b217fbef06fae0f817248a3436d0fd2021eba73bd7ed3ce2c66d521bf521ab7b

Resubmissions

27/05/2026, 21:38

260527-1hjrssct9z

27/05/2026, 21:35

260527-1ffx5act8x4

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/05/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Slendytubbies V2 Beta
Size 12.0MB
Sample260527-1ffx5act8x
SHA256 b217fbef06fae0f817248a3436d0fd2021eba73bd7ed3ce2c66d521bf521ab7b
MD5 75f6dc72bfdc0d36db0b2264bf47dbf8
SHA1 6aacfcd0869851d1c6d214cb286ae4fd6afb7ded
SHA512 6cdbefa9c4daefcd18fa322bdc5e841b9bd73bd1c730e184e30cea8b6c7cd6bfc4ca3649a005087cc7134a267f6ecc9a3a3e9485f8baebd6fc06cc27988292f8
SSDEEP 196608:O9TSqRqtuDF0/bkyhWUe1Ll+E9ZzV5zxS3L20/ORL5FQd6D36c1qqxgj3QlR7D5J:O9TdfFoaU2p7i20gxquwjVDqF1
TLSH
T162C65A09E517D0FACC0B0831511BF67F5F309A74D0208D56EB889CB5EDB3992BA8DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5952	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243914586620285"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{79651E50-7D07-4C50-98B9-E422DE92F0DA}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4996	chrome.exe
4996	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	firefox.exe
Token: SeDebugPrivilege	4364	firefox.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4364	firefox.exe
4364	firefox.exe
4364	firefox.exe
4364	firefox.exe
4364	firefox.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4364	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4364	1500	firefox.exe	102
PID 1500 wrote to memory of 4364	1500	firefox.exe	102
PID 4364 wrote to memory of 3148	4364	firefox.exe	103
PID 4364 wrote to memory of 3148	4364	firefox.exe	103
PID 4364 wrote to memory of 3148	4364	firefox.exe	103
PID 4364 wrote to memory of 5024	4364	firefox.exe	104
PID 4364 wrote to memory of 5024	4364	firefox.exe	104
PID 4364 wrote to memory of 5024	4364	firefox.exe	104
PID 4364 wrote to memory of 5024	4364	firefox.exe	104
PID 4364 wrote to memory of 2456	4364	firefox.exe	105
PID 4364 wrote to memory of 2456	4364	firefox.exe	105
PID 4364 wrote to memory of 2456	4364	firefox.exe	105
PID 4364 wrote to memory of 2456	4364	firefox.exe	105
PID 4364 wrote to memory of 3008	4364	firefox.exe	106
PID 4364 wrote to memory of 3008	4364	firefox.exe	106
PID 4364 wrote to memory of 3008	4364	firefox.exe	106
PID 4364 wrote to memory of 5076	4364	firefox.exe	107
PID 4364 wrote to memory of 5076	4364	firefox.exe	107
PID 4364 wrote to memory of 5076	4364	firefox.exe	107
PID 4364 wrote to memory of 5076	4364	firefox.exe	107
PID 4364 wrote to memory of 5624	4364	firefox.exe	108
PID 4364 wrote to memory of 5624	4364	firefox.exe	108
PID 4364 wrote to memory of 5624	4364	firefox.exe	108
PID 4364 wrote to memory of 5624	4364	firefox.exe	108
PID 4364 wrote to memory of 5932	4364	firefox.exe	109
PID 4364 wrote to memory of 5932	4364	firefox.exe	109
PID 4364 wrote to memory of 5932	4364	firefox.exe	109
PID 4364 wrote to memory of 5932	4364	firefox.exe	109
PID 4364 wrote to memory of 5940	4364	firefox.exe	110
PID 4364 wrote to memory of 5940	4364	firefox.exe	110
PID 4364 wrote to memory of 5940	4364	firefox.exe	110
PID 4364 wrote to memory of 5940	4364	firefox.exe	110
PID 4364 wrote to memory of 5996	4364	firefox.exe	111
PID 4364 wrote to memory of 5996	4364	firefox.exe	111
PID 4364 wrote to memory of 5996	4364	firefox.exe	111
PID 4364 wrote to memory of 5996	4364	firefox.exe	111
PID 4996 wrote to memory of 5696	4996	chrome.exe	113
PID 4996 wrote to memory of 5952	4996	chrome.exe	114
PID 4996 wrote to memory of 5960	4996	chrome.exe	115
PID 4996 wrote to memory of 5960	4996	chrome.exe	115
PID 4996 wrote to memory of 2724	4996	chrome.exe	116
PID 4996 wrote to memory of 2724	4996	chrome.exe	116
PID 4996 wrote to memory of 3620	4996	chrome.exe	117
PID 4996 wrote to memory of 1108	4996	chrome.exe	118
PID 4996 wrote to memory of 3620	4996	chrome.exe	117
PID 4996 wrote to memory of 1108	4996	chrome.exe	118
