90de1d4c8b4e44e22f87cc193d3eb68a85551d48f6f63f9cb4ed46684454fd5e

Analysis

user interaction
yes
max time kernel
260s
max time network
259s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MetaDataEdit.exe
Size 422KB
Sample260511-ybdk4acy2k
SHA256 90de1d4c8b4e44e22f87cc193d3eb68a85551d48f6f63f9cb4ed46684454fd5e
MD5 7ba4c63cd06b05090018696165310697
SHA1 b869baf286412c105e0967d638f2045bffbb8195
SHA512 ce84e21ed9e86a7115b836f6090309133baea358d5080dc620a04ab43323851c91272e8829e41bf6e2fa76780c603e26167278f01bdd2b5306b4a8717b7f7446
SSDEEP 6144:18RxcwiOG1JD/fXVFxvxkepq8RxcwiOG1JD/fXVFxvxkep:1sPiOs/dfvmecsPiOs/dfvme
TLSH
T1C2945A82A74C22D5EBB943B82D5108EEC7273E3EC0C7A88E55B6F85510A75A32077C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
211	2372	chrome.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	Discord.exe

Executes dropped EXE 13 IoCs

pid	Process
1120	DiscordSetup.exe
4528	Update.exe
4744	Discord.exe
3112	Discord.exe
5208	Update.exe
3224	Discord.exe
5192	Discord.exe
5592	Update.exe
4776	Discord.exe
3988	Discord.exe
3976	Discord.exe
3156	Discord.exe
884	Discord.exe

Loads dropped DLL 12 IoCs

pid	Process
5192	Discord.exe
5192	Discord.exe
5192	Discord.exe
5192	Discord.exe
5192	Discord.exe
3976	Discord.exe
3976	Discord.exe
3976	Discord.exe
3976	Discord.exe
3976	Discord.exe
4776	Discord.exe
884	Discord.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
180	discord.com
185	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MetaDataEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3488	chrome.exe
652	chrome.exe
2372	chrome.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230018711886711"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9236\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9236\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9236\\Discord.exe\" --url -- \"%1\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9236\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Discord\shell\open\command	reg.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
5984	reg.exe
520	reg.exe
4764	reg.exe
4164	reg.exe
3136	reg.exe
216	reg.exe
1540	reg.exe
3388	reg.exe
4764	reg.exe
1832	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
6000	chrome.exe
6000	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
6772	chrome.exe
6772	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	MetaDataEdit.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe
Token: SeShutdownPrivilege	6000	chrome.exe
Token: SeCreatePagefilePrivilege	6000	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2792	MetaDataEdit.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe
6000	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3048	firefox.exe
4252	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3536	2456	chrome.exe	90
PID 2456 wrote to memory of 4036	2456	chrome.exe	91
PID 2456 wrote to memory of 4036	2456	chrome.exe	91
PID 2456 wrote to memory of 3488	2456	chrome.exe	92
PID 2456 wrote to memory of 5620	2456	chrome.exe	94
PID 2456 wrote to memory of 5620	2456	chrome.exe	94
PID 2456 wrote to memory of 4044	2456	chrome.exe	95
PID 2456 wrote to memory of 1384	2456	chrome.exe	96
PID 2456 wrote to memory of 4044	2456	chrome.exe	95
PID 2456 wrote to memory of 1384	2456	chrome.exe	96
PID 2456 wrote to memory of 5736	2456	chrome.exe	97
PID 2456 wrote to memory of 5736	2456	chrome.exe	97
PID 2456 wrote to memory of 6104	2456	chrome.exe	98
PID 2456 wrote to memory of 6104	2456	chrome.exe	98
PID 2456 wrote to memory of 1920	2456	chrome.exe	101
PID 6000 wrote to memory of 4852	6000	chrome.exe	113
PID 6000 wrote to memory of 2012	6000	chrome.exe	114
PID 6000 wrote to memory of 2012	6000	chrome.exe	114
PID 6000 wrote to memory of 652	6000	chrome.exe	115
PID 6000 wrote to memory of 2040	6000	chrome.exe	116
PID 6000 wrote to memory of 2040	6000	chrome.exe	116
PID 6000 wrote to memory of 1032	6000	chrome.exe	118
PID 6000 wrote to memory of 2648	6000	chrome.exe	119
PID 6000 wrote to memory of 1032	6000	chrome.exe	118
PID 6000 wrote to memory of 2648	6000	chrome.exe	119
PID 6000 wrote to memory of 3980	6000	chrome.exe	121
PID 6000 wrote to memory of 3980	6000	chrome.exe	121
PID 6000 wrote to memory of 6136	6000	chrome.exe	124
PID 6000 wrote to memory of 5152	6000	chrome.exe	129
PID 6000 wrote to memory of 5152	6000	chrome.exe	129
PID 6000 wrote to memory of 1616	6000	chrome.exe	130
PID 6000 wrote to memory of 1616	6000	chrome.exe	130
PID 6000 wrote to memory of 4260	6000	chrome.exe	131
PID 6000 wrote to memory of 4260	6000	chrome.exe	131
PID 6000 wrote to memory of 5228	6000	chrome.exe	132
PID 6000 wrote to memory of 5228	6000	chrome.exe	132
PID 6000 wrote to memory of 5668	6000	chrome.exe	133
PID 6000 wrote to memory of 5668	6000	chrome.exe	133
PID 6000 wrote to memory of 5028	6000	chrome.exe	134
PID 6000 wrote to memory of 5028	6000	chrome.exe	134
PID 6000 wrote to memory of 6096	6000	chrome.exe	135
PID 6000 wrote to memory of 6096	6000	chrome.exe	135
PID 6000 wrote to memory of 5892	6000	chrome.exe	136
PID 6000 wrote to memory of 3528	6000	chrome.exe	137
PID 6000 wrote to memory of 1384	6000	chrome.exe	138
PID 5528 wrote to memory of 988	5528	chrome.exe	146
PID 5528 wrote to memory of 5440	5528	chrome.exe	147
PID 5528 wrote to memory of 2372	5528	chrome.exe	148
PID 5528 wrote to memory of 5440	5528	chrome.exe	147
PID 5528 wrote to memory of 5744	5528	chrome.exe	150
PID 5528 wrote to memory of 5744	5528	chrome.exe	150
PID 5528 wrote to memory of 4684	5528	chrome.exe	151
PID 5528 wrote to memory of 4384	5528	chrome.exe	152
PID 5528 wrote to memory of 4684	5528	chrome.exe	151
PID 5528 wrote to memory of 4384	5528	chrome.exe	152
PID 5528 wrote to memory of 5704	5528	chrome.exe	154
PID 5528 wrote to memory of 5704	5528	chrome.exe	154
PID 5528 wrote to memory of 5024	5528	chrome.exe	155
PID 5528 wrote to memory of 2100	5528	chrome.exe	157
PID 5528 wrote to memory of 2100	5528	chrome.exe	157
PID 5528 wrote to memory of 5444	5528	chrome.exe	158
PID 5528 wrote to memory of 5444	5528	chrome.exe	158
PID 5528 wrote to memory of 748	5528	chrome.exe	159
PID 5528 wrote to memory of 748	5528	chrome.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MetaDataEdit.exe
"C:\Users\Admin\AppData\Local\Temp\MetaDataEdit.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff83a1bc728,0x7ff83a1bc734,0x7ff83a1bc740
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,6244142933444042607,1198324858200147635,262144 --field-trial-handle=1988,i,8853506768377850824,6810123382694418312,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,6532750660454713930,6496412562889254712,524288 --field-trial-handle=1988,i,8853506768377850824,6810123382694418312,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,1825452578325744817,13126054548656659514,524288 --field-trial-handle=1988,i,8853506768377850824,6810123382694418312,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,3950283999112387850,4579129169614254524,2097152 --field-trial-handle=1988,i,8853506768377850824,6810123382694418312,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,16243167109766389328,954662428563094796,2097152 --field-trial-handle=1988,i,8853506768377850824,6810123382694418312,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,1136575845676221561,2989792687732209436,2097152 --field-trial-handle=1988,i,8853506768377850824,6810123382694418312,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4624,i,1467856413614092615,14085713553137439226,2097152 --field-trial-handle=1988,i,8853506768377850824,6810123382694418312,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,10566534165820593210,11430391789593704389,524288 --field-trial-handle=1988,i,8853506768377850824,6810123382694418312,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff83a1bc728,0x7ff83a1bc734,0x7ff83a1bc740
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,9242827872741432846,13383010983441250482,262144 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,8066619545961962013,412018469206188363,524288 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,814037407963193878,17962714566434999052,524288 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,10077861313220161856,11290230977302155708,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,702882797183092585,15128770947739704841,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,13897277052741869142,12432567937669290379,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,6370516321882384012,6097946724267097227,524288 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5600,i,8091982961307581504,12196750082970696766,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4576,i,17121680552336660467,4287543780883828803,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4432,i,380663406912751056,2807286283792038374,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5796,i,4813781365421800392,9728556263471945796,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4656,i,9234318153493478104,12696564893213424198,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4628,i,1351169013657700693,2452557763876136803,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3384,i,7659982776025230404,6204541640765575519,2097152 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,16730202583241145321,7038463194338266763,524288 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,14509861650721223790,10146667855961301061,524288 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,17190977529310764643,7948925654094754003,524288 --field-trial-handle=1984,i,4887728823408428832,9792650561413119785,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:1384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff83a1bc728,0x7ff83a1bc734,0x7ff83a1bc740
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,4405609676760221504,10446195056022018027,262144 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,474556336402834705,13601597234062169354,524288 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,8312566406032535003,1748325688566735163,524288 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,6191340499652069431,7837419454210574214,2097152 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,10796938955621904932,9923656711456141336,2097152 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,12260385384483469585,2837101368415523903,2097152 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,17463641248082547750,17798502470537157813,524288 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5400,i,18162762426479271566,6322450538559581260,2097152 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3444,i,13301931322558703107,4081654292967023814,2097152 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5780,i,5831489526202703251,15701140369573171574,2097152 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,6084881157545655347,11794791609541578424,524288 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:5676
- C:\Users\Admin\Downloads\DiscordSetup.exe
  "C:\Users\Admin\Downloads\DiscordSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1120
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4528
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --squirrel-install 1.0.9236
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4744
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
        
