f45ec7207432393aef14d282ea2c60e36cee2ed76c1d1bd6b22c1048a97c5c67

Resubmissions

24/04/2026, 15:24

260424-ss9f7sew2j

24/04/2026, 15:19

260424-sp9b2aev2m6

Analysis

user interaction
yes
max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Balatro v0.7 Mod Oyunindir.club.apk
Size 62.9MB
Sample260424-sp9b2aev2m
SHA256 f45ec7207432393aef14d282ea2c60e36cee2ed76c1d1bd6b22c1048a97c5c67
MD5 da132a145326ba8da6fad56060cc1c37
SHA1 4b80467d40e4da11990a6b2306eedbd7913f8167
SHA512 cd99d67b10becf6d21a0201465d389a0fb33fb03ea9cd5db3f51d2fd0be758f628b4d2e631cfeb040eaff700691a6dbdc331714dbd411e155f8a70569ea21dc3
SSDEEP 1572864:sARu9E0zUZbPrp3CIF9St2lrjId8QxqiaVNWuugxEM:sARu9EJPFy5d9RaTrl5
TLSH
T1F5E73389EEB9E85FCC37A03319AF0F2713919E699661835BA674713C1DF7E904C50AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery persistence spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4616	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215177169902435"	chrome.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\莉翿	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\cs	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\cs\ = "apk_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\˦ \ = "apk_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\.apk	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\.apk\ = "apk_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\࣐㥚ɵ	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\湐㥐ɵ\ = "apk_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\凄蜹谀蠀﫨皪翿\ = "apk_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\˦	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\莉翿\ = "apk_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\࣐㥚ɵ\ = "apk_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\出蜻謀耀錠㝛ɵ\ = "apk_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{64407571-C50A-4936-8D30-DD711BB55CB5}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\出蜻謀耀錠㝛ɵ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\湐㥐ɵ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\凄蜹谀蠀﫨皪翿	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\apk_auto_file\shell\Read\command	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2308	chrome.exe
2308	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2884	OpenWith.exe
2344	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe
Token: SeCreatePagefilePrivilege	2308	chrome.exe
Token: SeShutdownPrivilege	2308	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe
2308	chrome.exe

