af02612545e4f84920bad38b9fe5ec6c60d6bce656931afe215e42821eb6d319

Analysis

user interaction
yes
max time kernel
518s
max time network
519s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FuckVacAgain.dll
Size 2.1MB
Sample260706-2l4f2sh14m
SHA256 af02612545e4f84920bad38b9fe5ec6c60d6bce656931afe215e42821eb6d319
MD5 466be4079e228e25f9d443df728cc0b7
SHA1 16ca585ddbe423d85fcfcb0e147ea3530e91d4f0
SHA512 15272ffde44d6432f498d36199ebb2b6a8f93b62ce66822728a97cebc2056f5ef1562672b780f95e00c86a02b39e1eb8acd565777a3ffdbc76da7968432c751b
SSDEEP 49152:46Vle7nD0RXAv/JedzLrDx5YKcNDAtjIEx6WdIny0V++:rCURSxedXodNkfx6WEi+
TLSH
T115A52255F9D29B78C5F2823417C341B0B08B24144CAA9FABF6FA9A017C72C9E624775F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
73	camo.githubusercontent.com
56	camo.githubusercontent.com
59	camo.githubusercontent.com
60	camo.githubusercontent.com
62	raw.githubusercontent.com
63	camo.githubusercontent.com
84	raw.githubusercontent.com
3	camo.githubusercontent.com
13	camo.githubusercontent.com
57	camo.githubusercontent.com
58	camo.githubusercontent.com
61	camo.githubusercontent.com
62	camo.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1520	chrome.exe

Checks processor information in registry 2 TTPs 39 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Extreme.Injector.v3.7.3.-.by.master131.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
2436	chrome.exe
2436	chrome.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe
5456	Extreme Injector v3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	2944	firefox.exe
Token: SeDebugPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: SeDebugPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe
Token: SeIncBasePriorityPrivilege	5456	Extreme Injector v3.exe
Token: 33	5456	Extreme Injector v3.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe
2436	chrome.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe
2944	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1332	4356	calc.exe	92
PID 5828 wrote to memory of 2944	5828	firefox.exe	94
PID 5828 wrote to memory of 2944	5828	firefox.exe	94
PID 2944 wrote to memory of 4556	2944	firefox.exe	95
PID 2944 wrote to memory of 4556	2944	firefox.exe	95
PID 2944 wrote to memory of 4556	2944	firefox.exe	95
PID 2944 wrote to memory of 3312	2944	firefox.exe	96
PID 2944 wrote to memory of 3312	2944	firefox.exe	96
PID 2944 wrote to memory of 3312	2944	firefox.exe	96
PID 2944 wrote to memory of 3312	2944	firefox.exe	96
PID 2944 wrote to memory of 4492	2944	firefox.exe	97
PID 2944 wrote to memory of 4492	2944	firefox.exe	97
PID 2944 wrote to memory of 4492	2944	firefox.exe	97
PID 2944 wrote to memory of 4492	2944	firefox.exe	97
PID 2944 wrote to memory of 2204	2944	firefox.exe	98
PID 2944 wrote to memory of 2204	2944	firefox.exe	98
PID 2944 wrote to memory of 2204	2944	firefox.exe	98
PID 2944 wrote to memory of 3644	2944	firefox.exe	99
PID 2944 wrote to memory of 3644	2944	firefox.exe	99
PID 2944 wrote to memory of 3644	2944	firefox.exe	99
PID 2944 wrote to memory of 3644	2944	firefox.exe	99
PID 2944 wrote to memory of 3036	2944	firefox.exe	100
PID 2944 wrote to memory of 3036	2944	firefox.exe	100
PID 2944 wrote to memory of 3036	2944	firefox.exe	100
PID 2944 wrote to memory of 3036	2944	firefox.exe	100
PID 2944 wrote to memory of 1940	2944	firefox.exe	101
PID 2944 wrote to memory of 1940	2944	firefox.exe	101
PID 2944 wrote to memory of 1940	2944	firefox.exe	101
PID 2944 wrote to memory of 1940	2944	firefox.exe	101
PID 2944 wrote to memory of 4372	2944	firefox.exe	102
PID 2944 wrote to memory of 4372	2944	firefox.exe	102
PID 2944 wrote to memory of 4372	2944	firefox.exe	102
PID 2944 wrote to memory of 4372	2944	firefox.exe	102
PID 2944 wrote to memory of 5436	2944	firefox.exe	103
PID 2944 wrote to memory of 5436	2944	firefox.exe	103
PID 2944 wrote to memory of 5436	2944	firefox.exe	103
PID 2944 wrote to memory of 5436	2944	firefox.exe	103
PID 2944 wrote to memory of 1916	2944	firefox.exe	104
PID 2944 wrote to memory of 1916	2944	firefox.exe	104
PID 2944 wrote to memory of 1916	2944	firefox.exe	104
PID 2944 wrote to memory of 1916	2944	firefox.exe	104
PID 2944 wrote to memory of 2396	2944	firefox.exe	105
PID 2944 wrote to memory of 2396	2944	firefox.exe	105
PID 2944 wrote to memory of 2396	2944	firefox.exe	105
PID 2944 wrote to memory of 2396	2944	firefox.exe	105
PID 2944 wrote to memory of 2824	2944	firefox.exe	112
PID 2944 wrote to memory of 2824	2944	firefox.exe	112
PID 2944 wrote to memory of 2824	2944	firefox.exe	112
PID 2944 wrote to memory of 2824	2944	firefox.exe	112
PID 2944 wrote to memory of 3032	2944	firefox.exe	113
PID 2944 wrote to memory of 3032	2944	firefox.exe	113
PID 2944 wrote to memory of 3032	2944	firefox.exe	113
PID 2944 wrote to memory of 3032	2944	firefox.exe	113
PID 2944 wrote to memory of 5428	2944	firefox.exe	114
PID 2944 wrote to memory of 5428	2944	firefox.exe	114
PID 2944 wrote to memory of 5428	2944	firefox.exe	114
PID 2944 wrote to memory of 5428	2944	firefox.exe	114
PID 2944 wrote to memory of 3676	2944	firefox.exe	117
PID 2944 wrote to memory of 3676	2944	firefox.exe	117
PID 2944 wrote to memory of 3676	2944	firefox.exe	117
PID 2944 wrote to memory of 3676	2944	firefox.exe	117
PID 2944 wrote to memory of 1692	2944	firefox.exe	118
PID 2944 wrote to memory of 1692	2944	firefox.exe	118
PID 2944 wrote to memory of 1692	2944	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FuckVacAgain.dll,#1
1⤵
PID:4464