        C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9236 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x500,0x508,0x510,0x504,0x518,0x7ff7f444c074,0x7ff7f444c080,0x7ff7f444c090
        5⤵
        Executes dropped EXE
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Discord\Update.exe
        
        C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2452,i,8903277291263278679,14095835838885139616,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
        5⤵
        Executes dropped EXE
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2452,i,8903277291263278679,14095835838885139616,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5192
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
        5⤵
        Modifies registry key
        
        PID:5984
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:520
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:4764
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:1540
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe\",-1" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:4164
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe\" --url -- \"%1\"" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,9253523807026527315,14116514504164654753,524288 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,9425599315360191550,1486920964139330783,524288 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,18291054352457175634,17202796416746901363,524288 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5992,i,9583624107829259999,9869483118117355885,262144 --field-trial-handle=2068,i,11297654083740547094,8213689158853920928,262144 --variations-seed-version=20260511-010040.854000-production --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5836

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5592
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4776
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9236 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4e8,0x4ec,0x4f0,0x4dc,0x4f4,0x7ff7f444c074,0x7ff7f444c080,0x7ff7f444c090
    3⤵
    - Executes dropped EXE
    PID:3988
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1912,i,11503226830137095117,1088236946834242795,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3976
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1912,i,11503226830137095117,1088236946834242795,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:3156
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:3388
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1778527743223651 --launch-time-ticks=641731145 --field-trial-handle=1912,i,11503226830137095117,1088236946834242795,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:884
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4764
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1832
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {135abe79-f9f0-4874-b97d-379bba6e1c99} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {171dc08d-517b-404e-814b-5b2f1a0dac3a} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27276 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {a47ce828-ac99-4d37-9651-b96e123e200b} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3944 -prefsLen 27276 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {ccdf5b57-b578-4944-a7fd-7bc8e9eeee94} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2840 -prefsLen 34775 -prefMapHandle 2992 -prefMapSize 270279 -jsInitHandle 3080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2756 -initialChannelId {59f76f00-d130-4f16-8a93-b2bbbf990240} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2620 -prefsLen 35012 -prefMapHandle 2624 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {2bb3735d-3aa4-4e71-835a-8acac3bfd1d9} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5364 -prefsLen 32952 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {e5fa3568-47dc-4fc9-aa80-be10c35ca9b7} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {bdb60bd7-58d5-4860-97f8-a9ca75311122} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5744 -prefsLen 32952 -prefMapHandle 5748 -prefMapSize 270279 -jsInitHandle 5752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5760 -initialChannelId {131498eb-bb58-4c50-a348-57bfb6bce4fc} -parentPid 3048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6904