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
2884	OpenWith.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
2344	OpenWith.exe
1776	AcroRd32.exe
1776	AcroRd32.exe
1776	AcroRd32.exe
1776	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2212	2884	OpenWith.exe	82
PID 2212 wrote to memory of 4884	2212	firefox.exe	83
PID 2212 wrote to memory of 4884	2212	firefox.exe	83
PID 4884 wrote to memory of 3676	4884	firefox.exe	84
PID 4884 wrote to memory of 3676	4884	firefox.exe	84
PID 4884 wrote to memory of 3676	4884	firefox.exe	84
PID 4884 wrote to memory of 796	4884	firefox.exe	85
PID 4884 wrote to memory of 796	4884	firefox.exe	85
PID 4884 wrote to memory of 796	4884	firefox.exe	85
PID 4884 wrote to memory of 796	4884	firefox.exe	85
PID 4884 wrote to memory of 5108	4884	firefox.exe	86
PID 4884 wrote to memory of 5108	4884	firefox.exe	86
PID 4884 wrote to memory of 5108	4884	firefox.exe	86
PID 4884 wrote to memory of 5108	4884	firefox.exe	86
PID 4884 wrote to memory of 432	4884	firefox.exe	87
PID 4884 wrote to memory of 432	4884	firefox.exe	87
PID 4884 wrote to memory of 432	4884	firefox.exe	87
PID 4884 wrote to memory of 440	4884	firefox.exe	88
PID 4884 wrote to memory of 440	4884	firefox.exe	88
PID 4884 wrote to memory of 440	4884	firefox.exe	88
PID 4884 wrote to memory of 440	4884	firefox.exe	88
PID 4884 wrote to memory of 2012	4884	firefox.exe	89
PID 4884 wrote to memory of 2012	4884	firefox.exe	89
PID 4884 wrote to memory of 2012	4884	firefox.exe	89
PID 4884 wrote to memory of 2012	4884	firefox.exe	89
PID 4884 wrote to memory of 4284	4884	firefox.exe	90
PID 4884 wrote to memory of 4284	4884	firefox.exe	90
PID 4884 wrote to memory of 4284	4884	firefox.exe	90
PID 4884 wrote to memory of 4284	4884	firefox.exe	90
PID 4884 wrote to memory of 4752	4884	firefox.exe	91
PID 4884 wrote to memory of 4752	4884	firefox.exe	91
PID 4884 wrote to memory of 4752	4884	firefox.exe	91
PID 4884 wrote to memory of 4752	4884	firefox.exe	91
PID 4884 wrote to memory of 2680	4884	firefox.exe	92
PID 4884 wrote to memory of 2680	4884	firefox.exe	92
PID 4884 wrote to memory of 2680	4884	firefox.exe	92
PID 4884 wrote to memory of 2680	4884	firefox.exe	92
PID 2344 wrote to memory of 1776	2344	OpenWith.exe	94
PID 1776 wrote to memory of 2780	1776	AcroRd32.exe	96
PID 2780 wrote to memory of 3248	2780	RdrCEF.exe	97
PID 2780 wrote to memory of 4412	2780	RdrCEF.exe	98
PID 2780 wrote to memory of 4412	2780	RdrCEF.exe	98
PID 2780 wrote to memory of 3992	2780	RdrCEF.exe	100
PID 2780 wrote to memory of 1436	2780	RdrCEF.exe	101
PID 2780 wrote to memory of 3204	2780	RdrCEF.exe	102
PID 2308 wrote to memory of 3216	2308	chrome.exe	110
PID 2308 wrote to memory of 4616	2308	chrome.exe	111
PID 2308 wrote to memory of 2072	2308	chrome.exe	112
PID 2308 wrote to memory of 2072	2308	chrome.exe	112
PID 2308 wrote to memory of 2544	2308	chrome.exe	113
PID 2308 wrote to memory of 2544	2308	chrome.exe	113
PID 2308 wrote to memory of 4784	2308	chrome.exe	114
PID 2308 wrote to memory of 2680	2308	chrome.exe	115
PID 2308 wrote to memory of 4784	2308	chrome.exe	114
PID 2308 wrote to memory of 2680	2308	chrome.exe	115
PID 2308 wrote to memory of 2576	2308	chrome.exe	116
PID 2308 wrote to memory of 2576	2308	chrome.exe	116
PID 2308 wrote to memory of 1104	2308	chrome.exe	119
PID 2308 wrote to memory of 1104	2308	chrome.exe	119
PID 2308 wrote to memory of 1688	2308	chrome.exe	120
PID 2308 wrote to memory of 4816	2308	chrome.exe	122
PID 2308 wrote to memory of 4816	2308	chrome.exe	122
PID 2308 wrote to memory of 1620	2308	chrome.exe	123
PID 2308 wrote to memory of 1620	2308	chrome.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Balatro v0.7 Mod Oyunindir.club.apk"
1⤵
- Modifies registry class
