a25dfdec1527a9292a9e818f2ea908e30929515abdfde123a7f4f114f3b46bec

Analysis

user interaction
yes
max time kernel
221s
max time network
222s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 14.4MB
Sample260706-2fmlcacy4y
SHA256 a25dfdec1527a9292a9e818f2ea908e30929515abdfde123a7f4f114f3b46bec
MD5 fbda4248a6454b4a6a5d2c7bd5218713
SHA1 5471fd0b0f4e6180b715e4d14fc86c5bd43a2dbc
SHA512 00596492e6b4685ba0f57d27ff243f3100bf4258736e7422151d60004998a2a1793463811935293d5a724c61bc720645f4eff43249e47ffc007d22b43ae768ad
SSDEEP 393216:yfq86W37sLIv9cFpNHiRHf9ff9ofUrDw6anwZSLTPmZ8:LF9HDU46
TLSH
T120E6E06AE6B900E5D87BC27C8142A227FA71B915537063CB5B645AE60F33BE45E7F300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5992	chrome.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278509381633741"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5736	chrome.exe
5736	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeShutdownPrivilege	5736	chrome.exe
Token: SeCreatePagefilePrivilege	5736	chrome.exe
Token: SeShutdownPrivilege	5736	chrome.exe
Token: SeCreatePagefilePrivilege	5736	chrome.exe
Token: SeShutdownPrivilege	5736	chrome.exe
Token: SeCreatePagefilePrivilege	5736	chrome.exe
Token: SeShutdownPrivilege	5736	chrome.exe
Token: SeCreatePagefilePrivilege	5736	chrome.exe
Token: SeShutdownPrivilege	5736	chrome.exe
Token: SeCreatePagefilePrivilege	5736	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe
5736	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
444	MiniSearchHost.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4336	1928	firefox.exe	84
PID 1928 wrote to memory of 4336	1928	firefox.exe	84
PID 4336 wrote to memory of 1684	4336	firefox.exe	85
PID 4336 wrote to memory of 1684	4336	firefox.exe	85
PID 4336 wrote to memory of 1684	4336	firefox.exe	85
PID 4336 wrote to memory of 1300	4336	firefox.exe	86
PID 4336 wrote to memory of 1300	4336	firefox.exe	86
PID 4336 wrote to memory of 1300	4336	firefox.exe	86
PID 4336 wrote to memory of 1300	4336	firefox.exe	86
PID 4336 wrote to memory of 3136	4336	firefox.exe	87
PID 4336 wrote to memory of 3136	4336	firefox.exe	87
PID 4336 wrote to memory of 3136	4336	firefox.exe	87
PID 4336 wrote to memory of 3136	4336	firefox.exe	87
PID 4336 wrote to memory of 1848	4336	firefox.exe	88
PID 4336 wrote to memory of 1848	4336	firefox.exe	88
PID 4336 wrote to memory of 1848	4336	firefox.exe	88
PID 4336 wrote to memory of 560	4336	firefox.exe	89
PID 4336 wrote to memory of 560	4336	firefox.exe	89
PID 4336 wrote to memory of 560	4336	firefox.exe	89
PID 4336 wrote to memory of 560	4336	firefox.exe	89
PID 4336 wrote to memory of 4468	4336	firefox.exe	90
PID 4336 wrote to memory of 4468	4336	firefox.exe	90
PID 4336 wrote to memory of 4468	4336	firefox.exe	90
PID 4336 wrote to memory of 4468	4336	firefox.exe	90
PID 4336 wrote to memory of 5268	4336	firefox.exe	91
PID 4336 wrote to memory of 5268	4336	firefox.exe	91
PID 4336 wrote to memory of 5268	4336	firefox.exe	91
PID 4336 wrote to memory of 5268	4336	firefox.exe	91
PID 4336 wrote to memory of 5284	4336	firefox.exe	92
PID 4336 wrote to memory of 5284	4336	firefox.exe	92
PID 4336 wrote to memory of 5284	4336	firefox.exe	92
PID 4336 wrote to memory of 5284	4336	firefox.exe	92
PID 4336 wrote to memory of 5292	4336	firefox.exe	93
PID 4336 wrote to memory of 5292	4336	firefox.exe	93
PID 4336 wrote to memory of 5292	4336	firefox.exe	93
PID 4336 wrote to memory of 5292	4336	firefox.exe	93
PID 5736 wrote to memory of 5760	5736	chrome.exe	102
PID 5736 wrote to memory of 5992	5736	chrome.exe	103
PID 5736 wrote to memory of 6032	5736	chrome.exe	104
PID 5736 wrote to memory of 6032	5736	chrome.exe	104
PID 5736 wrote to memory of 6076	5736	chrome.exe	105
PID 5736 wrote to memory of 6076	5736	chrome.exe	105
PID 5736 wrote to memory of 4128	5736	chrome.exe	107
PID 5736 wrote to memory of 4128	5736	chrome.exe	107
PID 5736 wrote to memory of 1624	5736	chrome.exe	108
PID 5736 wrote to memory of 1624	5736	chrome.exe	108
PID 5736 wrote to memory of 5540	5736	chrome.exe	109
PID 5736 wrote to memory of 5540	5736	chrome.exe	109
PID 5736 wrote to memory of 5184	5736	chrome.exe	111
PID 5736 wrote to memory of 5184	5736	chrome.exe	111
PID 5736 wrote to memory of 5812	5736	chrome.exe	112
PID 5736 wrote to memory of 5812	5736	chrome.exe	112
PID 5736 wrote to memory of 6140	5736	chrome.exe	113
PID 5736 wrote to memory of 6140	5736	chrome.exe	113
PID 5736 wrote to memory of 4072	5736	chrome.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
PID:756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1204

