648c62eb9a650459e4d6052f240ed8ad732569c745fc9c03cdb19bdd376d6a375f47dcb9790fe8eea84868252389f5475fd4c2b2aebd9737f1c834270
TLSH
T107D08074334B3C1DCF9F71711A14969155019E176145973024134E5455C41791DD51F9
MD5 SHA1 SHA512 TLSH

Submit Download

0a058191-9a1b-47c8-9870-6441496865ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a058191-9a1b-47c8-9870-6441496865ac.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

1eec05d0-1fdb-41c2-9cb4-6e8378faf0e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1eec05d0-1fdb-41c2-9cb4-6e8378faf0e2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38a58989-37ba-44b8-bb87-95fa3c7233b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38a58989-37ba-44b8-bb87-95fa3c7233b8.tmp
Size 13KB
SHA256 207e6ba57b31df518579b6c10e1c4a5480578083233f1d3ca508e33ff0436f74
MD5 ae6542818a5383a57cb80df06ac497d3
SHA1 96e53fa946ba40f22a15de2cdddb1b39d61693ef
SHA512 04f3ec5771801c09ed697d090f0843c77cad5465eaf86c06a8d3765cdd3a91e8a19173e12b147e8cb676896c1536841c17cbd74471a8f2fc9c352569998f6297
SSDEEP 192:sxRpROTv/fks4WpVnTZXLCtzoA8pLj/g6+WNewGuHAcfXnXTaghHIgD4MHJ:sxRpyv/fks4Wvndbln/5HHRHzp
TLSH
T1DF52B615AD68A93B8CD7D21DFB557F23E2FD103261A16E48A6FC891C01EB7DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

402d06f9-e628-46a5-9107-dbe0307c8250.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\402d06f9-e628-46a5-9107-dbe0307c8250.tmp
Size 27KB
SHA256 6107e646497059fc47fb2866704b33a696c1fc231ed158a17ca866fa15278261
MD5 0675c1f6fdfcb5d55537a634f6db0d6c
SHA1 320dcf7eb15f48089ca63a039da08758935319ac
SHA512 65e10a481071064e4614741cc536d837f645ec8cb34ec5d6bbd93a02ca0771d42ad690ac5bc8a7b9db85f7cfd8a9d757f328361cd88d58888560ec0b1e04495c
SSDEEP 768:dmGxhF7pLuLb1sWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OViUGeLromLmOB7z:dmGxhTEb1sWgmMfk6u1jaFVe4iB
TLSH
T1F7C2CA7B740CCB7F4FC04ADDAD197A9B6D6802CB9698CD8047FA941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5396551d-9fd6-437f-b441-e5d951566751.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5396551d-9fd6-437f-b441-e5d951566751.tmp
Size 13KB
SHA256 e1d4d59466a69e7eea217a86dbe807f80a7be13e304bfb0d00e2c0c465c10557
MD5 147b5d6455fbb94ee90102c7ed2a7591
SHA1 af6cf88770f43f54f6befeb3132e167f0c79440e
SHA512 7ea860868dd6224414880722bf2144d1c103524ce01664d9651f3072dd140e68fca633102875894b98d87f404b98e2e2ad80402ce20d0abaa5909b04965e19a6
SSDEEP 192:sxRpRfCv/fks4WpVOTZXLCEzoA8p9P/g6+WNOl+O/A4RfgJnGhHIgVMHJ:sxRpEv/fks4WvOdbUt/5m/zHip
TLSH
T19E529615AD68A97B8CD7D31DFB55BF23D2FD1032A0A15E48E6FC891C01EA6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83b90739-1fe9-413d-8a5d-16bd25a4c3bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83b90739-1fe9-413d-8a5d-16bd25a4c3bd.tmp
Size 12KB
SHA256 3c2a3269c77859b29a1249a3b5c281f26b9d014c3e38864aea2bb8884f6cfca0
MD5 917dc0142721b714e21cce6e3472fd16
SHA1 a9b4e7d627407c6322409736e616beef99db1e37
SHA512 eb1be995076abc0803e987656a92c3cbed358a7088915c5e5e3d85c077ed8eabbf1eb8b0e529394fddc99a36743d1799b43e550798f602d7692e974a224e6d4e
SSDEEP 192:sxRiRfCv/fksoWpVOTZXLCEzoA8p9P/g6+WNOl+O/A4RfgJnGhHIgVMHJ:sxRiEv/fksoWvOdbUt/5m/zHip
TLSH
T12F529615AD68A97B8CD7E21DFB557F23D2FD1032A0A15E48E6FC891C01EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e078fd750f2a04061dbe2f22828c32fbff4330005c08658811ae8f5885550e98
MD5 4c8c0dcf44d5eafaf12c291f121231a5
SHA1 8c50bbd2593645ece55c2af3b9287cc0dc3fdfde
SHA512 82495be41193c275806f5368ffd8f7dd2ea45a495407d76ad0144c43362959442d477f750bde0b55a6f7be31f36d25751bcfc00ed84667ada37f7547736cf303
TLSH
T196E02B76C923FC3725FD4B1861504E46E71593572650891B3B3E860C8FF0536414686C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 348b5be3718f694074bb221a99ae2c647f991b2efdf1ff1a85c01408c8a6c6b7
MD5 e4a272326b097693dad27c4a4ec9f216
SHA1 fb3f6fa2e68dd91fe5424c48a953f647bd8289c5
SHA512 2adc3bb5beb960e6bc770595f40fae92b36953c4a22b6617c09ae60a864cd555fbfd4e7f561ec70b993455ebe55f72106ff8e79f6d5550582e39e8025a14c5e8
SSDEEP 384:hjYP/Wq1EcJCl/n79ow61wUbxt+jzybmGnlJq:hQWl/ZW4zybmmJ
TLSH
T16013E43C72983C29D6C6423DC19F2EF86774DE30D6E16DA753B6F6244A69B0B0E1E009
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 81bf633e7656aee696e23c529d01ebf24b70b7f40a21aee929934cee4cf91d38
MD5 05d8210096dea522dcec91b1888003f9
SHA1 82f84337ca21d06f52a75fe3b14e69fac6a8d742
SHA512 a677565e86ef685853a1a65fcee04d340e5e362626d342b756f4384c16a49b06f0769d3b21937971a54a91bc5ee146c5f47e46831a9b731fd098efc876ffc72b
SSDEEP 1536:sGT4TJ+L/rxL/K+Fwswx7jmfC+ARRP9Y51O5rrS7AfsL/LL/dL/j27a:s7+L/dL/f2xnPoL/LL/dL/
TLSH
T149444EF74951A01BCBA852F5D3133E3DD17B451E6CD1FCE9E1788C812825B22B6BDA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 ebcad79ebfe9b3ff0059036388ac98550fd0a5519d75e4329f37a86db743f0cc
MD5 0821588fe7825f8e70dfec497a38f9cc
SHA1 fab70c922afc9cb79705060a89ecfb2a668d87b6
SHA512 b6769e244ce3f18ec7e1c7052c452863d4bc95a3a0e9ef21eadd5ce17cd6b3a9b50bcef61b70433eac4462849f56bff6707a4d9ab9fb2667ad3ca7201867adaa
SSDEEP 3072:0v9G+bW3YoHvAwMJBFBrMQQmfouoHmpS2BO65/LQ5ptIqBudZzqpW7mKtiph2WiK:0QiUMJVVQ0+YBO9ptIsoG23btE
TLSH
T1C62528EECB682C82DB6B8770B0E0D9077E712182B65DC0D39944C5D997D6B8176F82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 fb3f8bf9f765121dbef492a2ba7f779829aa04a4bfc2044a038085a6265d758e
MD5 ec470d9d679b8e35db4b49adfa051a0a
SHA1 9a66d48c050b7429b298d35f3d8697426a5163a3
SHA512 3d81564e32bd4ede15c7c00f8a4d9f20296fad8ba7ee0ba8bdb7daf4bfda49c06fe0ee855ae771d2c0a2e86caee020644824d1ea07b6f5b20369747557740972
SSDEEP 24576:7u86fH67spGzKQqNSgJGmbeTZ9X6zV1UP0:C8y6uiBhmqV9X6hmM
TLSH
T17E165CEDCA6858C3CD63AA30B4F0E9477C7413C3F955C1D68898C58402AB7C5BBAE769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c7f47aa5959442d04a05ead992d65ffb749c2ebcb5fb99829226a3cb02d393e0
MD5 7e23f210f53ee12d4ce5e4f0431140a7
SHA1 8e2703134a17ef0bdac0100491e5054d83a07e13
SHA512 e0a42b97ab64ac60dbddb10c9d60d9e334f9a8c9048c8ff310d25bccdad490ac3ea4b18a7f0b5a1292f8ba911a08bd960790919a38be0cd6ac5feb1248953967
TLSH
T11461C988DB9C4C5FEBDC3230AADD33A7F6BC5EB055870D4186EDC134582372A5144D85
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f827bff16e3a35ebfb708626b5dfcf9634f336545ccdd436dfc6a705d40748fd
MD5 59c9955e610ee993a449796aaf763d0d
SHA1 73d5065669aaad6b1ad8c6400a2e38191d97aa23
SHA512 b1d3e3535a3c3c9601ff0d9972b98a6cf2153a8f086ccbeb8c00912a63a4dbcc1665033436c4f022d4c31f895089907c1f410837301b4e9299915fc87a330d7b
TLSH
T17E61C788DBAC4C1FEBDC3234AAED33A7F6BC9EB0158B1D8186EDC135582372A4144D85
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b92d0f453538290ebd5f5f29831df9152c0000a22177dcb9c9df4c0d428eb831
MD5 da82d015999b0143ccb49573a1c23165
SHA1 0c15cc37f558e3f0e10fa46f26e9ef1411bf2081
SHA512 9852a24529ea49c9d504c8886012e40e34c91d240e398790a0d50b5c9bab263ad1f46fbcd5b49ae804e9e340e1792b47887b6cd9ccfd8693adf820feaf6dbc44
TLSH
T17D61D988DB9C585BEBDC3230EEED33A7F6BC9EB014870D9286EDC139582372A4140D85
MD5 SHA1 SHA512 TLSH