PID:1820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Balatro v0.7 Mod Oyunindir.club.apk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Balatro v0.7 Mod Oyunindir.club.apk"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {814655bb-2f8d-477a-a0b5-470ef0314fae} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {64d1306f-8915-489a-851b-c3b429594969} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27274 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {5130d3e8-de9e-43b6-9268-637a820e3891} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27274 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 3776 -initialChannelId {cc138c28-8612-496d-8695-97f37f5538ba} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4248 -prefsLen 34773 -prefMapHandle 4252 -prefMapSize 270279 -jsInitHandle 4256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2752 -initialChannelId {488b5bae-f756-4b5f-84d8-dfc612e5c01a} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5152 -prefsLen 35010 -prefMapHandle 5156 -prefMapSize 270279 -ipcHandle 5144 -initialChannelId {005a573b-22b6-4cbb-b2e4-a9d6fcc3a600} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2884 -prefsLen 32900 -prefMapHandle 5108 -prefMapSize 270279 -jsInitHandle 1664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {3dc8761b-7467-4339-8c85-ef0fee7dfb56} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32900 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {9a4a147b-bf6b-4b4f-9f77-ba4fa3c51525} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4752
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {a0af1643-ba8a-4a71-a7d1-b6e523ea3ce9} -parentPid 4884 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4884" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Balatro v0.7 Mod Oyunindir.club.apk"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C6009A60D66809BC2BED581023FB2D7E --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2ECA2950AE42428D2902B9BA1C0D5F90 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2ECA2950AE42428D2902B9BA1C0D5F90 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4412
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3C38FF4B261918AF34DE659E2610BA6B --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3992
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=26784617A2FFCE149D032518F8558A72 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1436
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D99C69310D98CD2D5EA79CBD96CA6C9C --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\5c3ad91124a94f668d874c77a6d88d0c /t 3700 /p 1776
1⤵
PID:732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6592c728,0x7fff6592c734,0x7fff6592c740
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1836,i,10599390788915697485,15990737639859266464,524288 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,1975926775754869225,15725739950550806177,262144 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,2651255172904323968,7663470106874484760,524288 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1732 /prefetch:13
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,17777816427862754675,15561861591703987620,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,8803466274792944934,11901544084253935937,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,7412058449041905585,1652017820090940665,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4212 /prefetch:9
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4584,i,8129654444537037401,5784880697541301161,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,6557697730035279185,5233173333617933154,524288 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5416,i,15592575000911523702,1234422443972897630,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3496,i,14633472322410338677,5838406964033555293,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3388,i,14225262651717655957,8032420469416111645,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4580,i,11654885219943803822,13789426772015500194,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,13819197429000820029,17190458630110262188,524288 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6384 /prefetch:12
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,2439616365324067017,9656070318951864475,524288 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6592,i,9550997889432559642,2845948995888131052,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6648,i,1463388290877706208,7810024616248154853,524288 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6620,i,4197579655526462543,9643751160257695046,524288 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6604,i,6003336960379207205,12945976455184441221,524288 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6828 