3b1284aea38772a0379bc544b5c9b5857a2463681a1fdd95768a318b0c8a194e

Resubmissions

05/07/2026, 17:28

260705-v1237sas8m4

05/07/2026, 17:25

260705-vzc3paas7l6

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZKM 24.0.2 Binary.zip
Size 9.5MB
Sample260705-v1237sas8m
SHA256 3b1284aea38772a0379bc544b5c9b5857a2463681a1fdd95768a318b0c8a194e
MD5 1b6ffe3c7f2787f391ea1cdb8bd48176
SHA1 7b1fb23aa09002f64cd7fc31be729b62e519cf77
SHA512 4e0f54bdd53c4114d622368023f8f8b1048e62d477fd7244c4ae07faa4a2efdaecdc8f4974a4b055c3c2401df71135216c7ccc75d9449ee9f92257eae5047727
SSDEEP 196608:+Hn/aDFyIpWbaXE1b8ChJZR0LsfNAU2wDFQx5IO69FzSUpya8:+HyJyWWl8ChrfNAU2Zx5Iprf8
TLSH
T138A633869A8950D07061F84AC5E1FD79ED90CF697F3EC1BFB122680B6BA1AFC7650434
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
652	chrome.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277461167825949"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ZKM 24.0.2 Binary.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4432	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 1264	3220	chrome.exe	82
PID 3220 wrote to memory of 5108	3220	chrome.exe	83
PID 3220 wrote to memory of 5108	3220	chrome.exe	83
PID 3220 wrote to memory of 652	3220	chrome.exe	84
PID 3220 wrote to memory of 4596	3220	chrome.exe	85
PID 3220 wrote to memory of 4596	3220	chrome.exe	85
PID 3220 wrote to memory of 3960	3220	chrome.exe	86
PID 3220 wrote to memory of 1828	3220	chrome.exe	87
PID 3220 wrote to memory of 3960	3220	chrome.exe	86
PID 3220 wrote to memory of 1828	3220	chrome.exe	87
PID 3220 wrote to memory of 2136	3220	chrome.exe	89
PID 3220 wrote to memory of 2136	3220	chrome.exe	89
PID 3220 wrote to memory of 2676	3220	chrome.exe	91
PID 3220 wrote to memory of 2676	3220	chrome.exe	91
PID 3220 wrote to memory of 220	3220	chrome.exe	92
PID 3220 wrote to memory of 220	3220	chrome.exe	92
PID 3220 wrote to memory of 1568	3220	chrome.exe	93
PID 3220 wrote to memory of 1568	3220	chrome.exe	93
PID 3220 wrote to memory of 2324	3220	chrome.exe	94
PID 3220 wrote to memory of 3288	3220	chrome.exe	96
PID 3220 wrote to memory of 3288	3220	chrome.exe	96
PID 3220 wrote to memory of 4856	3220	chrome.exe	97
PID 3220 wrote to memory of 4856	3220	chrome.exe	97
PID 3220 wrote to memory of 4556	3220	chrome.exe	98
PID 3220 wrote to memory of 1568	3220	chrome.exe	100
PID 3220 wrote to memory of 4532	3220	chrome.exe	101
PID 3220 wrote to memory of 2492	3220	chrome.exe	102
PID 3436 wrote to memory of 4432	3436	firefox.exe	108
PID 3436 wrote to memory of 4432	3436	firefox.exe	108
PID 4432 wrote to memory of 4016	4432	firefox.exe	109
PID 4432 wrote to memory of 4016	4432	firefox.exe	109
PID 4432 wrote to memory of 4016	4432	firefox.exe	109
PID 4432 wrote to memory of 2448	4432	firefox.exe	110
PID 4432 wrote to memory of 2448	4432	firefox.exe	110
PID 4432 wrote to memory of 2448	4432	firefox.exe	110
PID 4432 wrote to memory of 2448	4432	firefox.exe	110
PID 4432 wrote to memory of 196	4432	firefox.exe	111
PID 4432 wrote to memory of 196	4432	firefox.exe	111
PID 4432 wrote to memory of 196	4432	firefox.exe	111
PID 4432 wrote to memory of 196	4432	firefox.exe	111
PID 4432 wrote to memory of 3068	4432	firefox.exe	112
PID 4432 wrote to memory of 3068	4432	firefox.exe	112
PID 4432 wrote to memory of 3068	4432	firefox.exe	112
PID 4432 wrote to memory of 3300	4432	firefox.exe	113
PID 4432 wrote to memory of 3300	4432	firefox.exe	113
PID 4432 wrote to memory of 3300	4432	firefox.exe	113
PID 4432 wrote to memory of 3300	4432	firefox.exe	113
PID 4432 wrote to memory of 4624	4432	firefox.exe	114
PID 4432 wrote to memory of 4624	4432	firefox.exe	114
PID 4432 wrote to memory of 4624	4432	firefox.exe	114
PID 4432 wrote to memory of 4624	4432	firefox.exe	114
PID 4432 wrote to memory of 2600	4432	firefox.exe	115
PID 4432 wrote to memory of 2600	4432	firefox.exe	115
PID 4432 wrote to memory of 2600	4432	firefox.exe	115
PID 4432 wrote to memory of 2600	4432	firefox.exe	115
PID 4432 wrote to memory of 5156	4432	firefox.exe	116
PID 4432 wrote to memory of 5156	4432	firefox.exe	116
PID 4432 wrote to memory of 5156	4432	firefox.exe	116
PID 4432 wrote to memory of 5156	4432	firefox.exe	116
PID 4432 wrote to memory of 5164	4432	firefox.exe	117
PID 4432 wrote to memory of 5164	4432	firefox.exe	117
PID 4432 wrote to memory of 5164	4432	firefox.exe	117
PID 4432 wrote to memory of 5164	4432	firefox.exe	117
PID 3220 wrote to memory of 5460	3220	chrome.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\ZKM 24.0.2 Binary.zip"
1⤵
PID:1188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff89f1c728,0x7fff89f1c734,0x7fff89f1c740
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,17433163621459757063,6070684019029391656,262144 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,13252141032915974668,3470251040942158874,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,5181185563331185174,14478051930542684421,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,6031710153732645669,11388096893564519750,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,838103039374502012,4976038448954126235,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,12837685069260971889,3183018531872880034,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4484,i,8453428953942422511,16373908943553862505,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,13342361581957264890,11988290615426531935,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,43973358105510604,16615631081756918793,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,3450700111643670943,3168124622270257125,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5868,i,14161378212562511804,4187776621558669987,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4664,i,9723693026155130934,9192179628501017986,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,4630504764068893984,7206348791136523051,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,14251515654139712845,17394099848454200564,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3648,i,12741002190755507268,5793211278948013849,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,15651017977655360999,12256204344904399983,524288 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6064,i,18272174474794299438,11382231039730064929,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1144 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=212,i,1979240808647380409,16401734703119206774,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6432,i,11983292989357372502,6034679195404213056,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5228,i,8032361926801822453,11469287145445670891,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6372,i,8828103941850660677,2771538819308629699,262144 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6276 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6496,i,1127580195265943468,12199701025997860017,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6244,i,11837843096069766975,3130788423845954616,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6508,i,1280734110779366641,7734195383335383789,2097152 --field-trial-handle=1948,i,10267301950507887435,9807441388656833462,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4000