Submit Download

1fbbfcf8-bca5-4179-9b47-9d84ddef1b04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1fbbfcf8-bca5-4179-9b47-9d84ddef1b04.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 88260ad5be973a4937bbe5dd95e83964ee419d8d139bbb7c81cec89b11794c96
MD5 ccccf9982b7fc9827f7b8d0504c200c2
SHA1 895ddd649638a60e79858709ee8832d4acd8f770
SHA512 4d64eb97544fe85d1e03da450cdb7e2304648065205719aca673a675472f789f1100b61f0faa54ddabbda1311eff4f2775ed8ef8547113417c955398f7661378
TLSH
T115E0D8F995EBC11D751435D213787B09C78434A2D6996E072708C8C5764E001F245587
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 0078d543166f5dd09bcdc0524016dc00a7bbf02a25f3328443aa549604431b78
MD5 f0b02ce4b53f4e95d46e2733aca8e598
SHA1 39fe4d87d48003bd1c3a6e3816a8c11123a77c71
SHA512 b7b357a548887634460546ce2a96e69fe97dd3630d9446f8bbb3476c9cc58d3f439ebfa76d9db586cb647f549ab701e7ddf0b162354625d1283d8cea4b74d122
TLSH
T1BFE0267404C9C12AA21968E78BB8BB49DBD03896A2E03E46170CDD88710F241E2C62C1
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 eecd0ff01861c86839fbd0c862d980a6c6990896ec2164302a40e081cf727823
MD5 30d2c5fbddbe72f8fc33ed8ee5cd53c1
SHA1 fc157189b73948dd3751479f85ba116e768ee7c8
SHA512 1056af0db6275491c38aebe2c90660ca8b083b42cfc6cd5db16f6e2fce7df86d005b7708c74e4c0e4edb2b27b401c95e46bac17eb1467c552cc38e5f51e9cb54
SSDEEP 48:uzBmw6QU1PzF7bJ707JjcivLHy7SjW7170:6BCxhbNiJ7oE0R0
TLSH
T12492005B8A347843DF50283D238EAA35893BA21E9E63CCDC757448626DB47C3B0255EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 6138039d09082e47e8dca0fc05b2bc3c258be9c5b4d4170e8c81e59d1fa06269
MD5 32177511fcf8b53f19837318bca06bf1
SHA1 0ff4adbe617e1c89a2f62a03e41df43a61c8a227
SHA512 04b81f47067e4308211bb6c5e36a19383a8c49867877bc1a8e3adaec3952409e1bf16a9791ebfb82a9c3b9811ab19db90b9fca9f82dbba13618ae1142ade6ebb
SSDEEP 192:AxjSmh6vMH+bF+UI3iWGVoWN3qL/1VVV63:AxGmlIkUI3ijVoWN3qL/1A
TLSH
T1E5240D1F5F302712CDBD913669EB45A35C6DF03F8B1366DA686114B4DEE2742A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 109KB
SHA256 9a202d4626aa02927dbd4ab56fa2b79141018dcc1823a569b3cf7eb7afb85c42
MD5 46b43e3cc220d93a5af9e2f7b65fad05
SHA1 68aead5776bc98770bd6f02230b6a61012068223
SHA512 58fd708f6a5a2f148840e1c83b0a29510d851450829d1848bb8af54417f00d47ba008ec731adf04f3c3bf67d0bf2ca0265d73c38b21e5e2bcb20837290c2a0f8
SSDEEP 1536:3TfHzzSUasgfbKSPpaGghbacPFPIPu1vaOR7RhZTi4b4J:DfHzzSUasgfbKapjghb1PFPIPu1tR7Ri
TLSH
T1C0B36F49E7FA0548F6F7AF0E69F6604B587A7E866C29C98D05740F4D0936B00D872B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 8e33cc16f1b9cfd2839520abf1695e722a77fd6fa632d6ccad0174c83e493b55
MD5 38e7396078d05024f9c936b03ee0f3b4
SHA1 9939883c2a732eab3d057c713ff80ff35cbc9087
SHA512 1adfba72d0da2f37c8be77683a03f83858680fd2518facb680b98056d17a191afb2c0f4f4d82286bbe3db229f33c490b5d64fc153ee56d77d2997990fa9dad94
TLSH
T158E0D8B044DDC11A5208A0A7437C7B09DFA1641AD7853F065B08EE85B00E004F2C11C3
MD5 SHA1 SHA512 TLSH

Submit Download

31ed886e-c9d0-4cb6-aefc-bc175292907f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\31ed886e-c9d0-4cb6-aefc-bc175292907f.tmp
Size 853B
SHA256 f92d707b629899a6cb3cd2833a645144da8a04eb6bf8467080a48f70f5905025
MD5 da80bd27b888f0096275147b68c866c8
SHA1 547a5a8755a5290685c296811827a0ef1231befe
SHA512 fa0d2a69f228c4c9c0db484caf5a2311cb89c2c73ca5a6c0c7ea7c8810226bdf301bf13ae8d8e0dc39bbbf27036c863e5e3d2d346a6bd8af4cafb1a47b1cf1af
TLSH
T143014C57C97EA4AB503A04BB0D49FC09AE7EE832514268F4DE9783BCF0C20B34A52062
MD5 SHA1 SHA512 TLSH

Submit Download

38b11ef9-90bd-4fb9-a7bf-3a7da2d76619.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\38b11ef9-90bd-4fb9-a7bf-3a7da2d76619.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

86ad938f-3b9b-4269-9609-4b4e403c0aa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\86ad938f-3b9b-4269-9609-4b4e403c0aa2.tmp
Size 3KB
SHA256 2a91a4c1a76365cd6b5ceda7398bffe7a70e7c547ca6386da8718a05e02aca3f
MD5 e0cdfbe70412e072528d4566593c45e5
SHA1 4743fc907381458ef10fda482ee8744d211a00c3
SHA512 6d77668ea745b1093a558df9be678197e30972bd94dc86f759fb51f421f88a0e8a433231750e337759f258dc72e9148191c4c43c5ea0357dc860c0978bfbb6b8
TLSH
T10361CCF787F4852ECA0196F0AA18AE1FCF2D0515432C7C6A89E4AE27D3E3472E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

90e465a5-dd95-4b1b-b246-815ce8145837.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\90e465a5-dd95-4b1b-b246-815ce8145837.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 07ec61a32b081423df26baa7540c1cbf27b4eddb625a25c5c3a9fe5c932ab2e2
MD5 eb82643d073e6c80f6ea5cee2362a534
SHA1 6a20b824dca7f453d05e898fcaf51c4108c53ef6
SHA512 291950948d241cd0eb6c53b18a80de8915d239f806f52ad004a4ba866af4e63ba90acf07e533520ff1f0743b094903c6e2979d7843dd0e3b8c220dfb7cbe44e3
SSDEEP 96:qDeMatha95dQCO2vkzqTNcHarILWGWJp2pe+kPt:qDLaTa55Zsqx2pI
TLSH
T1ECB2D80F2B202215D5F12B37E8D0C5613F6C103F83636A9D89A960735E667FBB5060B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 d7d5c0bda37e3f3672dbff36aec508e50148480435657d8608deb093b2724648
MD5 23830b0362cd8ff2135400a75e58ab0a
SHA1 6092aea652ef2e073ba9411e3612a9bf28ca2907
SHA512 9b4ddd7590fbb3d0e537302a2e0373459e0a5ebbeb8baae1d058d72cb56a31e187bcb4e59a039e4638cb16656ac99e50a8753e10d98f1cbfcf74f88b09f37954
TLSH
T132012B53847DE46E613618BB194CFC05AF7AE8311195ADF4DABB83BCB0C15F30613065
MD5 SHA1 SHA512 TLSH