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5828,i,11947837705922991818,12246517998382903156,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4280,i,6908152767133422948,3754638376264694105,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4316,i,7700858569443653620,3196822790716012126,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6924,i,2132571517950357970,15677860217375821802,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4308,i,7286214419631289796,9726706244473814554,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4288,i,2507707939476444812,9362931641558634277,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6728,i,16209514352813317633,16630626747937530962,2097152 --field-trial-handle=2088,i,17718679523055161927,13174314984354190346,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf35506bc3b515421984bd1bc9c65fae5b72f025c6e8621ffc5a0b3ffb5b7c21
MD5 a83468cb0d570aa9cee933f62ec859bf
SHA1 3b0c53def9e3410d05e6f4237e44bdf0a7651243
SHA512 3962886320255b83bde2a4351d0847950d2f95a5884be23007e9e959ee8ad2d795f1d287e3e242a747a0725abba77a5d8a541a290f78ea19aea3db0b7ab144f5
TLSH
T187E02BAAD9B19C2709FE4B1850644B46F651135B2F90545F3A3D810C4FF5A2A8549A5C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_turbobit.net_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b2337305c493916859020a52ffc2d6af86b58054afd06f5c221e07fb8a7a0ebc
MD5 1727c6dfbfeabb61edfb962bcc6d9b43
SHA1 85052606529dd8a32ef87f79361cdcdab3ebe7e3
SHA512 343a0a6e2fd96283ed5a8342f4cd13a806a5c0319e4bdd80d735c3c4d1e9ba176adf6f53d8621b9b9de55a86b9a2525ff4439ebb6a20e39c0c76d1e956d9de71
SSDEEP 192:PRrcBztL9TUQoHv7HYhAPRp2N8h98Hsb+WNn+644fj42cmeffp2Kg4VyIsnAUgtK:PRrmztRoE8XT6wj4Y42Kfp2Kh8
TLSH
T14952C62EB914797B5CCBD21EF922BB27E7F5102165D41E84EAFC8A2C01E7ACD2617017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3b9f4da9b402327ad10927bd33805745f4fa02e1f264c0d1f0d28fe1e41f926e
MD5 cd4165e7ccf9b398a8fc528664c7d740
SHA1 d35790fb6111e87e6e4e49c54180f52f58ddf785
SHA512 7d63b482c6fd7c8e12b023dac02273959b3a5a20575e7a6a7133d1e861df09a671a8df3ffa6aef138cc935c4853cf7ede4914160546ef304a979304da503c47c
SSDEEP 192:PRrcBztL9TUQoHv74YhAPRp2N8Hw98Hsb+WNlk+644fj42cmeffp2Kg4VyIsnAU/:PRrmztRop8XK6w64Y42Kfp2Kh8
TLSH
T1B152D62EB920697B5CCBD21EF922BB17E7F5102165D41EC4EAFC8A2C00E7ACD2617417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cdc58af5141c01582d151b05233488353e792720857e5a07ce591f5c02271adb
MD5 85b789262d19ab8423680e6c10c372f6
SHA1 b4933621bf626d6418b3cbcf85bc755155595f4f
SHA512 34087a7032edf3a0c572c5cc6a08f370f7e967221ebcf033933705801993a56d775cd01ae557007185faaf15d82aeede014a883e0ca90e8a1188ad008ac5415e
TLSH
T101B0123081419501C04302B525C748C875149F109705170193E1AD71D8365E24015150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599d21.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599d21.TMP
Size 96B
SHA256 72dcc1840afa7ec7af67f6c4a0e998017430d8c39d6ba04b5eb005cfe31ea1d8
MD5 bd8f37ef447a49f2719dce7f29d70562
SHA1 a4e518ac0852e3bbf5daf98e4c0e83397b17cc02
SHA512 e9d9f553b35c009ba5bed15444ade6270e6842331bbfdd115e68bb5282dbe70b0c5506cce592d1df8244ce8c382b9a3877140796153dca522275b929650c251a
TLSH
T15CB00255C2126212C04207B0259599D9B1A6DFADC603122292E11FA6EC2977145755A1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 237B
SHA256 ec33971fc492d2118d2ef117337bf925c4919fb1dc5df526fae666a8063214e0
MD5 6ed11a99aaf51f457f1ab826f30f43b1
SHA1 0657480847abea6a272483261605de2712830705
SHA512 e11b8ef159e834ccdcc4d3c690cc862f8aadb1d98a980e520a6587fc9ce3065ffac0c4bee8767475cf918a12ccd901a30ce9e0cb66f2bff9263fc3812c3ffdb3
TLSH
T1FDD0A7EB03308D8357709D981165B84DD1176F4AC8C8C8E4C948B093707D713D453A35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 153B
SHA256 a64dcac861018ad4b47490d9c0f99a673cabd85db7291a7f02eda727c9161f4d
MD5 dd5fffcebea5def681335f5f976123f5
SHA1 ae4b8abee0efa356ded185b12595c0e5feaa2532
SHA512 a279dd4ca76b4f1f3f2b7e80762389d7a234c75ae2c358f6444d26f3d0bca7a9951f28b99a87577d287fe0805a3697ee034fd85151690b43bf280520c5c41d7e
TLSH
T130C04CF705104E875B71A9D82515BA5DE20B974D88C8CDF4D549A082617EA635442D25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c087.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe59c087.TMP
Size 160B
SHA256 598c009ec8555ef8b78996225defb3c01aa21370471b6291e3652e6dbbe9e114
MD5 d1d7d648c663968ca980f84ed11a9c87
SHA1 805b660cc5e651616a59def920b45daa1b35fb2e
SHA512 c706abdc6bb00ba922c29c2ba848e44270df4dab5e7da3e60d5ef2a6cac72c73ba2fc7f8538d2ebba2c72f2590a32a6be2138e5375f22165d3136b48039b9501
TLSH