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3788
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2080 -prefsLen 27059 -prefMapHandle 2084 -prefMapSize 270279 -ipcHandle 2156 -initialChannelId {24ec02b7-f82a-466f-b634-c06710ad3fd5} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2532 -prefsLen 27095 -prefMapHandle 2536 -prefMapSize 270279 -ipcHandle 2468 -initialChannelId {06e0a743-3d11-4dc0-b0a0-84c91e43cc0e} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:6368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3436 -prefsLen 27236 -prefMapHandle 3440 -prefMapSize 270279 -jsInitHandle 3444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3452 -initialChannelId {baa6a3c7-cc00-466f-862b-1e1eaddbf557} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:6228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3604 -prefsLen 27236 -prefMapHandle 3608 -prefMapSize 270279 -ipcHandle 3692 -initialChannelId {0648a715-6a0f-4959-9d55-feb10aca00ed} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336 -prefsLen 34792 -prefMapHandle 4340 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {cf2976ea-a74d-42f1-9509-07a7fc6d3ca7} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:6572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5016 -prefsLen 34895 -prefMapHandle 5044 -prefMapSize 270279 -ipcHandle 5056 -initialChannelId {adc22785-7d88-449c-b4d8-fae293af82d7} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32818 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {295b6d2e-cf4b-45fe-b314-5e450bf5432c} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5720 -prefsLen 32818 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 5728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5736 -initialChannelId {6a3ccac9-675b-491d-999b-ff3a5631e767} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5876 -prefsLen 32818 -prefMapHandle 5872 -prefMapSize 270279 -jsInitHandle 5868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5856 -initialChannelId {7ed492f8-a809-4fc3-82ce-241cfd2031e2} -parentPid 4252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
TLSH
T1D25444E56118FF0ACA31CFBC08B186526C79BD17A923640777453BCD0A77ADB5232D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 232e203e466db43a7421a3ef94a06ec687029d0a0c24c82e718de22511a118b7
MD5 a75d4cf544cc27995b4f3eb7571c94a0
SHA1 e39860afa38fc626350e955d8183e60454944651
SHA512 4abc378891054cf365a9a5df0b08135667598d1cf7979757ffb32256671626fe63913a545a4887a54424344d1cdb5f1a1ff6909ed580eeececc2a5eb6a583e2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f825372d87e4f4c6b157e0cb81def2b4dc7e128be0c080e41ee2b907178b85b8
MD5 ce1316676ff56a12e5c472e313680b9e
SHA1 9725fade76efdc6f6811c660c9b2a8357f314df1
SHA512 3dbffc639fb800b0601805dc99ef5fe9caac21fda908fbe5285d884a01aee00710c15c3b68e1f48bc8e99d7c2b6c5604aa2a6da6531d118c076d827d9eecbb11
TLSH
T1D3E02BABC952EC3708FD1B196064074AEF6113172B41550B7A3C860C8FF523B55C295C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ae09eaa39e263720fe8c620c8f1ef9da9101541755fb960376a12f1336115e0c
MD5 99114e349587e1963d8ab4da2d2bce32
SHA1 f0ec0f5f792957f668dd3d5c0e11d8041be6da37
SHA512 49613adecf6c47f0ef3dcd60934d5bcea53d7e244a9e15af6d144f6bcb2a534fbc0893229f52f23f1e0df256e690d686826c96dedb679d942e10e5958d6dbd4e
SSDEEP 12:dszbeSp/dgzbc6O77WerP/JGvJOYn0P0OYJsR58Pq:d6/+Y6O7lP/EvAYC3YJKePq
TLSH
T10113657C861A2F8ACBE51075A5C74FB19330C68AD9B3755F36F535317040F1111CA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 eb94eadcc9e7bbbd1ef07317f2deaa2fd117ffcd53349a4b6f182a7fc4605044
MD5 c065349b6b7431e58f08737709c78443
SHA1 c296f62d71a4a49f3b2f4f29a55a5c233cca3927
SHA512 13b58b6f1bba0fcc1c88548dcb66d827e2f6d17efd4c872b7177ae40dc20b7dd77c1bc9efc29fcc1fd7ca68fb41828d8d465bb57cd7e65afb1c0a064a25acb89
SSDEEP 96:b36/gloTJKjW3aBF09VOLHKWolEDWFMPDqSCyc2eugMhHj:uC0JKZ+SclEMu3awl
TLSH
T10544C9F71909EDC3FB29CFB16C909134DD32A62719A5AD32F62944A106465F3322CB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d5c6af94d3ba90f2f59ddd98f24208d7b78029381f4d3686a3d74c0ceb156d2f
MD5 e5f654b79c08f38fbaf82ed914634cf4
SHA1 b48a2f6e38fb571c52aa5755c7859b52df5a27cd
SHA512 484032a16b157f6c2ae1bd9bf743b0776d94d1cc74018c74bdb2c5b6c19886598c6c7e85644ae1fe1e5ba91bd3d28c5ab6cf3f223479ad5d63628b0620d3321f
SSDEEP 192:0vlSOxQ+N8XjzMuevq9HmlM8pZbTNXBL+v:0vs+Svjb2plNBL+v
TLSH
T1A6259E116C0B8FC2D6B842B13E08C3F8DAE88EEEF3D7139209BD85D4444890ADB6647D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 6a1306bc91e7a3dcb743c46635c8386996841454c50f4004242fbf0128b76381
MD5 91253772f1425cb301af1e2accfd42fd
SHA1 1556341215d66fa476def805b81f0cdc61f56b0d
SHA512 2740f0e205683f4061fdefa7780e00965c0608565f75a856a701aee10980880282dd676ed397254ca21bdb3b49e90370e8ef5cfc9564d758cdbd773e9502dcf0
SSDEEP 768:+U4vx544IOiK4DM4s4i474JfDPLSgcRUv+j44bx644q48xQ44diK4:Jo43KBl/qt4L4Pc4NK
TLSH
T19D163BA74F74A543EA86EEB0FBCDEC1C7C703292ECD79482A61682B944F0BC4174519D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 35KB
SHA256 40a9aac29554e662fb18e9a44787263ecae8db3b2786520f44124d651306ff8c
MD5 82d972e9a2fb889a09df658490c55db6
SHA1 1051543bcb3c0e4dfb98c33d5963a9021600b438
SHA512 c778dad88a2707350331c87da06e8db03681d999d936b005ba7492cf859b9892e6763187ae306b9122f8a4c2cff336655cbb37152d31c5312acf0ba9c6ea949e
SSDEEP 768:mOUAhFY4NQphgwxtYCq6K9wrphAMStRC0biIuhLKOfzfipQ7c:mOthC4NShCOhhStRpiIuhL1fGpQ7c
TLSH
T1AEF2F154E3A7ADBA7590A109144CE250DC0C2ED78FDB742768A022975C283E57BCAFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 67KB
SHA256 8040fb9b23758318712ad783959af672679d82d164b4ca8adf2215836a0dc35a
MD5 b507148263c145cbfd2377046f906835
SHA1 97aac946f428bf2397bcb1f7760176cb31a96299
SHA512 ea36df995b92ad410bea34af6fb3e8e72dc9263993ca5046898ee09d5e2724c3cade234475ded8777491bfee1b825071d3256637edf89949dc045e5d73afc1c0
SSDEEP 1536:pulGSzd2shU1evf8gZQE+DOm+m6+ywGlmxryBltysvq:4lGShl3k0YZ8irDh
TLSH
T1756302BF89F14D329987A862D0F4728207C2593BEB6D53744F484BD9578C3B5E98E0CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 fa7cddab245027bbf8be602ef15a7e50b430425c86554db5b549ef4a67f8c0e4
MD5 8c429e1fbbcd9be3865734fa4b0f2288
SHA1 5034ed110e267bec67dbb01f7a4d841778f19ae3
SHA512 a01e4aa0c8ea61f3a4f7067c63e03ab20dec2d5bcb7e315fab1aeeac0070c79701a16122f54f721516760f02a55b80948b5da2b65e4b8ea6b7a80964517dceeb
TLSH
T133114DB82B89847FEBB1FFB84C560C04C9801E7DC0E3411A0093925F6FAE3BB20A009C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c0d9e5fe2db765dfe09260df82634e6088576b86344a4de3e27141418e9f6b6a
MD5 a984e9dd4f7285c0655612e93c8e8886
SHA1 f39915e71937fa9f6a258ab7c25dabc90ec96c2b
SHA512 bea7f2a6ce0558f12e22549c6fd5211bbd35610330921234fbe04eb2a1f90ed9b4dac61219fea9eb7564af01ae96d3c38ae1af79f54d785c54dc671b7448ee49
TLSH
T1643179B42B84C02BD7E36B7748510C31ADA8097EA4D7161701A3D66E3BAB39F64503C8
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 36KB
SHA256 ab37ef6d270769baaf2ae1db266c329954de4c853e937b3ba9c1e481ea64fad5
MD5 8fb3dfb1d37f66ce93f711f8004f7d5b
SHA1 c7744b395372a0f939c352d48dc29bcc2c7e76a7
SHA512 a8c104c0fc180ee010e35331a7e00fcef03508fa8eedee0fa00fa22f6677ea2b494ea5232bfb4393ce5e1732794d1b8e2238d04cc5f006da33383f6c7156c628
SSDEEP 48:TJqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwU1cx2B/l:tCEmrm43b/LuaLNW9WjWbfltxW
TLSH
T1ADF222078E393C61D4CA863789C18AE70F790758935B5E6859A804615DC2A4880BB0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 bac3e4453d9bac6708939922a8aff54602a65204ac47ef29e25dc73c74a259ec
MD5 65941106a05c372162e85a1baad00241
SHA1 229524460c895f68c98745185f0f9f62eabd5f1f
SHA512 0940c56bb3e2208c4feb5f437612e6b999fc4594158b5c61abd9c459e5a7f1e5a59ee5f3b6453c213d0792a4918c2a740d8c8e0bcbd5031c185aee22db9bd9ff
TLSH
T146E0868C34C9C76EB4B48AE78374570DCFE83445B7F87C469749D4C922C65086699374
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 f99b674c24729e31a355e251dc0fd0d340731528548914c643bacace728e00e7
MD5 aa5303319b3bec3f005d49503523bdce
SHA1 ad169e845df903b13a18d648cc5dce6491447733
SHA512 43e9bfa906afacfa9da4b7c3c6794dc60d8f359b168e2ea040170e29a3bcbe741541f55ce83bc0d8d552e8e904f7214a5f402e5d8b513eeac5c2d39d52516244
TLSH
T17F3176CD1B002377DF1618787DD2E3065EB099101A9898E353F44EB70EC7AE0AB2328E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
Size 327B
SHA256 f272e823710565b50e7cd07abf57b66d5f21d3f3ee6444adb92c3f184da4af99
MD5 b77ae9c0fe905113f625bb41749708e9
SHA1 16c4a3fe9d470db301995965a22c5cf9c7e94e17
SHA512 1ea53ac7c2c696d1753854a3a5c2324fc0c672dd554d6fbc5a49cb9300c8156a00b20334952d45fb24f186f0872fe6e80e4a1ef41cc5c45569fdafdedb1ccd70
TLSH
T117E026893898EFAE66B083A356349F0EC6F83409ABED19032B57D0C412C0808F18F2B4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 4957f3d83e0fb8aca88789e090f4859928902adffeceb10cfdd1ff6208452ab5
MD5 89df9f79d2bc5471e7c59c7a0dc6bf73
SHA1 589c17e34cc009db375200f7e443f750b9edb374
SHA512 f55830afdf48cc7c83585ee4b823452d265ce571735d155348cc2455396b14cf55e4655f4f338c944f34758bde1e129e246d2dd0829df42088729f21d2fb89dd
TLSH
T1EDE0261A3998CB6E8990938303349B0DC7EC7448AAEF18822711D0C09280C08A18C27A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 44e773f97ed128bcef5bfb5e8d60181248c39261ea0f8a029e337209217d6684
MD5 27830e6a026c5a92ba9a77442feba9b9
SHA1 ca97ff0bd8f0e304def78bb496225db406f545bf
SHA512 831838de40d2ea909b7ce6427d74e8a6148fc76d2e65b842a3d02f0299ca93af7a14498e10d865148c57b6592e939cbdb1b7cc3661bd553de324e462aadacb67
TLSH
T16CE0D8A625CDC66E55E492978324770DC7F43408D6FE6E018B44D48571C640853C42A5
MD5 SHA1 SHA512 TLSH