Submit Download

e792781f-db0c-495d-bc35-412fb4f58fee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e792781f-db0c-495d-bc35-412fb4f58fee.tmp
Size 3KB
SHA256 99314ff19f27afebb323cf8c6b6d645edbe44bde037b72617b3ac8596e5b3f1c
MD5 ff5c27d2e99449cbc2a44a810eb8b1f3
SHA1 1ff775155848b2849e8aad99622320c06ff436ed
SHA512 83ac25fbd97788818f7f76a84bd23ba4427ef64e7143888da19352351d82afaaa076fa89628cb090a3d96f1bd93f05be3911edabb27f8edf0cc766790df070e0
TLSH
T16561CCF787F4852ECA0196F0AA18AE1FCF2D0515432C7C6A89E4AE27D3E3472E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

ec739af8-b873-4942-b0ee-a6892aaf7c96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec739af8-b873-4942-b0ee-a6892aaf7c96.tmp
Size 2KB
SHA256 bd6503912579966dde1562ea25e3de156a7a2d1ed75556de58b3a6a723458142
MD5 dd3cf161272a625681d790b6742b0e32
SHA1 658bd7880ab747080f054f613b38a6b1097e6932
SHA512 4f18c23caf7ea14d6460163888c293645891c51e10ef5e49254ab7e6b095ab74c06791264fd62d3bfd9dad25429ed71dbcb362639bb10ac6f577491c2a0d55c7
TLSH
T16251BFF787F4856E890195F0AB14AE1FCF2D0515432C3D6A89E4AE27D3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

ecacb193-ec26-452c-9e37-9769dd812e50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ecacb193-ec26-452c-9e37-9769dd812e50.tmp
Size 2KB
SHA256 39c7325949284596064d48291e252229b24230f21f9a405206884c7b3e16e7b3
MD5 a8f50b50f3004d11e34fd4b4aa878eb7
SHA1 eeb261b074bead6f2cb2a2569266aa5b1a45aa42
SHA512 5c04c4e9a985cbb216d945ef1d93ab9a3f09e9e0657700d9a70b3015e818b60d0e3acee2367948e1b08ded599dfe5cb3c048b2f106d69e6c6124343677897ce7
TLSH
T16F51BEF783B4856E8E0196F0AA18AF1FCF6C0615431C7C6A89E4AD27D3E3472E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 a5fd8ed960dfb9182266b25c763f63e87c3ed7848021e11fc745e68937810fcd
MD5 a68a8cd88d1559a7592b29f7513e913a
SHA1 9ac6a32e836ea666cdb68f09cf0dbf0b9555822c
SHA512 cd3646576fe9bc9952a9dcfbb44a995eea286ef8634dfdb38c2bc8010202364934f14cea2097d0524c76e36df6e40723630f48723afaa3c790a5d1ab63f3974c
TLSH
T14BE04FB005DDD139601A309306B4A719EBE4B467D7D53E062F48DE88614B948F9932C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 118b60618bb12ac09a661c530994cc39ba11be38344b32d455d9fb74847b15be
MD5 ac95de00612bae6c454a1c9f48d43938
SHA1 3e572bbce92e6fa46e015be96b6ed85d19e40bb4
SHA512 7df2445ea3a445aaf380f711c97ffd5a80e93f81bafdb00eeba2028acb81e331ba3215ca66db457fadbdca09e810b24c24ab0591aeaebe9835d351d2bd395258
TLSH
T122E0487016D9C32A614930E70774F75DE7E2B417D6D42F152B0CE6C4724F944F653681
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b0b53f57b8491f9df2108ff10a718036a86ad46c74cbd24b0366dfea1f840cea
MD5 4286b695324827e2b62e084b14eab0ac
SHA1 a7c5a164246ccb62833221be9ac52d1eeff61748
SHA512 4678b301572339979ac0be9d71be3908ba37f16435a89842197bcb5d427086f21e2bb8dedd26ca303b74f2b6ca364a79d89b8433c0e87b4d00c309b05b17e53e
TLSH
T15AE04FB045D9C2395098B0D207B4FB4EDBF1A85797943E4B5B0CA884B10A544F6B65C2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 62640dd0cddc234627e0d3de36595b24868511a49acb1a5a1d285afa0f749136
MD5 a7fbd7913dadcff7dde1c6a0b55c06ee
SHA1 caa18748a3dd9c648c5d50b0b6e79cd583f68246
SHA512 58b3cf161f0b62762d3c18e67c2fd96f1bc2ab146baf03129b479aecc28458acabbebce664e1beeefc7e92cbe50ef9eca9e680505d9917d478a98e1cba794055
SSDEEP 24:KWYHAMWIFK0hI1+SZ01yXvgjg8SIxKQhs1ySFeZv7yt0WxNVllYxNaYIvRlK+ChJ:K4RIFKiIYNyt9IxKGs0igIHKRmM3yu
TLSH
T155911F20313A0200387F351C91E4BB6BD68175637038EA2E7BED51A68E6BE245DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 806834d25465be85322e19e2440d30c8bd4c8f37a478e89757525cac1f063974
MD5 1591460959fdda5acbb224ebe3639cc7
SHA1 a94159a99ed8a633fca4a8d7596b596bce8272e6
SHA512 1e0d62c5881b35375d6b4ecf0a6e0caf629aa73be7cb64df17e94afa44a23b9e49519075f0dfd6dd7da3c0574c7256af05d5189c5c88d85b62301300a9b19bde
SSDEEP 48:K4RIFKiIYNyt9IxKGs0igIHKRmM3yljI9KkkIb:K4R6KiIwG9qKGsNgYKRmeGjSKkk4
TLSH
T1F4B13420313B0200387F351C91E4BBAB965174637028AA2F7BED51A68E6FD245DFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 b42cae1d03d1343fd8a1220ac260dc217c7ae0b20ee2c7074e443578b8a87cd1
MD5 c6d4eb620a88b6f0d6ff042786e778fd
SHA1 70d0c8bb7de39b6a4531fa88c1314f707753c9b9
SHA512 3457227603b2a90b822e1f2866269dfc02b2e5d4c1b840fd21523f4e055b3f8a39df7bc42f7c033501db5b9f5cbf6db32a51991afc995c0ff2e2090fe4bdce31
SSDEEP 384:DNrRZyCSDnxTICaeGMEhIKyll7svbFKfk7:xFZJSDnihYyI1l7svbF9
TLSH
T1A644850A7B747001EDE6DD725CB080771E3CB26D8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 ea423a17aedcbfa0ccdd928b731c96ee0ac8b5e826aa9ffae40def72e4388888
MD5 dd4c6dd916a740adaa8553b1397bd0bc
SHA1 9ac5affbd0eea631f34ffbf04d7d9710367fdc71
SHA512 1f04fd921369e65b29ef94f0e8af6db6b1b6b7891b0ebec8abc82e4129651204659e7bb5c54497070777b085b48465d18c70be2acaa3c8b64a1d40ec60d67c70
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgVRy7/XBJduu/tCW77iW:DEtSyGhp22iSYRo/XBiuFjnl
TLSH
T16A52EB9FEA301202CDF512358BC227E1BE2B613F8E82D65648E510157FB5793E31A2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa05c6bb-fb04-4a3a-94a6-af3d5f57a932.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa05c6bb-fb04-4a3a-94a6-af3d5f57a932.tmp
Size 14KB
SHA256 136f04786f96267d9ea688f534ea2d77cf29778c05a9a4bd5d3d5013455a5769
MD5 ca0d2a34c1abbf9763bf0e46a8111ddd
SHA1 f690112ed14b1c36cfbddd557dc5b624e6a0f854
SHA512 13512370618ccbedc94a8b00ba3d886d6c8054ed81686299e8190d239fc649b7abb98724778490b3eed0557383d43653cce683b56387deaeb9ae8dd917acc5e1
SSDEEP 192:sxRpROTv/fks4WpVpTZXLCKtCxhzoA8pLj/g6+WNewGuHAcfXnXTOGhHIgD4MHJ:sxRpyv/fks4WvpdbPtmcn/5HH3Hzp
TLSH
T17162C719A968A93B8CC7D21DFB557F23E6FD103251A06F48A6FC891C01EB7DD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac5e6173-5057-4c4f-b484-4f488e482942.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac5e6173-5057-4c4f-b484-4f488e482942.tmp
Size 13KB
SHA256 d30df405544e49eaafa29ea1694dc5541501eab7cec3af459ea2426872eeccb2
MD5 c16e41bd99d76966cc3815bb8c81341f
SHA1 12f8d6fcf640a59b373941e963ba67d45a4c7d91
SHA512 79fa5488cfb1f01347e01ceb0e2ec4bec33ba7e2cf747d4f343102537a2b37b0ff1f1d43ed2a41399eee163cfda3ca0b52900aaa279c4c27939b642a5b0872d6
SSDEEP 192:sxRpRfTv/fks4WpVnTZXLCDzoA8pLj/g6+WNOlGuHAcfXuYTnGhHIgD4MHJ:sxRpdv/fks4Wvndbbn/5qHaHzp
TLSH
T10152C815AD68A97B8CD7E21DFB557F23E2FD103261A11E48A6FC891C11EB7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2dfa80b-b92f-4cb3-ac8f-417bddbfce5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2dfa80b-b92f-4cb3-ac8f-417bddbfce5e.tmp
Size 13KB
SHA256 822cc7fb75f81970cf3a318d7fa1dc9a3d0f257fcd02dec3d7e4f84fc02203a7
MD5 1dd45a10dcc65a678a48134cbc9c1643
SHA1 4974767fdbfee1cd948e70aee68d524485d2f139
SHA512 844d06bbdd0c08a9a9b7d3b7ab1b0d4bb9627f0941ea10cebbe192cc2b12c3bbd9112072942fee6b9bcda621e66fba72d9b84cea169e89767c1a226c51417f65
SSDEEP 192:sxRpRfCv/fks4WpVnTZXLCEzoA8p9P/g6+WNOl+O/A4RTSJnGhHIgvMHJ:sxRpEv/fks4WvndbUt/5m/pHkp
TLSH
T16D52A715AD68A97B8CD7E31DFB557F23D2FD103260A15E48A6FC8A1C01EB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9b106e8-9246-4eb5-a96b-b6843c3e436e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9b106e8-9246-4eb5-a96b-b6843c3e436e.tmp
Size 12KB
SHA256 47edcf1a555db8932b90a1464214466cc136b8cf115f4646099ea736fbe1b41f
MD5 c660ba35f2c87850fccbebb27a54dc10
SHA1 1a156ef9c88acc7d50a29948bf13dc03bbe1697e
SHA512 ad4975c1ef1313e07e8455c1b4741ed28d89a20a115d584f38a4c67ea005b7d81060e8094844708283a99ec6c5278c984b1c3c73aff768ceaafcfd676d9ab439
SSDEEP 192:sxRiRfCv/fksdWpVOTrk1zoA8p9P/g6+WNOl+O/A4RfgdghHIgV/J:sxRiEv/fksdWvOcYt/5m/LHv
TLSH
T1FF42A616AD68A93B8CD7D21DFB557F23D2FD1032A0A15E48E6FD8A1C11EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 488B
SHA256 04b8a13eeae711204b7aaf4719e8d1ce21aa05623318b3bda01ed40ade44cc4d
MD5 6a6750f4392618fa96755b1812c5e516
SHA1 b9b495f796583b1079b92a24f5315877994a2dd5
SHA512 9ba6955620b122af5f435715cf9830c77bd15b0523eac496abd6f96bb6a03adb62fd7e17500e25e4f1121430c8db9261cfc0cab1fd298f16e58c4e13cc804679
TLSH
T1B0F0BB90533AA040EA4F9A40D20C3F13A4D47A76510D4EB5379E67B8CB8D82C4A2EF77
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 4dcb67dd61472842c41dd4e47844b34315bf58c88e2c1f576245b30b3c35d8fb
MD5 38df8ad83582cbad231d3de351d61651
SHA1 e4ada75350f12c7f583b114edcb1a968a1cb0fe5
SHA512 94911d7fad25be5ee709588d2aea9f52b19e7d2121d9a0aeb3ff5aae0b8c4d21adc511e0ceb54503f35f5c9a42a853a63a57d6dd735119151a3a1d27806c5ea3
SSDEEP 192:YQrIII6b6MIME1YcY98AOagAspl9uECsJdBdoWdV:YQrIII6b6MIMiB3apsros
TLSH
T11F42836E16012B77C29E9B76137B8654AAD888C14032236D76522C1F8DF7FB783D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 ea7d51ae917cec299bb9a64693ed9f9025f3e3a77364e17daba64acaff4bb925
MD5 b7ec9886f7c0dc84adfedb16b48eee01
SHA1 cf3c67ba9fb3513144222bd79e928a095939359b
SHA512 bc49a0e33710db87f9491130fab6fde3fbbbab19db2d409c8db5ae43b3003486ef661ad4053a33781f0f765fa9a47f60f925f6d283e23b3ea7df218e362f9ba4
TLSH
T1DCE0207054C4C11E615D20D743786749D7C02413EA902E091F04C98C700A144F2CB9C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 7e46a2a9afb5f9eebb77442ba472dda0c6c4cf94bcb864ecd3b2a4b59e3235f6
MD5 9a680711bb63c6c1c86dcd1d3d4f2efa
SHA1 9d402e7ba839dcb61361f8b25e282faabe73850e
SHA512 01e83879172e804ebd2faac04950a7ae2d9c473bfdf130236f129781ab51893617cdb3bdbe63df944276c03d15dd0dbd28b8caa17f1016be6257e5d8342feefa
TLSH
T14421E145F330D109E28AC63E907A9B260338D446CFBCEC4F44BA30646E71F540E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 3ba7de8728bbd357edf8030434dfca3d66e391c1dd0c4b5c29b4749f7751ae36
MD5 e190ac63e1756f8e1b4f0235acd3b7d4
SHA1 80f375def82b97604abde9f1ce3560d90a7aae3f
SHA512 a956c03af0aa915c23655c071e7395f81e805415fbd223f7d9d6e30a366e7985883571d4dea76d509a22be7cdae14ac9ef841451b21c2ef625d21b852533a9cc
TLSH
T11FE0DF34ACE8C12FA01920E342B4B74AEB917812EA902F0A1F0CC988E10A145F68A182
MD5 SHA1 SHA512 TLSH

