e128585991e6d74dc1b71c1fc4d6ad1158d9ee8055b5eb90f91da737bf7c7455

Analysis

user interaction
yes
max time kernel
520s
max time network
517s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TermixPS-main/INSTALAR.bat
Size 1KB
Sample260506-apf2dacy3k
SHA256 e128585991e6d74dc1b71c1fc4d6ad1158d9ee8055b5eb90f91da737bf7c7455
MD5 19f01c4faf66a5796e8f44fe92eaba84
SHA1 4e4705acb3999c7e99da553b9629c459d38208fa
SHA512 3021b1195b676313faaf7fc6ca9c09469d8b3884112e8ba0a6f4b60553d3bcc9183d8b135c6e25155f2bab7f3cc7e980187e5a4a76a66f9e1368b31fc9cbee3d
TLSH
T15131F0063C5E6752269EDE6994B28E03F50A418FD21CACDDF0A182C41E343C0CCEE359
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5104	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5384	chrome.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225006972360288"	chrome.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TermixPS-main.7z:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5104	powershell.exe
5104	powershell.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5312	chrome.exe
5312	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1176	OpenWith.exe
3840	OpenWith.exe
4972	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe
Token: SeCreatePagefilePrivilege	5584	chrome.exe
Token: SeShutdownPrivilege	5584	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe
5584	chrome.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
1176	OpenWith.exe
3840	OpenWith.exe
5776	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
4972	OpenWith.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3200	2256	cmd.exe	80
PID 2256 wrote to memory of 4928	2256	cmd.exe	81
PID 4928 wrote to memory of 5872	4928	net.exe	82
PID 2256 wrote to memory of 4876	2256	cmd.exe	83
PID 2256 wrote to memory of 5104	2256	cmd.exe	84
PID 5584 wrote to memory of 1636	5584	chrome.exe	88
PID 5584 wrote to memory of 3708	5584	chrome.exe	89
PID 5584 wrote to memory of 3708	5584	chrome.exe	89
PID 5584 wrote to memory of 5384	5584	chrome.exe	90
PID 5584 wrote to memory of 1964	5584	chrome.exe	91
PID 5584 wrote to memory of 1964	5584	chrome.exe	91
PID 5584 wrote to memory of 3368	5584	chrome.exe	92
PID 5584 wrote to memory of 3368	5584	chrome.exe	92
PID 5584 wrote to memory of 5832	5584	chrome.exe	93
PID 5584 wrote to memory of 5832	5584	chrome.exe	93
PID 5584 wrote to memory of 1216	5584	chrome.exe	94
PID 5584 wrote to memory of 1216	5584	chrome.exe	94
PID 5584 wrote to memory of 5756	5584	chrome.exe	97
PID 5584 wrote to memory of 5756	5584	chrome.exe	97
PID 5584 wrote to memory of 5440	5584	chrome.exe	98
PID 5584 wrote to memory of 1020	5584	chrome.exe	100
PID 5584 wrote to memory of 752	5584	chrome.exe	101
PID 5584 wrote to memory of 5524	5584	chrome.exe	102
PID 5584 wrote to memory of 568	5584	chrome.exe	103
PID 5584 wrote to memory of 568	5584	chrome.exe	103
PID 5584 wrote to memory of 4568	5584	chrome.exe	104
PID 5584 wrote to memory of 4568	5584	chrome.exe	104
PID 5584 wrote to memory of 5312	5584	chrome.exe	105
PID 5584 wrote to memory of 2260	5584	chrome.exe	106
PID 5584 wrote to memory of 2260	5584	chrome.exe	106
PID 5584 wrote to memory of 4196	5584	chrome.exe	107
PID 5584 wrote to memory of 4196	5584	chrome.exe	107
PID 5584 wrote to memory of 3232	5584	chrome.exe	108
PID 5584 wrote to memory of 3232	5584	chrome.exe	108
PID 5584 wrote to memory of 5448	5584	chrome.exe	109
PID 5584 wrote to memory of 5448	5584	chrome.exe	109
PID 5584 wrote to memory of 4896	5584	chrome.exe	110
PID 5584 wrote to memory of 4896	5584	chrome.exe	110
PID 5584 wrote to memory of 5296	5584	chrome.exe	111
PID 5584 wrote to memory of 5296	5584	chrome.exe	111
PID 5584 wrote to memory of 4148	5584	chrome.exe	112
PID 5584 wrote to memory of 776	5584	chrome.exe	114
PID 5584 wrote to memory of 776	5584	chrome.exe	114
PID 4972 wrote to memory of 5244	4972	OpenWith.exe	119
PID 5244 wrote to memory of 6052	5244	firefox.exe	120
PID 5244 wrote to memory of 6052	5244	firefox.exe	120
PID 6052 wrote to memory of 1272	6052	firefox.exe	122
PID 6052 wrote to memory of 1272	6052	firefox.exe	122
PID 6052 wrote to memory of 1272	6052	firefox.exe	122
PID 6052 wrote to memory of 236	6052	firefox.exe	123
PID 6052 wrote to memory of 236	6052	firefox.exe	123
PID 6052 wrote to memory of 236	6052	firefox.exe	123
PID 6052 wrote to memory of 236	6052	firefox.exe	123
PID 6052 wrote to memory of 4336	6052	firefox.exe	124
PID 6052 wrote to memory of 4336	6052	firefox.exe	124
PID 6052 wrote to memory of 4336	6052	firefox.exe	124
PID 6052 wrote to memory of 4336	6052	firefox.exe	124
PID 6052 wrote to memory of 4576	6052	firefox.exe	125
PID 6052 wrote to memory of 4576	6052	firefox.exe	125
PID 6052 wrote to memory of 4576	6052	firefox.exe	125
PID 6052 wrote to memory of 5156	6052	firefox.exe	126
PID 6052 wrote to memory of 5156	6052	firefox.exe	126
PID 6052 wrote to memory of 5156	6052	firefox.exe	126
PID 6052 wrote to memory of 5156	6052	firefox.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TermixPS-main\INSTALAR.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3200
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5872
- C:\Windows\system32\where.exe
  where pwsh
  2⤵
