c73c7140884570c40444f6a87967fa0c29124a985d96fd1f2ce6f2c398a28070

Resubmissions

04/08/2026, 12:07

260804-pamb6saf895

05/07/2026, 19:42

260705-yepsjaa13n5

05/07/2026, 18:50

260705-xgyyjse16z5

05/07/2026, 16:47

260705-vavansd14v5

Analysis

user interaction
yes
max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 12.6MB
Sample260705-vavansd14v
SHA256 c73c7140884570c40444f6a87967fa0c29124a985d96fd1f2ce6f2c398a28070
MD5 ad65634d937a79cb3baa3441fc3627cd
SHA1 088c6531a60a73d178d41fd45a1651ce12909c28
SHA512 c2cda2a7a3d498e5e84cc8a3c4e27c7ef0f2530f40d7e515fb39d31f3e112b2aca4009b2facee4c9d33cbb05e42dd04daa033c6f0d5997adf96ec4478b89847e
SSDEEP 196608:gS8Znhi1eMPWr0VF8KJ3O31UhBGOW3xKBchOTTTjTFlbqdK+48O0e7mADefQIelF:d8ZgtkChUOW3sAOTTTnqVChHIcwGt
TLSH
T1F8D633D777246AD7D442D1F3E26787ABE4825C1B427E58053EC33A001670E32AE7B69B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4260	Loader.exe
4260	Loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6312	msedge.exe
3140	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277436902773178"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4260	Loader.exe
4260	Loader.exe
2544	chrome.exe
2544	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2148	msedge.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe
Token: SeDebugPrivilege	412	firefox.exe
Token: SeDebugPrivilege	412	firefox.exe
Token: SeShutdownPrivilege	2544	chrome.exe
Token: SeCreatePagefilePrivilege	2544	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
412	firefox.exe
412	firefox.exe
412	firefox.exe
412	firefox.exe
412	firefox.exe
2544	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe
2544	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
412	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4680	2544	chrome.exe	87
PID 2544 wrote to memory of 3140	2544	chrome.exe	88
PID 2544 wrote to memory of 4040	2544	chrome.exe	89
PID 2544 wrote to memory of 4040	2544	chrome.exe	89
PID 2544 wrote to memory of 4736	2544	chrome.exe	91
PID 2544 wrote to memory of 4736	2544	chrome.exe	91
PID 2544 wrote to memory of 4964	2544	chrome.exe	92
PID 2544 wrote to memory of 4612	2544	chrome.exe	93
PID 2544 wrote to memory of 4964	2544	chrome.exe	92
PID 2544 wrote to memory of 4612	2544	chrome.exe	93
PID 2544 wrote to memory of 4840	2544	chrome.exe	94
PID 2544 wrote to memory of 4840	2544	chrome.exe	94
PID 2544 wrote to memory of 1648	2544	chrome.exe	103
PID 2544 wrote to memory of 1260	2544	chrome.exe	114
PID 2544 wrote to memory of 1260	2544	chrome.exe	114
PID 2544 wrote to memory of 3332	2544	chrome.exe	115
PID 2544 wrote to memory of 3332	2544	chrome.exe	115
PID 2544 wrote to memory of 740	2544	chrome.exe	117
PID 2544 wrote to memory of 740	2544	chrome.exe	117
PID 4460 wrote to memory of 412	4460	firefox.exe	120
PID 4460 wrote to memory of 412	4460	firefox.exe	120
PID 412 wrote to memory of 3420	412	firefox.exe	121
PID 412 wrote to memory of 3420	412	firefox.exe	121
PID 412 wrote to memory of 3420	412	firefox.exe	121
PID 412 wrote to memory of 4544	412	firefox.exe	122
PID 412 wrote to memory of 4544	412	firefox.exe	122
PID 412 wrote to memory of 4544	412	firefox.exe	122
PID 412 wrote to memory of 4544	412	firefox.exe	122
PID 412 wrote to memory of 5272	412	firefox.exe	123
PID 412 wrote to memory of 5272	412	firefox.exe	123