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27098 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {6146084a-5727-4e06-ba00-ee3c6622059d} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27134 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {722c1ccc-ff57-4e7a-92be-fa88e8b036d6} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 27274 -prefMapHandle 3724 -prefMapSize 270279 -jsInitHandle 3728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3736 -initialChannelId {cc5b56f2-e62c-4190-8705-63fee2eb8761} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27274 -prefMapHandle 3888 -prefMapSize 270279 -ipcHandle 3904 -initialChannelId {e9f44248-a1b4-4b79-b697-bcb87e34b6ec} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4628 -prefsLen 34773 -prefMapHandle 4632 -prefMapSize 270279 -jsInitHandle 4636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4640 -initialChannelId {9be2ada6-67e2-4feb-88ef-3facf0f30487} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2576 -prefsLen 34929 -prefMapHandle 3356 -prefMapSize 270279 -ipcHandle 1372 -initialChannelId {124b657c-993d-41d0-903e-954330b5de9f} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5196 -prefsLen 32952 -prefMapHandle 5200 -prefMapSize 270279 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {5d2fe641-8b2f-4b19-83eb-1087df299ee9} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32952 -prefMapHandle 4756 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {0e33c1d3-e1b8-48d8-9763-cab01449094e} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4756 -initialChannelId {e9caa569-2bdd-4cce-bc8a-2b85e57763fd} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5292