Submit Download

90724f90-6a9f-4a9f-ad60-bad605f6543b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\90724f90-6a9f-4a9f-ad60-bad605f6543b.tmp
Size 2KB
SHA256 b87c2f6a55e6d2c5f2beebc5fb6b4f9ae5ab2d876dd24e4d1b43f97eb6a9cc0a
MD5 06e719c0bd1eb3352e8f5d669e03f2d5
SHA1 e4392e339519eb29f3aaad226192a386fc60e47c
SHA512 35c970b11a31457c60a75614a591e38d3290986f14657c16cab55a60fcdcfba4a7fa8ef22130d125fee755c296ef43748d13a3c4e6f6b8a797e41cc955b28de5
TLSH
T151517CF793E489BD861196E4AA256E2FCD790924131C7C56C8D4AF1B57F28B2D20138F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 b7a283dee6dbcf3f5e459ccb6aad8b83346e6d13ac440a5cdf2839bd01792624
MD5 3d2f85c5e26e3d0bb896a19c9acf5f83
SHA1 adad40f24dcd487c1419257feecbbbd80e72495d
SHA512 f30ef79f663d0482a0a1b94cbe2fcc3035775ff0228598dea63ab7881e7ca8dc0d958283d8d7d1ff84d0cd615ab61459a00ea5e39a5218da79e3b7bcb9065611
SSDEEP 24:TL/91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBrwd59jM2A+MFvoFUc6JXvj:Tb9aw/aHLopFMavU1iBrwHdMI6okX7
TLSH
T1B1921C8F0F343210C0F48777E9D24A5B2E7C122D9327AA89EE5460B39C8299FF6050A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a1550a387fd4c7050ccdd2b219c3923023d2cac8bf816a5c5730fcdd02d1d3bc
MD5 7ec8c8acd8fada9064c76a98be7cd65d
SHA1 ecf8ca8399fa4f2bcda013eaae6bdf9c7b1d457f
SHA512 33a009f3b25ef99bbbc9beba2bc93c68ba0e9c0cc1e05ad905b76025b0d7370a96116781e182805099411ef8ea216179251037a432c3d5aaa8aa6ced18f4a38f
SSDEEP 192:D7N4wWZPCcaaIA4Em9i7hIUILtIhDWv3DIps:D7N4wWZPCcaaIA4Em9i7hIUILtIhDWvj
TLSH
T1A5D19FF7C3D9866D895156F49B15BF2ECE290A18031C3C26C8D8AF5B97E2472D21129E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 a45d3a3188aa9c2441741fd3a9e1618ee67ffbf7126bdc0ed77d60a9f9d6cbb3
MD5 7767f6232dc0d8c798f0eab80bde2032
SHA1 f281f3e394961e19ee967fb1e68da168a563394b
SHA512 9f5022d1b2b43ab574469893586ca3014db03e3ed63cb0cb705d78ff5d85e03ef166066c2665ae8eaefd1f45fd8dcc9c945b1ca5f79a61762ff16dd97d74a064
SSDEEP 192:DeWNf5cahdN0Ei7SYtaaIAYhIUILtIUxZMW4I/CboCURVNU5YjbJrU1Qprgn6Pgk:DeWNf5cahdN0Ei7SYtaaIAYhIUILtIUF
TLSH
T13E22AEF3C3D8C66DC91156F4AB157E2ECE2D0A24431C3C2AC8D9AF4B97E2571E24169E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 ea868be39d69685eca634281c6aae900d15119700f2690bcf3970ae0f93f8e89
MD5 34ea3a26fa0f543a4963f7dccca53bde
SHA1 926662551b57ebea0db4e1ae7ee678fc040c6a23
SHA512 c838515de868eda87124771fe578a2c1cf1d943b8f8ffd0d4e00a9ad11fa15cee385cb08ebaebda8df897feb154d1e74476f7c0fd3b66d97ac52dd15c599a7c6
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB7bI:OIEumQv8m1ccnvS6MRB5
TLSH
T11FF2FFFF1B05B501C0D491B4E5810ECFFD6D151D4B9ABEC0AA9809F366C66F39538359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 10250b6ec4d9c573811ba905471cc0c962ea7fc2845e5fa3d94140b696785802
MD5 7dbdd764f0812fff8f31631f4d54ac9e
SHA1 1fe2f8893e0dd776ff52c88ee288940f22fee213
SHA512 87e8eef09f54d6f8945bfe74fc47e2692d700505bd449b4398042832a712fcc3f33b9d496f8e52f629291ba5f3f58039b276536f23cff20fc348430ccc4be3d4
TLSH
T14BF059E7D63A749710BD44AA1D00F80968B9AC3902422CF4CF6A822DE0896F35B02443
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 3872387eb722900c2867eec5b690dd85b4111a33f84d5e0ec14b406620e1075f
MD5 d786b6926004d2ae04aaf87ccbde46f0
SHA1 36edda219c448df6b4ab5f0076e7806946ff61cb
SHA512 379b3904037e650dfed657c55cb4afa24b5228c2bf60001c911fbfa0e4a9eef99470f57035cdfffc7605738710997d811c267b77c044c340d45a534a5bcdd980
TLSH
T1FBF059E7972A789B10BC89AB2D01B8052C7AB832078268F4CFAA812DE0845F71B02453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 33a403550564531fd27928364a448fd04c23502390158fadff6ea138ab2eb6e3
MD5 3260095f84ca95bb10589808232360af
SHA1 0a5637a1f66bfaa90c2f972e14ed4c0d1f53d558
SHA512 748bb0b39256cef362928787d8975cf1ea2f27a22600ff60527007c32eb4ce81f9f8acd1be1fd86cfb0cd3d2eb54533ee3922657cdbfffea131921d31a119e2c
SSDEEP 192:QR1cBhxh/5Cj1v7japAPRp21ZQf6y9mHcRb+WNnWjMfo+oo8eP98TaY+V3rVyIsB:QR1mhxuFaUXJI0QRneUan3te
TLSH
T16052D82EA814697B5CDBD319F9A5B717D7F5203168902E84E6FC8E2C04DB6CD7227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 97e70eb595217e42d283d398e07248e1b2c4e602c8945d44e56723833a485453
MD5 e33a29c65520a33875a2569323dc60cb
SHA1 2301f5f9478a12de382ddcfb14a08c0f82718a6b
SHA512 5f6bb3e8488703a334fa4b80d28d6e834cc53383a3038621ce7a3b2b3bc2ce296b76484b3f3169c835d7369a5c7c016a684c68104ace77fd90eb7a9ff01236c8
SSDEEP 192:UR1cBhFh/5CN2v7japAPRp21eQo459mHcRb+WNuLJOTfo+NS/Ag98TaY+V3a+Vyr:UR1mhFkCaUXGI0X8xYjan3a2e
TLSH
T10D62D82EA814697B4DDBD32AF965771BD7F5203168802E84A6FC8E2C05DB6CD7127027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6966fdfed0e0bc6e4b8c8442ef23351f4531edb6714ce830c71881fc7687be8f
MD5 040851f754b1acf806cfe8dec4379aa2
SHA1 ddcaac99d183f2521b118368b08c3a94c8d89b23
SHA512 96502e74d687d1a5781df03faa9b93d300458339190f76cbe75b4355c83251e31ee9c38ce8ae794202adef6915d2413c5c1d8d368315c355c3dcfead10da9b28
SSDEEP 192:UREcBhFh/5CN2v7japAPRp21eQo459mHcRb+WNuLJOTfo+NS/Ag98TaY+V3a+Vyr:UREmhFkCaUXGI0X8xYjan3a2e
TLSH
T17F62D82EA814697B4DDBD32AF965772BD7F5203168802E84E6FC8E2C05DB6CD7127027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 73b69e76b43be40b9fb46acf25b72ee02a985523a40ba23cf2e4d7ff43665d2c
MD5 dd2028e515113fa5ff852c1e63c2ee70
SHA1 046c1b612c9ebc1a6f1189ab06405a9767e95b86
SHA512 227e0f73abd0e7406d3e15b7a3338cb2bb63ac65b10c0e1a3ca09cbfa79a0d03d07e9763c18e6a86887462616548049f18e51df9c5ed08046ad5bed7cb3c8063
SSDEEP 192:QRJxh/5CP1v7japAPRp2w9mHsb+WNnWjnM98TaY+33rVyIsnAUgtaJ:QRJxWFaUXbIwQnXad3t8
TLSH
T12242E92EA914657B5CCBD329FAA17B17D7F5203124942E84E6FC8E2C04DB6CD712B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fcb0a4f8421edb5dab37075bcdbf6f3abe4b09e1d82826e546b54919280ebce7
MD5 35f39a8daa7d2f7bd53ff7361b70d828
SHA1 ddac7c6fc39fa9e8b5f4479647c28fb1ec848a53
SHA512 8f830139837756f638c543879abf86580c682e3669d18b75283e4f4f55a4f39037d7d3bc5e95718ee2ac4532dd8391ee6822e6df3aa91c6cb977548cff651c29
SSDEEP 192:UR1cBhxh/5CN2v7japAPRp21eQo459mHcRb+WNuLJOTfo+NS/Ag98TaY+V3a+Vyr:UR1mhxkCaUXGI0X8xYjan3a2e
TLSH
T18462E92EA814697B4DDBD32AF9657B1BD7F5203168802F84A6FC8E2C04DB6CD7127027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4644e5e1fa6b58805383145e7918465a104de0d8e66e674c7930720379659e06
MD5 aca5b6bf464e500f4fe0acc8a4ca63c8
SHA1 d2ac39c30fffa17f87d8fcab982449228f6b4843
SHA512 7dd0cff257157dc488d4155b5cd64dbef25b9af7af40369c92921dcfc30e81efd52899bc1ef473f620443f05cf06d93fdc4ddc915e3263ea1c20f0c70aaef767
SSDEEP 192:FRJxh/5CnNv7japAPRp2w9mHsb+WNngf0398TaY+33rPyIsnAUgtaJ:FRJxmtaUXbIwo0Mad3f8
TLSH
T16242E92EA914653B5CCBD329FA667B17D7F5203164942E84E6FC8A2C04DB6CD722B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1b64fefc5d0ac96a3ed1d4c8b86e53e2f0014d21704a0a75e80a4e2c7e4cbd9f
MD5 60227a568680ad56fe32aaa12ecadf9a
SHA1 b1b1c8cb325ae34eefdb3e380a5370ef530b73be
SHA512 94a2269dd967a6f93bc09d4e8dc93cfd4cae1a3700c0882f4af451136af96f43cc72fc5ce559dccfff65f62b310e8da4d07f7dc3faabf179645f8f380d0e0200
SSDEEP 192:QR1cBzxh/5Cj1v7japAPRp21CQfH9mHcRb+WNnWjMfo+7E2W98TaY+V3rVyIsnAq:QR1mzxuFaUXyI0QR32Jan3te
TLSH
T1E452D72EA814697B5CCAD319F9A57727D7F5203168902E84E6FCCE2C04DB6CD722B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 ffd98ea149699dd6761872d2dbe5eef244122448134f5df8db1adc88ac5adfc7
MD5 7385118cd0cac718c91401fc3c52230f
SHA1 9ec7af73902b2862ce80139e29213f6785bf97d6
SHA512 b17b64441b62039ca7d9f3c95c7c6c67d5f5a41142fc69861bcc6ae50ea62532afd4da0139ca8069897cc331353175192f21f958b2d7cc9108535f42a1eb8a62
SSDEEP 96:F1mKqMBJRwcnDh1JSiJSLXbXFXKXTAFXSXTy3XFXKXTtxhXsX10XbXNXKXT+2uZ5:F13jB4mDhKiAL1ajyCjy31ajd8WL9aj+
TLSH
T147A19C6EA90A184EE4AD0937CD79570B6F79CF0C27BE3767A9DF8A0405B065701086F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 d9db3369f7315d77603cb3b3558ef0ac82bdd49b9f99dfd573a6a7e08b766de5
MD5 01ba870ea485a9357a31bb01855ac8ed
SHA1 a78815260841ef4ae4a85e1dc017d4ff98e4188e
SHA512 cf013b65f0bfef172ba3b95d012d424d06d26f5dfc3e0b8545a6b349b59c92917117ff5970172276ff01455e8dabe14d84be98f962b04f42e4caa30f6367548b
TLSH
T15FE04F5C25C9CABE64F9839702759709C6E8B405D7FD6D029F95D58012CA90872A5274
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 963a9f83f74360b98a9b0f6b8d7cef3a352fcc27da03129abe2b01ffe1e92a77
MD5 6bace8e9905c4f8845f27c7c96d51709
SHA1 2e0c8cad4ac40df979146ff322147f2588ea49c9
SHA512 1f6581ea3291f072d0271f9538969744862cc474945a09592127fd9368a7ef3285c1dfa4f222af43e5712260a2c52ae741393f6880cdfa74cdfa994de9fdcdf1
TLSH
T1E2B0122480017550C40301B4318384886514DF109A08270253E069B198370B28014170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5875d7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5875d7.TMP
Size 96B
SHA256 4ef27579a2870287f678ca1e6fda8d50cc98f0d9ea7af33b2bd1663f32dc2d89
MD5 933a2da73eed3eeb497c1e24f276a8b8
SHA1 98d73ddc2e8f92a3923a77783c69f3cc8d96acce
SHA512 c948400cbfebcc61c5ae1cf364dae9676d0322b7281a1a7fa15345e4c72c1f35ec187184c5eb53c7c06008b51b2fcf72b6b8d08a4116a991aa989a584d19a9ab
TLSH
T1D4B02228C0832302C00203B0238380C83020CF20C2030323A2E00FB2CC28F30CC30020
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 308B
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb
TLSH
T1E3E002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 14ecf217828864dee33caec5368e29361f09849a6736c077124ed6e616338086
MD5 5e8a9a3e77e7ce269ac9b64d4e39eb2e
SHA1 1d55f719a6070cfbce949d851aa37cd220704025
SHA512 3bed580112108a3c500d309c0fcc110f14b782168f998d8090367898ee9b4e8224eb09a66ea2011f36f68c44c54e11354c6ec2c37ec4d66a890026e61f0a1e7e
TLSH
T152E0869934C9C66E54F496A70370670DC7F43408EBFD6C025705D4D433CB90863D52B4
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13423001870210744