PID 412 wrote to memory of 5272	412	firefox.exe	123
PID 412 wrote to memory of 5272	412	firefox.exe	123
PID 412 wrote to memory of 5300	412	firefox.exe	124
PID 412 wrote to memory of 5300	412	firefox.exe	124
PID 412 wrote to memory of 5300	412	firefox.exe	124
PID 412 wrote to memory of 5516	412	firefox.exe	125
PID 412 wrote to memory of 5516	412	firefox.exe	125
PID 412 wrote to memory of 5516	412	firefox.exe	125
PID 412 wrote to memory of 5516	412	firefox.exe	125
PID 2544 wrote to memory of 6492	2544	chrome.exe	126
PID 2544 wrote to memory of 6500	2544	chrome.exe	127
PID 2544 wrote to memory of 6516	2544	chrome.exe	128
PID 412 wrote to memory of 6544	412	firefox.exe	129
PID 412 wrote to memory of 6544	412	firefox.exe	129
PID 412 wrote to memory of 6544	412	firefox.exe	129
PID 412 wrote to memory of 6544	412	firefox.exe	129
PID 412 wrote to memory of 6728	412	firefox.exe	130
PID 412 wrote to memory of 6728	412	firefox.exe	130
PID 412 wrote to memory of 6728	412	firefox.exe	130
PID 412 wrote to memory of 6728	412	firefox.exe	130
PID 412 wrote to memory of 6748	412	firefox.exe	131
PID 412 wrote to memory of 6748	412	firefox.exe	131
PID 412 wrote to memory of 6748	412	firefox.exe	131
PID 412 wrote to memory of 6748	412	firefox.exe	131
PID 412 wrote to memory of 6768	412	firefox.exe	132
PID 412 wrote to memory of 6768	412	firefox.exe	132
PID 412 wrote to memory of 6768	412	firefox.exe	132
PID 412 wrote to memory of 6768	412	firefox.exe	132
PID 3052 wrote to memory of 2148	3052	msedge.exe	152
PID 2148 wrote to memory of 4540	2148	msedge.exe	153
PID 2148 wrote to memory of 6224	2148	msedge.exe	154
PID 2148 wrote to memory of 6312	2148	msedge.exe	155
PID 2148 wrote to memory of 6224	2148	msedge.exe	154
PID 2148 wrote to memory of 6224	2148	msedge.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcf9e8c728,0x7ffcf9e8c734,0x7ffcf9e8c740
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,5188866205967227587,2158720958501815955,524288 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,13949658939857160417,2296712724421755694,262144 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,14350473507761590775,12786500014000829991,524288 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,13550830794290532133,5752669799404705817,2097152 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,1009066901980637112,808057161022493442,2097152 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4564,i,15567038167510685188,8184842459176315213,2097152 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,1918113581134853373,15099863428025988372,524288 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5816,i,10991851162287344656,8984817524943962758,2097152 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,15603279469571553226,15626333944826767694,524288 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5768,i,10890932979621939376,10282969352417170128,2097152 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,17166622669924586404,17467422053622785899,524288 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:6492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,2249230976805120827,7819352927107629546,524288 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:6500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,2719385723334222308,9838977222246868274,524288 --field-trial-handle=1980,i,2680270023809794885,6547309761396781799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:6516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27099 -prefMapHandle 2032 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {38c7c03b-5e1a-4fad-a08c-5178086a0b64} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {98e65903-77e0-4efe-a085-d8f54a99433d} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3736 -prefsLen 27325 -prefMapHandle 3740 -prefMapSize 270279 -jsInitHandle 3744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3752 -initialChannelId {c8778d1c-ed0d-463e-a2a9-18013bc04bde} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27325 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 3952 -initialChannelId {50a85d6d-8cb3-4e78-9078-18601cdfee85} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4288 -prefsLen 34824 -prefMapHandle 4292 -prefMapSize 270279 -jsInitHandle 4296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4360 -initialChannelId {b26e7859-3758-41ca-ac32-4915d9655f11} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1668 -prefsLen 35012 -prefMapHandle 4484 -prefMapSize 270279 -ipcHandle 4880 -initialChannelId {63227b69-4d04-49bb-b44c-67cf986d19db} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5072 -prefsLen 32952 -prefMapHandle 5076 -prefMapSize 270279 -jsInitHandle 5080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5088 -initialChannelId {48957329-73d1-4aae-ae61-b7afabb63dc3} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296 -prefsLen 32952 -prefMapHandle 5300 -prefMapSize 270279 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {79d9e035-b1a6-43d2-9c26-b9116585b8f2} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {09a8d1c7-fa89-44f6-b6e7-81bba00af431} -parentPid 412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault0a5542b8h7313h4e9cha8cdh937ad04620b1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault0a5542b8h7313h4e9cha8cdh937ad04620b1 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x238,0x23c,0x234,0x244,0x7ffcec4bc188,0x7ffcec4bc194,0x7ffcec4bc1a0
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,9733662285659771871,1426156552477360300,262144 --field-trial-handle=2220,i,17967739387937649783,17204024212359947431,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:6224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,1527998617006500195,11439890779172048809,524288 --field-trial-handle=2220,i,17967739387937649783,17204024212359947431,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,16264339994873406115,1815030563735215833,524288 --field-trial-handle=2220,i,17967739387937649783,17204024212359947431,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3320,i,16272934479004634412,3604201861560855557,2097152 --field-trial-handle=2220,i,17967739387937649783,17204024212359947431,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:2
    3⤵
    PID:7080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 47d8dda9fbd250aeef23f2d08c8345e8a50b452d8503061bab67bade6bf90943
MD5 8efe29c42c5fafe4752b6cb626b9a23c
SHA1 a57e2967ee3fe00e214d93d3209ecdf450a7f7f5
SHA512 6956590eade5d14e9594fd0cdb9e19e2ffe4be1c36907f42f957599be6a387565f81be5ac11dbb0b8bf73936cda6d5e50a81b63ac22cc2297c739125065bb018