  PID:4876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoLogo -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\TermixPS-main\setup_terminal.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbab23c728,0x7ffbab23c734,0x7ffbab23c740
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,16424634155731833406,11269884365967654100,262144 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,4928446559062095800,5950531968653333928,524288 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,4189334094373930476,17098339328730836025,524288 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,941125035036564893,2288959734655090298,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,3493249924755106016,16637753686350515995,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,7791333366407805919,1734147626254473577,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4232 /prefetch:9
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4596,i,14021496092176966255,6090972816386202243,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,2531980755885905315,1787914175781061735,524288 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,12156102904467369536,6616331564899104570,524288 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,8184571014434086579,3831693467801421927,524288 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,7140496631445998613,10808499255846909203,524288 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5416,i,14877529874525928619,8613831136456477873,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3456,i,1484601221140916711,18037884118576065469,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5772,i,1917838293605003783,13656508042186002333,262144 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5780 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5824,i,13321457468599441855,7828313969694014712,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5944,i,14608340414471110794,597279259579110783,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5692,i,2578279607031733233,13523791041724995235,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5952,i,1526117212462047303,14379272758394564686,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3608,i,4400994547979116477,14313747147028302693,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3668,i,1099814193654364853,294061486252345552,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,5493951815924998293,949704552768219742,524288 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3696,i,4205506992539751657,13031069302479677663,524288 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4244,i,4615998755788167952,10132370486835769490,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6408,i,2658103589292112270,11758201820330938302,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6728,i,3705229618308107381,866420146357495141,2097152 --field-trial-handle=2020,i,8727971363552726078,8055316832539052719,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:1780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\TermixPS-main\TermixPS-main.7z"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\TermixPS-main\TermixPS-main.7z
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {4088c0e9-cc03-4350-b7dd-34913114ecef} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {71eb04f2-8318-442d-aeee-d3222ff632db} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3672 -prefsLen 27274 -prefMapHandle 3676 -prefMapSize 270279 -jsInitHandle 3680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3688 -initialChannelId {5b87bfe7-8f79-448d-a6b5-9c920ec516fc} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3836 -prefsLen 27274 -prefMapHandle 3840 -prefMapSize 270279 -ipcHandle 3908 -initialChannelId {01be9431-6979-4340-b2c9-221330efb43c} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4296 -prefsLen 34773 -prefMapHandle 4300 -prefMapSize 270279 -jsInitHandle 4304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4312 -initialChannelId {b02e286e-c1c7-4f57-9121-9c47ad4e3b91} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2688 -prefsLen 34929 -prefMapHandle 5068 -prefMapSize 270279 -ipcHandle 5076 -initialChannelId {6f6929e8-912f-41f8-aafa-7e6738fe7d3b} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3184 -prefsLen 32952 -prefMapHandle 4996 -prefMapSize 270279 -jsInitHandle 5004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3304 -initialChannelId {7b17c2a7-e883-49fa-9148-06564e1f1ae6} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32952 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {25184085-efe4-4a28-8fce-f1d979cf4415} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {b6f2d4ad-a5f1-4b7d-8212-5f49d1cf52b2} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6180 -prefsLen 35062 -prefMapHandle 1376 -prefMapSize 270279 -jsInitHandle 3096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3136 -initialChannelId {69707298-4eee-45ab-b2dc-62674bf92a9b} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:6012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6084 -prefsLen 33071 -prefMapHandle 6164 -prefMapSize 270279 -jsInitHandle 6168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {7ffda0b7-0754-4418-8a9d-8019a34c4591} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:5512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\TermixPS-main\TermixPS-main.7z"