PID 4996 wrote to memory of 5156	4996	chrome.exe	119
PID 4996 wrote to memory of 5156	4996	chrome.exe	119
PID 4996 wrote to memory of 6064	4996	chrome.exe	121
PID 4996 wrote to memory of 6064	4996	chrome.exe	121
PID 4996 wrote to memory of 5744	4996	chrome.exe	122
PID 4996 wrote to memory of 4680	4996	chrome.exe	125
PID 4996 wrote to memory of 4680	4996	chrome.exe	125
PID 4996 wrote to memory of 5788	4996	chrome.exe	126
PID 4996 wrote to memory of 5788	4996	chrome.exe	126
PID 4996 wrote to memory of 5624	4996	chrome.exe	127
PID 4996 wrote to memory of 5624	4996	chrome.exe	127
PID 4996 wrote to memory of 2268	4996	chrome.exe	128
PID 4996 wrote to memory of 2268	4996	chrome.exe	128
PID 4996 wrote to memory of 3084	4996	chrome.exe	129
PID 4996 wrote to memory of 3776	4996	chrome.exe	130
PID 4996 wrote to memory of 1888	4996	chrome.exe	131
PID 4996 wrote to memory of 5216	4996	chrome.exe	132
PID 4996 wrote to memory of 5216	4996	chrome.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Slendytubbies V2 Beta"
1⤵
PID:4952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {5624475f-dda5-4b6a-bd1c-7fc6a6cbd483} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27136 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {70d909c8-f48d-4c6a-8a70-6b4b42933178} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27277 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {398e1ab2-b47a-4a87-851c-12f28247b9b5} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27277 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {3a4793a7-5dd9-49de-9826-e56d54750665} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3100 -prefsLen 34776 -prefMapHandle 3020 -prefMapSize 270279 -jsInitHandle 3060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4480 -initialChannelId {3f834239-6daf-4112-81b0-018a6a13d87e} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4924 -prefsLen 34825 -prefMapHandle 4860 -prefMapSize 270279 -ipcHandle 4932 -initialChannelId {0a5bd04a-f881-4636-9463-7d2f3c5a65fd} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32952 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {76951a71-f13b-4768-b99e-0258f9a06fa6} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {cf6ed774-8af0-4e35-ad90-670e31a76a4b} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4916 -initialChannelId {3abb0671-1999-4cd2-b036-5ec669e8bc4c} -parentPid 4364 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4364" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffadb01c728,0x7ffadb01c734,0x7ffadb01c740
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,8061275385341340859,14104542124580883161,524288 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,3092284425071734285,8984648293242915876,262144 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,15180195392971677604,6087029561831372771,524288 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,8246540323544676859,13830965389512717106,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,9215406473387095359,7580811566461309992,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,16084676319870915324,384144406082909481,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4552,i,5047557386547694781,8603229003240165799,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,6687720971038683385,9699023794181663691,524288 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5700,i,1400933035243404016,11491107651427201696,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4616,i,957005753617089479,15228717664423152326,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5964,i,9995521284669113697,9890841063398412196,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3344,i,9003375561436804996,16002178359053741652,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,14457371208493345049,17851348576688179043,524288 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,17551609844412225868,9630999452487894961,524288 