TLSH
T13AE0E5AADD25DC2729F9576C6094474AD64013572B40994F363CC20ACFB6736095981C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 9701152161b73d33af4d4492a367a8a1df5169b441f986bc9560d0230f620ecd
MD5 4bcaa5e85a3173774f9b3b8d263f8efa
SHA1 fc4d4fe2010a3d278c38abe2ff74cf1e3566c5bf
SHA512 ad08fda71074fc85a8788e2c64859c6474d75d1f4c3fd4fcb9e688c657ba8f5baefba30df68f32ce0f4105c136a246add76896e8f7b8494e6860d5ec069be94d
TLSH
T13811494BA06F853ED7F16FFC27BC0A6E3621165A55092BDBC3D094EDE2A21703331619
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 bf83c248af2f008da04e01734d1a8f880e49bd04cb21440dcd4adb0f65ba41d6
MD5 d22dcfdd67c84753e1753b38ee9bc100
SHA1 74c91e565547cad2609d44b90f1bc32ad7fa40e7
SHA512 629c1a924185a6cfce8f5c8c22751bc06c4b03ab127de6c9f8e288a0138479ea55c6e224c3184479f3a6bffc13dfe456fa294544af93b887d2eed907fb6a3998
SSDEEP 3:MsEllllkEthXllkl2zEklS:/M/xT02znS
TLSH
T1074404057FCC0415C50414704011D3D50370FC100D1357C334510413DCC57400F00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 c4db9c924ac05a63c02a1aeae0bc2894d578ccbd0fc6e3de9aed3cce5089791f
MD5 45c162eabc773e6e0e8ba9eac7c94d96
SHA1 1b31a51544d56a2e59c8ecf2593e8ec6b686bdd6
SHA512 de4c688574841e9c3d42b7a18633875eee7c9175c70b9497dbab814426877c9452c50365831d762343c0127a7cf7d01f6526a2a8dec270c55a796b628a053066
SSDEEP 192:DRATM/uKo0DJCRaIJ/HO9sKbXvyIEIkIOFIwBaPdvPfPHNPP7E:DRATM/uKo0DJCRaIJ/HO9sKbXvyIEIk/
TLSH
T122F1B0F7C3D8C52DC80116F89B25AF1ECE2A1A28431C3D66C8D8BE5B93E2871D21565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 8432389843e62c7fe2ff23a53bca58258bafdaa4a79ade635bfd6161121a3800
MD5 bb121677e43322e47a50036eabf3b9e8
SHA1 4c50b76cb285693ef6e3074f59bbde4c5e4b1ee4
SHA512 78a12bc6a89aa5cc3a5611808b95ee8f2ad87eb075e3b300398fa72aee27d78553a4afc12a72f5eca99bc0cd3b7fb40364604ba6ed9b6bcd5957bfd6386258e8
TLSH
T1A3F059BBAB6E7067C57D46AF1E00B80928B6B83526405CF8CEAA826CE0814F71F02447
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 70440ae2eebc004f65136fdb0af51dcdf203083cb7dec6262be48cc664bf81ac
MD5 22cf9944b8f77a244cf1c4a55b7958d8
SHA1 b74a6e916947ad388241d56335da63d5c7a81794
SHA512 7b5473c4db883e7d3af535e3dc4bb22c3bf53476aed4165b86989953df44d1625e08e9e95b282e7f4ff0cee6bef51fc7c7384e8b7f211fa77155369abd30a0a3
SSDEEP 192:p4RTcBz6xqkv78pAPRp2ZPRI9DHsb+WNnRdrAM26r6kwDu0YuVyIsnAUgtaJ:p4RTmz6oA4UX0I5w37206j0m8
TLSH
T1B442C62FAD142A7B5CDBD22AFD617713D3F2102265952E84EAFC8A2C15D79CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1194429c7aee004ffe90a69297bb495be0112f4d3ae829aecd919afa06fdb943
MD5 b9c06e728ef35075e69483d495de9ecf
SHA1 30fa18a1be49ef37bdf3882230f0de591a2fcfd3
SHA512 9ecf571a269c1908eaa41efc473d290c905301272bfb434fb939b4f82c058d591b345f1f918b46192e5977b620df4614433fcc95a65c1983ff4d586748efa907
SSDEEP 192:p4RP6xtOv78pAPRp209DHsb+WNnJN0Jr6kwDu0YuVyIsnAUgtaJ:p4RP67q4UXD5wn0B6j0m8
TLSH
T18042E72EAD14693B9CDBD22AFD617B53D3F2102271942E84EAFC8A2C14D75CD322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 738149a69dd56c362c743e75cdc7f01822615309043f5227c20a6741141f1fd5
MD5 3abf88cbd8b09b5a67e08bff0441bb7b
SHA1 1a6058ea762f04ca4c6b4bdf7573daab9422c2e7
SHA512 dec6c4e3503f479cd5cbf3f430e08180bf501b94c8f470c19f63fc32e5d98ce261c43f0a71d3bdf1c1f19e63972f861c8761edcccca6bfdc8dbe4e8d71e98fdf
TLSH