1⤵
PID:2036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\TermixPS-main\TermixPS-main.7z
  2⤵
  - Checks processor information in registry
  PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6694594692a2a5e0731107f3616f25c3c57197ecfe2bf432f5c7a14fa69ec119
MD5 58116a966e3131acc46f06c787f901ab
SHA1 6b1934fb573d71123e7f8c95ffa11e401e0401c7
SHA512 5db097fcf06dd644e802e2135b194fd150c51f10df895ac68423dacf8495d988afd229e94db9619a3b81db59a108392b03295877015fb3748a452e0730b43671
TLSH
T13CE02BA6CF65E8370CFC0F2920400741E75907572B40890F773D460E8FB1A3A464981C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 67KB
SHA256 50f31d19b1aa0b5ef65e000533d4dbabb9907befa07b6f0ebfbb11d2597c8b83
MD5 df1ca1e1cb004574d666faebe5a13445
SHA1 1d6395dfab6df8ad8e1bad4174bebc7d4c28d8d4
SHA512 c114db5c2a47f04b6c4da4c2e9f5a624ba6c60d879c167a1c5b4818d39b03299dd63d25eba18d8f400e8c6ebceb64a31c8fdec49310765bb399f371d6a2b77de
SSDEEP 1536:bdywojyhnRExdFcIdsDzFgr2F066INt7VdzQSDantp:bOMnRExdCIds/Fgr2O2Zc4antp
TLSH
T10663012B9A0161FBAC35C4FFD6DAC47A9605C78E3D6844FE46C0144E27B5B8E6BC034A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 363KB
SHA256 5ac6c3c8c9045405f3a89ef0e0c80536a989becb552e97bcb94a80cdf090f0a4
MD5 f007441abab99e3a21d27dc2d28060cd
SHA1 c35c3f7bc29f579b8fef5bca815d8166f25fe620
SHA512 e425a78e7b98639ce278743929745392f47677447fb862d7dca3a9a141ec7795e4a26a23af660f868c400c0f309588e681272c0a437f3fc089944d5affa90f09
SSDEEP 6144:qaBl1GmDy/PFE4focYk1uyBbZ/zf1HV40+0/OuS8c9EznEmePW9OVBfJ8E/DxMI6:qaBLGIULocL1uyBb9BW90mGoErMGObJ6
TLSH
T1958423F5E4B83899198D4DB762DC5A4483D38BB20D63B1A89FC2483E4F40E476A1B4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 114KB
SHA256 17a7ce0099129050b7ba353d64df23b7f4dbf206f34aa197564bcb31181044d1
MD5 b1b1d781a25b374edcc8588bea685994
SHA1 e7b2f4b4973db5172a4dbca8cb4b106e9c7d29c9
SHA512 455d03a2b2408e51b76094ccf06ac650d3dfd3c96a714383f9253258b5808d0428aa0740f9e058a0b0ef6c60ed84345427aab5506543f2253453ebe4b0a027be
SSDEEP 3072:ZnrS1YM2S/YJF+JBCxfqsZIDBn9AXkeb/GIpjd:HMRYswqtskeKIf
TLSH
T1E3B3F18699ABFC50FC1E1A38981F8E277C34042C866C1675E13EA3944EF7DC3159576E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 05050c63851267fa611c6a7e94b06950fc1d5604a5defce79560e7b76645f072
MD5 0e22d23a41128003753015495d6e3053
SHA1 65e9d3ab9d7873d4b2c33608649091b602b83471
SHA512 174e95509e1e4dd524a0a64c15718571dc58d2afce40ed26416dd4eb42eec6c2809ddb5a176c08fa6ea270b34557082b6fdbb429e56b453cc6b648dd357d7942
TLSH
T176F027E7B1B50867CFA7397043D90E607519A5678B374A1EC26EFA5821066B02123157
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 6c7f0d384ef60440bbc679ac2a0e88980c34339dc16f6fccdf1c1ac3db66a247
MD5 6e92ed9359de2494c49064f1744ffa42
SHA1 dc788f8ea3789816055c77e2108b0b08dd2857a5
SHA512 8ec7b38f7fab87695a6274a731aa10fa0cba047e4766944476f4571f2f1a7e878c52ce5ea332959189ae0f314069348800dd257127eac1b3b1f959efe229a2a2
TLSH
T1A7C09261B3C20236CFA026B02AE79C803624D83949661196C6C732C878A92B5A523B80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 a817b2dc1abd07c31aca5944e7d624b4174353293653fbb2d3ac60f1f8a3f4e4
MD5 520fd07846c758023859f105c53c47c8
SHA1 b79a8043a2e6544ff9dc7c95e6b9726bd84ef973
SHA512 68a237fa72d188bf8a58808f72f8b5fa96f2ccdb828810deaafae81d8236896c71ea3d93f9cdc88141b5b535a237d3509a1952605b265b6e5ed2c9e045f0ae9b
TLSH
T1C31168EB71BD0467CFA33E3133DA0D547A3594AB47734E7AD22AEA341AC23701162193
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 53d068847703ae614da3469a81a706dd930ca8f0211041fab77cca4fc826fbea
MD5 5d1f270f227728a1b736ef0494082ec7
SHA1 6c0908eedf27c143c9797f32d3005aa34e8fde86
SHA512 2eecdddc4d0d2728d52678a5e560348d250ba9ca35f03ad5a0b989854996cd68149e5030934a943f66a1a4e56105a38c04531bc0e6ae955e9f3e40444588ef44
TLSH
T1C2717DF7C3E4C66D861196F4AB156E1FCD6D0914031C3C66C9E4AF0B53E6972E20039E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b2bd0343913a6139b874b3f21d72f5e183c03f7ed7fc2fbd9fa46d166cb5617b
MD5 fc5b5c9e7dce11994c4c4e5fbdf4e5d1
SHA1 f9fe05ee4e069ace62796366d57242bd7ef24b16
SHA512 0636491ed1e190b7138333158c543d1bc9358e6ea255c24985449071e0332d8520388848492285e8dd18c6576be9857630abf153230f3313a8d9745d4d2d67a5
SSDEEP 192:D0xwuWtxDesJ5JNJtEaIaxHtCkZqVX9e8JebPDS1IPKHHf0EPVb5jh/2UWD7YNPj:D0xwuWtxDesJnNJtEaIaxHtCkZqVX9es
TLSH
T1C5129CF7C3E8866DC91152F5AB157E1FCE2D0918432C3C6A88E5AF4B97E2472D24168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 12d86ea074752c5ad8e8620e5d77c1f6c03faa6ed7353a53d4f8b70892f78f7e
MD5 74bd9779beba1d312a73468e596d2845
SHA1 9ea4fb0272b7f0d92cc18056babb1d158ccd9eff
SHA512 6c5668041b2edf6e32e073da19f668bb450c2e7662bf38bb1aec8b5b2af3bb09fcc6a2c16d42cd0667c4aaa824a3f6ac1fed6c3d06edfc1fa89d666ac354f2cf
SSDEEP 48:YALlq9qYhqh3hthFhohd7aXYfo7zskgmzsYfsuoswKsMqzsu+s0tsB/sdcsQBsH3:DWxoJjTSX7aIaxvfgqOOC8UQVXJANVfu
TLSH
T1C3C16CF7C3D8866D851156F4AB156F1ECE2D0A18432C3C66C8E4AF4B93E2872E21539E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 70466b3cf83c589caa037615cb8cf85a3e80e75ec397eb072e5e8c41b850c565