T1ECC08CBB01200E824B32A8D82024BA8CE20B9E4D8CC8CDF4C50AB082303DA238002D21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 c4de8db028f8a51a92aed3d373924ec59ee186e455454a97e8ecfa6d0e65efea
MD5 d34325ad02f4add23c3acccfd32d2aa1
SHA1 486eff90eb9ddee9f8fb74d9301c79a406e69a1d
SHA512 edcf9a1dd4c1da7806b50d2390a47209e029cbde47128f4796f1b078179b2ade8abfc781ae287c2302df384dcd7e3f1408b237123449eaf8ebf1dbd39df91268
SSDEEP 6144:Pq/jbgax/Ti+jl8HxfcGfqb++JjcMW2VcVL1:S/jUaxnjl8RfzcOMW3
TLSH
T1771412E15F1B3C7A637AE585640B7E6D8D96EC8E0507129931C23B2F129F397A707C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 4150f391c8316523c6eb2842a805a351e5145d9b5a329114e1b00bd2bd03fc16
MD5 525f8d7ada7df0312a6a7e9a6f6fb070
SHA1 26e82e5667a3aeaa01261d33df2ddaa2f3f9728a
SHA512 84446624795a3521e2fb8bf112ea9d41900f35d375fe594a99cd70b10068557891be1bbf68da13b72339be8ba199004b6d6ce35ae21f1f7ef7999ec24bc45240
SSDEEP 1536:wSIP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:A++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1999312B9991E7D79236FD39AA0179CAC88D3DCDE151410BC30C66F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 fd1e4a709853e681671e9eaa8664c07b3d2cb69c8e6109cf1fc9105b7b9fe2a7
MD5 2dccf9eb8457bed15b16b7bdc3fa0f61
SHA1 7655cf7627ab8aeee82f39570e45bbc9e83ad616
SHA512 46f2b3afc3ce9933bbe8585c9bdb7ef6f5980361f683f5025422aa7053e3412af96d39b8f37f7ff1f5a80935fb0129d9fdd1dc8ffee5fedbdf3f75801d119858
SSDEEP 6144:tq/jbgax/Ti+jl8HxfcGfqb++JjcMW2VcVL1:A/jUaxnjl8RfzcOMW3
TLSH
T1C11412E15F1B3C7A637AE585640B7E6D8D96EC8E0507129931C23B2F129F397A707C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 0448e6d42e83835947b473c615d3689b1d10b0500ee26b6983b386c4ae332ae4
MD5 89cac0f33ff69da8e16f2b5124a78c05
SHA1 3bbcbce5d5aef76baa672c062c4d3f14526c491d
SHA512 f292bf6d369182b667254dc05fef80d09cec9d91511a4786043c475ca5781fd81d6ddac187a321d598654e56b36f4cc3ada2037c396f0527ef49674c9370a00b
SSDEEP 6144:Jq/jbgax/Ti+jl8HxfcGfqb++JjcMW2VcVL1:s/jUaxnjl8RfzcOMW3
TLSH
T1F51412E15F1B3C76637AE585640B7E6D8D96EC8E0507129931C23B2F129F397A707C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\769walom.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 e232064e68320c77deb57eea13b9aafc49f39dbabb87f788127c8406788027b8
MD5 1a0f42eb9342193f31d6435ae9f22945
SHA1 861028ffd1f4ae8d8217951a596fbf189a309bc9
SHA512 5fa50c89269ebeb84aea705800963c525ae34609634320e8d75d0fc03f52dc7ecbc5999d2106650161fed7395e6d7191af2acf73aaaf3b5a2c6a63aca3282c04
SSDEEP 384:HbaFrLiO024YOFuhw+5EL1pPsac4j0lpDII+fXxXT:7aAZYOFuK+5EB9sac4ID8LfhD
TLSH
T1EF528E7E9F0138BA1B67D294D8ED5218CE04D6BBEEE2D16605143844C7847BCB8FA4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4d82bbff3beb7530855fb8dac6ef251e586fc31c8c142ffd08a8c49f1cd6d3d0
MD5 77a92963bfdfd0771a00ac22b60f5b81
SHA1 23b15048b635ba0cc5f2eb8983f6379944bc8a0c
SHA512 9b8f1cde65602cadd6960b718a33cc4d86708f641ffb793883f4a50ae190c5e70566df986d3e1c25a80bf948252d1b1299b26857f2b9619865eeb96b5507a7f0
SSDEEP 192:M1d66Joz0dzgCl6mc0dFjOv5zboObH/yj58:2d66JozQzgC1jAboObH/yj
TLSH
T15FE10D64EA29467FC408437BCCA61F004F35385B984E3F2936ED65082D5B2EE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 1c1e2d56524e503cf38f1ba17f83d55ba002556bda40b2cad34e33ac1d3311e4
MD5 aa40658552e7ff005787f7b623bcb3e2
SHA1 adf05ecbe317b7e9356d36bb260de1d845c85d25
SHA512 083f66c08e9f75ce743a944fc6cd63c4650b37f3aeb1b4c109f1817af697bf4012f0e9571e2e355e0b0b49e447ea8b2a03a4e5fc1f920ec72f97472a7dc63a40
TLSH
T10A51C959F2298A3FD4450139CDC61F406F34340698AF2F2B36ACA18E1E5B2CD768D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ed9ef91134357540a39ab05dcc8cc6d4b2b6201221bd46b31f24e154a044fb19
MD5 2041c77401dff7b4c40e04b16fb4323d
SHA1 a431976e76c86fa9dff41f26f6fbd35623529577
SHA512 f3d03e1efeca457403f21d22e326759658fb2f794a9220244238ca6a4d31cd3bcd07d3db70f183170a71c6cc37e589343ef9e62e661711d47051ee2116e8a7df
SSDEEP 192:qjOv5zboOZH/yj58o1d66Joz0dzgCl6mc0d:DboOZH/yjrd66JozQzgC1j
TLSH
T1FBE10D64EA29867FC418437BCCA61F404F35388B984E3F2936ED65082D572DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8cf54ae722e8808f134017132d62b8a4f45ae1d0e8cc2119faabf8fbcaf3c09d
MD5 e84753b4f5834fd658c21c5271316b6c
SHA1 2542b64cd73334ed528b247753d35d83478424ca
SHA512 676628dddcb59d03ef06aba36d74d2f59a473d6b67e7d104bc623a629dc8e210ef51787f16de583679859818bb7a31d0df260cc5d3ccade65dacf6dff6c5c8b7
TLSH
T13A219A5C39F84D3AA8CBF29C744A128E53498A1644CB1C430E02DE8CCDC9BD9336E83D
MD5 SHA1 SHA512 TLSH