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
PID:1920

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
PID:5236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7fff2b21c728,0x7fff2b21c734,0x7fff2b21c740
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,3347236297386075378,8509108342828559138,524288 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,11052056120604647129,16814066204541238507,262144 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,15340092043346705706,12976950861251167767,524288 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,16057557849787549599,3527757563459301152,2097152 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,4375723277108469380,2260155767885425368,2097152 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4060,i,9039993193965604709,14164636986010467526,2097152 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4072 /prefetch:9
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,9984761878581158638,6144507622038422993,2097152 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,8398503665714611301,12649789658634638723,524288 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:14
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,6455532796952644107,10309609164101297563,524288 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,16922390417418377139,1438572092591433888,524288 --field-trial-handle=2068,i,581305714090581743,12271533554914645547,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:4072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ae52bca0d05346ce6ecd5c7162594b2f8fe936e84ad3fd7ef4cb0f65939e9f04
MD5 eb1fad3b9de87ba08a452942109551e8
SHA1 28ab26b14b7cff9d2fd8cbbbc937e887cdebc2fa
SHA512 295c1a2f29e31e86f914189a166fa2e85e5550a69330b764e8fc5299a61c105be873e3ed8e4ecf89a7a51bc5eea50f0716f23c680c8fad49ef2478eddcd70318
TLSH
T1ECE02BBAC911DC2B2CFD076851540749E68003073791595B7B7D8608CFB26375591C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a6915e196f99b962120da746964677d69da52553f4845ab3caf47bef7597c9ab
MD5 7a63378b9b1828b17250aed5ec658710
SHA1 516fb788e8b2b036eda8b8a953658034fa0785fe
SHA512 ec084bc458cd6704062997ccf44ffb8819b0f1a00541ac22881d699f011861fe124a5b96d39200239ed915b2880a11bedbee131dd38c7d0f420640668cb5d252
TLSH
T1CC419FF793E4997D861092F4AB156F2FCE690A54531C3C66C8D46E2B53F28B2E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 9b03f80582a510cadc852589e4a7be8f32f90f4205f3077510e1ce53b9ac605c
MD5 fcfdf921a6204d097acdbc99aedbb45b
SHA1 5e8921d62dc0473687df02f1268d7a45ba807569
SHA512 3b668e0a7b24c23328b9fce452b8f579acb592127e2649008659dbe4d989ce07fb20c89398b51065cc38bac70b45efac38c45edce07d28ed91effe61f19b57ca
TLSH
T181F059A7E37A7427227946AB1D48B90A6975BC3202816CF4CEABC23DE0415A32F13483
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c3ac2b9c77f5151e61b03b111b48f5c00dbd3bbbaf63744359766a4efd620eee
MD5 a009dfa0a5e4de079f6b82d4a5a21792
SHA1 10fd4406485a331a3e122dfbf934ebd829c00987
SHA512 13607b59c0fd4d9703185fd860997603b49fbf7aede6ff28f3f508bbc98da089a96f7568966a2723e7aaae4c5fec2062497fa770f9d5c2c4d487cbd75841cbdd
SSDEEP 192:vR+f/VuanP1v7lpAPRp2O9+Hsb+WNnRn0Njs2S4QxkwzEtOPyIsnAUge:vR+fJFRUXB0wF01s2S4QxTEGe
TLSH
T17542E8BEED10643BACCBD229FE557B53D7F4102161902E84EAFC892C19E79CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4465e6e5a04c9eaab998f79cd0a16d519036ae29ab252431f7ecf39fd75e5690
MD5 11551009ef697504e91f6dacf4be062e
SHA1 eb68016e79319696336c6c0c23abfb2428d91d01
SHA512 95a48ab598cf6c0823cb83a6eb81a844ff5cdc7df2a261eb614195b620c2f17fc3ca46f0ff4ee5c261b569ae3e7cbab0986aeb1d27db6a6d7eabc48168e8c05d
TLSH
T12BB0124080036620C05607BC130294C8714CDF14AD092F0143E47A22D865071C014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bdbf5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5bdbf5.TMP
Size 96B