T129A0021381D50CC4C8401671DB4209D61340FA50470586C348A144548F526528705204
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 18d9bf755c880942ff725bbe9688598e75b96021c8224b94df6ef667d0d5d07a
MD5 9bbaceb91bcc46c469316b7ace6c42f2
SHA1 7127d7f3d1e62f6939a1aca5e4d2a4281607b998
SHA512 52a08d79773d804d5b52b19abe6ed29e6eaabb4337821be9c015eba0f9066fecb3aefe7ff4fc077f97de7222db17b06bcb94a999501a613e54ef540dce27eb12
SSDEEP 6144:BaP8pYw80nubFS/sBNxDm7Rkm1tYpBeh2BAop:BaENBUDZy9oBGcAop
TLSH
T1E93423173C919E7BB9ACBB2DB8031E1F4EB14C65C921EE96CDC4DF4872A834D1A48974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b23ff9655c63be01b958ee4302598388ab263dec7d0f164b57037fe72a38d5d0
MD5 f72deec137b62c6f7b4049853714ec32
SHA1 bbdd95612b91ca6f1d5976284540477e748dec30
SHA512 9eaa417275e94aac79baa07d4633393f8f8bc7ea6d6406edb72891b8e6e4050d40fb27b8542391616b19d0346b2082776fd38c358d086525d4794f83f7b037f6
SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Rm7Rkm1tYpBeh2BAoO
TLSH
T188C3123B5D65E9375979A71EB48E0B1E1EF24DA6C920DE4288D86B0433FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 93aa6e2912f04fdb587f4689082069b1751d2d0e386ef2a00b09daf703a65ebe
MD5 343619ded4f6559e9448e1a3b16defbc
SHA1 4d07b2fbfc03a65738e05d4038e5a995bd3f9349
SHA512 2adfc79dda51c4ee7579bc54de1b23b2fc4dff9779426cbd187d4b9647d229f139959eef769f0a61013d81f05dc67784d3e1fb5b3a2f71064dabec554d8122de
SSDEEP 6144:NaP8pYw80nubFS/sBNxDm7Rkm1tYpBeh2BAop:NaENBUDZy9oBGcAop
TLSH
T1A33423173C919E7BB9ACBB2DB8031E1F4EB14C65C921EE96CDC4DF4872A834D1A48974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 3fa7cc009d84b03b78ee245bfdf97f549888806e15e63dd0e9fff31f4e99564c
MD5 bd52ff5f7fbb63e4b0b2954932bbe64e
SHA1 90e6473acfdb4beb80ea086a8de1337fb7dfd39b
SHA512 a4cf2463b8fd58cc217fbf808d36710b8c4ce6e19ace81b24c9ecb60bd0189a981ec76b9658add505f2e1f5d2eaf4e5cb461d1a650ddaf3926d76037a5b14234
SSDEEP 6144:caP8pYw80nubFS/sBNxDm7Rkm1tYpBeh2BAop:caENBUDZy9oBGcAop
TLSH
T1213423173C919E7BB9ACBB2DB8031E1F4EB14C65C921EE96CDC4DF4872A834D1A48974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 43868cd979cdb8f479caad0278d2325eaabefa8d16d240651fff82c49529c5aa
MD5 e64619cffe13b63a8f4d4ced7c7d7762
SHA1 e798ef21d2efa2d9a050b7f39879dec9f99a8b4f
SHA512 3428aa3e5aed3c3b60f31bf62240f98d2de9b9da07aea7d343c59a6237474ae75f28625543eb87d12a8e93175075e9358c89e595e2daee6683dc902ff829d295
SSDEEP 96:sa2YJiEDWN0scdb9LTdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjc0D67wgwUhgNc:sxIuusI5rpMHW6+WNGYOgxhgOJ
TLSH
T1C9F1C8527E28A97B4CCBE11DBB667B43D2F6503265C5194CEAFC9A1C059B6CD230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 4d17b045d0be553b8849978b4ed2436e18af71606ba3610d38685dd30ecccf8c
MD5 22e6d99e799e562c7ece19b0643cd1c5
SHA1 3846c2089130fc34aec4ad860c3e9d9a10dc91af
SHA512 39d94bad330104657913cf91dd3e59f2dc09da30761d70848d3231327ac362cf5ba188cd83e9c368f1ddb45d38b1a6a525bfdb4cc343a81a0e250ac70d513ba3
SSDEEP 768:EIqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKdbrof:EIqbUj+WvSCs6u1jaaZLbWdof
TLSH
T1ADC2E93B340CCA7E4F801A9DDD5A6F972EA802C767588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 85f4fb392a1df48eb47ce01a77f820113a0fe8025e94674fa5491e3779c29145
MD5 52aad456a6d884b53c16122cecee3eec
SHA1 170617196c33da31e97dc46ac1202532edf2ebc4
SHA512 8035af5276be7c309f1fefa1a2c66da80f5533781897edd838f920fb2c8bca8e286f01092ba97aba007f52cb45c7fafef56a2032b22b083ac462db70dc9ab339