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13423001870210744
Size 2KB
SHA256 2f43a21705b45bf817c956799486e5a1f4a6bf1647efb38ccaa04bed183593cc
MD5 70a0ea881e53312ee536a90595f561ef
SHA1 d016279a0367ee3f4a44a79e4be8f5c54b5a6c39
SHA512 91e0ec5c977c5159771b4b0f1f4acf83345549b4571c3c138fa9af1d3c0487e65752919160e1381e3a4bb19b5c64898fedf99556dbd1fbdf705b1904be86610b
TLSH
T11C51AD035AF5043EF23F8635517710FA7E36FA4231868D2F71A611101C63A722EA8EEB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7aec8112f29bdca8a06c3ed8f32d6597f8b411b0bf06e735260b682a0ee423b8
MD5 78645e319a134ecf8f7e12d550994c83
SHA1 1d13b695faad60d8bb16bb538ed0e4e757d7be34
SHA512 878b507481f8a10d65b3edd30f00d320c3cb28ef833b179a255c1bfd4857ba2852e7bad69f0f1b8c4586e17bda4c18e40ed845a96d2f2de319f60771a1ba974a
TLSH
T1BCA0022461C06D41DE8152F510A581407254AC65C222C253A29D41888C57745438D401
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 a9519c71da76198f681c54aaaa1ce79e509914d8a63782eef9fcaf6b8dcbd560
MD5 2446815dfdd66ccf4f3cc7973f89d72f
SHA1 1de713a627eaaeeb1f64b56d3acdae0fca73ba16
SHA512 b1f6241b9a2abf7642a372720e89611bbcf697221001805c6a59c1029a2917928ad2ba68857fe2c6c486b2b0ae91785c9fe25dd115857ff9d45eeb8cd406b347
TLSH
T123E0DF2836C9CB6F90F6929F6360E70DC6F17400E6FE69126B04EA80738A40472A63A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 8c69973f06aa665c9478aab76bdbcb0437b577ed423e04a52950b16b7e94c4f3
MD5 7adaee0ca5947d289f8b10116a5ead87
SHA1 596fc0cdf0bea80d3b131a7b05d444f9aff2d3e9
SHA512 c9d248b5a43db07694170e2d774db3a245a24b90766195a0f39d3c600da256595a6d012131fcbfb43f465464ebd8d86808978ea4328d3077d22040965bbe1a0c
TLSH
T1F0E0807835D5C7BE54F4D2D74370AB4EC6F4780497FD7F459704D481628550462B45B4
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 ac4b1788f5de582990f5a158d6d97f76c95bfdb2961a10950f639a86c826cece
MD5 f0c697375f139c568f3faf9bd755b254
SHA1 e98588d4348c177020e03bc73478fbea3ff097e8
SHA512 2b8b2453e1f92d224577ddc921789918eee8d5a8712fccd1f86c3219e4aa4eb50622a62bb606d7ee2af1acb8493bae74e354b62b0296fd2209a4fb69d1da47df
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OFpX6Tq2Vump2wkn:jeuvBnhJsueMEGvIW1DcP2OjUVump2nn
TLSH
T12ED3A74B3A743102EDE59A725CE051BB5E3CB16D8F1595D428B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
Size 4KB
SHA256 8b8621c3a88747a9bae90b981251b935d09341afe866fdd172996ae2ee9c65ac
MD5 1e0b4703130349674cdfcf7b9850d730
SHA1 4c383f8807362c13340342777e398fb8fc5bef3c
SHA512 7ed806b287a10a554c1e013d2c5fe955169361544a7aad10fe7726d1ad49295fbcd3603ef8393501da83793dfdeeb560092f2b1b5d7d859ec4deffbaaecb4c16
SSDEEP 48:+eNJz25MYOdq+4LWSNm6zgaMXBVwWOquu3Br3TL/eOEErjQ10wY0wi0wN0wBgGZ/:+e+SYYCWs3qvKl
TLSH
T10091DDA337D01183F4FCDA7CF4977A4D5B19A181D896E2FD547400480A66F2760EB5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 da99db756d240b9fc519d6bd416f30c7e15b98041baba247a40e60073329ef5b
MD5 203719139216408385851bf998c7ed82
SHA1 00658646ae43b3589f8dd8c4c0367433436c1a2a
SHA512 6119e719d7fdb40c6ad77f10f71a073223d934c089bb4e2601118c61f6959d2890dc9c4b1de773c5ab7cc771fa913654fddb155d690e9aad15f1070c1bf75ec1
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4S+XvX5:7ZT0nzXggmfJ
TLSH
T176033D8F962840F3D0B6C13EEAC656D6FC7C260CA72379E519E947714DAC13390186AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 dd7594ca494fc3d91e7a9f9f396071ac3f8c25c38258ae872dbb5bcf3b888ec9
MD5 750fcf0861427f69bfa28e320be2e018
SHA1 81e7d6fd0f895aa8dc2d63833a9c67d6bc760e19
SHA512 2ec9655d29012f0a90791efc9ebb8f7b8c1ba63b86e9187e5c9f0f0ee72f05a58ae573eecdc1ccdb48d527fa32963efcd912478fbfce32c72cac188e98c64b0d
SSDEEP 6:uqVk1e3L+Bcc/XKuqHKu42nNzyCc/mLEJOgLEJL5/tF:uqVk1e7+BXXwX4lmLULIXF
TLSH
T14702209FF408444AE423413DC79EA5852E258FD83F83752A1DD5CE181C7C213C0047C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 26KB
SHA256 c9e03b291b835bb4d649b13f1ad47698eeaca7a602840340b28a4a3280e3ba0f
MD5 f94a31423a74231e9e77d3907045cc09
SHA1 b5f42ee1f2dd3b243c6fd005b4048348bba938de
SHA512 7bcdbd29873ff70a0c32396c9235b27cadaec50431879163ccd0cd4a0be3c47bb69eb65319e5ddab554b622b1232009a00f72ffb12375a025471dd116900b66e
SSDEEP 384:SQcKsdGtEFGHAKQvIIIebOMIM1BquFSsdGfL2ZjsdGjrcqGsdGJdGvQcH25sdGJp:LaKQyoT/C
TLSH
T10DC2C65EA3B21B43FC8F93FBBC94CC6F17739C8A44560005A8E25ABE3863D17499175A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 5032d7586282aff4aafabb4e8cf06dc1272393d48d20d5c6c3c01cc998428c08
MD5 c51602a9af9754af74c0b2f6b94d36db
SHA1 5daeab29e88a1207a71685c16ed362753f145c9c
SHA512 0b3f7612fad19778b3057ad3b0c7692e1c6be665ed7335f5232158f6ec444d8c9e53da948f13d018bbec9b116ec9428fbea6cf3076675adccb6560de29c945c1
TLSH
T163E026047BC8C6EFA8F582EB0238670DD6F43801EAF82886AF10C0849383804A2B9270
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c666ef85f1050d384d4a365bee1f8842d8dfde28fe2c748aad12bec88452051e
MD5 9cee0441c7dba1f4c9d5fa858855cbc6
SHA1 032bd41bec71425e137b5d27b899f7709e428d6f
SHA512 15ccc9743ace0b11410921ee5b008874d19eb28bf4877b768ef9e5772966685dfc351a6dfc3865f188acc500f449ef2726c1a8243c5a742d2f856e2b86cff837
TLSH
T17121F9A1F336C205C599467A513E6B240338D4569FF8FC0F54B520752EB6F180D473E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 bd088d9eb6a88130c41bf423b5cfc2b86cc19af8a016d03bb74b67a63454c9ac
MD5 4cdd69a4f40665d73965a16b7f8142db
SHA1 0d7e6951c8d6d660b2260f9a04d23e0e91dd1924
SHA512 584775f36e1c718791a4f6f127d812b5a3881abb9075e88214bed3217d169a897733ef2d154f4b065fcfed28085d41bf0b8b40109eac9d09ead548dd568a7662
TLSH
T1CDE0200476C4C6DF84F142E70274A74DD6F43840EAF83D419F10C8849383404B2BA170
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e2aab54c3347a07ae6d1ec2e1aae92d522466ef187b7ab478c9d916b6055f1c1
MD5 ee008446a8c239673acb7803057c9008
SHA1 fe8c4fac45308f5dc4d7be72d45f505fb47afedb
SHA512 53e084d41247a04c5dc165ec528eaaec45c751d52d941e74c2d967f77f7e3e2eccaca43e7b87a079fba420d47e91a9857f856f3ee78bdd9af151674ce3c0c69c
SSDEEP 3072:0Q0Tw/CiuX8SDlwE4zDMLp4sppUc0UWkF+55Y4992kp0ZB:0XtDaE4zD0mKWd7U4XE
TLSH
T1D3C31256BDBF741B2AAD8343E81D1809E8C967E3079394E48F8FB794C276383652345A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e843e6508c8c6eae01ec403ebdc5e37a607102223dd538a1f1500a24fdc06a57
MD5 dc753c670b0a9296ac249238296d31ed
SHA1 b1073b0586a2dabe37bcdc170d8cf6444e01c183
SHA512 bb184731417cad9524fbef98b26604ffebf023ad317d6647a2e2cd6b0eee3dadb5cce12baf9220f67abde70cff06bdbde5a0825eb9258e76abd9f7240a99495d
SSDEEP 3072:0Q0Tw/CiuX8SDlwE4zDMLp4sppUc0UWkF+55Y4992kprIB:0XtDaE4zD0mKWd7U4XS
TLSH
T112C30256BDBF741B2A9D8343E81D1809E8C967E30A9394E48F8FB794C276343652345A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 1533e55ea4d56817b8bd46251d1abe11ba5c3dae15cb64c6ce300403f89f1884
MD5 46869a46d2bd58c08196cd116193ca2a
SHA1 aaafe26a21015d414c9186fd689b3d56c20eccd9