Submit Download

63f42b6a-78e8-494c-be24-23b01cc884b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\63f42b6a-78e8-494c-be24-23b01cc884b5
Size 235B
SHA256 3ab346d097c177cbdf44bb56c8d6ea4e57388d18071375ce5e55d8964266c799
MD5 9ef9afdc38ec52c845bf3400a86f6b68
SHA1 8e43bb638b82c331d1203570debf9c0d636339f8
SHA512 90dffa66a63db5a21d858e5a6cabbc8e817d8b1526b2bbf19de2ee0a1a68cfff5a8dcb5e9c286d4b9f6e8afa6ac786ce6953fd451eff6fe1fd06ba6c66b0efd1
TLSH
T1D1D097A414D8736E48188F16F0A079C330C54C3310646820C6A289749AF8DC442A1806
MD5 SHA1 SHA512 TLSH

Submit Download

8e32571c-10b3-424b-b3d2-3a4f016ff47c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\8e32571c-10b3-424b-b3d2-3a4f016ff47c
Size 886B
SHA256 234e6c821c0527de331c9481f4d81b09fb58f6c3b0f3c2cbcb6727a06e595c23
MD5 f0fb2ff401f3704bcb147d74d76ae91b
SHA1 f64c245e2474f08764c51d813ac9b3746b735cc3
SHA512 22eafdc90162cd3ffc9c2227209c39dcd081b777ca44cc750c3543a3b4a37ee564079e56446de58e97bb161c56d7ac7cd03757db173531cdeef558144d4254eb
TLSH
T19F110441863579F3CDACC28B99E67B419AA07017C0CB4C243EB4DB144DBF51D625A607
MD5 SHA1 SHA512 TLSH