SSDEEP 192:zosNYVDbiZQmiUyn1lEa+jyOmM+JEQFahrNmnqelZUO:zosNYV63alEa+mO7+JH3vZUO
TLSH
T13012F535682C9C3749E6A548F8CB3AA79FA82077DC466F94D6D84F0C00DB69C234F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 07c6a06ddf58fd4a1f7daf592c1c0febb7909a8cefc9ebefd43c90f3b89b0324
MD5 6728318b7ba255fb22869de2928bdcfd
SHA1 9369f33c3005b93ea95c70ed557feaeb52c52b37
SHA512 5508d88ed6f22475178e8dbc2b77ccb1eca481d5504cd3bf5b5e42647780815710c9b61a4f3b3fc3832ed7978e5c4a588c75dd23b18f38c25ce1d45f0b469478
SSDEEP 192:vON56Db6QmiUy6mHBa+jyOmM+HRgqaH1U6:vON56uGHBa+mO7+Gr1U6
TLSH
T10802D735693C5CBB9EB26E49F88B27279F94203BD9562B54D6D80F0C00D768C234B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ab0b9e5fa16c40a48eb3416596b7da7aca15af62d191021734dec2b9be0cb522
MD5 690ddb266ef3e343273554d3ebece4d8
SHA1 7bcdf67b5d1dda41c0569012b3714653e66e756f
SHA512 a2242316955604a547a2172c307dec741bfaaf8cc30a3c3d0c9e1d0043db610cb7f97e623a2e38a3ce2312cf64fa8f4a597bf070484be3b0877196a83d938324
SSDEEP 192:zosNYVDbiZQmiUyu1lEa+jyOmM+JEQFahrNmnqelZUO:zosNYV63DlEa+mO7+JH3vZUO
TLSH
T1D3120635682C9C3749E6A548F8CB3BA79FA82077DC466F94D6D84F0C00DB69C234F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d194b4a4eadf3df3fcfbb0b33fc7545320c4b3ee65f8d721273cc39288a313f
MD5 1544e07f98d06232fa1ef237d24663c2
SHA1 6b9c56d62d448db482ed0cb946fc08aa4ca8e74f
SHA512 d4c9378444e12e3975867c9dd672ecc95567dd0945a96fe0e01148f5482aed537906d8e0882b077579d55c3da9e378bb104a0f0b008b559d1e8ba0ce0ec2cbae
SSDEEP 192:wON36DbZQmiUynmlBa+jyOmM+JEQFahrNzGqelZU6:wON36/JlBa+mO7+JHWcZU6
TLSH
T180120635682C9C775DE6A944F8C736A79EA82077DC466F95E2D84F0C00DB68C274F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da31f970-85cd-42ea-a12e-3c3117b458b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\da31f970-85cd-42ea-a12e-3c3117b458b5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 8ec62bb27209349da6993888d1aeb5bb28f1fab233f5409a3108343b1a285b38
MD5 93b5c71d3df7173660a60c34d89eabfc
SHA1 07b6f773ad92eebeb3343353ab0c7f6c396280fc
SHA512 af78ef32cdd59469612a5f66b230d6551675af60772a732f06b6e93ee1d40d07f6a3c38128469d6cc0683d4943fe1a0a5592684bb2a128c8f7164826856ea9ad
SSDEEP 96:+uFW2FRf2FRGFRIFRa/dd66JozGzgClKtmc0d/UUXSdF95/7bkW60rcEDLyUR64S:+8W+Ma1d66JozGzgCl6mc0d9Ov5zbow2
TLSH
T186C1AA69FA28463BC448423BCCA61B410F75389B988E3F1532DD64492D572DEBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1cb0624a2ea47e6c6c3def509645c7cfddb4d1ac32488c084c6ab4f1481d6511
MD5 791947dbe1335f420f472e2cb93db75a
SHA1 c9b0dd97ae7a2555384f928640484aee50ebda16
SHA512 febfffc47a678dfe5bd6e16aa7b04038437662eae7a4f236809d69733557bb344baa95285abcb7eba4b25bf706f5e6c5ad310c34818ff0817bd235712539648a
SSDEEP 192:FOv5zboPzBZDLyjlMp8W+Ma1d66JozGzgCl6mc0d:abolZDLyjA4d66JozGzgC1j
TLSH
T1ACE1FF64EA28863FC404037BCCA61F410F39389AD84E3F19359D65582D572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f5e989169cdd09c9d4c6cbc3e45e34b84bb625445fce77e79b077999ab02f894
MD5 53d319c7a408783b07aa10ccc37fc932
SHA1 ab48b20a8de0f99cff59966aa4b1b57717f2715d
SHA512 3cb650f8736f4558c653d8b6e2bdcea3662dc389b7bc5ba565b562ffae5e1ea53e173623f25a1b83d05dd80a547e6710242f380cde057e68984bc730e7798bda
TLSH
T1C011805C3AF54D6A998FD39C7051028E97528E0616871C434D52EE8DCEC16DD71AE53C
MD5 SHA1 SHA512 TLSH