MD5 dc3d77fcfc6f10820a17eb0cafcfa366
SHA1 1015a9859f39be66c90241c58745295d64d965fd
SHA512 b7c2052efe3b9b255d981e96ab8adf9f747c38a7e4fbc9dfd58c1414b1d3aad7ee1d95c687aabe4baae22fa60c5638c659c83755d8c4b769ad80044ee8b81c8b
SSDEEP 192:DWxoJjTSXHDesJ5JNRaIaxHUC8UQVXYuC1fYe8JebPDSqbIPKHHf0EPVbdn:DWxoJjTSXHDesJnNRaIaxHUC8UQVXYuE
TLSH
T1DD128BF7C3E8866DC91152F5AB157E1FCE2D1918432C3C5A88E5AF4B97E24B2D20168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5947b67925f499e3e4a6043c75137453049d28cf20fd97c679dc77c2d1a93f9d
MD5 cc6d5f7caa8e3d9ff8c68782afca995b
SHA1 77bc85e22269d8d593277882d75f4e837c7bce8f
SHA512 0b941c7896381c2eec8e98f1a7a1318cf773125d92e5ee47868e8b93c87c14ac855ddab462f79b5c5353930aeae93db3838a0147ccbb8447f125238de677e626
SSDEEP 192:URCRAISJSa0pmJHv7gpAPRp2B99Hsb+WNnG90x+JXMkwUsqaplhVyIsnAUgtaJ:URCRAISEFaPsUXq/ww08Jc0japlH8
TLSH
T11342D72EAD14753B9CDBC219FE21B653E7F5102261842E88EBFC8A1C18DB5CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6544d267a96207deb647155419b18099ba60c8a748c2f4d647a315f76dbcfae7
MD5 77d193202d14e80ebbf8da8d66e9f541
SHA1 9bd2606c9056b71aa9ffff11a37a5c1efde41246
SHA512 3c965c8a9c1ceaf0b1acc9c50ee196356a34829d2bd9659268a147ff909d81379cd9058e6f3abda89d30e00e5ea2164552c79dcab87b6eda48fa9a3ea1aa6461
SSDEEP 384:URCNmzAISEFaPswXmp/wIgqeYJc0jaulHe:3NmzAISEUkb/wbXul+
TLSH
T15562D62EA914793BACDBC619FD15B717E3F5102261942E88E7FC8A1C09E7ACD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 62977efe417a2e3369ed8995a2fede2eda1bd587617f52e090bf1ba25e26891b
MD5 8b9f096f746eccbbb0f4388e241bb616
SHA1 0eb8bfe99660c8e638d4d4f6611f659abd888200
SHA512 9220f0ad8b6c2ca0f7bd21edc8ca0dda05f96e61d8e8483f0f3c8dfdb54294506579c214db1555a2a696485c520cfafc6ec7b81bb35d78121ca31ddfd3a3ebd3
SSDEEP 384:pRCNmzAIi4yFxss1XmU/wIpW9AIe4Jc0jaulH9:eNmzAIi4y3Z//wY3uld
TLSH
T16F62B52EA914793B9CEBC619FD11B717E3F55022A5C41E88A7FC8A1C14E79CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5977e46d4106d1a61c4257e06cd1fad1e6a4d51016d9a93c8c4e32e53cc87fa4
MD5 435b0f3d306fc9886d5a312fe18c6d6f
SHA1 ef215e4a28e055ac355937466e4097c09da0048a
SHA512 1fc5f3126c94248c0e636b0c2f7807026ab4a167d9a18e470e7ad076a0384693d86644711b42a3af5d3855884944832e1568cdcbb48b5a6c3ef9ef76a77a2605
SSDEEP 384:4RCNmzAIi4yFYMs1XmU/wIpW9AIe4Jc0jaulH9:TNmzAIi4ya5//wY3uld
TLSH
T1B162C52EA914753B9CEBC619FD15B717E3F5102265C41E88ABFC8A1C18E79CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cf9c5acfe444363fd5a56fd8d8ee0644370b089aaacd1c1c1f418fe972c4e3ac
MD5 8368fd9c350b7f1b7b7ab6e7c2b069f3
SHA1 e404981eb66ebb9a9b9d6a084638521917ab4ddb
SHA512 7783a30a4739d8f5dfd11ad0aae0da5f15c6cfe22f23c376254de41363254721a67c6f726a90080b893e65fdbd815da2b83f4d9b13d42e275fef43f268a1070e
SSDEEP 384:pRCNmzAIi4yFzss1XmU/wIpW9AIe4Jc0jaulH9:eNmzAIi4yhZ//wY3uld
TLSH
T1AC62B52EA914793B9CEBC619FD11B717E3F55022A5C41E88A7FC8A1C14E79CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 59b5ddfe79cb5f1935cc3c3d0eb70a448c04817f4706b51b8341a68ca203042f
MD5 1c188fb4632258bedced681989d2a151
SHA1 bb608118ec712e7a16a91df2e00970114e2045b5
SHA512 15bff79b590fc895ca41adfb58981c4af6c96e39d57317c8b352d2cfb8c09720d442d1759ff46949e932dd6cf9a12bf54969d199e71e7392dc31469896b41638
SSDEEP 384:pRCNmzAIi4yFVVs1XmU/wIpW9AIe4Jc0jaulH9:eNmzAIi4yve//wY3uld
TLSH
T1B662B42EA914793B9CEBC619FD12B717E3F5502265C41E88ABFC8A1C18E79CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1019633528eb92bc504908b69b620225d98c1ff177b17a55ad6d8f73f4710da4
MD5 91d1476f1f2242c4466b9ade83185c33
SHA1 f18eeaa11807e07db272008ef170309dc5838738
SHA512 3a86df076323f61ab0f0b17073b39cdbe74571c9db0f5becab348745cc4918b1685bad478568b3b8cee5e982429996a9541538a565d4f8c88531e01923ec4700
SSDEEP 192:URCRAISJSa0pmJ7v7gpAPRp2B99Hsb+WNnG90r+JXMkwUsqaElhVyIsnAUgraJ:URCRAISEFaDsUXq/ww0CJc0jaElHe
TLSH
T1A842D62EAD14753BACDBD619FE21B613E7F5102261842E88EBFC8A1C19E75CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7349ebe1133df7544f722b1793fa15b0237d64f747d8b50b51cfb2fc9478e990
MD5 be880132ba3921f56b615a0a0e56444b
SHA1 638815b50d0c874349f380e99f1f629ccfed896f
SHA512 a08ad24dfb7e47750c8ac59a7905e9946a3bee0609ac0d0f9b63f50d6347ab84fcabfbf75abffcf35d0c9339ca34f84273031b78a139ee774f9966cf040fd0c7
SSDEEP 192:URCRAISJSa0pm7apv7ghYPRpiz699Hsb+WNnG94gP2S+JXMkwUsqaulhVyIsnAUp:URCRAISEFawswX7/wwr2dJc0jaulHe
TLSH
T18D52C62EAC14793B6CDBD619FD11BB17E3F5102261942E88A7FC8A1C19E79CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c96758a9274e83cf93b00438014fef341f50b9e513d53751f26662e6173b86eb
MD5 fdce2cb8a97ebf98dc9ffa8cd0432fee
SHA1 90de27b5afb8334437af0a9925a91234b7817ffe
SHA512 1ffa509ca2f5d61608958bcc62cdaac9605f6f634379da201753a21265057fdcead250259953a5442ab300a92b92b1b33af67d8355ea35c2f4a0eadffebb9f9f
SSDEEP 192:URCRAISJSa0pm7lv7ghAPRp2B99Hsb+WNnG90r+JXMkwUsqaElhVyIsnAUgraJ:URCRAISEFaVs8Xq/ww0CJc0jaElHe
TLSH
T12F42E62EAD14753BACDBD619FE12B613E7F5102261842E88EBFC8A1C19E75CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 082ad7c4c2f4d814476d2d7ef51e8bbeea17fe065b9cdeb1a52ea1e9c875f0b3
MD5 2525171bd099464e5f915a509cb3a9cd
SHA1 e1e2199244032a49dcce77c33f0add37f6abe740
SHA512 eba50cae85a109b11efbfb09c702dc3d5f7cf3a7fb2aefbc3d4d60c4cb93aeef17e7ba92ab0a45f2fbcda7b4c27802fbc80e68f532ec147cbcb5ace902c6715a