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {3b4a6055-fb2f-4d6c-a426-5054a16c45ad} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {d3d223e9-e9e2-4761-a526-a4102fc5136c} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27323 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {ec2e5f6b-795a-4264-81d5-a09f08362145} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27323 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 3952 -initialChannelId {27bdef09-e96a-436e-a88b-41796dc348a7} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34822 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {5e3125d7-fc21-4a47-8816-2e5fd6c3c4ee} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 35010 -prefMapHandle 4952 -prefMapSize 270279 -ipcHandle 4980 -initialChannelId {f7ef8019-31dc-4efb-a19a-53ea05e5d163} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4996 -prefsLen 32900 -prefMapHandle 5000 -prefMapSize 270279 -jsInitHandle 5004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3040 -initialChannelId {f0027280-3027-430f-a0e3-f6f21374eeed} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296 -prefsLen 32900 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {6b71cfdf-cb18-4d0e-9105-c57fd0294707} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32952 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {49979e48-80e9-45f6-b8eb-bc413f93344c} -parentPid 4432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e494c7e54d0c888160a7a0a251240c350bbf638737c268054890974d67236ebf
MD5 b1e53b92987a1853d5abac0b7f68b7ad
SHA1 4c9e9184655cf261ae517ac50133c987bd1127f7
SHA512 d50b7f8a6fbddf59f6246fbf79ca8c2965b69b3f49a2ac898a3b9d1000c4b3a71eb9927420be24489f7e2a2d77a0cded122117bf689b294f06aaa527a7d28085
TLSH
T14EE02BBBD831DC370CFD0728E054478AE711039B2B80894F3A3D86088FB077645D592C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 069e73e3b8ac0d37fd9996917750c6dcca534f86f5a3c37f4ed9b782bafc065d
MD5 556065c3675f324073b9dedac420fb88
SHA1 72e8c7aeb5610c36c6c78d2c47aa20c46d6b9654
SHA512 195526cdaf596e06b11d2f278f2cc92d4cfd8c14541830ee0792d88627f9bfe74704278e279532f61cb2f7e1160affbb0d80ca67237d533a033eb32717c9e993
TLSH
T1F1D08015574618F1FF454570F4CF1CD032370CD486221BC985F955E46F35F9843C5510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 f18c9831d69dd3ff5f3601c37c20160646199a2a33ad63d152189054ca467644
MD5 ed419e50d75a1243224a49ae854a3720
SHA1 281075c45efd351c38e4703d8f954b624660bb91
SHA512 dbf3061a50e6433620ea89cf35b45717ecd567888dc0303f9de2bccdaf9998cd576c56fd252a0e07fc40539b45e62aab5f0b43a6a55eae4054d195d98074c7c0
TLSH
T18DF0AB2A35C20CA2DF58067048EE0C2123F30DD804763BEC406C9198AF366BC4340D70
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de40a312c616eb8c9d5872a91c669961069e4ff18c2acd8ba316f9b57afdd6ce
MD5 44c4a9c98080f4bdb2dd6068acc6c710
SHA1 7518f27dedb007d35b36dcb882d4bcb325cd33fa
SHA512 19b4f4db4f47bde20a3f873ac381811e0ab8798c8226bc23e93bfd96031c351c24378848c4ed14cdf426f3270a9a7e36ae8e248f8c994378aa5c2b9059a3c237