SHA256 b26e20ee33e62ec3dbfb0df4df255065ab2ed0b7674543ae540f5a1875aa5488
MD5 d6bd2d429545e9436c085a89752db25e
SHA1 a51401017e290b0969a1ca0dbd60bf7f26d7fc24
SHA512 ce272817f7915d87da0bd881a2b7fd557cd30d1b0c6720b240feded2b8ea098532398d2a191c9c135497c07c365c3520166361b70dcc9d0501c0ad5181a15265
TLSH
T103B022A0C002E303C0C20FB02882A2C830F8EF2ACA030222C2E80F23CC222300820020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7c04ed3de872b61c189aa59d9f8e51480353f0beecdd0ec8cc93fb0fa9ab57ee
MD5 876b036c5e84e930e59139b76407ed49
SHA1 4dc69971fe8f4d63a86cf9141dbc183bbaad2ce4
SHA512 33f3a816b21f3ea1f74eea6f289a80886ae203286406f48ab5737269a929d65818fc264e683a3a2d84c4494c23cbc554aa9d8a58db46e7ac5fb759236337addd
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:wm7Rkm1tYpBeh2BAoa
TLSH
T157C312375E71A9775979BB4EB08E0B1F1EF149A2D920DE42C8D85B0437FA7CD0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 5e5e4e252cad01603d7c88bd845b38ece9f6180b265b26e0a4b17a962e8cca3d
MD5 84caf934bdce4df17b80e77bf25920ce
SHA1 c4b92fab0b19cdbd5f2cb3e705e1f43d2e8613d4
SHA512 6a2d9c9638004706d08126fa941a003299d93bc5a905a87475431b8b81b4b5e3372a5aa46769f2ac4877a179d0a737895030654db1c93f47613acc92448713c1
SSDEEP 6144:fcBaj2tiHpCbVDpaJ/v8wjm7Rkm1tYpBeh2BAoC:EmHOe8v9oBGcAoC
TLSH
T175341237AD25F939587DA24AB08E074F1BF15FE28530BDEB9DDA6B0817952CE0704938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wvdcag27.default-release\activity-stream.discovery_stream.json
Size 76KB
SHA256 2f206232c2072ef5cde18c1906055347ade33e23aeb331e3b3f5913c6c3eaea2
MD5 61e6ca21ef0f46b4cef3c6691bb0f8a0
SHA1 3eeccfb694a364de113610f9e6521fdfbb58b4fc
SHA512 f4023136698a0bbd2bfe1c053ed9a6f3ed5a0d4169ee4ad7bf9ac2d1fc1bfcce82a7980fd90703279502c889e15f69db3b67b02005e19d5e237694016fffc536
SSDEEP 768:2yi+PHXp5fuVtkIczHSeHtfQalOsET2ZJ8aOmsUQfflwpAtUSu4q3KZVBs0CKhdg:t75ZzhET2ZJ/sUipt3uPI9Lbb5E
TLSH
T1D5732AA3A7B9B2BB1B912BC72C0B755B63E60545E38502C9EDEDC91C80CE754023A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 c9b979c892c9242e7734ca35821b55f1d334f47ac5d4e5f686c04b6f3886c78d
MD5 7222d367db8265101b66cf818ca7b2fe
SHA1 4eee3c9216bb65b44d3c2e14f17246ef929e6dee
SHA512 a801fc9c59a6e2efb217e32ee8d612492fbc63767da0dfbb6e5e7e3442c799fea34f6218f03655807e1c066fa98b9d7b05f6c2be41499ddd02b9112ba54150cc
SSDEEP 768:zlkFJYLFGcmhuzsOKDMWjFmEb3bbbub8Bm/:yFJ+VsOOi
TLSH
T138E2F044EB2E953FD41412BBDCA607006F7DB88999192F973A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7a2c2665417b34d7a69d732d11b5d56a3c2dbb1245c22dd9e89110147b10feab
MD5 f897cd25c92f3b49094214f6f7e137a7
SHA1 c96e93647f52d928f49cb9d2207be2212c7928e6
SHA512 cdb26e297d94d7cbe6af8391f8800c94ea1ed8595d34273654c23b6d277102774b74b1658d9e73122e839ba912296943c28dad2a877a91237f0341d77224c6ba
SSDEEP 192:DVomt1d66Joz0dzgCl6mc0dMOv5zbooEZU3yj0x:Hd66JozQzgC1jhboBZU3yj
TLSH
T1CCD1DE28E629463FD448423BCCA61B400F39389B9C5F6F2931DC645D2D572DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7e147c89faf45fb7e5ba3e027448a82c96e477a556eef62b2fdf389f3ad10328
MD5 4a60b35053617e9cbdfe65d36e7b6e2f
SHA1 9c16e25f1dc9013927e375d1e7870d666307f950
SHA512 52685162191522e4aa7b30f40ec63d9ae54da954cf22890fb7d5471b5a7ea0f1cb825e091f8c35ea191c961e72d2b36f36856b90a797a54d52fcf3619658889d
SSDEEP 192:POv5zboHzEZU3yjf+aVomt1d66Joz0dzgCl6mc0dz:gboAZU3yjjd66JozQzgC1jd
TLSH
T102E13168E628867FC408527BCCA21B404F39389ADC4F3F19319D644C2D572EE7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ad42eac3c3c43908511ed9819ca9fd5d33b7a6fadce506898c05c06510110e78
MD5 7389f3858fb8b29b0d062a3e80e6957b
SHA1 960e883254901b4d2802666dd37bfe3f2e4de6d7
SHA512 63c86bfa0d6f7db1fe79d6c476b1b9864f176b97afd1fbf172f67501523e7d07cfd8fdd842514e3a4164690e7703c2e307f71778da47ed93a729ad26511361bf
TLSH
T1F9217C9C39B84D6A988BF29C7441138E93904E1605472C838D02EF8ECED1ADD326B57D
MD5 SHA1 SHA512 TLSH