SSDEEP 384:pRCNmzAISEFzss1XmU/wIpW9AIe4Jc0jaulHe:eNmzAISEhZ//wY3ul+
TLSH
T18A62D62EA914793B9CEBC619FD15B717E3F5502261D42E88ABFC8A1C08E76CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f177e6ef0158b5fbcbeaec58b7798f2cd026d8e37e47fc94be70a62bfe909f3b
MD5 f1249cafb2568b41923d7cc91c294668
SHA1 68fa462e8727ad1ef776d0c58781b26fbc5026c6
SHA512 a5761e9b9be6b958bdaf9d87567acf73a77c4442dbb0ffcc95c95f97ddf4878eb1dab8769a751c137ae312b2033ab2d5fac2294c3bcc8ba0b633b0713dafacb0
SSDEEP 384:4RCNmzAIi4yFjss8Xme/wI42YEUJc0jaulH9:TNmzAIi4ytZQ/wYruld
TLSH
T1A662B52EA914793B9CEBC619FD12B717E3F5102265C41E88ABFC8A1C19E79CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 12d201488e5b5429e365c6b81a84c45a6625da5fe9f80d6addb6b3b7ff788328
MD5 1ae985590fa8e0db2dd8756a71526327
SHA1 03578e0203da9b1a3ac2a54c90654ef7b24cea00
SHA512 fa331698bdb4b19f1c3b216576ef82010ddc3093b65c0566b5e9875a60898dfb07247cc3d7b83d84f33fc27ac0f2e8afc3b102789a2cc24f1a9c439b5f5a893f
SSDEEP 384:4RCNmzAIi4yFDMs8XmU/wItrIe7Jc0jaulH9:TNmzAIi4yt5q/waYuld
TLSH
T12962C52EA914753B9CEBC619FD12B717E3F5102265C41E88A7FC8A1C19E79CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cd6c8dac162bd4f3380f2bdd0d376de45eda6a229edc34ba3b875c2f6252ac67
MD5 17ec11cddc4c5dcf1333873ec0657119
SHA1 bbfa8356d97661b6a318fc29e38482b6d35a98de
SHA512 b92b9149f58794c0dc6044972498115b91aeae5745b7d927569baa9fe9e3358bd2bdbfe4af310cfae7e94df1c98dbaa3d0e159f4481081b556ddea366add4450
SSDEEP 384:pRCNmzAISEFCVs1Xmp/wIpW9EweseJc0jaulHe:eNmzAISEoe6/wQ2ul+
TLSH
T14462C52EA914793F9CEBC619FD15B717E3F5502261841E88ABFC8A1C18E7ACD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 22696f37fbdca04b1291b49e815c50e635b07d6fe20102780271650ebaed2232
MD5 168733ff35c3faa0cb8c216fe1aa6ef2
SHA1 e7940789802f57ec72b4106d109a103f3775b915
SHA512 82e9d5d1f44b369d9fd72eae1de333ba075de10ae1dab45a498c9872b9f7d20b6c517f45a749cd9e0914c7606a1ef79fb0052fde73d5044749d23e99c3a55074
SSDEEP 384:pRC2mzAIiEFzss1XmU/wIpW9AIe4Jc0jaulHe:e2mzAIiEhZ//wY3ul+
TLSH
T1A462D62EA914793B9CDBC619FD15B717E3F5502261C41E88A7FC8A1C18E76CD7227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82085f58435b7b7a260780dca3ee69a48427de11b3ece82d53af0d56f36fd555
MD5 92547e8f34c99d1b69c0e1d957604d80
SHA1 4ca5a2d93853b96b7fc565a0e16045bbcee47e58
SHA512 aee9857bb3f81b98b9310e49ebca2773ad80f91201f0efac2260b404123571baef569acba1d144b7aa20664020dd07820f3547f4604d3bc6c7d155025f48eb07
SSDEEP 384:V3jBM7KxkXqKf/pUZNCgVLH2HfgslQwl7pLuLcifTuXODBU+ErU3bwxHGak5Je0o:VTBM7KxkXqKf/pUZNCgVLH2Hfgsi87pL
TLSH
T1DE72FA67AC4CAA370F94D6CCD827BE4FADB5020B65DD886883FA581903D5ADF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f4a8be983ed1688cdde1a1a8bcc69dd23a20a307d3a587549aedd5f43e6afa2f
MD5 d4e4148b30eb4772551f1c6f56607038
SHA1 4a84d68cc5b289ca28a55f086ddd73967420cadf
SHA512 1f21a9fb41fbd23f54d1990b8a75ef8ac385e32089f68954de9290e983773e88e117afd3616411c755e45fce3f4ca59535c5f9f4a5850071f9462b272b561fe4
TLSH
T199B0125080815521C49302F4118308883528AF208B055B05D3E46D71D8261A0421C550
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 e09135cc94e970c88ec6bce68e8edcc6507f4e07fec8f6511656b1b11b727329
MD5 b8ffb35b86eea3f4e75b81147aba8c00
SHA1 02cf59034a63c5c27bc00388cfbfd55c9c51da42
SHA512 67fa611ae971f0812a497cb7a44349632201a40c6b168ca3c0242144af4baabe33ba64e3e1d0d7009e091fb6c021f96ade4fc5a73df48417c03efd06bfd79b52
TLSH
T18EC0126BC1056103C00613F525C688EE3218AF34DF17179D96E01A659C393604026151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c634.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c634.TMP
Size 120B
SHA256 453ad642a50b88940ba830816cc07daf000805e68a5184b7fc7f09a039caab8c
MD5 5548fdd379bada6ce88bc46f18e44a24
SHA1 0038690163244400553055e60f01ec9787f8a764
SHA512 33924cbb400153e10e77cccac0ed263d0f615ef28eb29611cc80e0b0b73a48facc0ec45d2c801d222b4875a2557f0e61a1d1b2ed5724cfe55cfed734cb6d6bf7
TLSH
T10CB01293C441A211C40103B41D91C8CC3004FF10C6030217B1E04702A8355501215050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 cdd6de009e99ae5c2b8deb3997a0d2ea587005d03675c8a31170327de8704a54
MD5 bdf8350c72a58ece6885ea27ce8e2501
SHA1 21b1cf893b92570e8f29c0458cf8f95f70f3c246
SHA512 a069474c0ec11b46aeff6f08d218ea3253c52664d905404e1f396e94fd59388c1bb153ca8a6290e4106d66699364afdb8ace1a08d9176839d96d48c3c8679f05
TLSH
T1DDA0026187538203C102637210C107417351581142835603D8D80BA8E864D64CBB2081
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 4b636b537f159221e08c0b280b858d609c09241c7f5b45c653ad17981d5d3841
MD5 813b97df26fe61648dbedc7670c384c3
SHA1 3c6642c099362d4f16346a9528bdd2560de96306
SHA512 97f7ef5d71d5ec65b7a0f0f461cea8dc5695757639341c5d3badaa9a38fb89241d39b7fe59c1086cde1380c1de51f7edb4acfee34e15b435538b86d7e632d51c
TLSH
T17DB022A0AC082203C002B3BA22C20E00BF203C3003830003F8C203A88000E2CC0F0003
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 328c0a6057ff3e96feafa25ddbdc706337036e94d77e2b68e8fe34bbdaed14f3
MD5 b5d7f0e6c3baed4f26975fd9c96d521a
SHA1 d7da1fb8b65d6f577730381f4ecde20c8483acbb
SHA512 73002d67e91453f2ca0e07ec1a273b1f37228166eb665b21afc90e9a864eea7e16138103491025f5a0c3c4eea79be004e9c3f7a89da47570d875094600e67297
SSDEEP 6144:wjoJvCWNLAKFzvASF8XOy++JjcMW2VcVLjd:4oJKtK17FzsOMWtd