Submit Download

c52481e6-adc7-4151-b6dd-8f01cd4ac18b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c52481e6-adc7-4151-b6dd-8f01cd4ac18b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 92614446109655c29674344c1b666a23fded4c9ffd0c2351b2bc8737e06d15cd
MD5 cbb99312fc0cc53cf545434dd6fc7fac
SHA1 ec1ee218ef9209564b301a8a4f28ede1e89754a0
SHA512 34bdbf9ea36080cb0fb05665c0013e2500363c648977848551959ba3a193620ecf26796d4a97ae868f045315fe820baaa4d1c806e2233ca2b369d525c99bb5eb
SSDEEP 3:MsEllllkEthXllkl2zEfl/Jl:/M/xT02zEl
TLSH
T1644404047FC104CDC700D4304053C35053F0F410451157C335F145335CC77400C00104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 f20c586896a094003885b8c3b6bf159af378753990240923930b4700eb35e5a2
MD5 dfad59a4e80d4458bb8d431bc66e2f53
SHA1 0bef9762e82dbef770779800b99c2adc628577db
SHA512 8209b4213ef30e88d44e797e7f5880e4bcd31bc7d8504eb60a5ed60fe7fcc5f4f1c1e4d429d618e7aa6f70ee10175d4ee4dd24f16a8775283bbf78130ee9a16a
SSDEEP 3:MsEllllkEthXllkl2zEflP:/M/xT02z+
TLSH
T1484404447FC00405C500553040F7C3505374D410051357C33CD144335CC77400C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

b2227809-4f1b-4f65-855d-417e5fb0bae0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2227809-4f1b-4f65-855d-417e5fb0bae0.tmp
Size 37KB
SHA256 7d9bcae16664d0d16fb33082ec34c3f40f8912e6d9dc5b9a7d907c930e9154f8
MD5 c9042eb35c21732c2b38853be1cf8d7f
SHA1 ba793c879e2d12a11bac017524bc29085cc40016
SHA512 b8f497aca2c5099d5ba7cc595da96101b91dbf9681f53fde1a3953e67bd1228bbec2ef0f158f617d7cd3a3f4beba8c0787bdf9cf1e4f23d23680ca59278ef05d
SSDEEP 768:z/UxvxjgC+U3On9KnJEyY4xDc9bsMSJz/Fnn5SHXPyK/:GZj3+U3ZPNVQbs7JTzSb/
TLSH
T13703C03AEC9058A7CDE7A7803A8AB657FFF94953C5C5299849DD6E0C03CB3AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c89bcb5a-bf28-4a69-9cd0-a0e36e287bc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c89bcb5a-bf28-4a69-9cd0-a0e36e287bc0.tmp
Size 38KB
SHA256 329d7ae58173809d5782c5b3352fd682968f59cc94de7465f1f5c57bba817011
MD5 d254a69d51d1a414d502796e1b6378cc
SHA1 33c96966cb9c115567db872b0b1f53901ef78621
SHA512 7c0365cf54510ea5786c3bb8549c94b464299e94fc320bfaad537a3e1947ab96cdabf25443a36d63e71705370063af86873f7c4b2fbc218dbbe39570db10f786
SSDEEP 768:l/UxvxjgC+U36nNKnJEyY3xDc9bsMSJz/FnGZHSHXPyK/:IZj3+U3tPqVQbs7JTsSb/
TLSH
T13803C039EC505C538DE767803A8AB787FFF91993C8C5699895DE9E0D06873AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a5f5fde-12a8-4555-9e30-2f3a1eceaee0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1a5f5fde-12a8-4555-9e30-2f3a1eceaee0.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

81de92b9-911c-41cb-be8f-dc24b0066330.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\81de92b9-911c-41cb-be8f-dc24b0066330.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