SHA512 644e36f6911dbcc7bd54308a5ee9e8399dba85ae2ce50986f8dd54d7ccf52d0ce9e90ad8bc0a60fca9fb80ae618227f1a4dfb7d2ffaf49c8f3a89b8968d96b90
SSDEEP 3072:0420Tw/CiuX8SDlwE4zDMLp4sppUc0UWkF+55Y4992kprIB:04xtDaE4zD0mKWd7U4XS
TLSH
T151C312B97C7F341B1BAD8746E8092809ECD977F34B9794D88E8F7B84D26A2436C23445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ff1a667b0f791f0e598b24444ae7cba7224af39876fa615cda2b35e899282d6f
MD5 48c3a793446de466a28d5398eeed3d9e
SHA1 57bbedee7fd4d438b9ad8025095b15b4f38560a4
SHA512 6f10dd1dfe45e49d121d269956852065d5154d16f86dfd7c524383f57a599d2264befe9c301fd1bce627e5235972469915bec7ee3dca3e5d96a11b77f7156cb9
SSDEEP 1536:0cCMcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0Y3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1929302BA9E2646EB957D468176AE7809CE13130D70AFA9CC315C639C21D41C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bc2fbebcd4369816efc8c4cc3d5500cdb2ff7514bf6e413f93b1f9a31179bde3
MD5 52e0f7ac00936f5ddaf1472e727b5c0a
SHA1 510c9817c69bcc106e2cd7aa9e371586c3cf6199
SHA512 308c5d0f871a4454d4d85058e434fb20ecb332a86e7b99a6902b949576fecd272b7b1c9691b27133917d39270da7c9ab60331291348b4aefe73d31623621e388
SSDEEP 3072:0X0Tw/CiuX8SDlwE4zDMLp4sppUc0UWkF+55Y4992kp0ZB:0EtDaE4zD0mKWd7U4XE
TLSH
T1D4C31256BDBF341B2A9D8343E81D1809E8C927E3079394E48FCFB784C276383652345A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 428e3856c62bc1e27e5d12937dfc1937101440cd3b97e9a95495b0456eaed677
MD5 d6ceddb4011ed2e1890964fa69165bd5
SHA1 2d200c0f00882a8783f0965f124d8abd926cbc33
SHA512 f30a22dac468fd02fcfa76934ec506362a18434d68d5fc3bc5b5dd3522d49ea82f35326b95fa51fb34d69fa35fa5f7b53d3af37dce8f03cf801d9d1e7ff45fcf
SSDEEP 6144:0GtDaE4zD0mKWd7U4XQrOk0HOGm/SFyEE1:0yj403WerOjuGdF21
TLSH
T1C81413AA7E3F219B267D4383B51D6C0DCC4B1797229F94D8475EB3D892603833A33962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal
Size 4KB
SHA256 130ed21e6e7ad65d6f708598778452dd505dacce8e1d90b510bddf0d2ee6842a
MD5 aaf0a4f257c69b67aff52d937c47ed0d
SHA1 2633c2f0afc9d01e47c4280eacd0fb99218dcfa9
SHA512 3c42ea9e2d435b111bc3e7d83e7c5961ab15390c68b3288c0f188869572039409e722ffe1fdda94008139ea2faf1c54d415888d243db5bf4bea4cf59d44df200
SSDEEP 3:fHFlFllQ/8QuQll/lDAL6SlreqNcSFYojpuyOV9RUIU:f2/ZlCzetGy2
TLSH
T1C991124316048877EC84273F36C2009FBFB239004F81EC084174886257C06046698D2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\activity-stream.contile.json
Size 4KB
SHA256 da3e60f70ee0ba1e54d7705cd9ef957572ae8c8216726bce7b9dabb2b5f43d7b
MD5 72ffbfa9200b17c186ea326fa89bc72b
SHA1 cd7974a7703b26f2e45f3c4349bfd9ff524f58b7
SHA512 f4a0a28ce85f4007ec2163d824190f0b65e37d876c1f446d296cc5d3ff09c89463906366906e6d62062ba8c66afa79263492f5bbed227029bdc0d7d3397094a5
SSDEEP 96:Kh1CKvtM+7CkTejAdnKYycsn+56DdEHoSVvxtlYHT+mRfEml:KXCYtMmPTBdCq5wd4oSVptlJmRfpl
TLSH
T129A117EF6D34C9072B32A6F02D4F2B6DF207B0579AF55884E5498C20E0D628E10AA584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 1b7c299179cdbdd7b8bc2b311fa3b1b644cbccebfb09ac5c8b8b52d9679da0c0
MD5 fa70a07d165600c3f662f560688b8971
SHA1 c87e1bc36c1b56a98eabb7bd46352c135b6045d6
SHA512 4e3ee79b271af50f0ddecdc27d89aef73bb4f9774fd1b7fbdb728fca1a2354aef2de178c553bc27f83725156bcba5bc38408f50e210fa7daf169d4b4f574f690
SSDEEP 1536:87xRfP+F4CuGTF3cPl9vKXRpFCbuw4/YuPRF:872F4CuGVlw4/Yu/
TLSH
T1C473F9A3A3A871FB1BA537C72C0B795B62D2414AE78605CDECEDCD1DC08C655423A6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 15aacf69f936d567e88cb9e91c798e55ab8c0ff41d507b0e5d917d512406698e
MD5 aa23607a8856594ebe7249a129ef8b2a
SHA1 f5771d44fb4e1c43a120d754b5f99893dbcd3471
SHA512 16eceec4a9dc6988521af203b0b0c2bd2b387c7b74289f9db63efb740c21bb8781b92452e1da81c0aeacf6da3ddd4dfb6bcd1fde0ef41c47c1f6f2c24db15ece
SSDEEP 384:HHMO0iO024YWo6J+Sl1xDnZBPsac4j0lpDII+nd3dN:nrZYWo0+Sl7zZlsac4ID8LZ
TLSH
T150527DB99F1138E91E13D094E9BE9304CD09E6BFDFE280661A243C00CA446B8F4E64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 0f5018a2006888f82e2f99a8fdb05ff6da2c436aed96f079f47b7eeb64e6200e
MD5 0e9b12ebb4c8ffeb40a8b45b70c96285
SHA1 6d710e63f360ce67f67d3400dfb9bc04d391ff70
SHA512 4383a8cf1937db1caa3eec8b5d185a55e9489c8515464669ae777efc435057c0f2e1e4c11964be7c41e619c838e8b125b3eae9c8d26c4a8af688de41a976d13e
SSDEEP 3072:j3lTY/0IbHJfuIGp6JpIfCPdTJ4LWnuA4Pl27jiji:pT+3Ht7kpqPdTJaWuz27jD
TLSH
T1F6B3AEF6DB92CD6C65FFD01DAA82C43FFD222404B3A7200DD9636710A5C6BB86779248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8fc1f8e053e5b360d8eca1cec441098a4411818332d5bd74a827886628a72d1a
MD5 4ccf19d194e5d2c1317624ecaba628a1
SHA1 642f8d59003cc8b974a3a9eae6b11c526280d479
SHA512 df9cb2c73e9cc1b0ae490b21bbc5c9ef7d65bea7b01ff2a0590f301a241b6853521d88b4d34dc7b39e68e6a49cea1aa69ab31395dd7ef2a9c5c94223439b3c03
SSDEEP 192:y6mOv5zbowZHLfyjWK/X1d66JozGzgCl6mc0dB:y6dbowZHLfyjWmld66JozGzgC1jT
TLSH
T199D1DD68E628563FC409023BDCA61F400F76799A9C8E7F1532DC740C2D966DD768D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 08460b82e89d5d3f0a46ff81e7eabfc3983ca728c182f14c8c4eee0f0308b496
MD5 371f68944fdcdd55082faaebb6641327
SHA1 2c580e6acd64823d266730234cf68b28b7e77f99
SHA512 ad8dbf15edfa844e1221efa58bee82fc3b98e8cc74d658c2e41178d297c51cfa7b2ac0bbcbc6115032718831dd1b76b797a811c2f06065fa376bc56c148e153a
SSDEEP 384:zd66JozGzgC1j9DDCuc/CEO79NGcmhuToQRIJ5Lfodb8b5bzbvD26dbopHLfyjWK:8EHDDvfGcmhu1RIDLfodb8b5bzbrrE2
TLSH
T10CC22184FB2E913FC41552BBDCA60B001F79B88A581D2F573A5C64686C872DC399E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7c925676f5a1ff0cd476b89d39a361b39b53f11815e9d202078a472d68a4865d
MD5 3b1df9654d26e1c2a78f393e30fd9137
SHA1 2b69a274f561f2db56fded4d72b12f4236f2a2d1
SHA512 d9adeabea85350aec27149ba025b28b8562e3b4cc34991829aff019b5ba020dd6f691023a51bf2414793969b27b5a4a04ae336dfddaf8f4bd9472e5496ec2cc0
SSDEEP 192:F6mOv5zboPDZHLfyjWoQvX1d66JozGzgCl6mc0d:F6dboLZHLfyjWZld66JozGzgC1j
TLSH
T12EE11F64EA28463FC404127BDCA61F400F35799A9C4E3F19369D740C2D576DE768E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f131d4fa5ad828cf14fe5750d6a0bd472279c79b5a1b99a6ca685f2bf62c79fe
MD5 2518005110be852faf72c96b6bec08b2
SHA1 4fc042b4fc6fea67decb8ef2c0439f389d612db5
SHA512 153847a14118906e1f0f3a91debc7fbd3f3632d7c4d8b85f6b1214dcae94963544ba981665c55c04edfd27becc045340fcfa827a63912ec7f2b33f7c6cc128e7
TLSH
T135210D9C35B94D6B6A8BF6DCF440028F57554E0609C72C434D52EF8ECD896D9316A47C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f85f4d0938a15bb51b5d3bc27dc400500d042b7abfb66a8dae1fb4e0d59d8810
MD5 a127ae5d5d361e674b941085311bfbbd
SHA1 47663cefc6686ddaf0a7ea256b4e0e7941ff8de1
SHA512 e9d6ab8ea64847c48c6935093c46013d8ffff8e605a182aaf2706b6853403a33446213be1014095fe0c1216553daa691d29a8c1bb31f1d50054a271ecb14ae0e
TLSH
T16921798C3AF88D6B9AC7E698B8C0028E53558F4308D71C434D13DE8DCD8AAD9336E438
MD5 SHA1 SHA512 TLSH