TLSH
T1ED1412B4A92E7D766689D285A81FAF5C0EE3D88E0025D47C73424A4F1D7F3C2429BDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 ad23edcbd9d9c1df1e12b787ed463a5d2b2f96e24d393697b0055fb265936de1
MD5 ed2a9d6789dca882c095d962263b518b
SHA1 94354305c355d6ce4180de51b2cc68351f80dfd8
SHA512 04fcfda18182cebcc999f19e40121c080d4d1f0ce68304d5019ca46499829f7844826323cae4cb792f8390879404b4a1e933afaf9b8460b4494894aa24165662
SSDEEP 6144:K5joJvCWNLAKFzvASF8XOy++JjcMW2VcVLjd:yoJKtK17FzsOMWtd
TLSH
T1D31412B4A92E7C7A2A9AD285A80FAF5C0DD3D88F0815E47C73414A4F1D2F3C2865BCC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 a79161a5df7b33b9a6f88eb0ec6875ede683f61ad353b2998493d6d3d56e2554
MD5 5264fcf270eeab0ad1e899abae5b63bf
SHA1 c19bb59a790ebf3ed3aef1b5bf320c4df7be9149
SHA512 b8de1f58b8f50250db909f41d7567132cd4c8546a5705ce09963738f16063892f2ea367c11a30fe1a33b6012ec6ad3621821f7d8223db490df5dbbf7153ff937
SSDEEP 1536:ub1P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:8++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T1DF9302B9991E7D79636BC696A0079CAC8CD3CCCE111455BC30C76F1E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 dcba50ca30bb8c07a9dfd5d9f690d2ba68d684903880faa793fa0d7a0b09ec0c
MD5 0405d1fb11f889684041dc74c276f3f5
SHA1 95c45b109b4e40bb17a819d742135bd165ad63bb
SHA512 b148f2b4f3bf438d1ccdc09fa6148e26b280d69fa428ce5cad6849eb8ff90f5d4744933b935cd500869ea04d3e32e7dd86cc45dd6323025cea11646d2cc6905d
SSDEEP 6144:p5joJvCWNLAKFzvASF8XOy++JjcMW2VcVLjd:DoJKtK17FzsOMWtd
TLSH
T13C1412B4A92E7C7A6A9AD685A80FAF5C0DD3D88F0815E47C73414A4F1D2F3C2865BCC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 c18be2bd75f694c8d24b397ccf25fdd152afb9861e9dc926a2d831831803b52a
MD5 a1bbf23ff2002ed625192832efc322bc
SHA1 29b062ca913dab69bad642576ec1b2be118d007a
SHA512 a6ade779432567f4f8df2d9cfae5e46ba526fdf55c7f03591ccbd071de1d6bee2307329178d4c327bb2f0319011e37208663482b128d141527194abf86ab630a
SSDEEP 6144:djoJvCWNLAKFzvASF8XOy++JjcMW2VcVLjd:RoJKtK17FzsOMWtd
TLSH
T1B21412B4A92E7D766689D285A41FAF5C0EE3D88E0025D47C73424A4F1D7F3C2429BDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 72dea6cdbb885de74f8d08a2fe1794e1ef876e75bd7786f247d73d1e70055862
MD5 59141c72a9102c1c1ae96e0437dd7734
SHA1 527e7a0c10b7baff340c9646d140f18fe0d20134
SHA512 d89466e6bd6a6019afb357f64b3b87b8eda757792a97a2480796bcb84b295b9a87411fad6796dcb2d80657aa25c046b289669acd128088e3b27eae6bff9f74da
SSDEEP 6144:k5joJvCWNLAKFzvASF8XOy++JjcMW2VcVLjd:YoJKtK17FzsOMWtd
TLSH
T18C1412B4A92E7C7A6A9AD685A80FAF5C0DD3D88F0815E47C73414A4F1D2F3C2865BCC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 a2eff8ea50a330b6f786fa7b79e34dd5aecfc611af232b2ef516a09318882aef
MD5 faa3cff53bac28bbbf608434b345b7b6
SHA1 7b2e74891a655874df30310545cd1e17eddf9c02
SHA512 5187260645e1d49019453b0db4ba54c9eb6b64f2d4f6ae9f7c7b17656af17a1a39dc9bf387d9deb74fd6038abee65475e2b606f98146b5f4cf6cc5c5711cb418
SSDEEP 6144:F5joJvCWNLAKFzvASF8XOy++JjcMW2VcVLjd:voJKtK17FzsOMWtd
TLSH
T12E1412B4A92E7C7A2A9AD685A80FAF5C0DD3D88F0815E47C73414A4F1D2F3C2865BCC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 1a6a35fe748daed2035aac3ed0794abc8ecd40b57f2ad065d8c341ad46f0ef1c
MD5 3d462a8dccd3746fb4945187111dd23c
SHA1 97cf07acfcffce51bd0c6626b05dfdcb24122a26
SHA512 511583fde00c7f96a8cee27261ee7f26534b05f58c11f7f26e32dfb0068f38c00ff36032046417f37f79614d1f9b303e5c1169b6a510ecf72004bd69d52ea9af
SSDEEP 1536:jTrliNbebDhPFPyTDrH1AO146I3VNaxieZ7HkmVWyHi5HWK4dySZnCVrhUisSX4w:j3lX9PyTP15gYFJVWyHo2hUSZnCNa6
TLSH
T128B3AFF6DFA2893D65FFD01D6A82C83EFD266444B3A33009C963671052C5BB87679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_oeu4gnrb.vxc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oeu4gnrb.vxc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 f5033359f0e3dbe7c2e1580347d88060b5556a44defd5630f8281751d6ffdeaf
MD5 33b0074986fe5daed2f74679863b716e
SHA1 8f5c8f5e9142a27460297eeb31ee78c91fb189f6
SHA512 b83bcc359ba7700014a4c0bc5d2e97e96d4ac39e64babe225d301df6b3bc61f87ad5cc8c2e234434b66b5781ff63fd1fdc9e2e43ee879102b2423f191d99bc22
SSDEEP 384:3d66JozQzgC1jSboV4myjxHCkjAS45ZNmJiiuxJqkJVQtGcmhuO54yRZ38v5obZ8:AmQsuHEn2Gcmhuy7RZ38v5obZb+bjb/
TLSH
T185E21244EB2E913FD41912BBDC951B042F78B88A591A2FA73A4C646C6C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 288db2f1c6a02d2c98cc60e3de8d83beedc064aa6abb7c789c3142212f5c0b38
MD5 18af8ee44816d4baed5f1d73ba1e8ac2
SHA1 4c43c871d52dbfc28849019f453606c4ba8d9491
SHA512 5be472baa7e515514e52907108b9e3965e762561f318ffb1d0e0d71a9ceea3c051f8aea2f4356cace61c6ba500fba4f277e5e3e36460b7a9e04f0d63be00ed6f
SSDEEP 384:+d66JozQzgC1jvHCkjAS45ZNmJiiuxJqkJVQtGcmhuO54yRZ38v5obZb+bjbHf10:vmVHEn2Gcmhuy7RZ38v5obZb+bjb/FRq
TLSH
T10ED21144EB2E913FD41512BBDCA51B042F79B889581A2FA73A4C646C6C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\events\events
Size 1KB
SHA256 baed494fad3218ff0cb9c9f109a80f728c17495c9dba78aaa6de4f276adbfaf1
MD5 3c8bad222737a53514e83549061953a8
SHA1 1e5065aaf16b01460a2b65dde645714636a3cc49
SHA512 0d030464c9949bc59719802f25954ed72d7ac2cf12cf050d22deec371f385ae3aaa73f7ace359530fde8c6d4e1b6ec99fdb0bdb2b5bafe0c647a61313639b2f8
TLSH
T1FD217F4D39B84DAA9D8BE29CB444018E53554E0704D71D430F92DF8CCECAED5326E83C
MD5 SHA1 SHA512 TLSH