Submit Download

0d54696c-91ba-40ec-9e60-6649976e368a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\0d54696c-91ba-40ec-9e60-6649976e368a
Size 16KB
SHA256 52e4b91dafaa419daca247867bae682d6e440a16662baa5b9e41dffc148053b2
MD5 9884c7005fd4162a06e11bdae6645a14
SHA1 5b54747482283d7e519da4b7b2af3850f7fd57b3
SHA512 b56fcc90a341788d48c003ef46a3adfaf13a3c4409f9fdc6334fd2923ca7bd17cb2c46c0a090b5a8a14ea9a98f424333720bf8d2716bc6f1ce411dad9ac71b4c
SSDEEP 192:tzoiLBNXY4O3OQM6utje3ijUHkyfGHJtyggjEDDhX2BqAG7/pzmuzx6MtN9EhfM5:jNXyCjke2BKpzxl6MtN8MNVNvw6R
TLSH
T1A272BA565420857A8251E3AC98FCBFC3E6F528CF4C419FCA9BE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c699b36-8192-41f9-9a3b-2c76b3c19e1d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\1c699b36-8192-41f9-9a3b-2c76b3c19e1d
Size 235B
SHA256 2a77f22e885096ec5b68c617926f4170ce0a56c1ebed97e713e612636a6fde96
MD5 5d36d6720e3f1b41b8d470a97a95e0a1
SHA1 0453d95b9da0dced816b2c6a16f2fc04f8019fe7
SHA512 2033f84dd0fc8bad5707d0f28983ca5aba72f36ccc41e90b6f3f05323b0db6b8750ca8b4b87e64a55ffe92bd58d36ec00a92ab602176a284c29133c9f23136ec
TLSH
T133D09784248833AC08040F13F0E129C730984C3B107098509AA2417599BDDC41161806
MD5 SHA1 SHA512 TLSH

Submit Download

2ba923cf-5cb1-4499-8acc-1b58780a6fd3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\2ba923cf-5cb1-4499-8acc-1b58780a6fd3
Size 886B
SHA256 cc27473471bd65d1071c9ce2e104f97415d47a25ef42c9557ca5b95fb1259d03
MD5 404fac373b38c0c0337bb016e5b3a045
SHA1 977b6a456b187309bc76bf1be7a507c3021aaf63
SHA512 02e6bd5b91bc000118ebf5a17ca6628511fd052d19005a417a3e904ec5f575345c778e4cf8c8ae3b827ead38d162a11a0fa9eada90cdb7a629de652093dd5c23
TLSH
T10A116700C674B9B38C68D18794917B0287EC7023C0C74D147D955F080EFB12AA73B31B
MD5 SHA1 SHA512 TLSH

Submit Download

542280f9-8f29-4af4-b6cb-01ad29c5f299

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\542280f9-8f29-4af4-b6cb-01ad29c5f299
Size 235B
SHA256 0ec6a4867e84a618578445438ada540aba6a06fd54a3843012f9693ce91eb3ab
MD5 9094227d2bd26c3f2ed8bf5316ab74f1
SHA1 a0821dc091d8f5c6ff424e63c73e2f93c846340d
SHA512 d15612cae5050bc8ec1f5f685b82b4248880ea985ce410045d6d9c6d004648f7b0805f05a0c4cfa388582880086f2a0dc4fedf8af6d0303b532d082a7d02cb5a
TLSH
T104D0238054DC371D0C280F07F1F079C330448C3BA4B45C30CAA1C5788AFEEC801A1867
MD5 SHA1 SHA512 TLSH

Submit Download

5bc36790-d340-4609-a9b1-c695428ecdb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\5bc36790-d340-4609-a9b1-c695428ecdb6
Size 883B
SHA256 181ac1569cd68f7bcb217ad478e040774cc53b7bfeb7ed13926912add4e838b3
MD5 7ba7e66ce020a86c57a3bcae5e70e968
SHA1 e3ec1c277a5155af5d9dc970fd9dfcd4474ba57e
SHA512 597ea471722deb9eb12c9393262649357859c68d6d1d477bcfc5f94d0c068f7fbdae1ce944e867abb90a43bf56dc2c363607924e0392538abe2663a296a25be4
TLSH
T16A110051E63479B3CC68D24B8A613B029FF87523C0DA88143DE15E080DBA52E977F20B
MD5 SHA1 SHA512 TLSH