Submit Download

712e9d09-532b-4412-9a19-5d330079b8cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\712e9d09-532b-4412-9a19-5d330079b8cb
Size 235B
SHA256 3d86d6c31087a33cabf535b69bade678ee1ed3a84e5e103f8f7bba806e105548
MD5 b656caa2961c08bec03377125310b7db
SHA1 dbb0abef27845df8f2b30b64038a8bf345e8fb82
SHA512 0103708cee90f82f11f3c76fe0a5a3842cd88f080f1dd91880fde4fa9db63b1b026bd869c669998b5aff53bcce38ed0673d10fa6abd567775ec3038f46078e1d
TLSH
T138D097C0148C376C5C140F1BB0B0B8C230484C335168D8109A920978A9FAEC4026180A
MD5 SHA1 SHA512 TLSH

Submit Download

79217c37-6e17-45ba-93ee-5942109e7492

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\79217c37-6e17-45ba-93ee-5942109e7492
Size 235B
SHA256 cb1570852920aa6be2d321872af6257d342c14ea6ce17a6ca7382be8fde3d6db
MD5 3048f33b8e2223000073003a2a47ce4e
SHA1 e2d17f10cb4d803c63c47cb08340e60e23ae1ef7
SHA512 bd7ddad7345b672fd980e2779fcf72af79270c7db8ff0cf2fa00a107d2022acfa14d74966db633a707e35b9f940a83274bba45be21fe60520f8d998ffe43a676
TLSH
T17FD0979018C8271C0C042F0BF1F039C6309A9C3368A268209AE20078E9FEEC6827182B
MD5 SHA1 SHA512 TLSH

Submit Download

84771934-7246-412e-850c-c7d3014b2f6e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\84771934-7246-412e-850c-c7d3014b2f6e
Size 2KB
SHA256 35049557da1fcfb7d990338974a877e081b27a307c98fee4afce1336dbf3da87
MD5 16d6af079437c5a43f58d6f8e0f0560a
SHA1 5faf7b7a31604c9bbc5b99cc9fa505e7a1e518d7
SHA512 3410ae082a79a7030a0c6bb1fcd33cd6daa2d9faa31a09b1bc155166e197e22206b1d94b6dff95fce0ac0927d34d1a6b78bbc19730c7565314310da38c2f3ff6
TLSH
T12E41435C79784C778C9AF19ED851338E53A44A1300C128536E53EF0C8D96B9A73AB53B
MD5 SHA1 SHA512 TLSH

Submit Download

8591afc4-a506-4263-8174-1ffc1fb96802

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\8591afc4-a506-4263-8174-1ffc1fb96802
Size 16KB
SHA256 976a28e11f57c53824320b432c6fbdf4ccbe2d02a9eaf8f438789984ab912b7a
MD5 2f3b9e00353c01d7226c4f43f50c1f97
SHA1 092ab6b9c0fd0500c1883f1f0696a3e206490659
SHA512 9789c132849840982f35926dfffde21f1f5bf24498760e245f48f1a8083248860de42f32e1f1e8521a31f6b661074b30b4d1c772d723af5247ad8c1102142714
SSDEEP 192:hitBye6snawqP8qaL8AVR8qbdAyDCiN2DQvtmKwZ7CWg3h1ZlBRsLTONjb3KiUbS:WybAabP8hhTWMbSOF3KiUbK7RsY
TLSH
T1E572E916682055BE8251E36998FCBFC3E2F528CF4C419FCADBE47D0869DE0AD112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3a197d0-5aaf-42d6-a1cb-469f5af0f04f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\c3a197d0-5aaf-42d6-a1cb-469f5af0f04f
Size 883B
SHA256 10cc872ac57a313356925cf0be51b6b9cea90c3b7952dabf6624e6ddae3566f7
MD5 b3bb0f254bf200a30fd9927b2b99fc03
SHA1 9ea4365e1d7a2a814c3799cd8ae59accb69ae9aa
SHA512 ae3290506a64cc32af2ca02ba98f983c48fddb2f3bf12cdb4a2b5018c93ade870c8de634c79ee660b509d4a6859777567305044494f883733ee3d9831476cf53
TLSH
T1C31100829A38B872DC7C921B8465BB024BF82423C0C555147EA21E180D7AA2EE76B25B
MD5 SHA1 SHA512 TLSH