C:\Windows\System32\calc.exe
"C:\Windows\System32\calc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\System32\win32calc.exe
  "C:\Windows\System32\win32calc.exe"
  2⤵
  PID:1332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {eba253de-a298-4682-ba25-b38085e9a229} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2412 -initialChannelId {a7db9459-2de4-41ea-b4aa-8288529ef6d4} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27323 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {4a196956-35cb-480c-8f5c-b34b58e62ae5} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27323 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {487e0f9a-9a73-4943-b6d0-cb34f4c4b9b3} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 952 -prefsLen 34822 -prefMapHandle 1248 -prefMapSize 270279 -jsInitHandle 1256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2908 -initialChannelId {3adea9b0-5d34-4a26-a8a5-305f3914dbdf} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 35010 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {418c65e4-1ee2-48ef-bf9e-462da3fe48c6} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 32952 -prefMapHandle 2728 -prefMapSize 270279 -jsInitHandle 5348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2888 -initialChannelId {b251a4c1-3ace-45be-9c46-f7e4650afb22} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {e1ba8e07-6911-47e4-9e57-984fd55af297} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5748 -prefsLen 32952 -prefMapHandle 5752 -prefMapSize 270279 -jsInitHandle 5756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5764 -initialChannelId {f8bc1ad7-a3bd-46d9-a8aa-0068ab96f5a4} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6500 -prefsLen 33071 -prefMapHandle 6472 -prefMapSize 270279 -jsInitHandle 6476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6368 -initialChannelId {0207bf2e-d35e-492b-8cae-ef1f355becf3} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6696 -prefsLen 33071 -prefMapHandle 6676 -prefMapSize 270279 -jsInitHandle 6692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6672 -initialChannelId {b7f375a4-51be-45b3-ac71-2b931f69b9be} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7148 -prefsLen 36932 -prefMapHandle 1400 -prefMapSize 270279 -jsInitHandle 4884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6236 -initialChannelId {dce565d9-5efd-4aa8-80ec-da954848e1b3} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2796 -prefsLen 36932 -prefMapHandle 6020 -prefMapSize 270279 -jsInitHandle 2772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6496 -initialChannelId {a336e451-28fc-446f-b447-b54a914a7a66} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7000 -prefsLen 36932 -prefMapHandle 4516 -prefMapSize 270279 -jsInitHandle 3088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3040 -initialChannelId {65a829ca-c989-40b4-886d-569450cbb50c} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 37414 -prefMapHandle 3148 -prefMapSize 270279 -jsInitHandle 7080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3088 -initialChannelId {598ff9c6-205d-444c-a82d-e330796dac3c} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9768 -prefsLen 37414 -prefMapHandle 9772 -prefMapSize 270279 -jsInitHandle 6452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10156 -initialChannelId {165d6498-0bc2-4256-91e7-420393d5ff08} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:1692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9172 -prefsLen 37414 -prefMapHandle 9132 -prefMapSize 270279 -jsInitHandle 9200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9816 -initialChannelId {49addd5b-a6c9-4011-a8eb-478fb43ee2a7} -parentPid 2944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:4236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2356