Submit Download

bea0969b-d3c4-44cc-84df-f8ae8b6902e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\bea0969b-d3c4-44cc-84df-f8ae8b6902e9
Size 2KB
SHA256 0677602d081910dcd6597a564877f2a8667cc6b079cbe0dad74e005083e97a20
MD5 843a79ea07f7057efa40dfee0c0ad864
SHA1 d74dd12ccf10a804e5a2d96efca8418a818e7165
SHA512 b495ebf0349dfe4760502966b647b05783b084d960aa8ea4b911bdf9d22ae23fe315704d74ed9cb33b04d733f353849c0761fc6abf482ab209e219260b7e3801
TLSH
T13741536CB5B88EB79D9AE18CD582334E53605E0340C21C836E51EE4C8CD67AA337A53B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 0d1a42eaf61122a398652466aeff6ef19a034db96d8c4f2b017be1700f1e7288
MD5 116282e51052f6b76908d77a98de2067
SHA1 51f2580742613f87976141d05373c1f35fc58ef5
SHA512 9e7142738629a9ee3b62a9f9d85bca6a344d3230c8185112790acca9e459e9723d02724c11b48184573e0de09c81965ca1745d606859e247407ba76fd7ed1dde
SSDEEP 96:xHkUTUNqGqZf+aQ/FObzS+SSlqdv9jyNSnumHb4nNzw9Bw8OH8L4cntWGGS:+gRZf+aQ9kSSxhob0sBw8Ou
TLSH
T133E1307891188B7F74B6776CAC688831AAB2413B77BF68C750B554C5014CF3842FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 5e60854688f9bc250f4f5824b1391e49bb888125dc006ce67588eed35c7329e6
MD5 7ea1cdb1cfd35f80246b6f5980cfa32a
SHA1 bb968dd956c625df408d4447d157df7e94ab234e
SHA512 ce15fcfa437b292e4287eeb73eeeb149913d46312e0c70931d22f7151cb7877c1439269dd06c26fd690382405b3d868af4c48063ec000f7ab89287f88f1697dc
SSDEEP 96:xHkUTUNqGqZf+D21zScLSSlqdv9jdnumHb4nNzw9Bw88j8L4cntev:+gRZf+D2hLSS5ob0sBw88x
TLSH
T10DE13F7890088B7F74B677ACAC6888316AB2413BB7BF28C750B994C4050CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 4753c51e18eafe9097c2490102e8e1cc19ae2a13b92f0d0ee9de62709267ffa9
MD5 2214c6c2ffa210566f9165a4be6da065
SHA1 7ab19aaa77bda7b2727c5015388d030fb1dde99e
SHA512 82f20977a03545afdd5f2be031a9fc3d96b43592445dd77ffdd00c7b01d477b44fd29426b6c99c785c4b95df02e44b5f3fd4ed2d46a729644d9c14472f78c8d6
SSDEEP 96:xHkUTUNqGqZf+aQ/F1zS+SSlqdv9jyNSnumHb4nNzw9Bw88H8L4cntev:+gRZf+aQ9bSSxhob0sBw881
TLSH
T159E13F7895088B7F74B677ACAC688831AAB2413BB7BF28C750B554C5014CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 d87ca8eab3a8b7b64f60a9b8641dffdea458cc40b80aaeb8fd0508d83668078e
MD5 0fb545972f74fba4b20edc13e9bf9553
SHA1 37d3b9ee3127cf37f863e4ac1cae63604e7d4006
SHA512 745d6b8e7693604c1ef1f785dbffb11252ef88e57849bfcc182db6d8962738c8f06b765be211d488e09655500bab71319a91f9f67943a2ed49bd2b382b80d021
SSDEEP 49152:bwtRK8Xdg+ziwU7RnY7SrxXtXfotSU0sRuMvd:ctRK8Xdg+zMrRtXfoQU0w9F
TLSH
T1EF1639F824D2A257F3814037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download