Submit Download

eee00904-2f60-41e5-9632-c5ce01ef87bb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\eee00904-2f60-41e5-9632-c5ce01ef87bb
Size 886B
SHA256 30da96c4518fe0e696c9d30a2725021a58540e44158b1e3a766e5270f9081421
MD5 3e413905ba6b41a143fb9cacbd945cb6
SHA1 7f71e9d383d43b93a24a6ca1cdc25b259e0b84f7
SHA512 591670f584e9d60b8f5658703da6b3cb0d55a0909b024e1cc71cf6439325f32b46ed5461f61d19b87d5e2ffb02b4d4621de8dcb99835c5e2fd8220811b5aa97e
TLSH
T1FC1104418A387872CC7CD257D5A5B7424BF47433C0C659047EA15B144ABB62FA36B21B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs-1.js
Size 7KB
SHA256 d9c6779abd64c2c67d8b7a1cc36731b9aedeee08ff1dde142a2e9398b3af1657
MD5 1bdca3a13d2e53c12d6e5d1cd1c261b7
SHA1 db9cf83a89ffdb4568adb22892249edbf1987f5d
SHA512 3d5a9927688cf02f7182946ba1726242f5a25e5340fe60214ccd541b0f9169248b1dbcc5bd5872a00ddecf3bfdc3469dd4e6cd923aab02b536db1d5ee7ad0b49
SSDEEP 96:xH07wUTUzqGqvf8P7ObzSDSSladv9jOAn/5H1Bw88n8L4cnD0aGS:acORvf8P7dSSle1Bw88e
TLSH
T1F9E1307895488B7F64B6776CAC6888316AB2013B77BF2CC750B654C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 595db02fdc444e14ca67865569e761da97eea863c6bf6e0b4f5400ed2c866d1d
MD5 2b59fa2a011f1c06069a1d5afda173c5
SHA1 59efa924adc64e86253bb7da7c31837de9ad0de9
SHA512 7bc54c1264d8445e16619fe59cde7ff38ca8f97c5846aac2d11794fe604d7b41750972a01c6fee314eb5dfad6a1b3a4d73554130ed7cb8563a9d35d588773ae4
SSDEEP 96:xH07wUTUzqGqvf8nm1zSDSSladv9jEn/5H1Bw88n8L4cnDOT:acORvf8nmKSSp1Bw88L
TLSH
T157E12E7894188B7F74B677ACAC6889306AB2013B77BF28D750BA54C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 41df452f1c87874a35b46451a389833d9d6cf4b43696b83d5560c7b5b41d4667
MD5 3292e7d2c027714acd0b3a67e5c6b6da
SHA1 ee37cb7d3cdb0e6cc7eb753253a1ff174646a4db
SHA512 84a21e7c04a90193d4633f1d65cf554148cfd2e83989d8a7669ce00edb3b92219317858d68c9c72ea17dde7a60119e17a4f83ba648704a223dc015c85ceb57f7
SSDEEP 96:xH07wUTUzqGqvf8P71zSDSSladv9jOAn/5H1Bw88n8L4cnDOT:acORvf8P7qSSle1Bw88L
TLSH
T17EE12F7895488B7F64B6776CAC6888716AB2013B77BF2CC750BA54C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 ab08d431f763629c5ad46c2c57287128014889fe5376064557e1b04f3c635f3c
MD5 bfd97bb17f951821e7812aaa2029522f
SHA1 66edce39538ca2761a51eadc7b8ee3f9b767f5b0
SHA512 2dee6aea22bd34f5bd5940cfbc318f1609b7cf12e32bd3fc592b89b23d1385f3dc4557b9f8b6b1f83b4211718a7509b98554a923fe09054aeaa35f54c68bf323
SSDEEP 49152:uDmgBuOjA5lUT2loNcNeaKvgmRBbFOYTg/:6mYuO856T2KOeaKvgmc/
TLSH
T12C1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4260-8-0x00007FF7047D0000-0x00007FF7066D5000-memory.dmp

Download

memory/4260-9-0x00007FF705527000-0x00007FF705A36000-memory.dmp

Download

memory/4260-0-0x00007FF705527000-0x00007FF705A36000-memory.dmp

Download

memory/4260-1-0x00007FFD0A1D0000-0x00007FFD0A1D2000-memory.dmp

Download

memory/4260-10-0x00007FF7047D0000-0x00007FF7066D5000-memory.dmp

Download

memory/4260-2-0x00007FFD0A1E0000-0x00007FFD0A1E2000-memory.dmp

Download

memory/4260-7-0x00007FF7047D0000-0x00007FF7066D5000-memory.dmp

Download

memory/4260-3-0x00007FF7047D0000-0x00007FF7066D5000-memory.dmp

Download