TLSH
T1F9519BF3C3E4957E890156F4AB156E1FCD2E0A14132C3C66C8D4AF5B47E2872D21068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 da5a76c98231510d95d1e3653584f57ba16000361c3ce8e760861dd30d2ce547
MD5 464ce66354e1e7f4f1ea9b21e6a338b4
SHA1 112e35212d4f4b7e215d42636eb08f9813e05bec
SHA512 929002f99bfd10e017a8e3ba3c690863e7d36c0b7aa0199f036aced14e04c34fe0184e0e72e8ac7796646b1f60a69ca892744371a4e3fc23b9ca606a161f8618
SSDEEP 192:hR7vvOL6+W19v7H+pAPRp2Gp9WHsb+WNnG+YwH8r2wid2tCu8kw2rUDVyIsnAUge:hR73mW19iUXrUwbrcr2w+2tCu8yUle
TLSH
T13E52D53EBD14A97B9CCBD229FA617B53D7F6206261901E80EAFC8E1C15E35CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a892b4ae70cfe9b52058ee635db61dd11da079bbdc5ba1ed6ebeedcbcdce3cdb
MD5 7defb0c8e1a419635e4aece61b2ad72b
SHA1 9f4297ed4503632f49bf12ec19e68ba3873a57e5
SHA512 a9f727cae9363e07e7b701efb6bd6a72069b5ca44795a2f2d03a26c551a486eebab849a424935b52efeaf7c7a5e17ed2fc7c584c020051d411fef41873f705f8
SSDEEP 192:hRgvvOL6+W19v7H+pAPRp2Gp9WHsb+WNnG+YwH8r2wid2tCu8kw2rUDVyIsnAUge:hRg3mW19iUXrUwbrcr2w+2tCu8yUle
TLSH
T19852D53EBD14A97B9CCBD229FA617B53D7F6206261901E80EAFC8E1C15E35CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f9f85accf46745ccf30434f26c069091105222d216469a676435c678aa5bf64b
MD5 d7b80c90d10382ea947e6d9b477cd9fb
SHA1 36d26b4aeb0779f2fe817a415a2fc6d41d41e1a4
SHA512 f1040dc2d62942558b57a46f7e46245026b84c7a1a750242daf6e648472f3d2e31bfef7a28529923e13abacee86bc2411fdbf9d676cde2f3bcdd24767cc2b889
SSDEEP 192:hR7DvOL6+W09v7H+pAPRp2X9WHsb+WNnG+0Md2tCu8kw2wUDVyIsnAUgtaJ:hR7zmW09iUXQUwb0c2tCu8BUl8
TLSH
T16742C63EBD14A83B9CCBD329FA617B53D7FA206161901E84EAFC8A1C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9d1f7462219bc04e1808be6e7052e673635e2ecb922a491436333ecdf6787f5a
MD5 6ee6018e49f56f46da94bf5e6fa01c92
SHA1 1851ef3a55ea2f14c37ae29146d3f0f5de28af41
SHA512 647b89d3323e3b6007f462fdec39fca39dd371f8531f37c7f1992c6e703e28e8356217128f97ca2b780d995421048cf25a48e58dcd92b9cda303b3967723c40a
SSDEEP 384:hRnmz3mW2MNiWXrUwprcr8R272tCu8QUle:Lmz3h2MIMUwW72Zf
TLSH
T1D762F76BBC2459779CDBD229FA217B67D3F5206261A01E80FAFC8E1C15E3ACD2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6c7493da85df90694a20acbcb9c2dd1baaefe669ef7141dac7fa6c3b55941d91
MD5 c4f471189ddb9e3db73b60a329c846af
SHA1 34a62e6e5a83939d1efc6296cb04f871b24d2cec
SHA512 5a1e5c6d038fe8f8471231affce28a9f121892bf179ad6e747421f24cf7421b29a57bebc534fc584163e95f2ba06d9f89f7dbb6b110debef09b8c8da03d75da4
SSDEEP 192:hRncBzvvOL6+W/e9v7H+pyPRpoEHCgp9WHsb+WN3+2G+YwH8r+Ea2bd2tCu8kw2f:hRnmz3mW29iWXrUwprcr82J2tCu8QUle
TLSH
T1AE62F76BBC1459779CDBD229FA217B57D3F5206262A01E80FAFC8E1C15E3ACD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cc696e5a2e5e42db10467150c14744ec238eb72b31360d66fb0cef49fa0779e6
MD5 c1b09c59c4794c5d0a546229a59fe4a3
SHA1 57772355da87f38dbf261fd6d24fad91ecc2a0ac
SHA512 0216ba706c6f71f39248b7fcd0f52be8386b1a8d348ae5c6e7f3787ba83438582e45b26eb9be0c7c37ad0e64718104d698df7c1ffc84d5dd673530b141dd4bc8