C:\Users\Admin\Desktop\Extreme Injector v3.exe
"C:\Users\Admin\Desktop\Extreme Injector v3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcb597c728,0x7ffcb597c734,0x7ffcb597c740
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,2436015169971217982,15520676277273070128,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,4507815686826615366,1177365066540062244,262144 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,5950928805732231783,3347324261100221574,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:13
  2⤵
  PID:6184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,17646862381786124891,12602553460184120811,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:6200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,17283251648997946865,2182393362600484866,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:6212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4472,i,6099450630065811564,15518814029542737791,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
  2⤵
  PID:6376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4432,i,7408208881764239003,5061649177211865612,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:6384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,13065426110056877621,13541255721148835100,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:6464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4288,i,15259621991466723185,1799312461760523984,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:14
  2⤵
  PID:6620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4912,i,7119318607617164083,7450174921230538259,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:6788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,13277550005374698564,5316537724185540347,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:6620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5724,i,15145733257277767292,288541165083542935,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:6708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5796,i,7266612639754947153,72757289528998669,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:6852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6068,i,2733974639553161623,14120499928684094840,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:6460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5864,i,3588340153162274685,14183723743728527046,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6336,i,9192122543358614238,16394049330990345121,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6512,i,14105595273376627038,9096033533075083213,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6648,i,10794402136438655901,8287621257896376781,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6376,i,2562416913500345519,5829050794676097597,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:6376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,14749089095137534279,9443144366395262715,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:6216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,3632722036306429250,5977323971597554446,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:6292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3788,i,681368286503008749,12594515993129479919,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:7088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5732,i,7748897105155131848,13760516061632519166,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:9
  2⤵
  PID:6332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5672,i,2177347428510979722,14138378866523391682,2097152 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,13390045041340211817,10933612620450397996,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6940,i,2972060645315891259,16865245017429993804,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:6408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6952,i,13227948053243061688,4415804324139742462,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:14
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6608,i,17807564825341660657,18221730680695155056,524288 --field-trial-handle=1872,i,7495806847980599772,1517781478829806377,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
  2⤵
  PID:6928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 31KB
SHA256 f8735ca232653ec2f68db20c23a9de13a799c2828daef52244b5a2c266dec573
MD5 829a416e16b380c961578c3643abb856
SHA1 bf53c8fef4ddcf1143030294097b34720f21dd88
SHA512 ea242f0b27ca8c6fa8a526260f98d750515ecee19cf2a285264467a00627f2023947cb700502f3cf7c4fd7ab77b5852b240525da94093fcdc96ade9c150f26b7
SSDEEP 768:5ay1uYVIEoYSSYe0bkmqO8OwIH1LnseVMmK1I6iSJ:5h17IEGeeoqsiSJ
TLSH
T1A2E2F10907E6E5C57D36DE14FA6A935BAB3EC034F45E86E799B1C00C1D202DE50B1DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 190a7eeda909da5db237960cc662698a71336916129acc9de4931a9692efe2ed
MD5 3b3a4640325c82c679bdd19c5b74baab
SHA1 06b0db38d0121e1af817a0998c441fd8112b92c1
SHA512 3182f6dc277ba9407ec20feced1879dbcc51a628dd212a3b00ca336bc482b8688bce5f88947e5f6163d9fe45965a1d80269b66c6e0545f9747df331d3ac04a0c
TLSH
T19C214006136600C5F35A5A3C43E17182B9FD32BD863F1C39C86401B89C5ABEE03C5E31
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3186927ee4ea36ce1528af0be529e8e1eb5286b177d107a16f54823e6d4466f1
MD5 3370457e20b945852df366771b708753
SHA1 9b9f5c4c9589299904b6b3d1bb43fd70a1ae179b
SHA512 6b985126d304c13e842d663a128f519665c274246c6255b2540a9b9f7c430610f64bec39c8a874d209ca8d11f40ca1610e6beca91b27f3bc29d8527fe284c9b8
TLSH
T1C2318CF7C3D8957D890556F8AB156F3BCE290A64531C3C26C8D8AE1F53E28F2E24054E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 39131572692ffa41787bd6cb28536c2a3ec50b649f009f23c4788ff16aaf6900
MD5 2459159c8ed75221fe893f8bdd628dc9
SHA1 5c3b26ed93c7510622b8201e6f07f5940ba8c1bb
SHA512 6875f32a009f9b498429feedce3622543351eec89f93829f204fd07c0b37e2fa4ce0b2e443669de6219b48ee2e5f352fa3ce46766b5f24186be8d6b151f73ef1
SSDEEP 192:yRt6G2GNv70APRp2vTy96Hsb+WNnoIRk2tIl2k1f/9VyIsnAUge:yRt6utZXAyYwoC7t22kVLe
TLSH
T16032952EAD10B53B4CCAC21AFD257B67E7F6102536E52E84E6FC8A2C15EB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 253032547cbc9f4f4be247cbac47b2e5e9ae06e138793fed3eda721bbaada926
MD5 96f7a582b81e7ccab223c8de8fc6a1d7
SHA1 590728178f03581b199d1a16a825b48bbcaed8d0
SHA512 0776c5e8953ed328f9038489294910a8e2c68f7d6b1ff789028149a8c67e3dae1c51f0d47a57a83de15f78389ef4e06906717704c8a61046adef081a01fe8da5
SSDEEP 192:yRMKG2GNv70APRp2vTy96Hsb+WNnoIRk2tIl2k1f/9VyIsnAUge:yRMKutZXAyYwoC7t22kVLe
TLSH
T1AA32956EAD10B53B4CCAC21AFD257B57E7F6102536E52E84E6FC8A2C16EB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 46463f1b94d78f90e79ca747a60f2611e0baec3ef7e4d511bc56099a4c7c052b
MD5 08e7a97df0f84a7c790b5229ff815799
SHA1 16e202e1e49bae310676c9eaa370ba3a93de30ae
SHA512 8552ecdb6845405dfa10ffb7ea0879d88b1cad2b3573fd3b05f315e749554002b0521291f3ff411ca57757dc888b9907e44a14c68856f48a0f007ecaeedab610
SSDEEP 192:yRMKa2GNv70APRp2vTy96Hsb+WNnoIRk2tIl2kwfl9VyIsnAUgE:yRMKqtZXAyYwoC7t22k0LE
TLSH
T11432A66EAD10B53B5CCAD219FD257B57E7F6102536E42E84E6FC8A2C16EB5CC2213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9a8041b81730afe7ca24ef610ea933bc14c95a6f1be8b4f90bca3c47fa07f1fe
MD5 7aea8d433e8145f8c043cdfd244f8284
SHA1 3681d9140958eec6eb3fc3be47c530ec71d069c7
SHA512 af528600953b1dec57d1e7c4cdedb97c8259709305d1bb71592c7e9da23d551e25c81490245e4c119c97c4525cde7fc1cccf22843734dc1b4495b17246b47ed0
SSDEEP 192:yRMKa2GNv70dqPRpudTvTy96Hsb+WNnoIRk2tIl2kzfR9VyIsnAUgE:yRMKqtZXAyYwoC7t22kVLE
TLSH
T11432B76EAD10A53B5CCBD219FD257B67E7F6102576E42E84E6FC8A2C16EB5CC2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 d33aba460a84206e582a3bd7c6c7d64eb2aac22b8b3ddcab514d24f1780ee014
MD5 6f5198498b5b9729205cffed14325458
SHA1 3d977170ee353806ea2a3f5e96be737bcd522fa0
SHA512 b90f816a2285124562c4053e1c61ee22164412b151cd2ad38fd3f23ee14d14fed076d2e53af1c9bcee838563142b5ca9a9538fbc1c8d4d31029ee47d356bd881
SSDEEP 192:elW4K6BR7KxkXqK4I40pUZNCgVLHrKHfFKslEtNfXzKD/WJ+ErUkKN9OP1Rhjdd:sWjOR7KxkXqKf/pUZNCgVLH2Hfgslyf5
TLSH
T1C732F82BA54D9A3F4FD8D50DDC126F4FACB5029673680C2466FB9C0803A97CA115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8b43c1d669d1af15ba9484d51abc4d974b701625f0ade33f95380de9b5c5f6fc
MD5 e238f179b024f57ac1f0b097be737758
SHA1 abb841da455e5daba55facf25ce772b491056dca
SHA512 089d35626f802f611eeb5dde8640a14ff69c892b4d1a0674f1b9f964f7928e30d4b3c94f4a5e638d007940e1119624eb85889d8f69ab51de948459bee1efc842
TLSH
T104B01222C04655C4C8004170120A608921616E6DC0801382C6E85ACDF8930E001E2A11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ce46b35bb63618f39e457ffff4ee0093df049a40472b0093a23383f7a119ae2b
MD5 af90cf3a007405ee578a04744101458b
SHA1 f12763635d4c5b3f089a3b0638597664d3f9000e
SHA512 f720b0791ce7d9665bd9b262ad87fb4ceaf99a17fb05dd8fee3091e00ee470ce85b4ec635721259768339b19008e78c6e84d0f0e55c20c999226317c8570080d
TLSH
T1D7A00250D1C00412DD5842F4726165993ED1F86C696593B794920849886F1D84252100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe600b2f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe600b2f.TMP
Size 48B
SHA256 9bf5a55b36905ae3354d659b6efafef2ab283015f7e05538fcc7dc9674cc019b
MD5 0c406b8d61e5a5e29faec14b94d66b7c
SHA1 d9256b3290723bcb732b14d2d519c1aa482cb242
SHA512 c132665febb45979d3f53c226b9fc7098343f20c94929ee5ec591dba47927f88f87ee6aa4aea5d87e148697b6f93df58010fad33861d79251401df6679a12229
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 911d994790f71e130470ee80cdc3ddb41f8e12f63d452ad711f6923c5604f977
MD5 df394328cd5af142a6b467ea4ba7a25a
SHA1 a159feb8dc5cef22da52a4d1371c72e3091a78f3
SHA512 4366cecfd9724fbfffdbd767ecaeccf10d749090843212c31bb4a6a15e6296a16a985af6c76410f9b0018e4957e62a8e6f9297993a718a899fc4529e8d635f5b
SSDEEP 96:3C6U6d+acl8CHIuxfTVKnvpSRDotok5rNTDVB6iGyvKtcJ5obB4Rv4a:3CQZclJo6SuDUDlrufcJ5obBI
TLSH
T165A1F771A16D89335577DA86B9023F03CEB97067A721AFC8E9EC1F0C19FF4A81702616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 09c3d57a0747b39107cb329bb1250590a8542c081df62238c94a1dcf0a1db414
MD5 fcc562bab96a811d9d36a7ae54f56de8
SHA1 edf07d6999ad760eeaecdd8da5b523dc273f529e
SHA512 585ff6978e24c5125c8c5b10d576c7c1268b61df59920ad938e20fc94c9f4440365854a5d3131fb337de1da84bcb726e26bd0958c67c505ff3c1b25b2ba1eb1b
SSDEEP 3072:wVncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdy:wNcBaj2tiHpCbVDpaJ/v8wx
TLSH
T116C302B3BC1DA929982D9182F0470ACF57906FD241757DFFAEEF5B89060A0DA5314839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 f13929c9b9019d6dbc789253763ed69edbf4b84a7ba1cbe66238d501d20800ed
MD5 3c9e627176216743a1618321394e5004
SHA1 e5f00bcb289a4a03b868a6a5b95d96753f644f7b
SHA512 135ea062f6441e71a9e59e54d6650b366c9c2787f55c751aa00041e7d5a143c57e0c4cc51692cfd3794db0f50be6a02cf289bf043762782d694932b8eef520f3
SSDEEP 3072:w9Hncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdy:w9HcBaj2tiHpCbVDpaJ/v8wx
TLSH
T19DC302B3BC1DA829583D9182B046068F5FA16FD351757DFFAEEF6B48020A0DE9715838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 4027888de4ffe71d3dcbeefe693770c0d3abf7559c1aa59e392a99dc2210ba26
MD5 ceb24bd9dcde5a1bd946ba8d42075978
SHA1 ec624c070a9244038b556eb4d21cd8ec4ec222b1
SHA512 dd8429a61d8c1f3f3d6553647a2cad4b73025b57c2cf1e49edf662015a0b0e127f82b2b1cb0a6d565a6147a3159d57a8a48599807e16fd2515e5d53dfa13463c
SSDEEP 3072:T8ncuvkaj28uiu+O5EVGabmrbS0DTVaoT0ZqcNt8wMdy:T+cBaj2tiHpCbVDpaJ/v8wx
TLSH
T16CC301B3BC1DA929983D9182F0470ACF57906FD2417579FFAEEF6B89064A0DA5314838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6088y0oq.default-release\activity-stream.contile.json
Size 4KB
SHA256 d209f2843564aaa79e484b0843a76ef781e0c45e0d11aa07bca1d89cce9c873a
MD5 034b32243f050b7f24b44eb592f6823b
SHA1 e4bdef7c5a990d8e3410e66c6ec5fc41c1d37d69
SHA512 4d7477a18447fb8b0d3779f79e832a12379d598209221306355195d4533b662ba15f22469e96cc8135e4dd9d144a45029a94b2c96d097d71ce3b14a1134b06b7
SSDEEP 96:T2Aw1s8DeG5ZHrgV1zlY9T+mR+NHKYmdcvn+t6DYvol:uVvHMV1zlvmR+NepwYgl
TLSH
T110A10ABB7CBD9A530732F3F06C4A339EF14BB257DAE54A05F7918C12949422B41E9A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6088y0oq.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 15KB
SHA256 80d6da93ef2ea37398a663d7cf35bd1c900fe8c6ba16ce5e62b0eb9efffb767e
MD5 c182ffb2d973271e99ac208bab82ffa4
SHA1 caa28bcf775497d73c7b4c1f8a5c6a34a31572ff
SHA512 7fc95a64da1a7c8d9c2df189039a4a32d27dfdbed5c1340f5fdf67e76e42d09a51127d70bca93db90cbb5bbacc25c2b5e1979e4c2e3a1b9fe905f71dcafc6dfe
SSDEEP 192:+VvHBV1zlvmR+NopwYgi0Bzmoy72e0Bzmoy7oirNfoEHjGPl2BadE4Pro15j75yj:kztS8ty6PtyLhfdDE2Ba/rIVy8e5
TLSH
T184729FBB9FD88C4A0F52E583CC5D2395BC19B3178FF5E5D97A80340681CA36A94F92C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6088y0oq.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 31597f456599cec86d4b82ccc55ef0ee17eae3744bebe44268ee6913185a2986
MD5 43f13a46886a322d770579606d5e3da7
SHA1 5429f8026cc0e301b6d0b3a75ac7745682e424c1
SHA512 ac809d02c6324f05f33b132db99e49f751d4485fa8227bbb04f15597882f6b677eca286a84c5a8e3e18d4778f8ecf6ab9850033f1efe5af57c8ec22bfe368568
SSDEEP 384:H9XghOiO024Ypto6J+Sl1xDnZBPsac4j0lpDII+X2j:dX+ZYpto0+Sl7zZlsac4ID8LM
TLSH
T133529E7E9F023CAA1E23D190D9BD9244CD04B6BBEEE2D16506543C04CA847B9F4F64CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30ba454a-29b0-4171-9ea8-c6d45fc93e53.zip