Submit Download

039cdde6-8aa5-46a1-9588-584954bd8c8a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\039cdde6-8aa5-46a1-9588-584954bd8c8a
Size 16KB
SHA256 d6c84eaafcabd4fb9651acbb3342fdca8a0b0eed4e172e973ef80bab6f45409a
MD5 398f4509ca2cc1548d8b17a96897dcef
SHA1 6da1a3e88dbc9f393869cd186d52d5014d10802e
SHA512 242bdbe9a1a6d17a1dd28eb02181337104e631ff972c42bd12b93283d9adbd51b592fb10ff49f54529c128bf87933e856b29840a7c6032d83e157aa6402300e6
SSDEEP 192:T+zxBFRa7Scm9KnW5tTQibU/hhvBOG80N1YssD0Mr4X2Ess4oHadj0Vqc2Kb69tt:T+lBFRa7SPQnW5tT3IhhD80zsOQc8MU
TLSH
T17872C956186044BA8251E369D4ECBFC3E5F62CCF4C419FC99BE0BE086DDA4AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ee1e978-450c-42c3-8c03-271137633ee6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\1ee1e978-450c-42c3-8c03-271137633ee6
Size 235B
SHA256 73d5adc1aa4eb78ec3819e58c293fdee566cd10b7c7678c50a648dce1d8f9562
MD5 a67a9a62d493d3961d68c66a78179ff4
SHA1 201fb87b63fb3b40fbb42ad5e7078d63f073326a
SHA512 5de1f0e1f26e16267c172bfa1923dad5be19baee5c2a17dccb5c331048b1fc82b55c3c715ac50ddf4c71644fd6fe90a00bc8f58db1292dfd1dddd21dd2b4fac0
TLSH
T15DD097C01898276E4C148F23F0F0A9D33048CC3324B998108AD149B89FBDEC4219281A
MD5 SHA1 SHA512 TLSH

Submit Download

30ed37d1-1069-48f7-9568-d4e759f46178

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\30ed37d1-1069-48f7-9568-d4e759f46178
Size 883B
SHA256 1a965cac9cca752bf5ebc68a700a88d58245c5f17541f8cc532bde72bd3e0ea5
MD5 3b7a991ed81ba44e6c742c2ac06793b1
SHA1 05640c999e2de4b59f0d3f65c3144a9ec33fdf02
SHA512 485199f33eafd497b64f262e3ee5e729a39c691dece54d4f83066c99a802e2bb7bbd706656afd05790f1c0bee2dd67a8dd91cbb973f39a57c7451c79d7c04d64
TLSH
T1D6114081E63074B3CD78920BC55537028BE5752384C694043FA1AA084EBE92ED35670B
MD5 SHA1 SHA512 TLSH

Submit Download

4fd60d5d-a066-4e09-a6f3-260ae3276d05

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\4fd60d5d-a066-4e09-a6f3-260ae3276d05
Size 886B
SHA256 b5d70545173ccfd98cbad4f3198a3cc0f55f04a78e6b0d0ce07479f1e7d1d9ad
MD5 01ab9f1cf96e40e8b813ee8fbf0421df
SHA1 9d9c18d6def0ac976aec05669ccfd02c0e502fc5
SHA512 4af731801b913a477b289ae37b0aba5aeed2295482f121ca9ecad98991f0149e34eec0e1fc03ef18382ef17bbd83e7fa56a76668cd8205de0ca3616fcbd5f988
TLSH
T15A1140418A7478B38C68D25B84A13B424BF0B12380C64D087F61AA184DBA91E936670B
MD5 SHA1 SHA512 TLSH

Submit Download

682ec903-f493-413f-bcd5-e56168224415

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\682ec903-f493-413f-bcd5-e56168224415
Size 2KB
SHA256 52035ecbad9581943993ccb4b3dcef2ad3575494d3657b158298a1d9595c2133
MD5 a0896b711576da37c61d325688437772
SHA1 70cc58e00e4f8e2005a5a0e2c89663dccee5ca4e
SHA512 bdf7a4a14a0416570e6c290f8bc92822c73dec1209c37a49d123741567e7ddf27c1ba83f430a4d3e1a8c8038dfd6befc0a032a1464ff015491516e739555e803
TLSH
T11E41609C35B85C3B8C8BE19DD492378E13608A4304C22C932E21DE0C9CD66A9336A52F
MD5 SHA1 SHA512 TLSH

Submit Download

9de1c311-d7b2-48e9-ae06-65a8a97ec806

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\9de1c311-d7b2-48e9-ae06-65a8a97ec806
Size 897B
SHA256 d80d9ee7d235a16736f8c5635c294f7ac078bc5092c5735c33fa46e5c00daea2
MD5 441e7dbc0383c93f9c692e626f245062
SHA1 e63743f30e25da9dbea2afd811b1d9279d249444
SHA512 ccc4e98946ea080ae07941b24fff469e2453608b4b7c9bff15c38a5c208c74df8da900c0d22f32ac5a4f556ea42d671f884a0cdb5cb381b34a8f7417d5d75fb6
TLSH
T14F1104819A64B9B28D68E25BC4913B424FF4B52384C549083FA05E084DFA92DA35770B
MD5 SHA1 SHA512 TLSH