SSDEEP 192:hR7DvOL6+W19v7H+pAPRp2Gd9WHsb+WNnG+YwH8r2w7d2tCu8kw2wUDVyIsnAUg8:hR7zmW19iUXPUwbrcr2wp2tCu8BUl8
TLSH
T1F742D53EBD14A87B9CCBD229FA617B53D7F6206261901E80EAFC8A1C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0b63beadb31718ebc6359c5e0fbf705122d5c38a621b20aa7e3b69a0eb3785c0
MD5 e93de76e7f5242b704fc8811e08ffb01
SHA1 6182985f3ba6e50d474dad5f5a56c7eba9721533
SHA512 a6ca3a2d5d8d37393dc666bb9602eb4e79a912848209f023d2566a65f085043299be6de50fa3a0e95ef3b58087a54137fe7b901961cd3e91303d07f357483288
SSDEEP 384:hRnmz3mWAxiWXaUwprcrIx2+2tCu8QUle:Lmz3hAklUwC+2Zf
TLSH
T1D862F76BBC2459779CDBD229FA21BB67D3F6202262D01E80EAFC8E1C15E36CD2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 dd583fd8f552ce8f7c4d87aef60c067bae0cad7f0223a379d91f94c194f0cac9
MD5 3e63a7d3417f6681cd75180fa5f3e809
SHA1 faae9e8ba8a57c13e1650fd33a2dc245a696ce1d
SHA512 ac5db7f40b91714b738bb8ac36928171c79952119443ea4411d91eb31d74a78017a88482077395423fbb63d74efa58b66d3905f5f3c170a68883b57b40fbe7f9
TLSH
T100B0120184415552C04203B0114215C871245F18EB3A170193E06922C83A1A2C114161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d6d3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d6d3.TMP
Size 96B
SHA256 7eb2f9e0ca35d7ccba1f66d8acc4d63123016cb8705975692f3aef9f4295b4c9
MD5 4779ce62947e2089eb30adc4621ef6be
SHA1 998a01e77a72e564275cd0c0dbdd789ee3a74cb7
SHA512 4a4a928e08c58ff8fb684366085c945d059d3223aa1599831f21dc8edf9bd0657e03888fca0d89c102474c85cd0f693d2e99c1f24fa6e10675fc1f0599ba5447
TLSH
T115B00259C51AA613D04713B0369DB5D87170DF27C607129392E41E7BEC296724A662B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 2016e78dabb0171225cfe4da36c964dc5d918f4cba2aeca46be8d5246abb3ad2
MD5 42652ddadb6843fab7f98f992a97ba8b
SHA1 7d4c9c101d5c19f87956a8da37f0a477d7010a01
SHA512 734dd014bb42908d44ca79c29fcefbcf6a959ec8136979a8e714b344cf0dbe257b48297c4dd8833bf7b3f3b9699c8bfd3643b81145138ab473470b5f3cfa793a
SSDEEP 6144:RP8pYw80nubFS/sBNxjWDfxA3OnjrYQ9EU0/hEt:RENBUDZKDfxjjs+Cy
TLSH
T14B3423B03C26BE6A0DF8ED5878013F6ACFB49C57D143EDD76AD81F8C20E81895569870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 7e63adabc6c94bb5fe53e9487f5637592f98a77b55bd84eebdae10cd72365552
MD5 32b1e92136354622290f254a0472477d
SHA1 f3ded952b79cc9acae943efb075eee3578425228
SHA512 55f1bec0d7d5640c8392faee7a862d979dbe728cc34e50e402cf9c9b590f06e485155e1a6824d2d5eca15d3874c5bb6e44796b562c8d2b3f77b6aadcbf221a69
SSDEEP 6144:0P8pYw80nubFS/sBNxjWDfxA3OnjrYQ9EU0/hEt:0ENBUDZKDfxjjs+Cy
TLSH
T1073423903C26BE7A1DFCED68B8023E6ACFA49C59C243ADD79AD81F8D20F51491568874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0db632fe0bfa86e4f973502e94a2824f5e9806c275a3bd0009b869f3708b3985
MD5 8cf6f8cd20faccfbc15bf8dd32f5fa82
SHA1 0a9aedfb6289f6de0e6b46c570a42624748de6e9
SHA512 e74418ded720dc4e78a927ee5c7b0134cc6acaa279dc43e6f45434c3a8342129e6d0942cd1e517b5f6804c197adaf60097de1fae8922b16591c99ebcbf59a296
SSDEEP 3072:SzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:oWDfxA3OnjrYQ9EU0/hEV