Path C:\Users\Admin\AppData\Local\Temp\30ba454a-29b0-4171-9ea8-c6d45fc93e53.zip
Size 3.7MB
SHA256 fa4bb42248df1a52130e8be56d582f50e1ab0bdc25c23f6d9f7e828a1f4045a8
MD5 1eafccfc48eb1e70528e63d20d6c012a
SHA1 43c571e55fba742938fec9b6d3fc9958f6a518f3
SHA512 9546855a178ebe36645573326dd6fbb5b09cf4453d499a5239a52dbf447555877b005fc36d0223541a838c0e459b86f76f087187bf1d53138b2d2e9f9e86528e
SSDEEP 49152:lhXF3Mp5f9e1lmgt+m33JFb35sYNg0BoysGGvK5qUC4GSoaHDxcOkBhMOSMLsUW5:lhXlmH4/35jVEvK5JC4ZHxivLsUWwCJ
TLSH
T1E706DF35D6DC1F08C98F83BA873C2F82987C4F66B057AB6F6A6E9D715CA31D21B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2436_319808172\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2436_319808172\CRX_INSTALL\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 17KB
SHA256 8bd15d561aeeed89dc7a0318c48fab73aaf1da6a6d0f89ffeba322b741bc0442
MD5 b30c35eb8600710eeab1f8e977aff5c4
SHA1 6cf2d48127ca1257bfb07f52a420e51e832f8469
SHA512 e7ac8282b6180f1c7535b8f6845fdafaf384ad2a2509db4d506884065536ac8337bbfe7e064c234fdceec4b60660c38dfe1efc6ea08d4e110bd69bae5b838d2d
SSDEEP 192:sN6MG6J86/vH6UNNbH6J5qbA64iRbkz9dLA6uRN1XkH609QaNyoiasNL:sAM9Jj3a0agHzkz9FHc1Xka50yoipV
TLSH
T16C821F011FF60656F4F7D932BAB077079A73BD126A069B1E8181524D0E73B80D879FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 17KB
SHA256 6a8de6169dde52e8bbd82ff3834655532e7fa160a5732bd534c233f355856c84
MD5 5bfd1df9009836b4bf98440e60327fc5
SHA1 45e092937852869bd31d627af5dec0d45cc212e0
SHA512 f1ce436c75db74121d1b2348f2a2d0e69734b1dd649931b0a31ded318d06114408e492a139c890303f5f8046e40d6a54fea652db610acc5a80988c60a2978e85
SSDEEP 192:T6M6n6/q6UNNW6J5qd64iRbkz9dt6uRN1XR609QaNyoiasNL:WT6pEdzkz9yc1X050yoipV
TLSH
T1028220011FF70546F4F79972BAB177079A73FC126A069B1E818152490A33B80D879FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\AlternateServices.bin
Size 13KB
SHA256 92f948a7f76a1a4401a6fbf6bfd6945f9c3212e5e3167b77f0c0ff460452cb84
MD5 b4d750d2f159643f4400b78dcabbf3ac
SHA1 c0d3fdd7c6c770b1fa2b3ff113c4b90c8488663f
SHA512 a06b586c8893dd652a61ff731583dd5801bdd37cb4bb1095b86c4ac1439704c4135281142792675c9b1d99fd8a9f4caefd23daf8cd04f2bae9848c2eda9aaec4
SSDEEP 96:YlRqO0E4BoaI56esetM/pSBVc4LORgps4:oQr8
TLSH
T1955272F72B726862F0528FB4C459718C9C3313358A7CA585DE5880EB42D5B9E907FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\AlternateServices.bin
Size 8KB
SHA256 9a070ef39995d17876eab1d5c649a044e935f0f8e4299167d7d2f550f158cb7e
MD5 b2ee25fd6f92c86825781ef437e525f8
SHA1 3c5547377014dbf3ae9dc04b4d556c700ac9fbec
SHA512 70915f734f5e7ac9fa7a1bb26e71e4c47bb3703d25c3cddfb4ae393c8d159dc61bd85b779499eabd68279ef0af1a39524b66d5430975c84c900fa1c251ea040c
SSDEEP 24:2uhMZP291og9xMR9B75D9Vvt5g5q9F55A58f1X9l15:JuqOjR5xBt5aI56etn5
TLSH
T1520271E36B72A462F0A28FB4C459B18C9C3313755A789585DB0480F706C5B9A907EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 96194d856a891be72adfb1d11487327883b43babaf632d1bbf5ae7bb4ce58ffe
MD5 1debf4751a9c4e8c0fedab77098d6e32
SHA1 0855d2db158c46e4a7cdd7147243fc62f42e1f9c
SHA512 4950cc351f12e8dbc8f795fe0449ca4398986b18a0bac332dec6ccac5e76c597cd9966b1f1c11dd55defb6a1ec3edc7a4e14201128d007a9d1ec4adc99b31ca8
SSDEEP 768:W7IruMAOVpGcm+uRCRO8SsWKbtbob2bCQWQR2Uu1/:W7UuMAC2CoL
TLSH
T1D1D21344EB1A953FD42812BBDCA50B042F79F88959192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 5a2aaf0242c937aa81beda4341f9fdfca452748cbc9471d843f803c46d6a362a
MD5 6fdfe1e271e829569241d40f0c84e11f
SHA1 3ed6924c2c1e9e4fc646cf37a002b4fde7c1bf3b
SHA512 60eea507a396984dd594a1c556ecbe00790c3efe53df363ecf35485d9804a0770bb727018da5ed226e3acc88227eb0e319128283918d61fc9e16295d31a2c353
SSDEEP 768:yWQw2Us7IruMAOVpGcm+uRCRO8SsWKbtbob2bC61/:S7UuMAC2Cos
TLSH
T1C0D20244EB1A953FD42812BBDCA54B002F79F88959192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
Size 103KB
SHA256 8df6bec3bfbdb7ce05942a0eeecfd1b616c4e77b48ec85db56c7378ace9d98bd
MD5 7163157c87d840cf7e8725bba92fb44b
SHA1 11f0323f6d04ee3a7c9e681da27b1eb89225a5a6
SHA512 3d682dd21c963dacb01751c2cd5b1aa9387115c8c40e27c967c93f090fbf33ac2afe366b3cf27bd0d106ceb627a76ec643fb27b587eea9d9fa821f93557890c2
SSDEEP 1536:iAhSAedG4fyCzYeQeyVC3MS6G7FgS+wo2WKj4P06/lr3jN5JihxuA:iIVSbjvQ3MvTvCKQx9z55JihxuA
TLSH
T15DA31084DB1A403BEC2441BFB8951B283B35F4644A595B0B3AAC04752DCB3FF2D4E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
Size 85KB
SHA256 793cd5c02fb148c4cb1e3dfac6705c5193e464d5048a178270ed33b6b63fc0e7
MD5 d5341ab25ff5cc9c73d0f861b9b8120d
SHA1 c2111ccc7ffe1bc3ed7ebf7f1aa865eacf884553
SHA512 2f18eb00f74fb15ecfaa0f4db841034b9870dafcc87e1a997937fc37ba29622d5299408335a36a089f191d002cf8a44b4dc655d8f6cb6249ee52d25e7134750a
SSDEEP 1536:BvIM44YDahU3WldSPIUVRYyHdstzsLibmgo7pOLz+ZZ1jDomh4:BQv3DCB3AvWsd25SRALQ7XBa
TLSH
T1D7832144EB1A953FD96802BA9CD21B003F79F8895A5A2B67371C54383D873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
Size 103KB
SHA256 5c7edab863d160b88937f426e5cee28888ca8831b3077a2f0076ce7335d02da5
MD5 6cdebf775db2b9364ee5871d94b7507e
SHA1 abe59bea71b4e0c86b20aab6dc2646a5dc53f505
SHA512 da95eb1e2b2344f9d657eb52bd4de4ef94cb16ef61b55a9f877374d4d0176666f59bc463e7bd8bab078377b04192d8ed10c7c9bf2af354f3cea065b8d50b5931
SSDEEP 1536:hAhSAedG4fyCzYeQeyVC3MS6G7FgS+wo2WKj4P06/lr3jN5JihxuZ:hIVSbjvQ3MvTvCKQx9z55JihxuZ
TLSH
T1E6A31084DB1A403BEC2441BFB8951B283B35F4644A595B0B3AAC04752DCB3FF2D4E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 e20f87b0e9dd4330c7c89297f2a69d1ae52a422e28afe66de35fd90a8a1c7b67
MD5 1e521e6c30c099a4bf78ff171894d95b
SHA1 684c7134cf0a6fcc1b06c87c4cec5b7cc225cd93
SHA512 4f132cf23bf6eeba73f14f6dde9b272e350ef4c79bf1eaeac316a91bbcff8bcd693f47f7ee710eb9c071e16ca11959dfc8c79da05dcb54a5f431d45918ec2837
SSDEEP 768:KWQ02UI7IruMAOVpGcm+uRCRO8SsWKbtbob2bC61/:m7UuMAC2Cos
TLSH
T1EAD20344EB1A953FD42812BBDCA50B042F79F88959192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
Size 108KB
SHA256 527d20ca0eb4f0f6f0d8b046aa945d5a39ad178dfe8bd2e32c2a1055d81d057e
MD5 2af9d518ba6e6ecd71b9ff6668453869
SHA1 e27992960d6eec7529de56552c799e86e5da42d9
SHA512 60d1c4529f279b7c77db2c3ed8bffb9f1d3e29deaf8b716bf1ca07704cf47afee25b004419207fcc7d53e09e55c10cb435e891502dc3b596deeccf52da3d1b02
SSDEEP 1536:EvIJflML128oQvKBfKVCaMkQ0Giu0X2xVh+RnBPfS+tPdCz05Jihxux:EQt6LsYMcBlga25QnZfhwQ5Jihxux
TLSH
T157B33180DB1A403BEC2441BFB8951B283B35F4644A595B1B3AAC04752DCB3FF2D4E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f3015402a1bca6e25fdd4fc83e0344fc9fca25129bc61d48ada58367daf9c7b0
MD5 cdbaa6440092d212454baec891679250
SHA1 eac350f15286d3a3bd6ffe3118a38158d44d003d
SHA512 3ecbe2b068e6fe231b8b70ac963384fa919cdda914f5c046600ff58859fe16d036893732504d3affcc934e816d1fd65282cfe74ea536287ac837f1c81d2a8e40
TLSH
T1C8216D4C39B54D2A98C6E29CF481168E93954E0606872C434D52EECDCE81ADE326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\events\events
Size 4KB
SHA256 33f3db9fbdc3c21e8b2d37454e57f0ae2a1601d1b9164fda751d3b827b3346e8
MD5 aa9057019519ed22cf35add0690a28ab
SHA1 db6bcb133ef08c015b11fd38b817aa5e3a063cc6
SHA512 a2874f0707cabec40e02082bf3f6eb4df8135914fc68cddd7edb3098347c8b4e5fc347c86b162c6fc5049ca6c40e4dc510889d15d4964124a5807cd176150154
SSDEEP 48:YEkHMbYHR6Kui2JoKea60Ii/XzruUPQzSzdgzP9PX45HGdEadU8w/844QHQNIra8:EAYuhWIYSulX45mdzdPvwaSxHbdT
TLSH
T127A1FF1D35BA0C7E69C7D29CF882068D87DD4B1286871C474CD7EE8ECD96A9E321E42D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dbd620c-d77b-4901-a1ad-d8a95a32899e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\1dbd620c-d77b-4901-a1ad-d8a95a32899e
Size 2KB
SHA256 c1821720ccbf9377b23a482e04ba63458be7c095e848eb8096a152bdc1a518d0
MD5 5667e15bde3a1ec516158f75c7b97823
SHA1 b9ea72dbe9ed1d42dd4e19c559090193151e2b72
SHA512 27ce5a65ca875224758de82c2f4bdbec533da46d84b5bf57d8628503b546f5e6cb0507cb9c076795ae466f86b71ff8200afd76c67a7f5608a44ed5fc2b43fdd9
TLSH
T1F141302C35B84D769C8EF59D9582328DC3A0890240C22C433D55EF8ECEC579E33AA42B
MD5 SHA1 SHA512 TLSH