a4b20bfd-2b7a-438c-824c-069160e92ec3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a4b20bfd-2b7a-438c-824c-069160e92ec3.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d7b10819-5eaa-4873-a7e6-fa068727743e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d7b10819-5eaa-4873-a7e6-fa068727743e.tmp
Size 35KB
SHA256 b8932f58810f868a534eed8f3415243bdd1636e090187a288d5eaa1aec63f552
MD5 e51ef8d620b0e7b3f0403c9d123e93eb
SHA1 c7fa77133b37e9f367920d97da7609312a50c366
SHA512 c2498bafbb92e5d73c78e278859988d4fc462d4fbd63d7cc4ef4a4dd12c4ba21c8872c9a19a86e0b129e80b269bb9842d25b321ad67db7caeb51e7bba433119c
SSDEEP 768:0Fr/Qwguvv5juVHqn+3QmDKgw638XUEL6t:s/vECO1DKn63SUE4
TLSH
T108F2E6F998D7993BD8AE6747633D2D5298BCC163F8A44994F7890E0CCC921BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da67ac3d-537f-456c-a2c1-2e57ea0b08b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da67ac3d-537f-456c-a2c1-2e57ea0b08b2.tmp
Size 37KB
SHA256 ee5255b8f5465a482fe04b4ff3c74512a32dfd3d2f7ef28b5f180b3258cc0ada
MD5 068804ffffd51dae1f321d7eeaf5902d
SHA1 8dff9711969531bd935f3c595778623709a4ecf8
SHA512 e222373a7a49bd0ee451940efcdd359b7d8f20e832db02cabd38dee2672ad12e9c0acaea0ba71a460d07acc70219938912687d2ce2b7aaab652d484bc37681eb
SSDEEP 768:aFr/ewgurv5nuVHqn+3zzoKgw67CXUEL6t:+/xMCOnoKn67gUE4
TLSH
T17C0380F99CD7993AC8AE6747633D2D1698BCC177F4A44994F7890A0CCC621BFE346805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54de1790-5594-4b41-8c7e-926b74c59701.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\54de1790-5594-4b41-8c7e-926b74c59701.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.contile.json
Size 4KB
SHA256 9fa105f24884fe882151c18ac7d1a464f5cb75355da972a1215deaf3710ad162
MD5 fa2ba0a52a29ca8e99ce78d387c35267
SHA1 2222bbd7ed371ad847ad7ecec99a873b233c40e0
SHA512 6bd9db5d84b0829fef383d12ce7f690eb492b46ee196f90fb3d153b218bb27d96ef46b97687bb6380d1251abdaddaa5bdf7269ae69c7e97eae817ab72b4ec879
SSDEEP 48:YdbAureDZlDygWMTQwpqNio8DQUWmqp4JcreDZlaygN1sQuGjy6T+jiRQFQUMnqE:TpCM3i3mKZWyT+mRlBn4KY9xS6DgDlz
TLSH
T10891946B89B885522731B6E16C4B36ACF107B006E9F48A6C7169DC7489A87FDD0CF984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 041a78120a945970adf6f67906b369026338c7dab7a38c7f549917b010dc54d2
MD5 891378d160f7e1ded4cf3a0d8a310829
SHA1 613c25895eae2a9668d7c9f9b6411b217b6aa003
SHA512 198519048de5e542b6f696e3f19cddb2d1fa398a3b0960e7898ad7d53c511961e8ff792bd2c3c40360640b9d360a78f5f954a86111c5cb470ba1782e398380cd
SSDEEP 768:WylD6/JMABGH+x/5MVWnTiLViBUNQGtrQX84/vysCVskDhHmxly22xEFj:NFoJMAB3xBMVTCUNvtru84HyswhGL2eR
TLSH
T1967307A39AA8F5BF1F9137CB1C0FB95B66D6015AE38501C9EDEECA1C81C8751013B5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 080ab5104214622d6cac25303f0e8ea7a9dd3ab32387c2be54e9406b4c2f4dd2
MD5 fb1cfb715fbf0c0ea4ac2d5c31a17f3a
SHA1 601634966f013c30b788dcb4f51f2c089e760da4
SHA512 a00492dacf040afb065b2e7c51ba68e088ebf855e461b724d32817ebdcfe5a44fabef4202743154d37d766e8411467c3a4e7c70720c3664119eae4727f40ff01
SSDEEP 768:WyKSg1i6NhvjkLZCYwbh51dmiZNvXkJmrf4OOrSiD++GaOwRW:NKR11vwLZCHbLTmILbmvGaOF
TLSH
T13B73F9A3AAE972BB1FE077C71C0F795B62E20145E78506CDFCEAC91C818D654423E5B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

11563

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\doomed\11563
Size 12KB
SHA256 0b74c2573f07d5631021ad396fc9650836ae21eed7ddd4cb3fd509fc8bc7dfe4
MD5 2eecf2dcf3b341d8834b6fea327f3e30
SHA1 dbadab22f3c3370d575fa46764817bb26054f718
SHA512 4ab073f14d0ec4285008ff4670fae575a25d145addee6f6c0e0a33ea4abf432cd493081ed99a0dce9da8dd0991bba5c06f0cc096033904d739bec4d03f54113c
SSDEEP 384:aRxMXCKzJi90tIfefTAsMCTAsyw4XpPpaRFMktCQ:gKlJnmfGTAlCTAE4XRpaRl
TLSH
T165427CBECF0178F06753D2909C4E85596C283893DD328FE6EB4A6A94CD55FD520CE207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14925

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\doomed\14925
Size 52B
SHA256 d1702817733242aa5befa10c59f3e22d98bb752854d38fbcea7aba5c878ab152
MD5 6bbde1fa98a92a65cb29ba2d4e6a4d21
SHA1 2dd6767f5dc063b43ddfd8e66b03ecc8f11f1232
SHA512 188ef7e45d3851061e78857b41ad4852f08c76e9bef8e9831dd9e0a5df43d7a03a6b18adbe2c07531d362d7e0fe7aa800f36f925d2a508aede2bff6415074235
TLSH
T1C490020C42968911D15480311C0581F404907D508C81037275910B5614294E2C014144
MD5 SHA1 SHA512 TLSH

Submit Download

20920

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\doomed\20920
Size 257KB
SHA256 8b221fea9aa7e7783bb3b37fc871f333c815b9dc96dab24d70796431b8fdaad3
MD5 3e7490e8171927625a87de2bccfb7979
SHA1 22bc4e42f3c022fbc94032347107a31a94a2048f
SHA512 8fb09dff1f46270ba877fdba95007c638adb158954e4eb35f326c028802752c89322f987a0d13c4239b84fe3872537e3bae13a4eec1eb6ed8ec460b4a593e5f9
SSDEEP 1536:tYCYPs0eyymq2SPrRoEvkcIW06S1hlX27Bm2NPnAiaPIuKrwB22pCauK8Ct92ZFh:uj8oBc4rm7Bm2NP1rwB22pV2Zj3T
TLSH
T1D744F6F7D6AC70FB07129ADC2C0E72CF62AF4139DB5209DAF8688158C3C9E651076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7993

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\doomed\7993
Size 176B
SHA256 4463133549a716c07003e5f3323453252e3a347d93cbf476c8169e550734b071
MD5 83d708db07a6cca8e0bfde74773202ca
SHA1 51e5e47fc4a976a48822bf9a288156084b49fcb8
SHA512 90d5df94e7297aaedd91d395a1fb38bd0dd5485fc85bf7912aa04199d75ab6cc2ccea55611bed867ceadc8873bc25cfe49c9bc326faa184f04b456b1b96b4023
TLSH
T1D4C0C0D011819562F2080DB0082DF488705A1545CC5C4552D030120F007D68008D3386
MD5 SHA1 SHA512 TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 2efcd9870efec52999c21fd4a6dda54e31721bf8dc0d0b90c128d71ca4883b63
MD5 474eb05b985f8ff2886e8191ceb251b8
SHA1 aa08f6fcc47aa51bdc86ea93297305d062355d75
SHA512 f77f86f4c4a35e4ffb971b8451cc6c9506513e6ac71d239c3e50e0546db903359df59952536d42bb4d6eb1e96e3573c9a8277e15b009300499047989be4516d3
SSDEEP 384:HGNQiO024YKdWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAc:mDZYEWTToXJWTTogB7S/AmVAf+hRMB
TLSH
T182729E7D8F013CBD2B5790E9C8B543588D18B7ABDFB5C06D15C83D09C988A2AB1F945E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 563bc63f32908bfc5395928b454500659d059a9b41791f5115f3ae25bcc9b18c
MD5 e546729b78b4c2431628792af9d09f9d
SHA1 b5013d760393f51d20217ec772bb45b6a4699a8c
SHA512 050eec418aaefa627102a76ac404904e43e3fdec871feae84f2f4128d35c555d77029192cdcb975f16b074a2945fe97188e1c230e22ee08b0d1accd0da3484c6
SSDEEP 1536:XTrliSEUT/o3bIHX9+FDIQQMxseRJdqXxOAP3VN4XN1sq6cRk1b+ti+F4MojLWxp:X3lmb6X961s8jI9EHCMoje7fyHQAD1xm
TLSH
T10AB39EF7DFA6CD3958FF841CAA82893FFD262450B3A73419C923261452C6FB47679608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 8e4c134ce7309b511ae1637fc9c04f79427bcf060015febfe11ea538d4fffb1e
MD5 c8fc597fca00a89348df5c992a02a38a
SHA1 0dde33ef01c3755705b41bb8414f762b4210d7fb
SHA512 b920d914ed08b9ee718168dd5a2bbe79b1c874e0fc6c6569702f27a031cb9eed9e6394c58dea0f2f2db425f9d4994cae60dfc1c38e0175d9cde6106b9f0de3dd
SSDEEP 1536:jTrliSEUT/o3bIHX9zA4vcy6sJxmSLtCikwG4XFcRfD3k1b+ti+F4MojLWx2u77S:j3lmb6X9L/BGGzcCMoje7fyHQAD1xB
TLSH
T1CDB3AEF6DFA2CD3968FFC41C5A82893EFD262454B3A73419C923271452C6FB87679608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\SonaPoke\debug.log
Size 4KB
SHA256 aabce9b72d1be33f3f78a3183539a3eaa25c920c0276d2287fc3048757896ff5
MD5 043e6bb2a70e4696cb5d7bfe32d2979c
SHA1 8d79addf8320668826047097b48aa5cb99ad84fb
SHA512 044a82ff8a69a92613f7c31e04818d0179220a4ce96a18c0147db0862acf67695efa61015166096c3d766f28c8ecc5b18876fa8a4fb6653bd9442f301200696b
SSDEEP 96:odDeuS4zDIuJRes/tVvzZS8J7IqVXlWmQ68G:kF
TLSH
T16791152125D6E9B981A093AF05DFFFF9B5B275049A49264C974CCF84B3A8C7CE8C7240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsAppRuntime.Bootstrap.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\SonaPoke\7MMjKSzI2PdZ\Microsoft.WindowsAppRuntime.Bootstrap.dll
Size 384KB
SHA256 e4acd665ff39f8a0d591459bd5901482e71b4ffbe644f421ffad9431b5fed438
MD5 66b4d11ae652097e0769d0cf82c1d79d
SHA1 88295d3599001f7491803e3416ac142d0950a737
SHA512 e5c7914a24695ec8a59ad7c39b8b8bf4f246559600b0b8ba426ed45f5cb626a4698e4f6d475d1fb3737adcaf76b5d67dee54aa64f48dc19a11dcda0cce10980f
SSDEEP 6144:lAs3AvP92f0fl0CmqX5V9ph0lhSMXlBXBWn08Q2:lAs3AEsflnmqX53ph0lhSMXli08x
TLSH
T123848D25FBE941FAF0279178D9B74B06EB33308D432166DB026981251F77BE2693A781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SonaPoke.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\SonaPoke\7MMjKSzI2PdZ\SonaPoke.dll
Size 3.0MB
SHA256 133bea25116f95170ad9fb2045558193e1d4126b91499689454b6a5379b8b260
MD5 8f7be4a7c9211575d065f785a44152ca
SHA1 c757aa42fedaa43bbc4689837db5f598e3a5e728
SHA512 6a38d40fd083ce749e5e895d815905aecb50e953cc0009b0415bbce36ae23576f310b903c99a2776ceafe079739113b9030e5f30c8428db78ac7fa5eff8c943e
SSDEEP 49152:CFaIRgVNbrAHpec46i/zOrii6hzyRl0h6dNPweQ5Xr0Fj8CZDS0QVSrmRiQX/sKa:CTioM6i7OrivYOi6XC8YSpVSlUstlV
TLSH
T120E52342F89CA2B1E5EC91329247DA052D477D7CDBE29F265041B3723210672BE377AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\SonaPoke\7MMjKSzI2PdZ\System.Private.CoreLib.dll
Size 15.3MB
SHA256 1125acc8106c43fc8bad2d203c4c4485df6182d292846c2fff415c1040c54678
MD5 65ab87caa6fad6300656a7e67ef90880
SHA1 53d3543dcbdbcbe877a4bde23163b23432b07dd2
SHA512 160b7e2880aba7011463c768a67f5d44c3816f2979ec5830a1f6393bbfa8ba2bd4cdbe1f483f5232b6a06b08645f2856c9a1a757081c724cbb44257d6752d3a1
SSDEEP 196608:nSB8Fw8j0czR1GXgmFE8TROH0nhg6pf4u7Q7RoVsC6YSKFpUjq:SB8FjFzR1tmFE4OH0nhguff5PN
TLSH
T10AF6AE10D3D88F5AE13BC77C8177C626EA71F892532656C70595EA883F23BD0633B6A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9972809c-f748-4cf8-8f9f-168de7de3ad0.tmp