TLSH
T1BFC302A15C3ABD660DF8EE98B40D3A60BFF4AC9A91835DC361ED2F0C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 dc64a05f67f485cf01e557018b437a5f8dabb263c4b3da961bc7e46c5f553b0e
MD5 6784482f5cdf1a827b5190359f661b9d
SHA1 dd2bbe750f3f7460e643b16ec20a993164727612
SHA512 5bf3a1ba065004df485693e21510aeca01d95c8ca40bf74f334d32f277804935faa6ed96fdad0e045390b0d150bc58fa21ee65e1ed1a0839b6e7e4d7fd99cd91
SSDEEP 6144:HP8pYw80nubFS/sBNxjWDfxA3OnjrYQ9EU0/hEt:HENBUDZKDfxjjs+Cy
TLSH
T1A63423903C26BE7A1DFCFD68B8023E6ACFA49C59C243ADD79BD81F8D20F51491568874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 6c1ae58c8c2d5b54c5f8a882e3a8a9bd5ecef1b6e65f90771c3b38968ed96536
MD5 0e268c8c0161795a33053e1d4d11cdbd
SHA1 f80aab1acb58330062ceb084f743d7cff32d4464
SHA512 836c79d5b986ba7820996c781cd3cb0191d13b239e0dbf0a64416b1522e02b003b197e17729472ab3c201e725e8ab91480915b8798b249243f99e66d56c53a6d
SSDEEP 384:H9XghOiO024YZao6J+Sl1xDnZBPsac4j0lpDII+Txy:dX+ZYZao0+Sl7zZlsac4ID8Lc
TLSH
T1CB529DBA9F1138AA1E67D090E8BD9244CD04A6BBEEE3D1A516103C04CA447B8F4F54CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fba6ff3c176e020d8e59dc3990a3dea706f2dd8aff399662a3b82a1e87189d1f
MD5 f74694348f649cefa68308112790517c
SHA1 2ffb20fa1eb4bd4f7032f82f8c5e05723ea70b79
SHA512 67884cdeb337bbea4e1d64b3b420de5b016b5ef147baafa6df4c95cf9e9b3c53fbd010fda2d1a615e2bb95aebb15d60fbecedfa25ad420b3e8301a56aae2fd9b
SSDEEP 192:/vxev1d66Joz0dzgCl6mc0d9Ov5zboHzSZLayjSMN:gd66JozQzgC1j8boOZLayjl
TLSH
T1F5E11DA8E629863FC408127BCCA61B400F35389A984E3F1971DD651A2D572DE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cdf88be7b170e176f48366aacc7a8bc8b29d7bbcf77ec2acebe3a3d1bb2827f1
MD5 3e9838f58735646ec18476cab7298b8b
SHA1 18209fcb4a4afd5370e7f6b32f9eb90015b54208
SHA512 95ee49d3b348dff3c6623876fa1f3289a6a7bc4547ac69073ed49a76b300d214c46177a55a992c564adbe03cf3eff3c798b70e958d21c446fbf2c9dc487c2d76
SSDEEP 192:6Ov5zboobLayjwSvxev1d66Joz0dzgCl6mc0dkM:5boobLayj2d66JozQzgC1j
TLSH
T18CD10E64E629863FC408523BCCA61F400F75399B984E3F1931DC650A2D5B6DE7B8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8d4e2f98fccd11c73b9bdf3316bec3ed0bf58b1bf1ef9e3973c44d31e1aab265
MD5 7de6d7d10c470a8136622ceea2f87f34
SHA1 6c33d29d51e00cb9ca3346ef5ef52d48bc455c93
SHA512 95a7b9931b929cb4920adb28b3bc3296cb88454a323721ee461d23f4ba3ff5c029c532652d4468cc92b7b5c3f43e889dced4766d5009d512046d98c2692d8b17
SSDEEP 192:+xev1/66Joz0dzgCl6mc0diOv5zboHHLayjSG:n/66JozQzgC1jPbonLayj
TLSH
T176E11DA8E629863BC408427BCCB61B450F79388A984E3F19319C655D2D472DE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c9162c22c601e71328b2688cd018fc285f17e8de85c134d9c60ee029dfbbdb74
MD5 9207f7e5271e18b3da61563c96fd5768
SHA1 5c70bddd8876ea2b5c7be309337023639cc15cb9
SHA512 e839867f34f10057eb747773da7e120b4a8b5a0864030c4597beb0173b0446b460eca9adefc825f78a882d9727fc397956e2f44658c8e19a262f45b11332f1ee
TLSH
T1E321AC5C39FA8D2A9CEBE25CB49042CE97168E0346571C431D02EF8CCE91ADD326F439
MD5 SHA1 SHA512 TLSH