Submit Download

23bfdd75-002f-4390-ade4-4ce0df8fc4c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\23bfdd75-002f-4390-ade4-4ce0df8fc4c0
Size 871B
SHA256 f9f6cb54ce7eccf17d47c79d086a78986d2077fdc32ea1490e87e74f603a1400
MD5 60e11b19bc080c0e0e5832a77ffdfc4f
SHA1 d3e6a4bacfbf7722955b2cdef9111c1a475c047f
SHA512 bb6bd8168c6d825fe1691fcce814c3b745ee4ee646c7d29711a17a4be196227e22cde8ace4e16cf3e3223e4b14656cc2def30b6998445b8dd8b8126c8259500c
TLSH
T1D4112391C53477F3DC7CD24B84A53F458BF4B82380DB48143CA95A088EED31A93A6207
MD5 SHA1 SHA512 TLSH

Submit Download

69ab06a5-e3aa-4280-bd97-68775e5915e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\69ab06a5-e3aa-4280-bd97-68775e5915e9
Size 235B
SHA256 270446ccc00e78f1f224fa37abee4017fcbf60339c48c91c70659ef75e834797
MD5 a93e553e1be8cb90fdfb3db1610302c2
SHA1 11074fe05d0a78501f60fa6b37eb9f525ce71ad7
SHA512 f4c45f7d55bd80c417bb06cafbace0851d68db502190e2713996fde04346b21da36a94e8cdfe22d85c5606797a768f958ab44e2d714b79c149c90d1ba74f26d5
TLSH
T194D0978128C8331D08200F06B0A129CA30494C331474B810EEA14A389AF9DC8015381A
MD5 SHA1 SHA512 TLSH

Submit Download

7055161c-3f2d-44cd-bcab-453667e9029c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\7055161c-3f2d-44cd-bcab-453667e9029c
Size 235B
SHA256 08cdb6d067d4cbb8a78a7f97b2893612650582b48d71a35731559afe89be653d
MD5 88098081f097e6f7a1674a0a4eb8d197
SHA1 a58facbf53c6d8d26afb8119bf7214d49ff6f780
SHA512 22397c9227c908ab830a2c83929eb636727799e50b6b14615a61e60019f83f40356289feb1375186f1eebbfa3341a86957a4f6f1a57fcc9ed327dc7521fea9f7
TLSH
T117D0978058886B7E0C100F02F0B02DC6306C4C3390B4AC10C9B2493889BADC5012180B
MD5 SHA1 SHA512 TLSH