Path C:\Users\Admin\AppData\Local\Temp\9972809c-f748-4cf8-8f9f-168de7de3ad0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e6c91091-033c-46d3-a2b2-c29f20e69081.tmp

Path C:\Users\Admin\AppData\Local\Temp\e6c91091-033c-46d3-a2b2-c29f20e69081.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4608_1649007484\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4608_1649007484\CRX_INSTALL\manifest.json
Size 626B
SHA256 279bf453dd0572dcf4a326cb7df9fa9d296a2921ef96abdb1956a813268d78cb
MD5 b9d00380c0947d7ba5fd1efcbb8a7347
SHA1 fa8ef5bce53e46999cdd957da6113b37d04e116d
SHA512 577b235564c77be3050f2aa0e1b6986bcd3d38b09a792a01f943d7d85efccc43bdc9659aaa3b81311bddc1bcce47faf4f3d3eca77d955ee2fe93fa6b095f0c13
TLSH
T17CF04677EA1D482746F057A4E864B189FA22175FA0A05C063AFC542E0FB01AB0A03B2D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4608_613457929\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
TLSH
T153213806EA14BB37825F6036BC657585A3300ADB2600FC3D7EDC941C1B059AA91BB3D4
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4608_613457929\CRX_INSTALL\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4608_613457929\CRX_INSTALL\manifest.json
Size 1KB
SHA256 5066cb967bbc69febe0062f17823215a0db227fc4ade731f461d9e1d4ff8dfdd
MD5 5490a639254eae312ffa8f01950fafaa
SHA1 e9da87a417ea58cb2d62bd163edb977cd71b6d9a
SHA512 369c5ee6d62ea5766cd05e387106ba54881d4e7b0acabaea93791621ba43a81dee8380322cebdf50a5d4df91523d64195399944ee848d30ea81aad87083c0bc1
TLSH
T1784169F7BC00AD634BA49898AA1E714EFB69B24D55CFD4DB8298107302CCDAE1D611E5
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4608_613457929\CRX_INSTALL\service_worker_bin_prod.js
Size 137KB
SHA256 63b3d006783e106d3aacb9cda3224d48a218dd45d50db663d38b45d2d9b2bff0
MD5 97b43ffd3c415ea9887f0113d43f5a2d
SHA1 1afcebee8c88dcc9c3ff7d43ffdc3b00a329f9c0
SHA512 279521e204cebf954dbf991ba66b9d4a30534d77650c898ce2f052034263d9dfd9a1ea122a548f51a061ebee9859fd2e88860ebece906b23b9d6dffdc7d85c97
SSDEEP 3072:cFMbB96nK7qtBnZ8CDPDHbSVh6lGE4C0S1wmF9cWMzK:cFMqMGvSVh6lGE4CymFiWMzK
TLSH
T147D3D9CCF6A5B0124363A5F5402F000BB239B8B9E44C85A8F288D9E97D7556D8277F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\addonStartup.json.lz4
Size 4KB
SHA256 c1e0fa5d6d2596d068615453e0911a48fa5867ed06c1a9c414839aec7c7b7e00
MD5 ac5004fde5d63808b6bfedc7dbcb3d70
SHA1 1b26921a5261e385a70a6f0f3c0e1f1b61830409
SHA512 2a3373e644d50340ad75ba55f43f027705b177795c33957503e95753dbecee3eda7d777707fb7ace63750a37d64380191bd51a94e7432eab4d0cad88a077377c
SSDEEP 96:NAq4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:Na52xxhD8rGvm6ApwnHUuhN
TLSH
T1A1A16C7AD541EFB2FE22C0424CD57FB2EA969B7410A9C4D4F1AAB1294D74A731705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 67KB
SHA256 8de50964889fb13a8e7f512a6c9e150a363952545b951ae31cf21f51f742d996
MD5 d4ed35247a8a2a8116532305bdb57dbd
SHA1 acd9ec6a58b57127293fcbcd730b9a7c31c32cfa
SHA512 46a016b069e2f52794af85cbd69b2cc8bb5a6c6aa59eb8403bb02049df741e80339eca53e57c0235426a1dff6c577fae8217fc9f1a85da69909094de65bbf450
SSDEEP 1536:deT18c6a57+410SHu3fzfJglpnRVh0NK7WmGHkCw7wjRuhkb:dep8cJCS0SHuPzfilVR83mkM8khU
TLSH
T1E2630F44EB1A953BD92803BA9CD21B003F79F8895B0A2B67375C54386D873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 71KB
SHA256 81912136b0533b0875b92a5d74766f2b3a59f724144ad67c2caeed7532506177
MD5 8475983f4f48d48583435d7ab000dd38
SHA1 95179d6112b208f0518dacf5bd90cb64c1c3479b
SHA512 ac54685c113039496fa81aef8631fb3828f0d693ffc55fa6dcba50270682467149daf1bcef0c39603c03ff2be89ca39bfdef8d19e66d8dad9b2f8649af4ec233
SSDEEP 1536:XlJZ52mYS5TOX1CHpt/qzfJglp8DvGhtRxtD+7t3/+uAiKtNinI2:XlX52q4FCHptCzfiliv2jk7FYfWnr
TLSH
T1C6730F44EB1A953BD96803BA9CD61B003F78F8895B0A2B67371C54782D873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 3a8b43383671361b3ca28466871975c3820c262ae2e46df3812d4ce36ee76b20
MD5 c73cf49536ddc1a3328dce40be90ca27
SHA1 10fc646331d6a6869ec0c242a7b49403e7d11366
SHA512 5afd0c60995b914571b09166b73a9b60e9313f1ea358c597eca2da26ef98dea302edd30afbc8bc581f8765cf21a978415b6c9b9dcc7fcdd8b0d8c5118d973f52
SSDEEP 768:h/ArGTTNGcm+udARXAfwYXbBbNbDlb7ami1/:h/ArGTSAu50
TLSH
T1C4D2F084EB1E953FD42912BBDCA51B001F79F88958192FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 8090c1e4afb6e984bad2be61160f268cf75e23fc92ebea81882394421eb495dc
MD5 c407838af1987d9cbe0e798104cd343a
SHA1 b5b6f5e059f89b3b0681dc34e73255e2810d962b
SHA512 dcb8f7692ebd0e6558a52e24d8b7bbd74494c14cf593adaca008868967eda606b04e44f170506c1e586fbae5a852355fd80f860c06df631f01076f4bf5ce4772
SSDEEP 768:y1EmJ/ArGTTNGcm+udARXAfwYXbBbNbDlb7s:I/ArGTSAu5s
TLSH
T1D1D2E044EB1A953FD42912BBDCA50B002F79F88959192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 e934eb9ef2a6b69e18c5f9a22624caf26ff4f6ca4fd74abd6afc3838b4350951
MD5 8923e754d1739bd63ce2a662f80e9f5b
SHA1 d8f7efd9ceaa615a3166ad220ced384feb1ce14d
SHA512 f151bd0a3cc6faf5198b5c123c94f305fc0ffa5640b4ce382928d1283c32a61cfad0c670edc7808ee776474115c4a10c7c08d6571d48b1732c1053f150c0ca3b
SSDEEP 768:y1q/ArGTTNGcm+udARXAfwYXbBbNbDlb7y8C:X/ArGTSAu5Y
TLSH
T145D2FF84EB1E953FD42912BBDCA51B001F79B88959092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
Size 1KB
SHA256 de19361a7fe920fc1a37619b640c559a38a3c7213fcb91d4c1b53e869ecc7c72
MD5 8005f0b7930287d4b2e925a9f252d132
SHA1 aa6f7c6eae1e1899cc57e3cacc17d963e1755a89
SHA512 5221f116ab929ed176e236350ea2491e9949ecc5d83744b6d5282bbd004f9eb17727a9b5ff99f90f71238e0d332865a2cb1e5776f818536a06ed6c2f654aaab5
TLSH
T113213A5C3DBC4D2A6987FA9CB490458E57558A0B44872C430E53DFCDCE91ADA32AB43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
Size 2KB
SHA256 2a05356b61eb850a1f31f4c2c14026005a9f4c30ea85652bae03741e01457ccd
MD5 41b5bc9b1b3daecdb12d0034798f4767
SHA1 684394a4df7cbe33509012e0461510aadd44e279
SHA512 442681f617aa212d1f5bb0e6252f3abe3792638465b3fa067bdfcceaf1c1917eb022a914ba2b42cfbc9db4fc5d8e3f8eb54f08a2e9fc7a0596d2922a068372a9
TLSH
T12B519A1C6DAE4D3B699BF6CDF841058C8B954A0644C62D830EC7DF88CD46A99329F52D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
Size 4KB
SHA256 984aba9de618c9accd974853834ffb153e954028a05e18b3dca62ec90d163c96
MD5 97c5d43fb8977e2e83759e39e3d161bf
SHA1 efb57b08b9ef39ed8eb6c82aa2d9a73bada8f259
SHA512 01862ca7d9d837cc274a70524821f085eae8663461271f735ee1f524f8ab281a5f09bb75f3cbf07652f86fe43fe9628f17be64e07d641d7deced2cbacee41c3e
SSDEEP 48:YDxa2LaYAbSiIIKJKx1n1yi/hE8sZ8ldXImsgGJmK3+v9FI3peEM+Vy/y/AXLHr6:4zWlH1NEWrXjxcmIsERVhYo9hwHI
TLSH
T18C91DB0DAEBA4C7A6EC7F6DCF8414A8C87C9470744C62E830D97DE8CCD4665A329F529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