Submit Download

2a76a73c-cd1f-42a6-bb20-ca969ef3c6ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\2a76a73c-cd1f-42a6-bb20-ca969ef3c6ab
Size 235B
SHA256 c5c7f2747891888d37453bbd67357119993d2cf36bbd3534808bc4092e1c3d60
MD5 3c52bc2fdabc9972141026d4e01d29fd
SHA1 edcbff6b279fdf6d0998ead7d8ecc98f357cae05
SHA512 2bdb9878d039f8723b2a928bea7242cd6632b34152be79c05453a0ea20241f3e5d54eedf3eeedcd3243410b5ceebbc04554a3befb8167aea0de9c63949b0e672
TLSH
T167D0A79028986BAD48141F17F9A0A9CAB1894C375474A870D5A145B89AFEAC4626285B
MD5 SHA1 SHA512 TLSH

Submit Download

5b383527-2a34-48f7-a78f-f7a50342c147

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\5b383527-2a34-48f7-a78f-f7a50342c147
Size 2KB
SHA256 ab6e248b3fd9b42e5e9111c600116647d230405dd7240617bbd15af8c456d725
MD5 a5b486614b2dd7ec813ab8f0be4e19ab
SHA1 3584d78ec6853c8a01486886d0dd2f637867f519
SHA512 f20254318b3e299e48020c744c94d46b54009f38140ca9601dd00d5d0c9be801e88bc53746cb898f3659b8fbf2d1e4ea573200a43d18bd81ff39799efcc163ff
TLSH
T15F41F15C36B48CB7CC9AF15DD481334F53A08A0700C329432E91EF0D8C966AA736A93B
MD5 SHA1 SHA512 TLSH