Submit Download

bd2f6348-5d55-4560-bf1f-0f5f509e3e04

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\bd2f6348-5d55-4560-bf1f-0f5f509e3e04
Size 886B
SHA256 3b179f3186c97d6d5465362f8166e3317467129283491f2bb8ae1c32383d92ea
MD5 888b46a53296571833a70502f296ffa8
SHA1 54ed59e3546139386d7e868b7df500ffcaf7281e
SHA512 4fe7a7c948f734da6a29745726e2d1f021d4b38ea7dd8eb0083938b045c0983b1672c9554c887f79fe6c84f4bfb2bfb771d0a7b32cec71579d06fcc77ecf3739
TLSH
T10B1100518A75B7B2D878D18784E17B028BE4B42380CB4C143C986B1CCEEA21EA3A2647
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\extensions.json
Size 16KB
SHA256 acd70faa5f19fcc88d01d1bfec8a0798097bcea02843eab6a0468d93660b151d
MD5 86693329f769bdb4c58f550920af1701
SHA1 8f823fc6faa6ff91c8b159b34f93e2fedb10fe7b
SHA512 abfb0ca81a179f6786bdd5717b903fd35b321992f8f41ca595a17a9bd9ccbb170ce1f57c89fe7bed67d398e6da69251b271f9549d687dd4f38cdc6edcffddd07
SSDEEP 384:fkI4v/Umldvt8dhWe94zB96oXL4HSL4PzL4H1rL4H6wL4Hkp4hU:sI4HRfuXb4T6M4A434V34d4o46
TLSH
T17572521545048EB8294FA79BAA367E02C37D573B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\places.sqlite
Size 5.0MB
SHA256 5646817d3077aa570c07b0cee26ac31d46af8453546ab862b9bdaf4b8b835b5c
MD5 8b696260ebf565ac8326cf9f9131b615
SHA1 47c9c0ff7f74dc7c9c6ea3c2b3e4bae68bf8fb43
SHA512 e4bbb8d46aeb15e366261e3613c7146f035b7d8e8ecdb924cec4a2c3bf975dfc555d1c43fef2e8bc8306ef62acb739b61ce1a5c51d6c7b7389b4acc2b6c1cc22
SSDEEP 384:M8r54w0VW3xWHLxsQP7RPefu5hmZa0usn0YPN1Zm:rqVW3odsQP7RP6ZtTZm
TLSH
T1E636D99FB6245041C9DB9272ECE32B589C3F714A863277523C98652D4DE0B23795CCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
Size 8KB
SHA256 f08f565500cb430d3c98cda22c1e941af66b524fbef3d6e105d3ebfb6173bc80
MD5 0ffc94eaf55f712654060f13820107a0
SHA1 0645d97af7133239ae7d1c24872a1e7e07ad8893
SHA512 a48a542b81d519e4fdcbc3759724ff632fcd22b876733a794f819ecbc260340e7705b1e9be86215223711336bc6ead9f32b28970c39701176a14384a92490f72
SSDEEP 96:xHTlTUt2PqGqHLfAP3NbzSApSSlYdv9j5n6RWR33Bd/0TvBw88CshFX8L4cnP6C7:hVCRrfAP3JpSSr8RHBdmvBw88TFy7
TLSH
T160020E386104CF6F68B2766CEC2549715A62023BB7BF6CD710B954C9411CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
Size 12KB
SHA256 e0d40bef8468583b74a7d14177ee1d9faaadee7929c17fc5d8e8b12723931618
MD5 436e0d8869e48cfd37ddd0579727837c
SHA1 183e11ef341a46f03d311600c48f8315abebf24b
SHA512 bc46b41827e89391a9f594ae0dcd8f522844d5c398dc03ee154d266da6f3bb1eff87e3017d311e9a6bee232b4bc31965f0ba487a30ffd0b8f150b918334d3f8b
SSDEEP 192:FVCROfAP3JpSSrXLRHBdm+OBw88VMWGr0bM7:/IRHBYRwyk0
TLSH
T14142BA3861418A3F25B2367DFC2249B019A10237B7BFBCD705F898CA445CF6941E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
Size 7KB
SHA256 10fdc491a7511ab54dd76efc14d20162ea6b87322080ee67299577f39c89959e
MD5 8302b06da8c7cb9caaf1f99cb9c56d30
SHA1 f347d2246a9bc8578e24e728575a506c5d394c0a
SHA512 4e5585247d9ba1d367c1b95c6a3dd9f734be72a3ad015b761efbede88e365edf4430398269c0aac367e91dbb9c67f7abffcb347fd471f0b5aa1d8840c58f294d
SSDEEP 96:xHTUTUtjqGqHLfAP3NbzSApSSlYdv9j5n6RHzBd/0TEBw88u8L4cnP6CRGS:hQRrfAP3JpSSr9zBdmEBw8837
TLSH
T1C6E1217894089F6F68B6766CAC688C315AB2013B7BBF68C710B554C9010CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
Size 12KB
SHA256 e58ec78b45fbc64546eabe295be29999d0a0a885ad1d9570193db276c0c025f8
MD5 fbe62ab6f2a969df0bb7565fe215d2bd
SHA1 e175087be2afa90a80299458e55a9dbf5a8dae06
SHA512 2893283462beb355318a6f9587062fc42649d298ddf106e42f5030a7cde9ea57a952ba1400e2ab220ff66cc5ed2d834efdad1c166ab21b3ab5597e964c26278c
SSDEEP 192:FVCROfAP3JcSSrXLRHBdm+OBw8O/Ck05SHt7:/HRHBYRwEY9
TLSH
T14042BA3895408F3F24B2327DAC2549B029A14237B7BFBCE745FD9496444CF6841EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
Size 12KB
SHA256 7a7470e8675d8f0435684c936e869a736bd0712f6dfaf5020330739466ed8b07
MD5 af3c611674b4129ada232495226436d6
SHA1 5688db17299b4835a7bc3f263202bee7d9ae3656
SHA512 4fab99f7ad07ff49006119b5c434de0d36f00259ae233580a19d77c5df0ec349c16b50b568e7445fd135522c0a810e138ae3e834f1a8cb850675133c062dddbe
SSDEEP 192:hVCROfAP3JpSSrXLRHBdmGOBw88GiWGr0bO7:jIRHBYZw3ky
TLSH
T19342CB3861418A3F25B2367DFC2659B019610237B7BFBCD709F888CA445CF6941E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
Size 6KB
SHA256 86b3ff0e7eddd753de087439bc13c8f327f68849cbae03344ef7ee5d4fa3aaf8
MD5 cb567cfead521564c2e67c186931b666
SHA1 ad7b5d625d8a8d4a986390d3a5ccd41d8ef4cf78
SHA512 b887e4659f5907b7dbe6f7af492f444b9c2f38bca64a4a443193781533ec99983d23e9a462ba8ce8455b66b329016beead1eb6368bd828c4fba3873662672c48
SSDEEP 96:xHTUTUtjqGqHLfAP3kzSApSSlYdv9j5n6RHzBd/0TEBw88u8L4cnP6CRGS:hQRrfAP3+pSSr9zBdmEBw8837
TLSH
T1DEE1207894489F6F64B6766CAC688C315AB2013B7BBF68C750B554C9050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
Size 6KB
SHA256 dc84c596a4363b763ab637f2b71b5356b9654fd794f3692703adcd1876efd019
MD5 5ffcc3d8814b84d184d7ee052231cbec
SHA1 86522c2ef49bcfb0480567a5c39e5bb5bba2e114
SHA512 247d31c05752f9b95702507bc7ae6b2ee77a5283b5cb90fbbf537ffa665e05524a0fa28b1ed8e6f79d6748a98a1078c48e0fc2373569c664f1d30ca3defb55da
SSDEEP 96:xHTUTUtjqGqHLfAbq1zSVVxtSSlYdv9jVn6RHzBd/0TEBw88u8L4cnP6CU:hQRrfAbqOVxtSSL9zBdmEBw883U
TLSH
T110E12F7894088F6F74B6776CAC688C319AB2013B77BF68C750A554C9050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
Size 6KB
SHA256 55e2c6f6cd58e050fd2b06cf268bcc60321b83bb115f11645e7f9c25193d11b5
MD5 c5c7e7ca71617d3155db630dbda829f0
SHA1 57699110d0e46828d6ca8bd6748fd4acac4c59bc
SHA512 a0b7d2a0da40a8a0d2cbec61c130e28880a2bf91c4411dacd52b62c9fa224815d29799742e85b719f960b8736d8bf8155b6ce929398d6ae108caf8d67ac1e23c
SSDEEP 96:xHTUTUtjqGqHLfAP31zSApSSlYdv9j5n6RHzBd/0TEBw88u8L4cnP6CU:hQRrfAP3FpSSr9zBdmEBw883U
TLSH
T1F9E1107894489F6F64B6766CAC688C315AB2013B77BF68C710B554C9050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 e3f21efe66e56d89a86a117f84937d949df32e2f6c4bb5f051979d72dd26beed
MD5 c638bccaba8eb4173011049a18311fbc
SHA1 1a8a8ab65b8d038e015688726bd9e5352f5c5337
SHA512 611d788756b788f0c3db2f5b264e041d1abcacd55358e0990d8690d264ac1710e17ab52219a1ade2dbd0f448109c0e4c79ac7da6b32878a4589ecdb7d075c703