032e6ca9-2dc2-4241-8344-8895d21be25e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\032e6ca9-2dc2-4241-8344-8895d21be25e
Size 2KB
SHA256 04ecd5de913f8f6f15d989901463a81375a36d509e0ee0bb07be7982e80fe657
MD5 fa53d27b98999d4f5b7586d0bf0f8e30
SHA1 473efca067b78e0ffeaa1a95651f4c304d468d85
SHA512 8b3f206c608d5f7d07acbfd96f275fc013c6ea8fd8f9392785e7130693fc308f154efec69c435ffbf44c9c92a019704a2a1993c07e74168651250e5d8911adb0
TLSH
T1B85129FDDE52505A7C25D20F72A6A62B31576932498C838E7FFC003A4ADA83F0133729
MD5 SHA1 SHA512 TLSH

Submit Download

25a4030f-d6d2-4f4c-955b-702b0ee040e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\25a4030f-d6d2-4f4c-955b-702b0ee040e7
Size 886B
SHA256 d2129568177cc3b0cea98d77b335af998f7304913791609d20a0cf7a512e74ae
MD5 34baa941f11d4410d6dbb14aff0385d9
SHA1 8459b3b939e8cc15d1ecf2772f0874fd285ba416
SHA512 1ae01a04527ae3a2714cc51b0f109b4b0690dfbbe41dfe10a21d46d685b078d070187bbe288b00699a45cea539fbc33931d5984c2db55c0942cec2ceef6a788a
TLSH
T1081104905674B9B38D2C925F96D17B434BE47033C0C54D187DA54F184DEE51EA3B6307
MD5 SHA1 SHA512 TLSH

Submit Download

3f8a2375-ca0d-4c5f-98eb-3caf178f0d3a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\3f8a2375-ca0d-4c5f-98eb-3caf178f0d3a
Size 871B
SHA256 5ab8d3d049eb9b00642dedeb2eb14ab7288dc0cc5131c12c72f85659ec61a93b
MD5 80831be9e84e60fffc8cd87254d2b4b4
SHA1 674107b8d870dd7997382d04edd9f44beef40c54
SHA512 ea3deb7229c630e03ec287d7452f214e7bec6cbeb0ba758f4c2293a5398126df4ddfea2f02b396ab43c06a78522fe93ffd27a8efe277c58c0376f9f82ab3efbe
TLSH
T1EF11E3949760B9F3CD2C925FC5D577524BA4B53380C5C4087DE55F085CBE92EA3BA207
MD5 SHA1 SHA512 TLSH

Submit Download

79ff4223-ddbd-484a-ab97-83628bcefc15

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\79ff4223-ddbd-484a-ab97-83628bcefc15
Size 235B
SHA256 7fb7b29e46a21478dc8a5a0d57b05196c0bdf403218abe08a0a083a43351dbb2
MD5 d069cadcda42427415b749cfdd7a21ef
SHA1 1ace0b2d449a60852802ec2ae912e3c3e6b0ff43
SHA512 8c4e63f42de066c8cc8a5ae6d87c9b892573f0c8b6bd5f67985c0e517ada40958448c89cf90628f5fb288d6c3499ab6a1fd3c268552f641da2b6ebe29827bdc1
TLSH
T1D6D0A7859499776E0C144F2BF4B069CA30958C3324B5B860965145BA9AFAAC86171857
MD5 SHA1 SHA512 TLSH

Submit Download

a8a34879-591e-4ac2-bd45-c53bd907c3ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\a8a34879-591e-4ac2-bd45-c53bd907c3ab
Size 2KB
SHA256 7b4d90bbafdf2909abf6b8568c3b294a75c4173c2a631ce1147add5f5c70c34c
MD5 491ac90d354ae66401f8d4fe5330d46b
SHA1 e671489068777af24fbc9948004370769d6a841a
SHA512 0c0573d8817d762f4bb8edb5c5802b9b70fa145d8edfc458938585803d4f2f219f212e520109e28bc7bdb0a241e06476293ebdd4e979e784c8dedb664cc332d6
TLSH
T19941406C75B88D779C8AF15C9082334A43A08E1220CA5C836D81EF4CCDD769D73BA12B
MD5 SHA1 SHA512 TLSH