Submit Download

9642c350-5ada-424a-9236-f4005d0337bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\9642c350-5ada-424a-9236-f4005d0337bf
Size 235B
SHA256 a414c5d1cac28f626f7d749eff1b3a1125a2a966b7bf097020fa24d3d2b4274a
MD5 7a0f05fe2f26c8e1dcdb435b08ad8119
SHA1 9094eeae007991e8f86de80437c05d1b1e2696a2
SHA512 d681e6d6ee026a0e2d6096eb3f37a93b4c694fcab369c966eeb1d4b3be937c9251adacf88115ccb6517b8c8165343ac08b03140abcc3e4cefbc4abe193edb5ed
TLSH
T11AD097901888A35C08186F47F0E1B8C730AA4C335060982096F24538CAB9EC4012185A
MD5 SHA1 SHA512 TLSH

Submit Download

cbb2c2d4-ba8d-401f-aebc-9587e1003909

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\cbb2c2d4-ba8d-401f-aebc-9587e1003909
Size 886B
SHA256 6f74de4f58632b9893ef7aaca91cc5ffd658a919f7e0e14cebbf5337bda652ec
MD5 f73c4efbf59665764432986de62eecc2
SHA1 048d680f12baa347f5f29433b044a45d99fbcdc7
SHA512 a6edfbd66ea4cd83db83fac4164479f9fd0311bb9f19ef3baf3a87e1158c438718aa19f60c47492aa5adba0f48f7e1f8259970b41e12b1f86f8dc43a34e82991
TLSH
T101110081C625B5F3CC28F14F99E5F74286E4B02380C659043D956B184DAA52EE36770B
MD5 SHA1 SHA512 TLSH

Submit Download

d6248845-c079-4799-8e3a-4a786613337b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\d6248845-c079-4799-8e3a-4a786613337b
Size 883B
SHA256 35fc5104c8d159a22d31032e924acc3d4c5d6abefa77e1a263d650a308e2642c
MD5 1790cfaf41c246e478804993dea46a63
SHA1 967dae0a1eb22d64537cc0fe0fd7ce262cbd4ba6
SHA512 eb2f91231aa114cd9c4753464ea972c146a006df88b39deba5ca64d4854bc89c86737456921052b58c08801280ca8ee3c13a1bded4b05387ef5ca3f853e76cf5
TLSH
T1D211DC819630F8F3CC28D20F8AA977428BE4B12380C659103CE56E150C6A52EE3AA71B
MD5 SHA1 SHA512 TLSH