Submit Download

d79821d2-a4e7-4703-8d58-d30d1e4ac76e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\d79821d2-a4e7-4703-8d58-d30d1e4ac76e
Size 16KB
SHA256 0b0cb53d1e9962088868c185bdd2d4fef8a84dcdc229dc0802f56571ad23c3c6
MD5 b4d06c9c78ffd4879d1cc2e41b8a0c03
SHA1 69410c5ea89152e37fe65dbb616b889871dde195
SHA512 4f7f66d0e40e36ceea45e02983ad3c4c4528469e22ee71948b339bef67fb0a96f88eabead1283ce37c2bcfbba408211355109e4664c1d7edec60f0cafb8160d6
SSDEEP 384:vvG/zzh7ItJbNb6xrNOfUzCn7qRDYbIdA:HAz2Yhi3p
TLSH
T1B972DA062860457A8251E3A899FCBFC3E6F538CF4C419FC99BE4BE486DDE06D112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e22044bc-2b25-43b0-bfc9-14d1a95b6ab7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\e22044bc-2b25-43b0-bfc9-14d1a95b6ab7
Size 235B
SHA256 28d81ce3cd26e04ef0704b72d9ba0ca89a2b530dcc6d37d078fc89173b82355f
MD5 552085515867c5e4e74c6e1a716a90e9
SHA1 20472bb8c8d584c49962e341b0018bcf0ef687a6
SHA512 a3a4fc7acd89d946707f539e114658d06122580debb31bccc7b4498320dc4895497f22e9d2ced1a993bd45d3b5a79894b11a4e72dc7ede7006b5257479def3db
TLSH
T12BD09780149CAB1C08040F02B0A06AC230848C3B1074AC109A5105B8DDF8FE841A1A06
MD5 SHA1 SHA512 TLSH

Submit Download

e97eb284-e1fe-489a-a9b9-08808536a2ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\e97eb284-e1fe-489a-a9b9-08808536a2ef
Size 2KB
SHA256 36f54cd860f77cf46061385a095101680c9915580dc5a20264888d2784934c1c
MD5 0021ae1f2135df418fc233387b80a672
SHA1 ebe5ab738f16a1edf76d5dc5b73b8897b11f71c5
SHA512 29eac900e044383c41edfd7bac68b117b39122cc0b2900599b40710a475f1c4df2cfaa03e3b0f2132156c38a8f4b0ba77810495d99671e13d53797505c39fc2b
TLSH
T13341331C75784D7B8CCAF24D9482328F57608A1380C71D532E65CF0CCDDA6AD776A42E
MD5 SHA1 SHA512 TLSH