Submit Download

023d58be-7c9b-4173-a65a-7f8b77e8868c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\023d58be-7c9b-4173-a65a-7f8b77e8868c
Size 235B
SHA256 c627bc0225ef5558de0a8f9862a1e48560aca348d2eca20c69248065d47368ce
MD5 be2551db054ba6a2b7c0249339185e21
SHA1 d987637562311184b54a49e223abb53657f754a5
SHA512 6e6f59be9316db8b8bae8664dbf9c683c5bae08eca3eb1b3a8dee078aeb0b6708ae74f5babe088b563f132e550c0d7f623493a4210c1f87dd4420f34185960ff
TLSH
T125D0A7C074A86F6D4C242F47B4E06ED630854C372465A850D57185B49DBEDC98252C16
MD5 SHA1 SHA512 TLSH

Submit Download

07fb4a18-43c7-438d-b0d6-6098b47c5984

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\07fb4a18-43c7-438d-b0d6-6098b47c5984
Size 235B
SHA256 1278d9174d36cbf6b6c9e494340fc6bfbffba4aad860ea494eabec10501b8ffe
MD5 69f77b5f2016694da9a2c0ec6f960ae4
SHA1 2fd919aec2e694e8c0b4acdaa5499f2654922d72
SHA512 f3de6071598428fc0b8005f23909187c56c48379a6fe3055aafc7f1473952d2ba61eb1c7b2b7aab154857e4d6b670b4ca9b79f6ddc1800c95b0a0c04cc343282
TLSH
T1BFD09780A898AF2C08100F06F0E068D670648C3318786870C6A08738E9BAAC40161C06
MD5 SHA1 SHA512 TLSH

Submit Download

3e938f7c-466c-40d8-b7bf-c0e2468120fd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\3e938f7c-466c-40d8-b7bf-c0e2468120fd
Size 886B
SHA256 f2160720c7efc3abff48741897d576993c7c458fdca6f68bfa30fc55f9b82cdb
MD5 318d2ef8ac329ffe0438fcad689b8dfa
SHA1 c55d1deb1c27d3f039847431d3063050868c727b
SHA512 c95e38fd23339370928fb1046a8d52ea7fbe8753a53cb329b5ff1faad4d2c28ce5fb5fe2d80f8a6988a7a2e3d71c38a2122c20ab58a0c869d781093f8f43bd35
TLSH
T15211D0509634B5F28C28D28BD6D17B4247E47623C0C60D182EA45A084EAB01E977631F
MD5 SHA1 SHA512 TLSH

Submit Download

8227a955-9f11-4c03-b83c-54377e824278

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\8227a955-9f11-4c03-b83c-54377e824278
Size 871B
SHA256 ad96ef0ba180e1ac2cae9e6f3b0ca1d07529f093f08334785d03f8689d87e01e
MD5 275e1c9dbd01488334210de839208e69
SHA1 01be6613353c4ba89d5ec87543dd18e255c12a9f
SHA512 fe1119076e9cc4677df39a73d78dc1e4cb1e49d1a5449b423d22698fc5ba91106da6478c1e132c943ba93fb9dd1507cce9d6216ec816959f476b106965b8fce0
TLSH
T1811100509634B5F2CC38D38BCA91774187F87623C0CA49143EB48A084E6E11AE37A70B
MD5 SHA1 SHA512 TLSH