SSDEEP 192:DWXs9zDM8nlFyQEIadId52ob1aOpqOOTupMt5Qu:6cxDM8n1EIacIohvqOO7ou
TLSH
T1D2029E9BFA44911F08367035C0DF1E16A283F50BDAACD880CD654ADC58C5A4C35DA7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 40b60b4bfcda73f8602f4a1e746acb0bd03d2c4b2812ad1b3afd79b21fd54c9a
MD5 fc16363338ad931b8f7f8e713138929c
SHA1 9f1e359928586faf85cb472743b0eb912d15c0f9
SHA512 11103e433a2b9e52fffe5d16fdd3d89666f67ef62274b5a518f7cf9d77d41a83d980438d221885d9533f783bc7934a140ed42ccaeb3eed622dc8e51d8f13cfda
SSDEEP 192:nWXs9zDM8nlFyQEIadId52ob1aOpqO3Tupk7YV:WcxDM8n1EIacIohvqO3/EV
TLSH
T10D029ED7F544912F483AB031C0DF1E06A683F10A966DE490CE158ADD588478C76DA3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 da5d8e0e9bc7bee6a5a6a673b0ba165e4be11eb50909a8c876e98658bf9d60c9
MD5 8f0ae7121a45308c40e8e43902727557
SHA1 2bd9e072b13a3745d066c9379c963503248ce3ba
SHA512 b315b8829ec53dc6d52103e3ad249872eed151bf51292063cf832f1900d92917f14ad8ea0de688884d2fc9d150b4bca04b0b345cab55b1e5ab5dee454f9e3121
SSDEEP 192:KWXs9zDM8nlFyQEIadId52ob1aOpqOiTupcbi:xcxDM8n1EIacIohvqOiHm
TLSH
T16F02AE97B688942F087BB035C0DF2E16A683E50A962DD4D0CD594ADD48C4B8C36DF39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 09816416f14c2569fdf834eaeea9d5ebca0706fceec7458c05a7c9bc8c1dd9b9
MD5 7a54cb48d40740b40a08e610fd052bad
SHA1 34319615bb20eee0a3841bb7118676eb329a030c
SHA512 f9a92060446b04bb5d5e3158ae20c36effad110eb0bc1fe2909440ba437e08126ff5148d48412548e9608218df052add4c13d090a0d8fc245dae5d36a6226b59
SSDEEP 192:CWXs9zDM8nlFyQEIadId52ob1aOpqOiTupcCb9fafi0aCV2:JcxDM8n1EIacIohvqOiHCbVafOCV2
TLSH
T16112AE93F948955F48766031C0DF2D06A293E00A962CE8C0CD204BDD18C9B9CAAAE36E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 8b2500ae716395f42b8c32e7d240d5ede88539c3c7ab451d27d8f5d3b835db3c
MD5 b65dbc808d1b741db47b9da790de978c
SHA1 0ef30b21d996a33d8fa0dd14a26a297c55f30c11
SHA512 2d2330656a9de62036a8d1bf56a7b3e8b29dbc7b47e845315ebc62604394baa6eab3221f7c49abff58a59e1972da6419c3829ca144ec23053cb0ee0730b63e0a
SSDEEP 192:LWXs9zDM8nlFyQEIadId52ob1aOpqOiTupcqIZB+u:icxDM8n1EIacIohvqOiHyu
TLSH
T10C12AED7F548956F8977B032C0DF2D1AA683E50A962DD8C0CD184ADC58C5B8836DE3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2eeee9ca3aadd6c1f121046be2a1d01d53378829cf5d5217d006dd844986a1ed
MD5 dd1dd867197fe53154023241474b23fc
SHA1 64823e5687c1398e9dee4d5f14c15d8ec0f751b2
SHA512 ff3f5d5fd72cab3875151087745a3bc06a74338ee1a17f68b3fe49002e825adda0c78f65df47754cd03ed4ef248e9ebbd8878582b3f37e6cdb5ca61ca28c2a1d
TLSH
T18821DA02BCAF2CF62D11E24BD0C09FD887654012439C88E0DD44DC41065CD5EBBBBB06
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 f8fc38b998e679ff5ecb8d13880cc72fcb6db3137fb5a1c5e12668640cf102bc
MD5 26d21a8c2d536e31268fee4e0da1eb30
SHA1 6251b0db39a1f16d925d47b8b700c9bd15da8f59
SHA512 9031beb4612b3b1cfc1dfa1a320f06acf973133f163433bff652081a11f42c2980d3194b105f0ee30c662cccf0bd3bfe9a3958df06fb1a52bee6aae9ff4d7409
SSDEEP 192:8WXs9zDM8nlFyQEIadId52ob1aOpqOOTup3Iux5U9r:fcxDM8n1EIacIohvqOOFr
TLSH
T177029D9BF548952F487BB435C4DF2E0A6683E506966CE8C0CD244AD858C4B4C36DE7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 81b803388487d2e097e942b02da5b9b1738295fbecad6e144a964ae72f0064b9
MD5 f5b3ab284fe2263fd9458e61d246e62b
SHA1 fc3f384768d5797677a725f7a23ec6ddc0ba0a90
SHA512 d95308c9479d8ec70dc6e1c4c887984c21563f07116bddb83f92a12b43a3096df92d8e632bbf521a64bca21b5b967c8a1ea68ee6109e024a2d96407237177b6e
SSDEEP 192:1WXs9zDM8nlFyQEIadId52ob1aOpqOyTupudlhGQ9E6S:QcxDM8n1EIacIohvqOy13hU
TLSH
T136029D97B584A15F087AB435C0CF1E16A183F50A962DE4C0CD6949D858C4BDC3A9E7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 394e73d33d47d83de568940a3ea096b81bb2dfbd49143e4ed0d116dc6ce725f6
MD5 cd1ed8d6fced84a4fa8e3228da05ce99
SHA1 e9de2042eeffa113b2619d10d7bd0e145f7cc0f1
SHA512 87f7a07200aad5a8fbc53b5c3020787686d8c8c3c7c0c39eba320b83cb0d4a391816a30257fc0f545b2f1f3c64840f52da66a63a30e9f1f29bbd38a47de9b8ff
SSDEEP 192:AWXs9zDM8nlFyQEIadId52ob1aOpqObTup/24lq:7cxDM8n1EIacIohvqObWXlq
TLSH
T146029E97F648952F4877A431C0DF2E06A283F10A962CE4D0CE144ADD58C4B9C36DE7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.jsonlz4
Size 8KB
SHA256 071825b84ee1c2515c12add7ebdd0fcbc64f09301e823efac462c33788e4bbb4
MD5 571767167a90df1c772c54fdd5b8c591
SHA1 8421e96791fb103d53b4d4fe3080abb715de4319
SHA512 43cba6bccea1f6e09cff7b94097514b4314c63d6a3696a7d2d40654649e4a97a29d905bca924645043781d2fd6923fbd9e9b2904f53bac1cb68d12dae6bbfebc
SSDEEP 192:GWXs9zDM8nlFyQEIadId52ob1aOpqOqTupMm3EqU+mu:lcxDM8n1EIacIohvqOqG3XU5u
TLSH
T12A028D97F648952F4837B035C4DF2E1AA687E606966CE880CE1549DC58C4B8C76CE3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9cb07ac0-0746-4116-b97f-b3b392e16991}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\storage\default\https+++file.kiwi\cache\morgue\145\{9cb07ac0-0746-4116-b97f-b3b392e16991}.final
Size 50KB
SHA256 04f6619b5b9e3b465ead98604d3b137aed49d258fb503ec152326e7844e0fc6e
MD5 78ae321f546d976a5df2c6854ca45013
SHA1 d39d41567358cc2b5513c3c5c1f4e9621ff30757
SHA512 4126c718143a06a3a39b35fe734b3fb30a306193b8d3971697e5279a1a43f3cb7dd78afd208e244c2e94d25eb8cb1218679024e504a9a7196b4f1cb16e5e1748
SSDEEP 1536:5hyY1Bkqv+ExI+x8IRjsY9cjLBAO2MXHVBB:OYfkXJW8IRQpLR2MX1BB
TLSH
T14733F181D7CE0ED337C00EDE6914A705D2FAA465ABD8BC6A8B5D8B85C3749D0945EFC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3619099707vealluiddoamt-es-cbir.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\storage\default\https+++file.kiwi\idb\3619099707vealluiddoamt-es-cbir.sqlite
Size 48KB
SHA256 46c885f48a707da87d2efda00ba226415381b87d77bedc96b19a880db14ad5d7
MD5 d574251fa998046206b8513e55f8e074
SHA1 955f2f2d06ff6358dc048bc85bb63508201d2a03
SHA512 c40c7535a02d178172a2ec9c6b56b99dfbdd037a6098200ba146d4849b81feb342cf1117b483df7ec6aa877aef58447714c0c4fa3096b7830d37a5c61e14d801
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEdA9C:Oa16S6CKnqlizbxV+2xVeU7X2B0dd
TLSH
T12223708E3F07F511C53AF0B178A08D51FC5E321D07222AD66990DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Extreme.S08K5lJc.Injector.v3.7.3.-.by.master131.rar.part