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3516,i,8354616140813784725,18191159899815559705,524288 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4396,i,12924490339775389237,9223818386945114092,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4420,i,4573038619813352764,18198402113664755560,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,4986199666174051123,15189618357159179223,524288 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,16873171330625792996,13462160122186780720,524288 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6388,i,394282442590674828,9135834123644361115,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6220,i,3947539091959054453,9003756221722848987,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6552,i,5473933502441513430,15444109158117393087,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6732,i,10505059117625192903,8901479643145570739,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6872,i,12721655164804354441,89683591960966745,2097152 --field-trial-handle=2128,i,5674809477695543162,12791785341474334333,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:5060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7d548b46e466677455ff08cc7fa9115066237359fa59612df43187493e1e5299
MD5 72c4aa9f77f77159f6265aee61ca1cb5
SHA1 9ab37b68d5102fd5612a9e33e6aa0e2e6023e4ed
SHA512 3aa442a0a95f9eacd8982eb2844e065361719759f91e131b4319fe5682e40681aef83ff550a7344ffaa83a7fbb3a8caccaeca1640aab7d528734e6c46438f335
TLSH
T173F0F4B6D921EC371DFE0B5920644B46EB94136B2741884B3A3D830D8FB9A7B468691C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 ee857035a466e44085b159cce3783f9d54f2c984570cb0fb5d3739d8bdf10f32
MD5 e0aa99530f31c84da684f7fa3998cfbe
SHA1 0f8fd9f3459ba054c0e744efae1e99f2c007e097
SHA512 5f7398515cb02f68b38d7c9c4fa67e877903642d1a8f47bdc8c861fcad9ec684ee279d796910beb6442781f60173990d54598c8a1f0bee5dd4c8dccf5e15f848
TLSH
T1ECF0261C20A41296C7F51D70DCF445E2EFA40B471C00BF030770A173A0B3F743440845
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8eb0ad7cbcbfe227d9409fead435a0bbe1dd2bcdea88e6f562950eb295b04432
MD5 f50d07478d84ccfbcccc58ebd9a0861b
SHA1 c0912540902d227be08beaafeec4b6613732ea6c
SHA512 58da97c4ce9fc5038501f08a93479237a47907c67731195675024fc5fa48412b93bc63c644256f701e9ab520f77737e9d38209438fa56fcdf289b2b439be4578
SSDEEP 192:ARmYcBzfxiWwfm7CHav7dpAPRp2ONetN9Q9Hsb+WNB1fQ4aXCsV2RN7Ykw/VyIsB:ARmYmzJyfh2BUXGqwc5P2I5e
TLSH
T13B52C32FB910297B9DEBD26AF9217757D3F5102165982E84EAF8CF1C08EB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a777715ad3151ea5e8081c5b9c9626e97ca35c364b4c87a54547dc89d055dbda
MD5 f4e43e1d15ce5d2391039d74822b48c8
SHA1 c4b7545f471e0d01620f7ad1ba75e20371978780
SHA512 2cbfb967d75a3f977232043c1661df90302fdd81255c3996bd47dd003a6b7f0ee981e1a99a1d2e811120118dee5a14b2d80311c994c70e7c0e46f9ae7deda5d0
SSDEEP 192:ARmYcBzfxiWwfm7CHav7bpAPRp2ONv9Q9Hsb+WNnfQ4Fy2hN7Ykw8VyIsnAUgtaJ:ARmYmzJyfh2fUX9qwIt2Y48
TLSH
T13542B42EB914653B5CDBD76AFA217B53D3F9103165982E84EAF8CB1C08EB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 dd2f60b87c921e0c108510918a4feab66d3dbd4c764762bb5eeb58b6c1cf829c
MD5 8e57cb8bfea0622664b34a683f258fe9
SHA1 7ade466af827577f464ccdeb75e934acd9dae0b2
SHA512 cb689c26a4fa66e4985e12ccda8317926a3b0861560065212cef74a011ca18aa9b68950bce8600ecda9aab4c7dc3d35fecf7385e3d9b44d84b7ed25efc483732
SSDEEP 384:tnjp87KxkXqKf/pUZNCgVLH2HfgsljH7pLuLcSjjeXODpk+ErU3hCHGfYT8+wA:tjp87KxkXqKf/pUZNCgVLH2HfgsBH7pl
TLSH
T1EE7219677C4C8E770F94D5CCD8267B4F9DB5024B65E9886883FA982903D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e09eeecbe270372595e8a44a86b3ab17abdbb68b6716062a7627e515f175823a
MD5 dff47d7208355dba6a37f304b9154222
SHA1 c1ccdaeeeb6905326b66f07179ebff490716b1d0
SHA512 712b02698629b130b6934a95a5b50c37c176b9793f2fb4d1aa2ea0271ac7e40cf4ffcd4cf96b22863094831044fe03b28d32ecc8dd8ae5e98a92b9312718ba6f
TLSH