Submit Download

eb87ceea-70f4-4685-8af5-56a224e649d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\eb87ceea-70f4-4685-8af5-56a224e649d5
Size 235B
SHA256 3fe8b0710a52d551e2bbb73698c9d407ca188e516f14a5c3b0ef494ffea5ad8f
MD5 4a9fd9c7ede520a61b987e4e89ac89f3
SHA1 9c5a32860b960a1ab8c5defd9a89de06aa986832
SHA512 b8b2b95c1a1657cb10e07b21b92d701e944d4c9273ed28e9648479c4babfd82b1a089dc713b3783976725ad44b9b0d3e10798847bab51142e603716ebe702831
TLSH
T16CD0978018C8A36D08245F07B0A06DC631848C372460A820C6514078AEB89C4126191B
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\downloads.json
Size 723B
SHA256 eb1e26ed6fc847568d407aedeecd2b2c81616310cfdb4951582f8c04a00fe491
MD5 3b83f2b3a242636e2d4adb5e7bcfb57d
SHA1 66f64fdc92341cf70febb3110050c28d231829f2
SHA512 0fca1124599b2e6a85787e973c88b983aad49fa4d5994b6c56cab82bfbad46aad6b86565cd8a0c63af4e68ec0fa14ed45af1f9102bf15b7a50d1a44ec5550d69
TLSH
T10301F4F61103DDE52A055A90551C7F427D77E257C4C8C434B298CD1991561781D2C9AB
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\downloads.json
Size 789B
SHA256 e7bc78697d911d736e28c74e67bcfbc89da5cfe88f872ae997e2553710e2081f
MD5 e38e4396420a0071438fdc303aa1eef9
SHA1 cd666c12496281788db0326b3d87e7d25ee9d55b
SHA512 b0386736748edcf8e8b800720fd36ddd0887318ba544f93d037912260cc0d5c72c02a392518b8764c175bad5c5a95699ad1b4a75baa9af825b65caf19a823a31
TLSH
T1170120B20052BFF12E969EA5272C3F466F33E01384C484743AC49860D29D425083C6EF
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extensions.json
Size 14KB
SHA256 a2e21f6b1af114d61328e7decb2a1b15d63ce8587e88f19a3b4a1f892427f15e
MD5 eb42279ff4647b48313ed77da5cb2fc3
SHA1 4676e0f62974562ad107968f96a6998a66f12eb1
SHA512 45b21007b29d4f064adf99862235fb9c0eab1bf146de534ca9f565fbbe7a0cd8e60f0e37598f2463d71895f6fedaee8f09d293eb834498d66de9752f56f45877
SSDEEP 384:9kI4vyUmldv98dhWY94z+96oBL4HxL4PpL4HJL4HnL4HC:+I4qRf+Xp426u4J454B4r4i
TLSH
T13662432549049EB8294F578BAA367D01C37D573B70445C78F4DD8FC842FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\places.sqlite
Size 5.0MB
SHA256 a3a12195dd631dc2a11fc3aa59059f72bb3a62dbc80ed4782be31d297646cf01
MD5 f879657b4c5254697b9c8fb5e215184c
SHA1 050373dc46660fd59f2182e8b32a5152c3015e9b
SHA512 ed7af624b369ffd7659734abdb76f6c74193c4ae37cb2001a9d04d874ed3243fc5242da48f3b84746d20da1e06fbd2e16a34956364ec37f6fd7e9dc7df31c84c
SSDEEP 192:M8rJQaXoMXp0VW9FxWACH+fxhMecchMvXkjFxz/oOzXR9P0m:M8r54w0VW3xWACH+fxhMNchMvELR9
TLSH
T13936644F7A202095D4EAA131ECE32F15683FB126C93676533994152D4ED0B23B96DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
Size 8KB
SHA256 0a77483359fa092a5185c73d5e9516ce0ab989e7b070fc85346051382035dc9a
MD5 46190a94c2a1d53ecff63547b46fd022
SHA1 9459f2bbe62f209f5f8e73e744a9817ad934421a
SHA512 1b6ad8c42ab0a8fd2894dd154814455d484028467c536cd87aee17f79d5029b00b03afcbf0700b1d3370be62839c447310db8ed596dcdf5c9a067d83aef7ce82
SSDEEP 96:xHeVTUDqGqTfS/uObzSRSSlXdv9jsgPxnNWRoC/C+KBw88kkd8L4cnEtjVGS:8HRTfS/u7SS5PGRh/C+KBw88N
TLSH
T141020E7898088B7F74B677ACAC648D315AA2013B77BF68C750BA45C5054CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
Size 12KB
SHA256 6221bbaa988f251196c2d7c1406ec83de8cf975dd2815c8b687f2beba655466f
MD5 20f0e215eb1c3b2e602e45a5f94c887e
SHA1 ce8e8786a348d73a0af39b673c67536cd37da865
SHA512 647a99b7ee88de451b8b70319d2561120cffe5c78bfbe2d82bd3614aa3ea023a30e906699c0b8d5a0abcabb892769e8b4c083c0a08c9a02b2473b1dbb0d3c817
SSDEEP 192:8/CRSfS/u7SS5PZLRh/C+nOBw88TS48p+Ty:wXRh/C+sw2AG
TLSH
T11D42DE3C68058A3F21B232BDAC218D715E6101377ABFBCD246F985D2094DF6445EBAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
Size 12KB
SHA256 98f9cf7ce3a417dadd28b68931bd6c80fc296087827bdae66706a7799cf37822
MD5 26c90b8e48e96e9983af243cb101fae9
SHA1 7bbaba9f06aaa165aed39a96b87b8caa38aa1e2c
SHA512 8132a405192fa2a6ef8e60b19ca803f54d65a362c693672ab523cfc027474ec458109bc8f3060b87ac9bd21df5c011bdcae7acc967c73022ba00d26bcaeb0c7e
SSDEEP 192:8/CRTfS/u7SS5PZLRh/C+nOBw88TS48p+Ty:1XRh/C+sw2AG
TLSH
T10342DE3C68058A3F21B232BDAC218D715E6101377ABFBCD246F985D2094DF6445EBAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
Size 6KB
SHA256 152dbd33ca3eb17120a8c23109fa0a1afc768050eef9199007135444c6639ef5
MD5 65495f919ee35d6d2fdbc856aa42412c
SHA1 38dcb73ba2a5a64e4200db197823783712a2f1f1
SHA512 9466143ac66c5e0b4e2766442554cb054c606c4f726ccb9dc0da87236635a22f29458b71c11c5c0c596f95d1c976bbc1345e0e3d64f0549adcf79ba8e812b266
SSDEEP 96:xHeUTUDqGqTfX/u1zSRSSlXdv9jsgPxnNHG/C+DBw88u8L4cnEtjI:8eRTfX/ukSS5P3G/C+DBw889
TLSH
T166E11F7894088F7F74B6776CAC688C315AB2013B77BF68C650B64489055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 6KB
SHA256 6e26b1329dc20df07c1ac35e8be2487c4876ec847a5e8fb0ee4e519a9cb66f18
MD5 7fc464a779b2258f5cca871ff666002c
SHA1 8c1e656f5cd76c4461d8540533dbc44eda76b9c0
SHA512 ede69c5b1bb2a43cef849469a4fc70c98c2022a55b53cd52bedce4084c4a34a0d29cf70ed0fca19b70066d95d0747e266d26241e0f7f575f2bd8fc61aef584fe
SSDEEP 96:xHeUTUDqGqTfXc61zS4SSlXdv9jdnNHG/C+DBw88u8L4cnEtjI:8eRTfXc6BSSNG/C+DBw889
TLSH
T10FE11F789448CF7F74B677ACAC6888316AB2013B77BF68C650B55489054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 7KB
SHA256 10603e9642996da8b3dd0137896a8edc93ffc9be726318672a1d119fa899928e
MD5 20d5722dd299ff6f069bf96186670dc1
SHA1 27e986d30b014176688354a85a67b7f44070ef08
SHA512 286174d6815d5434175dbc873cd50e05fd8292e27e463bebdca9d2385472beb0952bdb1b8e7cff87cd1b9f912f4896e39c0ea2224d64deec328b4b04799450ca
SSDEEP 96:xHeUTUDqGqTfX/uObzSRSSlXdv9jsgPxnNHG/C+DBw88u8L4cnEtjVGS:8eRTfX/u7SS5P3G/C+DBw88G
TLSH
T1C2E1FF7894088F7F74B6776CAC6888315AB2013B77BF68D650A544C9055CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 927B
SHA256 19ff9070029d54e123491bbd4968f1d46a7aaa3829d5e8b42aecf7bcd579fbbb
MD5 7df98d2b5f2349112ee46da0c82f2750
SHA1 c2c31777b2b65a54301f92b0bfae43d1c352402a
SHA512 dfd9e4a1071a83775833644c84504b2559a8ef2015304a4a675541d256ead8bcbd8c240aa7e34aba17b32ab45a23261bd1b8f898fa832578705fa916684cdfb9
TLSH
T15C11C8D5BF9F28732B50D001B0C617E84BD82071027C10D0F80B22A1022865FBA7634B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 2aa73671f9827e89b331b025bc9fae77a7fdfefa018a46f75d704ce879edfa77
MD5 7a359f0115b02ca1115b933c6d04d92a
SHA1 bfd2b03fdb3228307f0de61bc2d2e207df5765de
SHA512 c8cc19fc51e0849da399c8eedce1298f36ab498d88e61c7230385646a7d2f544447710854c90e5891aa7ea99bd6665d5bb4b00ffde61dfce38af41e7a632d87c
TLSH
T1604129812DCE217F5BA9C140B48626BD83ACB0078A6C0064E05AB7A3C16E283747E7DA
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 035efe1d391436958d034a42727dce6c7c3be8f7a705b034a1ac9b0938da7d7a
MD5 39bdbd7dc19e0a1b72e9b2a5a88fd70a
SHA1 a0d7d36b201327ead77f4ac6f1ae65272e7daa56
SHA512 b51014bb5ef5b9fb28a16a146633f2099d5b3c1457558452785645528eae6616589ad0c7005dddefd2f0ce80da3194062a1d96457e8ba2cb9d1bec96236cf7a7
TLSH
T11721C653CD7B1EF525EA427590414FE5CA5E302181BA18B08059C68229AF05C7FC731C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 7338e692a9219b35de2e828bf1a8fb103e742db13b7dc35424af7c51e5bd9ee0
MD5 7383eb96634f474351c5a1d77417fb8e
SHA1 ff364597b9cb184c558789c6412dc56886f3a8da
SHA512 7157e59ec3aab8b8c7b030a527ac501fa139f0ac0c98df0a84e3aad916ece00704a182b97446492945c5867b49ae4b997e90a91f599dc9f409ed949ba753de4e
TLSH
T1714129812DCE217F5BA9C140B4D766BD839DB00786AC0064E05AB7A3C06E286747E7DA
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 993ca7bfb1b4f0af15fdbfd58fcbe25f6ff2a35fcfab332418bfd961085949d3
MD5 572556446dda36e796fa29724a1b70dd
SHA1 f26495940ae472c4561e22ff2352a129d99a0c59
SHA512 6801f798af6c6ba03902cc6a31209d5de42642e6ecf939d8587f07679e0636d91b824353eecb49ddc583fa9ecdfdd025730021e38f7785fe3df661be02a69445
TLSH
T146411B801EDE217F5B6AC104B4C6267DC3ADB4138BAC0064D09A77B3C07E286747D79A
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore.jsonlz4
Size 2KB
SHA256 e09ac26d86083649d61f2236e147728e7f7c89d52cc81873d00db22333fa1c25
MD5 0e4b215702aa63a71328ec28267301bf
SHA1 d3637fa34a5c100f17cdd1a0ba55e4bbf9dde92b
SHA512 525c758da323ed591db389ed96cce91ab85ce3bcc6ecfa059eecb30eb6b350661833f84eb18d410528e75ed1e2c00d5689da7972ef34ef48887cc6a9d46d43e5
TLSH
T10D411A812DCE157F57AEC000A496367DC39DA803869C0010E09A7663C1BE293353C24E
MD5 SHA1 SHA512 TLSH

Submit Download