Submit Download

f9b2de3c-2973-4521-9141-688173cf7aba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\f9b2de3c-2973-4521-9141-688173cf7aba
Size 2KB
SHA256 fd0931a321f798ed3e3c2e2a0adb76887b3ef418570427b64e4d52c862146f05
MD5 1eab2e853d92fe9dc6c16feb8dc25d26
SHA1 6b7730ac049d8093ad3d7e6581338695402d98b0
SHA512 9e189bd4b0db3a1f8652f6b9345b979c743789158169059b26333142630725689815535108e742fed7282d1e68e55032d87145b8f3592b886edd57a70cc10c0c
TLSH
T19251A76A8120D8BEC879B30BDD2537828BF2140B408B1D4EAEDCAF0B157FC5E9359649
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\extensions.json
Size 16KB
SHA256 d328ee2b3bc5da7867df207ec02dc3d35d8a9118e7fe404b5aa1b8b49e519646
MD5 3980cd2f85bedf5fc00853373e6ab3d7
SHA1 36c295cdc55e1299c1ff9aeead587f4973ee4ff7
SHA512 f71ef9473d58d3490a3d0cadd3bbcaab68c949fa2038a0d022f6bc73ffc15e0870ccda7a52a8fdcfb2c7b91c4596221358fe679209c0bc32ad5d30402319b3f1
SSDEEP 384:0DkI4v0Umldvg8dhWSD94zY96owqL4HgL4PuL4H5L4HNL4HQ+4h9:0AI4cRfJXHp446Q4i484R4t4v4T
TLSH
T12E72411545049EB8298FA78AEA367E01C37D473B60845C78F4DD8FC802FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 6KB
SHA256 0f34756f85ea0708b492c1d5c59cda6d36f43c55269b59af851dc283abb06d64
MD5 d0b1f9a0d23581e1853e047e6f1ba14d
SHA1 ada57e3e42e788a34e45194bfc80fd7f4ae837e9
SHA512 e46cbe1a09dd587a0ca4fbc9b8ec93f41a644422c545863baf3c7d972f169ad5c660ed44860c3107d24da149bae628665c020527881c09f4f42b110bc76bba00
SSDEEP 96:xHcUTU1qGqQfABQ1zSVmSSlZdv9jpnJH9zzBw88H8L4cnc1qGq:C4RQfABQcmSSz9zzBw88e
TLSH
T1DCE12E789408CB6F74B6776CAC6888316AB2013BB7BF68D710B554C5054CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 dc155582a0b499a3b4bda18534fbd70ee2ea9d56b72996763f5f16a8bb820a2e
MD5 a03e8e13db0dbc839a7fbb08322ddb90
SHA1 3a2bc0c9821eb0336c0955a08478ea01eb2cbd0c
SHA512 837d55dda6e2d3670cd0d3156675ebc1b110026b5b2c85953687427e0274d646908befe3a01a785bb80532aee907c8167ddff12ad08a4bc598ae7a504217bb47
SSDEEP 96:xHcUTU1qGqQfA151zSVeOSSlZdv9j/ZynJH9zzBw88H8L4cnc1qGq:C4RQfA15ceOSSHZA9zzBw88e
TLSH
T158E11E789408CB6F74B6776CAC6888316AB2013BB7BF68D710B55489054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 80e6f91a7144632eb85ed1e7cd4fd970d34625e68650cce7aa90148e3cec5f9f
MD5 e03f3ca9aa7cdefdab4b8826501dc35e
SHA1 156c178c20333a3872c8aa07c2ca33aff9523549
SHA512 03f94a535ffddd20fb90759df4f6a9c41a47dc5a59bb2004c05d24c11ee04411dccb6ab8c91c83687b39b8ee57fa7f025713cc417153ccc034fa346e2aad5f7e
SSDEEP 96:xHcUTU1qGqQfABQObzSVmSSlZdv9jpnJH9zzBw88H8L4cnc1qGq:C4RQfABQrmSSz9zzBw88e
TLSH
T1A6E13D7895088B6F74B6776CAC6888316AB2013BB7BF68D710B554C5054CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 7KB
SHA256 bbe8f9e7c8db24a3fe39dab898993dfab5b85a23de6988cceace6c1f63347e76
MD5 b8cdd20794181e88bfedbc721598dac3
SHA1 55bd1aa4f88b9da5f0ffa63ef1d3d937f701e120
SHA512 3430861ae645c2afa81c0c52d7fa7eeac8ec069137be8886e89a2524b36fbe4ce8816274a474e12d1a299d525d2a8b3d5ff5774f483ee39b613a73ff28da843d
SSDEEP 96:xHcVTU1qGqQffBQObzSVmSSlZdv9jpnJWRBbZz+0dBw888Q8L4cnc1qrq:CRRQffBQrmSS6RBFzZBw888O
TLSH
T111F1FE785544CF6F74B6766CAC248D305AB2023BB7BF68D714BA5485050CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZKM 24.0.2 Binary.zip.crdownload

Path C:\Users\Admin\Downloads\ZKM 24.0.2 Binary.zip.crdownload
Size 9.5MB
SHA256 3b1284aea38772a0379bc544b5c9b5857a2463681a1fdd95768a318b0c8a194e
MD5 1b6ffe3c7f2787f391ea1cdb8bd48176
SHA1 7b1fb23aa09002f64cd7fc31be729b62e519cf77
SHA512 4e0f54bdd53c4114d622368023f8f8b1048e62d477fd7244c4ae07faa4a2efdaecdc8f4974a4b055c3c2401df71135216c7ccc75d9449ee9f92257eae5047727
SSDEEP 196608:+Hn/aDFyIpWbaXE1b8ChJZR0LsfNAU2wDFQx5IO69FzSUpya8:+HyJyWWl8ChrfNAU2Zx5Iprf8
TLSH
T138A633869A8950D07061F84AC5E1FD79ED90CF697F3EC1BFB122680B6BA1AFC7650434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZKM 24.0.2 Binary.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\ZKM 24.0.2 Binary.zip:Zone.Identifier
Size 121B
SHA256 420f7743020009e5cdaa95a8e1a9112d4384ee9cfc702f292206b43469dfefb5
MD5 ea4678d1476555933d5993eea724534b
SHA1 f1111aabe5b5f29415e05d964d62be66cc91e4cd
SHA512 59af464d9ee0576e1ee38bc1280b32f2f75f2a8e624de8a34dbe8cfb5c04f7a7d9efcd0db0885da1b705e37b7c1d19e8494edb2172cdc1a977b7c44649857f89
TLSH
T14EB092AB4408C0282A0962C8CDACD09DB90B26165866868AE80040EBF8821AA88929C3
MD5 SHA1 SHA512 TLSH

Submit Download