T17FB01201C0816141C48302B42142548872585F109A0E1B0143E06923D825275C124061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e0a2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e0a2.TMP
Size 96B
SHA256 3addf17e014bf45bb96caac32aae5e9827f84634b64a24de00afedd4b580ba3f
MD5 da684975af6c8abbb3726aaceca70855
SHA1 a51f0e0976db33a9ce9a3c8d12f8914db13a82b0
SHA512 674f082f9adef7bc940e813fe36936b68da110c217652efaddd95fc59fef6195efcc021f1970a2379ad96c568b18df0e0c42b7e631bba3acc27689b733b86471
TLSH
T177B022C2C0022202C00203B02B8882C83228CF20CB03A22283E00B2BCC2C2B20030028
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 db652f0db027c545e7dee642a3895df7718b686f1f62756a7d55a9a8d0d2288f
MD5 329c75511c8a35de83524ebc1036e480
SHA1 6b847e70936daa40bc0227ea681db0f320d298b1
SHA512 8e0aa483d6d52eed545550c0b705eec5d33aba2a60783f896697c32e2d01795e249e1ff6493e05accb4b2ed66403abf57af30f60aa37535b8a011f34a3c26388
TLSH
T1E9A0025876C43E55DC0452F014C296503B1569296655CA07A69009CDCE573414383040
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 5f7b7a0506d6961aad4f7231a061dd5954def8fcf07170c1ca3eca7ca226b06c
MD5 d37f67d85e5c3ac18a30f531d8801fb5
SHA1 df10bd8b6880650aab6c9d022113700b5e13b28e
SHA512 77cabd36cf51eaad9bf37f076a2133a472d511c54df11a5332b5d61132abb10c7e0873c159a6f225e3178195dba0c2d9373d9bb3e381fef5acb554aa15da182c
SSDEEP 3072:2nHVUJVjOYhk6o7zyZ5MGss7dpzCbzjyzqfHsCqfRRV6mr9FX8RtWZ/Q+KLl+13L:y2JNllk3Wz3CqfRRVZFX8KZGES4T
TLSH
T1F73423B0AC87464D7AB4E68EC29F3E0FB2BF9551C6705AC2648F471BA05A1C12F62E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 15538c07cea9e48fa7de645fc7c8bbc0c06ddc8df3b688b734156f7518407540
MD5 c2aa0090445107c94569f85068912d61
SHA1 6601362f83d7a46bc3049499f7ea7833a7894dc9
SHA512 a406800ed7b226fbbf1097d20c65a66efef9665d9b424339f136f877bdc1f32d9ec9d817c116504dc9e4e6c6d81bb19bd770cdc3c1fbae01da4e84637d5b4f01
SSDEEP 3072:eqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:eqfRRVZFX8KZGES4F
TLSH
T133B312F1A91AC96FF752630DC3CF2F0FF66EB141D1265AC0789D052E98477812322B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 7778ab7ab54e388a2b0f3ed23c37a3d3ac282e9f38e367cccc485772740a1bb5
MD5 b46615d0c8526db90af6203f7f035049
SHA1 d83b6d074340679c39749d43bdb4ad20f71cdd83
SHA512 d02f5e273a9e9a5683acb313781f73954deb0daa8cc94df951f32176e7654662f0f5dd72271c7d7dcaec623e9dacce35c91e272123a7617e4a941473eec1f747
SSDEEP 3072:bnHVUJVjOYhk6o7zyZ5MGss7dpzCbzjyzqfHsCqfRRV6mr9FX8RtWZ/Q+KLl+13L:z2JNllk3Wz3CqfRRVZFX8KZGES4T
TLSH
T1273423B0AC87464D7BB4E68EC29F3E0FB2BF9551C6705AC2648F471BA05A1C12F62E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f6ab9a044cd560aac9fe5ce852611c8cddf65e05d72e6d0fdf88f5bac67a19d3
MD5 201d370344bae118976439b6055ccc8e
SHA1 c691e5db8ec23955cfee546a68c20a834e45137f
SHA512 18da7e9294abb9721abaa883c153c39355b22034d8805dbd9fe5b47cd50b7fdc3089eee7e0bd1d665fb5ff0e683812b5e62041fe751095fff16e692a16a43ca8
SSDEEP 3072:9nHVUJVjOYhk6o7zyZ5MGss7dpzCbzjyzqfHsCqfRRV6mr9FX8RtWZ/Q+KLl+13L:52JNllk3Wz3CqfRRVZFX8KZGES4T
TLSH
T1EA3423B0AC87464D7AB4E68EC29F3E0FB2BF9551C6705AC2648F471BA0562C12F62E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 766588148d6d5a22c0f83cee5548fc3eefd9c85b14db78d2f74f54919f9299d3
MD5 2de4201fd94e43b3c470125f46ea7c54
SHA1 7297b37bb929b6977a9b949d3c3dab50d585c3a1
SHA512 aecad648579b4df37a448cdc6424db6997f54d1e1f10fd59565d6022f3f9204ee1dc32137c92ee833dd3486941f469aa1e47cc96b35d7ae905cda47babb32d2d
SSDEEP 192:POv5zboBZrOhyjym1d66Joz1zgCl6mc0dz:gboBZrYyjTd66Joz1zgC1jd
TLSH
T17AD1B968F629867BC409027BCDA61F404F76788B988E7F1531EC640C2D572DE768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3df01c6605d043f815c4a635149a810f5049c79a518e814ca5cdc5d2af63fb48
MD5 09a5431b32f55f31661ba4fb32e9c9bd
SHA1 7b7baa06984b4128b1a47e6133f69e9a222a1ed2
SHA512 2f6c0a4d7845b6addd5a0f35f72e8a91f6fa4e0f698252b512e71b988f8cb82e18be14ac06bd781ab31ede7ced4b9dfb53e771e32646ef10b3ebd5584b2337f3
TLSH
T18D21444C3EB84EAEB8D7F2987480118A57864E0614D71C871D12EF8ECDD5A99726E83D
MD5 SHA1 SHA512 TLSH