Submit Download

b1cefa86-823e-478e-b661-bc25f12a350f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\b1cefa86-823e-478e-b661-bc25f12a350f
Size 235B
SHA256 9dcd4662359ed7c7473caffc489022e2f2f4f52f44f9d3f90bfb841b847fb026
MD5 02ad1cd9d6f55d388c670b63996e5f4c
SHA1 5737d99c535c47b0935542a69e36c4eb1c191f8d
SHA512 127f9b13a4d721e387f1c27db88c198a6d2a53ab228cca94095ba34a318b6d283ee309c1104e80d6ca4af0a00dcba670106826d6bed7d5eadec2abd4a05f5305
TLSH
T18BD0A7A034A8E75D08240F17F0B17AC630544C3329797C1096A1C67899BEBC885A1C57
MD5 SHA1 SHA512 TLSH

Submit Download

b7e9629d-2e60-438d-8060-3bbeb89a3608

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\b7e9629d-2e60-438d-8060-3bbeb89a3608
Size 235B
SHA256 9cfd122556fa6960af534ae4e64f6ac4eaf0767318c223a3fba881bddd830938
MD5 795b549e17e379a9f23c7b27ab6db83a
SHA1 f03f49e10faffc14b69ab9ca51177dc0b65e2501
SHA512 e15fb4704f28e12a93b881c2c3df5b6404cfca2c6415935a6b1dba221e52a60be168f9bea4e55dd74359320ddfc336e828121f0e6990a7a53f4edf197d4464eb
TLSH
T148D0A7D55898B76D0C144F27B1E26EDB30998C3324A8A850DB5146789DBDEC84166C17
MD5 SHA1 SHA512 TLSH

Submit Download

dd9d85ba-8bab-4e42-9334-95d9b29fd5ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\dd9d85ba-8bab-4e42-9334-95d9b29fd5ec
Size 2KB
SHA256 1143ad808e29ac03842fa1fd027b5de1422ac92b3fadaae6005f680059751281
MD5 c7dd71d522200b93022ac2c44b39ccc7
SHA1 af8d392c4e668d04515e70bfabd2bf1b6c6d93fe
SHA512 f0385b006711b66e639f53804bfcb57fdf17881ab120859fd22bf5cc4bc9b905fc2665619e3d5082e289366545c8094e9d688d856a0b43185acedece6220d9cb
TLSH
T16641119939B88CB78E96F59CD4C2264D57A08B4344C318836E62DE0CDC9AA9D336E537
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 6KB
SHA256 0622ae3fba8da239f8cabc3d239b1dab7bb096096379247042bc6162e7b51156
MD5 675a9de7d3778c6177c84f5da505e96e
SHA1 867fd55ed683486a2cb98d39bbac74c93f1d9ac7
SHA512 0523816eb75cb8f1fc4237498a507952078dba01c28cb4e4d63130357d67b1fa7a09c2da3847fb95ba252522b7b3d6bd6e7a1ed3862fe5e88db97a477efe39f0
SSDEEP 96:xH89UTUfqGq8fCqVj3ObzSfnSSl8pdv9jcnFIH6OBw8On8L4cnoV0FHn:2CR8fCqVj3FnSSGB6OBw8O5OH
TLSH
T13DE1307895088F7F65B6776CAC6888715AB2013B7BBF68C350B94484051CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 6KB
SHA256 cc10727117831e53af935bd0f80d3cb561c80a0ff82bbbb8df1d9905b22e5b62
MD5 41a641a7b98aca933f428656414bb50b
SHA1 126b7cc288ecafd5c38af69fe3aadffaab5283bc
SHA512 9c340a95421b5418c921c1d6193d6c071d986a32a33b884fb406be199ad303e0c1a4b17cf10bfe9b5b7b8011013cbd54c4d38ceb571ba0430639d9b011e48d6c
SSDEEP 96:xH89UTUfqGq8fCqVj3ObzSpCSSl8pdv9jbnFIH6OBw88n8L4cnoV0FHn:2CR8fCqVj3fCSSGK6OBw885OH
TLSH
T145E130789508CB7F75B6776CAC6888715AB2413BBBBF68D350B54884050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 52236e6b6b9505c1ef08bd0670cae9588cb1606028e22edbb2cdb92f91773e70
MD5 ed8fe75787c91cf5839ad548d5e76239
SHA1 d616f362ab46f4520b3252ab579f42445b97d4a1
SHA512 418ef1972d64bfa91efbf729b92d7c8a64756fa2823e395faa897a6719cf88b21c113d0d2bf357d835dd438ae6ec6721b721ea4545f5dc526d2ab71701ddb3ab
SSDEEP 96:xH89UTUfqGq8fCqVKjfnjz1zSpSBkSSl8pdv9jznFIH6OBw88n8L4cnoV81FHn:2CR8fCqVYvoSBkSSGS6OBw885y3H
TLSH
T1B9E10E7895088B7F74B677ACAC688C315AB2413B7BBF68D750B95484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 9c3c346a2a8b8b5e0399bfa0ab92dafda217199a6452d0a3015d1d780952c210
MD5 83eab6784f6d396ca51c932bfbc621f5
SHA1 aa716944fb29225b68773198e9142aa60143a97f
SHA512 e28c90822a1eb7fe887be8051522eac8a4a92ad2ae08410ef3547274a9c5f557c87bf5b0c348423ab7bd325a53664c093b558fef405917b079d2d8ec86ccc09e
SSDEEP 96:xH89UTUfqGq8fCqVj31zSfnSSl8pdv9jcnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVj32nSSGB6OBw885y3H
TLSH
T1FCE11F7895088B7F64B6776CAC688C715AB2413B7BBF68D350B94484051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

50769891-7e78-4e23-9056-591704456983.tmp

Path C:\Users\Admin\AppData\Roaming\discord\50769891-7e78-4e23-9056-591704456983.tmp
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

memory/1120-1136-0x000000000A360000-0x000000000A443000-memory.dmp

Download

memory/1796-524-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-525-0x0000020E96250000-0x0000020E96251000-memory.dmp

Download

memory/1796-522-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-521-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-482-0x0000020E85F40000-0x0000020E85F50000-memory.dmp

Download

memory/1796-498-0x0000020E86040000-0x0000020E86050000-memory.dmp

Download

memory/1796-514-0x0000020E96600000-0x0000020E96601000-memory.dmp

Download

memory/1796-515-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-550-0x0000020E964A0000-0x0000020E964A1000-memory.dmp

Download

memory/1796-549-0x0000020E96390000-0x0000020E96391000-memory.dmp

Download

memory/1796-516-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-517-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-518-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-519-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-520-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-523-0x0000020E96630000-0x0000020E96631000-memory.dmp

Download

memory/1796-548-0x0000020E96390000-0x0000020E96391000-memory.dmp

Download

memory/1796-546-0x0000020E96380000-0x0000020E96381000-memory.dmp

Download

memory/1796-534-0x0000020E96180000-0x0000020E96181000-memory.dmp

Download

memory/1796-531-0x0000020E96240000-0x0000020E96241000-memory.dmp

Download

memory/1796-528-0x0000020E96250000-0x0000020E96251000-memory.dmp

Download

memory/1796-526-0x0000020E96240000-0x0000020E96241000-memory.dmp

Download

memory/2792-12-0x0000000005460000-0x0000000005543000-memory.dmp

Download

memory/2792-11-0x0000000001540000-0x000000000161C000-memory.dmp

Download

memory/2792-3-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/2792-8-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/2792-4-0x0000000005850000-0x000000000585A000-memory.dmp

Download

memory/2792-5-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/2792-2-0x00000000056A0000-0x0000000005732000-memory.dmp

Download

memory/2792-6-0x0000000001540000-0x000000000161C000-memory.dmp

Download

memory/2792-0-0x0000000000A80000-0x0000000000AF0000-memory.dmp

Download

memory/2792-1-0x0000000005B70000-0x0000000006114000-memory.dmp

Download

memory/2792-7-0x0000000005460000-0x0000000005543000-memory.dmp

Download

memory/2792-9-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/4528-1137-0x00000000054D0000-0x00000000055B3000-memory.dmp

Download

memory/4528-949-0x0000000009250000-0x000000000925E000-memory.dmp

Download

memory/4528-1976-0x00000000054D0000-0x00000000055B3000-memory.dmp

Download

memory/4528-948-0x0000000009270000-0x00000000092A8000-memory.dmp

Download

memory/4528-944-0x00000000089F0000-0x00000000089F8000-memory.dmp

Download

memory/4528-761-0x0000000000B10000-0x0000000000C9A000-memory.dmp

Download

memory/4528-1139-0x0000000005BD0000-0x0000000005BF4000-memory.dmp

Download

memory/4528-1138-0x00000000055C0000-0x0000000005BC8000-memory.dmp

Download

memory/5208-964-0x00000000056D0000-0x00000000056F0000-memory.dmp

Download

memory/5208-1004-0x0000000005650000-0x0000000005674000-memory.dmp

Download

memory/5208-1002-0x00000000053B0000-0x0000000005493000-memory.dmp

Download

memory/5208-1003-0x0000000005830000-0x0000000005E38000-memory.dmp

Download

memory/5592-1021-0x0000000005A40000-0x0000000006048000-memory.dmp

Download

memory/5592-1022-0x0000000003110000-0x0000000003134000-memory.dmp

Download

memory/5592-1020-0x0000000005670000-0x0000000005753000-memory.dmp

Download