Submit Download

8be5bbbd-2c6c-44ac-8b08-aa070df44aa3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\8be5bbbd-2c6c-44ac-8b08-aa070df44aa3
Size 2KB
SHA256 4cf39b2e34916e9e248431d0b8ee8c86eb55c94f7aad191e4d4165562ba4f371
MD5 ea15f2e3669d5725dd968657d939d68b
SHA1 0f136cc7236ff58b3d25fae041be80f7c31b4427
SHA512 2c12118d6ca31bc96c3593f69fd3dbe022b3daa646f47cb4e9c0f7c9d73d6d27f764a052cc536de1f92f6ee2f5883f7ffb92b3e7084b302c86fa1a6abb8e359e
TLSH
T1B441345C36785CBB9CDAE29CD482374E83A04A0300C61C432E92CF0CCD866DE737E42A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 7KB
SHA256 34fea0e35d44546d41d4f83e51cf291af0d9901c7b26f7d5565c7d66da95701b
MD5 df009deadf564b4fab370abc8a56b898
SHA1 29ec8a8f568dac4a8a4b1a4e706af5c7b6c7d619
SHA512 77496005712fd2cd73a4c507992a1d1fcf3730e6e468cc90145e4a74d3a47d19cd3b1b5b65c62f60ee930dcfe40e55fc6dd25f08f75c42464a93079f1ccf4d5f
SSDEEP 96:xHtjUTUubqGqV9fd7lutNbzSHSSlldv9jwncHJRL9I17Bw88H8L4cnfVgL3GS:Pj+2RV9fd7lutqSSRn5uBw88qCx
TLSH
T138E121789508CB7F74B677ACAC6888315A72013B77BF68C710B55484010CF3481F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 6KB
SHA256 490b64b411ed83aa89144a731be03680ce7229dcef564e1f74ffaeea69697f3b
MD5 6fe0c3b3992bdb208f3eecfcdcfe4b5b
SHA1 2ac513839a3b044a438f839a17bf6ecd129192a2
SHA512 228c24b826cc04e52bdf2679a9999e18ae9687c2290204460ebb6e993736d1b453a37e4c827edb1e6f937b4169cca5eec70427373c2d73d731783b5890972eb2
SSDEEP 96:xHtjUTUubqGqV9fd7lut1zSHSSlldv9jwncHJRL9I17Bw88H8L4cnfV+O:Pj+2RV9fd7luteSSRn5uBw88qT
TLSH
T181E110789548CB7F74B677ACAC6888316AB2013B77BF68C710B95484014CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 6KB
SHA256 9af0fe5caae1f06e26b57bd3c012bc1c858818a65d1e73e00c0ed161408ffd30
MD5 d10c216c2a522550797b55eaf0c619a2
SHA1 19aaf40b3ace7a93406263a90c3cec81dbd56096
SHA512 2b48165782298fc648fde7755365c76b201ea23391a3cf1edfa1c7c361566aecf497730e40a99e867fd77011a11f87d16117719bd282c7ae3a4c1a09ac9c42df
SSDEEP 96:xHtjUTUubqGqV9fdKjYnj+1zSxSSlldv9jAGFncHJRL9I17Bw88H8L4cnfV+O:Pj+2RV9fd7yUSSQDn5uBw88qT
TLSH
T156E110789548CB7F74B677ACAC6888315AB2017BB7BF68D750B94484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 9746a19781f035099f69b18dfed874e26547d6434f15121a219278f19f20673e
MD5 bff64f2a6b11c1ae8f4ab84635c51a55
SHA1 c5d4009100c08d92677043bef6d3adce70eb2787
SHA512 e80d37d91ea4363520d2230ecaa4c1f3cc219b09f505e9f71d48c4f5cd630b64cf4349fa9da381e44c0b64b9f7d7e1a32fea6851a83de6b0ec3574683a744783
SSDEEP 24576:3CWk+tIYI0Lgrb63BDcYrVQpa9dfH9EQ8lQyjH:3jv7LO6pcYrVEa9d/9EQ+Qyj
TLSH
T19CF52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.6MB
SHA256 68dfeeee5d077499c9ef69bc4c738daef1f9216caba679be582445f7208256f2
MD5 e5d542a63ff99068438965a093767ed7
SHA1 dcbeec0c9dc9e2a8f9eb1a8a1d440c42bc5ec395
SHA512 f7460ee51fe57455d4bfd85c0873d3a81c1a143f51a12f9eea0a5d9527230138218f6269d3d92b01747c6775b5f6929f6c5b7b9d719445f8c1fbce06f373baa1
SSDEEP 24576:RCW++tIdfnUaru63BDcYrVQpQ9nyq9P2elq6YhtHUQx:RjUvUp6pcYrVEQ9nf9P2M9YDr
TLSH
T190062AF860D1A243F3424073B64593EB21EFD00C6027DE0447A956E9A479CEF9E56BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TermixPS-main.7z

Path C:\Users\Admin\Downloads\TermixPS-main.7z
Size 9KB
SHA256 60868a8b1054b0808d186c40f2c25c125f70b14966616f1c2c1ade777965a100
MD5 5cc51dddec62d34d4166cad01fd2a49a
SHA1 d68c812d419dc8e5c3fd5e39bc677bb82282f41f
SHA512 3131222b1d5311447421ca5d0716bb2e4e5ced738a07853587ce5080145c1601b8e8e97d0b2bfba82e4c3886f6b00243731d67eb65d9e7aa74121bb7d11eb465
SSDEEP 192:tqXSJzr64Xcn8ms9oJgCcqACoLTtt3NXmm0IdF4izpIr:0Xq0n/sqgCcqqtd8qaizpg
TLSH
T1C312CFDAAEC1682AA08CDA7365D77427B0D09CC4A337D651CD96A0CFE2E7076B0E1D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TermixPS-main.7z:Zone.Identifier

Path C:\Users\Admin\Downloads\TermixPS-main.7z:Zone.Identifier
Size 153B
SHA256 1b93a727e9e20161ac8c12b089b6f4e33f777b3ac7a2c812c26e96649fdc68c7
MD5 73a6f2701f817f1d733ad3e4956c03a6
SHA1 0a2d59360087bb09f2dbf911c103a6e7eed80f56
SHA512 1ce1fd9997fb11d8d0bce346e9c3c3563a447c55041553fe9d761bddd96887bb7bae74b47a864d741f12abe3f8d03e95091a3ed58e95fcae3883edda1f6ffa31
TLSH
T148C08C87AC00806E0934EBE0709EB29DF10A310888D0618C8804504FFC100E1C89892A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1176-418-0x0000023CFD370000-0x0000023CFD41E000-memory.dmp

Download

memory/3840-427-0x000001988E390000-0x000001988E43E000-memory.dmp

Download

memory/4972-449-0x00000207953F0000-0x000002079549E000-memory.dmp

Download

memory/5104-24-0x000002E27A4B0000-0x000002E27A4B6000-memory.dmp

Download

memory/5104-20-0x000002E27A490000-0x000002E27A4AC000-memory.dmp

Download

memory/5104-1-0x000002E27A120000-0x000002E27A130000-memory.dmp

Download

memory/5104-21-0x000002E27A470000-0x000002E27A47A000-memory.dmp

Download

memory/5104-22-0x000002E27A4D0000-0x000002E27A4EA000-memory.dmp

Download

memory/5104-23-0x000002E27A480000-0x000002E27A488000-memory.dmp

Download

memory/5104-0-0x000002E27A120000-0x000002E27A130000-memory.dmp

Download

memory/5104-25-0x000002E27A4C0000-0x000002E27A4CA000-memory.dmp

Download

memory/5104-26-0x000002E27A120000-0x000002E27A130000-memory.dmp

Download

memory/5104-8-0x000002E27A090000-0x000002E27A0B2000-memory.dmp

Download

memory/5104-19-0x000002E27A440000-0x000002E27A44A000-memory.dmp

Download

memory/5104-18-0x000002E27A530000-0x000002E27A5E3000-memory.dmp

Download

memory/5104-17-0x000002E27A450000-0x000002E27A46C000-memory.dmp

Download

memory/5104-10-0x00007FF4B5F40000-0x00007FF4B5F50000-memory.dmp

Download

memory/5104-9-0x000002E27A120000-0x000002E27A130000-memory.dmp

Download

memory/5104-29-0x000002E279A20000-0x000002E279A2C000-memory.dmp

Download

memory/5104-30-0x000002E279E90000-0x000002E279EA2000-memory.dmp

Download

memory/5776-439-0x000001ED50F90000-0x000001ED5103E000-memory.dmp

Download

memory/5776-438-0x000001ED50F90000-0x000001ED5103E000-memory.dmp

Download