Submit Download

1f225ea2-e851-4bc6-9ad7-0fe232a73078

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\1f225ea2-e851-4bc6-9ad7-0fe232a73078
Size 16KB
SHA256 e67bc3cbb5e1112d4bcf352d36f903680b7932bcdd8812b7557d565362d8dbbc
MD5 e9987f6f33eb3cea4b53e0ea408212ce
SHA1 3a7867ef4b6bb23b01a8d3b099b30dba8fbece8c
SHA512 76468095840fb281bea7c21f7aa9f1af21646b726fbbf3858b7513dd0417d3fd4a4924558fa8a4e32c8a26a07c4df14ab40f103df0ad02adcbda922b73d5b2ea
SSDEEP 192:vjuXmFKsWZAuCgbS725iqX1KyNI+aoRDgJCgpau5P3ZVj7itESfGRzxDKg0MlVHg:vjuXmBpu5zna7itESuRlDKgBfTO8w
TLSH
T1D572CA166860457A8291E368D4FC7FC3E6F528CF4C419FCE9BE4BD0869DE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5aff3824-34a6-4f9a-95d3-1eadd7ac1a71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\5aff3824-34a6-4f9a-95d3-1eadd7ac1a71
Size 883B
SHA256 dc9fe4c63d15e07c207f9888283c44f376df1e47bfa1079abbee0941bd5988d2
MD5 baecf9f9ed90a8e6a68b2e717786c3f6
SHA1 dd592d460cc0273f1c22026d9dea6d3e44be4180
SHA512 70392368039f120288fc3415d85a0a50e454e240cbcbb76809bf4604f576109fb7c1eda47abb815efc71ff61163ce81977b61122ef9551c84861f1653098a5fc
TLSH
T1BB112380A234B9F3CC78C297C9653B02DFECB51384C694043DE16A040C7E62EA3AA34B
MD5 SHA1 SHA512 TLSH

Submit Download

7fb22dd6-41cf-4262-84e8-3eeca4f0937b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\7fb22dd6-41cf-4262-84e8-3eeca4f0937b
Size 2KB
SHA256 313d0da2b00734d78dd7459b182bb2a1919fa30986bd67462bac40d04e6677e7
MD5 b002bbb46500aa7667fbc43d587be961
SHA1 c7a3214bb45336ae417ac79e5f0fc3e4088cc02a
SHA512 05c295889f4f7b7e2ac3f4d5afe55948aea1b3ec91b925c3fb15c7fe055e3e849fe1c7579ea81d826c34ea4a161e7f1da0d4d8a3669135eee4966d614471be62
TLSH
T19341316C35784CF68DDAE18DC891234E57648A0310C268532E62EF088DDAADE236A53B
MD5 SHA1 SHA512 TLSH