Path C:\Users\Admin\Downloads\Extreme.S08K5lJc.Injector.v3.7.3.-.by.master131.rar.part
Size 1.2MB
SHA256 93dda8b91586acf53c70dfd3f512fcff5793a9af69e174d7e3ad67190361bce8
MD5 90064f3c81022f4beb1b660ea21f16c7
SHA1 3fd13ac9bef5dca67f98750e002712de219494f0
SHA512 897ed287392c669bc97097e4354d8205d30adefea06d8e2ef38e8a29b2a92fa499024a085270de517b93cdacdbe34bba385145980db92dbea277450f3be7ced9
SSDEEP 24576:pp4nq3hGhlcEdjYeqBRmWsGWo53eM3dIqcyL76MQ22nkchgQCebXckQuM3n+2:ppJ3KaEg9sGWowM3qqcy76F2PmVn7jMv
TLSH
T16B553312ADC3461ACFDB6A66C81D0E526227EDD2430AC9BEE3413C256BFC407BD9D85D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-6253-0x00000165BFDA0000-0x00000165BFDA1000-memory.dmp

Download

memory/1332-6254-0x00007FFCA1F90000-0x00007FFCA23EC000-memory.dmp

Download

memory/4464-0-0x00007FFCA34C0000-0x00007FFCA391C000-memory.dmp

Download

memory/5456-1091-0x0000000000880000-0x0000000000A66000-memory.dmp

Download

memory/5456-6245-0x0000000020270000-0x0000000020380000-memory.dmp

Download

memory/5456-6248-0x0000000180000000-0x0000000180048000-memory.dmp

Download

memory/5456-1092-0x000000001B810000-0x000000001B822000-memory.dmp

Download

memory/5456-1093-0x000000001D7A0000-0x000000001D7DC000-memory.dmp

Download