Submit Download

ed204e9f-a818-446f-86f8-46d9dbdc5d44

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\ed204e9f-a818-446f-86f8-46d9dbdc5d44
Size 883B
SHA256 f57ceabc6afe7ae0d7efd55cc82bf8c913a5074c832333fc517a4ff6b8846e7c
MD5 d4170758f4964d74d887d23877afd507
SHA1 06ad11567c60befa63ae693d8e898e70d2cee849
SHA512 f2d531c338c0dd785e0f931225534e4d69960e91f8483907430540a4a487694bd7981d428c7ee181bdaf619db2ce5104125f9d906fd60dcb56941a8c137ecb64
TLSH
T12711C081D63179F6CDBCD34BC9963B029AE47513C0CB48243EB59A144E7F51EA3AA70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\extensions.json
Size 16KB
SHA256 1b3f5e9c3a2d69b90c05d7700105ce7ddd39f8ecbfab577e0b4980c9d8544aa9
MD5 9d6137d3b7f94d4fd04d6cedb0e3ab89
SHA1 3123ae59261970bb87f95ce38319f23933630626
SHA512 29c7c5526e3ffe23c7eadedbce1cb2c9fb4977383fdd24c1690ce02ccf82fee00ab2ecf8f508305c0fcbf83aa99ca4530f8a5d20e75bf09e96b23dd5c2550070
SSDEEP 384:FkI4vXUmldvq8dhWD94zT196oIL4H7L4PAL4HgL4HHL4HfWvv4hRc:WI4vRfvXC476d4H4q4i4L4/g4E
TLSH
T1D872311545049EB8298FA79AAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs-1.js
Size 7KB
SHA256 72b54912216bf127c508ce1866b84f7503bb646539c4d5ade6b3ddc3d602484b
MD5 613bfcbda98f797e6a541203d26c8208
SHA1 b1b3551939b9350232608c055fcdf347ce4a1dc6
SHA512 de6cc5aa62fc40634acccb24cfe860f40c7ae1ef294a14387cdafc501911457ccb890d3ac04cb7c91cc0d30827e8d12581825cf6be7793c86e78a5110ff0e089
SSDEEP 192:xfwXkwYWCRsfpr7qGSSA8RIXTIjrw88F2JuP8:W/RIUjrwV2JuP8
TLSH
T1C2F10E3C5104CB7FA9B6776CAC2988715AA2013BB7BF68D650B944C5054CF3442FEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs-1.js
Size 6KB
SHA256 c388ade2a2bd0533777a70eae364af31cd1c2e961d83d6ca2792daef6408dc98
MD5 de6ab64b3f96d413fad73cde43c5ecd4
SHA1 6112e8c702877784b3903781e501607723b69f4e
SHA512 9c5408ebc62fb6be5daa56cb07dec4495d99d838f30b8583468ea989fca9490d7f72a972e5bbea4b3c4f8702851220620d18ac8bf289a9159484111d3366d461
SSDEEP 96:xHvUTUpPqGqsf0r7ObzSgGSSlldv9jMnBRHFIGVkSw88H8L4cnLTU+:xZCRsf0r7qGSSA9FIjSw88E
TLSH
T11CE12F7895088B7FA4B6776C6C688C716AB2013BB7BF68D750B944C4015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs.js
Size 6KB
SHA256 12c084bdd76a63458a620cf3318088e9453ebf63972c6d9eefdf9beb6b09756c
MD5 1852d2ce2428285484c6a7679b50d60c
SHA1 19a5d1574c2329ce3b83b5d9913ec66bc82407bd
SHA512 8afd781973f06e0b5a9c00d2e0863f2358084449a10785940927f565e1fe9e5d1072ce65ce08ebc73d67145e797b9632e2e0801e70fab275dda9b6ee8679686f
SSDEEP 96:xHvUTU2qGqsf0KjJnj01zSLXGSSlldv9j8nBRHFIGVkSw88H8L4cnLTU+:xxRsf06ocXGSSQ9FIjSw88E
TLSH
T107E1107895088B7FB4B677AC6C6888316AB2013BB7BF68D750B954C5011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs.js
Size 6KB
SHA256 7d90da850b1dd228f52a3eee642240845312f4a8643dce7f45d42a63df1cf4a7
MD5 9b764fc9a15ddb7eee6bebf2bbb6ce11
SHA1 276d11b46470b3c9d94f3829b5d48549aed86bbc
SHA512 19c42d1c3e98b67d6ddedc3255e8824097c18b178e5b15fa623e1b949a706b49f7354fde9df7858158e717eeb2e661aeac848dcaaef393fc807ddc4300df1fcc
SSDEEP 96:xHvUTU2qGqsf0r71zSgGSSlldv9j8nBRHFIGVkSw88H8L4cnLTU+:xxRsf0r73GSSQ9FIjSw88E
TLSH
T18AE12F7895088B7FB4B677AC6C688C716AB2013B77BF68D710B54485015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.4MB
SHA256 bb641ae2382364ebea2d863a3aff3f09e2e6e16e06c59ffa0996d98f7ac09e18
MD5 e1406f7e3af0c88bb5d4d1c9a4e026d6
SHA1 904110409b2e8d73853cd189564cc289878c36d7
SHA512 ce1ee4663e2e41e3235771d15acb9fedc838f57618b985ecac084b7472d31bd4758434cfcaed70f87f42eee2495384b083eda8324d75370d4fe1c2a5bd2ea640
SSDEEP 49152:N/67nCqoQTTg7hWCZ4+aLOlSYmJa8cgo+MB:569TTMhWCZ4+aa0U82
TLSH
T1BF263BF424D1A353F34080737589A3EF11AFD00C607789445B9D66F9A5B8CEF9E0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download