Submit Download

d0f81083-db80-4959-88cc-8e6bc4868759

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\d0f81083-db80-4959-88cc-8e6bc4868759
Size 886B
SHA256 6a4209ce486c4d18a2f66288e7ff53a5ff1ad1df8dcf5917c7c626198feac963
MD5 96c0ecb5cc55360e5f7e416c1b3ad154
SHA1 34f08e034da37c291a94b087992d9cef467f5ea1
SHA512 7a93f7fa4b3501276945f42975f4a54577a2294e5b1ac0ea0deb91382828960bfef340c61e54b314d59861ebce252904c1127a66d6b089a05508ebafb2884f44
TLSH
T1C1112380967579F38C7892C7CAA43B028FE8B513C0C65C047E916B180DBE51F93A7307
MD5 SHA1 SHA512 TLSH

Submit Download

d3a5e193-0b2a-43b7-8907-0a5711c17195

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\d3a5e193-0b2a-43b7-8907-0a5711c17195
Size 235B
SHA256 4e7197d4d0e737deb1bf8cb6aad918ed145e9dc53ea8a1c86067166004f4e3ec
MD5 ba046c616a9366ac38f5c1c8ca69a1fd
SHA1 1f761065181d2b6ac4f86751d625d7b7d1b06dd7
SHA512 315499a7680f2e7752ed58dbb7c330914f2ecee0faa7d3f74bd2099f7dc554b55d4d791507844adbce0d27269c0bcece6916099056e0c56bf3fd8ae4b1aed3b7
TLSH
T1EDD09780188EA72C08000F02F0E169CA30854C3768A06820899102B8CAFAEC48121807
MD5 SHA1 SHA512 TLSH

Submit Download

f009f82b-1e96-462f-8668-ffadd2bc5f58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\f009f82b-1e96-462f-8668-ffadd2bc5f58
Size 235B
SHA256 2b0d5d1b68c46471fc6347355a229ed20861b426db40328b939ebc281d401c5b
MD5 3284fa82a5b046bb6fccb437b29a0fd0
SHA1 89e94c726c7de8765eede7c2a73ce65048ca3c64
SHA512 bc689938075383a6baff71a5c3040faac9e91ace483b07781057b88430584149ee3fdf97da080edacf323afa740a53786b82c080836d5e50bd9f849189bf8580
TLSH
T13ED0A7951498E76E08184F17B0A56AD671898C3358A6AC20E6924675AABDAC8436181B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs-1.js
Size 6KB
SHA256 87848885844d752216f331621e01c51beed2ee50443be59043194f52024a13c8
MD5 6102366272c726c46dfff82e5c7eb750
SHA1 ec178156a93d10418e3422d9740f73451c752996
SHA512 04a8c9c0fa829d9fd380948f37036aa969b3e8769d7b0277f62ad9b8a58df36be2229096b42dea41c76450dcaad7472276804e6605a5cb01d0e7157c2302f2c8
SSDEEP 96:xHThUTUQqGqyf1BGEjC1zSbSSlNdv9jBnZRHboedaBw88P8L4cnVWE:zrRyf/LGySSz9bT4Bw88m
TLSH
T12DE130789408CB7F74B677ACAC6888715AB2413B77BF28D750B95484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 6KB
SHA256 0554f43e52ac02fe851f73ac9ce200ab3d69a4f09b5d08ffc6bb8b818eaf3b68
MD5 763092f9bad8554e378acb61fea611a0
SHA1 7da815287747b3ce4a0ffafb309a7eb3594cab30
SHA512 2d828349a9247eb7e62b3857c7b7b60a1eca734a1a34f88885d0c7fc2d900a46349145286b3786a1f30ad30132360e57c6d71dbf2ea3a7c7c5a70e8bce231646
SSDEEP 96:xHThUTUQqGqyf1B3J1zSOYSSlNdv9jsknZRHboedaBw88P8L4cnVWE:zrRyf/3JnYSSP9bT4Bw88m
TLSH
T195E12F789408CB7F74B677ACAC6489715AB2413B77BF28D750BA5484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download