7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/07/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MyDorm.exe
Size 102KB
Sample260707-blh71ae141
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1484	chrome.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278605182488444"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	firefox.exe
Token: SeDebugPrivilege	2800	firefox.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2800	firefox.exe
2800	firefox.exe
2800	firefox.exe
2800	firefox.exe
2800	firefox.exe
2800	firefox.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	firefox.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2800	2544	firefox.exe	86
PID 2544 wrote to memory of 2800	2544	firefox.exe	86
PID 2800 wrote to memory of 4540	2800	firefox.exe	87
PID 2800 wrote to memory of 4540	2800	firefox.exe	87
PID 2800 wrote to memory of 4540	2800	firefox.exe	87
PID 2800 wrote to memory of 3844	2800	firefox.exe	88
PID 2800 wrote to memory of 3844	2800	firefox.exe	88
PID 2800 wrote to memory of 3844	2800	firefox.exe	88
PID 2800 wrote to memory of 3844	2800	firefox.exe	88
PID 2800 wrote to memory of 2560	2800	firefox.exe	89
PID 2800 wrote to memory of 2560	2800	firefox.exe	89
PID 2800 wrote to memory of 2560	2800	firefox.exe	89
PID 2800 wrote to memory of 2560	2800	firefox.exe	89
PID 2800 wrote to memory of 1040	2800	firefox.exe	90
PID 2800 wrote to memory of 1040	2800	firefox.exe	90
PID 2800 wrote to memory of 1040	2800	firefox.exe	90
PID 2800 wrote to memory of 4496	2800	firefox.exe	91
PID 2800 wrote to memory of 4496	2800	firefox.exe	91
PID 2800 wrote to memory of 4496	2800	firefox.exe	91
PID 2800 wrote to memory of 4496	2800	firefox.exe	91
PID 2800 wrote to memory of 952	2800	firefox.exe	92
PID 2800 wrote to memory of 952	2800	firefox.exe	92
PID 2800 wrote to memory of 952	2800	firefox.exe	92
PID 2800 wrote to memory of 952	2800	firefox.exe	92
PID 2800 wrote to memory of 2836	2800	firefox.exe	93
PID 2800 wrote to memory of 2836	2800	firefox.exe	93
PID 2800 wrote to memory of 2836	2800	firefox.exe	93
PID 2800 wrote to memory of 2836	2800	firefox.exe	93
PID 2800 wrote to memory of 1000	2800	firefox.exe	94
PID 2800 wrote to memory of 1000	2800	firefox.exe	94
PID 2800 wrote to memory of 1000	2800	firefox.exe	94
PID 2800 wrote to memory of 1000	2800	firefox.exe	94
PID 2800 wrote to memory of 1620	2800	firefox.exe	95
PID 2800 wrote to memory of 1620	2800	firefox.exe	95
PID 2800 wrote to memory of 1620	2800	firefox.exe	95
PID 2800 wrote to memory of 1620	2800	firefox.exe	95
PID 1908 wrote to memory of 4948	1908	chrome.exe	97
PID 1908 wrote to memory of 4584	1908	chrome.exe	98
PID 1908 wrote to memory of 4584	1908	chrome.exe	98
PID 1908 wrote to memory of 1484	1908	chrome.exe	99
PID 1908 wrote to memory of 3676	1908	chrome.exe	101
PID 1908 wrote to memory of 3676	1908	chrome.exe	101
PID 1908 wrote to memory of 4544	1908	chrome.exe	102
PID 1908 wrote to memory of 4544	1908	chrome.exe	102
PID 1908 wrote to memory of 1732	1908	chrome.exe	103
PID 1908 wrote to memory of 1732	1908	chrome.exe	103
PID 1908 wrote to memory of 1672	1908	chrome.exe	104
PID 1908 wrote to memory of 1672	1908	chrome.exe	104
PID 1908 wrote to memory of 4960	1908	chrome.exe	106
PID 1908 wrote to memory of 4960	1908	chrome.exe	106
PID 1908 wrote to memory of 4188	1908	chrome.exe	107
PID 1908 wrote to memory of 4188	1908	chrome.exe	107
PID 1908 wrote to memory of 1044	1908	chrome.exe	108
PID 1908 wrote to memory of 1044	1908	chrome.exe	108
PID 1908 wrote to memory of 3460	1908	chrome.exe	109
PID 1908 wrote to memory of 2884	1908	chrome.exe	111
PID 1908 wrote to memory of 2884	1908	chrome.exe	111
PID 1908 wrote to memory of 4028	1908	chrome.exe	112
PID 1908 wrote to memory of 4028	1908	chrome.exe	112
PID 1908 wrote to memory of 4692	1908	chrome.exe	113
PID 1908 wrote to memory of 4692	1908	chrome.exe	113
PID 1908 wrote to memory of 4712	1908	chrome.exe	114
PID 1908 wrote to memory of 4712	1908	chrome.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MyDorm.exe
"C:\Users\Admin\AppData\Local\Temp\MyDorm.exe"
1⤵
PID:3248

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27098 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {88545a86-d0ef-4307-ab13-ada39abfb558} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27134 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {68bd6252-0bfa-463a-a874-d2d66d585645} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27274 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {0cc4c311-c841-4952-86e8-8a4e23dfee51} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27274 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {cb222435-6656-4a4e-8cf5-a8dbe7462b33} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3200 -prefsLen 34773 -prefMapHandle 4440 -prefMapSize 270279 -jsInitHandle 3184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3204 -initialChannelId {b8a7491e-00b0-4fa4-991f-dfb9d82fb037} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4888 -prefsLen 35010 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 4964 -initialChannelId {13baac68-70ac-42a2-9ac3-7bd9124006be} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32900 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {eab0d001-f3dd-41b8-8aab-fe033f3232c0} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32900 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {abbad640-e4ba-4810-8b9a-907d34a389e5} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5548 -prefsLen 32952 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4780 -initialChannelId {50b9e45b-306b-455d-b01b-f0386f8bdd8d} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca805c728,0x7ffca805c734,0x7ffca805c740
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,9778464314563310024,9938446408197230950,262144 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,5239289002471823266,14643472416842135896,524288 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,5425039281521413617,5390194598218468684,524288 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,12444453572480339743,67599531710565057,2097152 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,10991846299355853070,15631221475429717534,2097152 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,15335354975493119126,2833943765546377001,2097152 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,8983811596850051992,11989867650546388247,2097152 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3192,i,2745432663996350774,16353145070712898240,524288 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,364513088647230313,4193769575128120000,524288 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,10001794736387148584,8914488216134398084,524288 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5732,i,18914313196886755,13825688700043311462,2097152 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:9
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5812,i,16998595513497738780,550476283290078806,2097152 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3496,i,855908725153790026,2229450302174425404,2097152 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4888,i,6437256011435515182,10456227355388688609,2097152 --field-trial-handle=1932,i,3999178850104669596,16721752419184242998,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 61e7d8be319ea876f9e84596034f1569254aa985682c6a765847ffbaf31386be
MD5 da468fce8c76db0efbeda71b809d5bee
SHA1 96980dbc6ddd4b616c07a3323509a77bfae47d3a
SHA512 1304471ddbac99648af9cd4f0c2cbd4a843101815ec4eeba517d5d87f6c913ae38e11e482c5329f5d60b5b64376daa29a36211d4e54989b1e8fe7e913d7f0757
TLSH
T142E02BB6C951DC7B2CFD076950544746E700130B3741998B3B3D82088FB163B4595C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 5a84b3c6f7c60a0b96be78002bdb181d93cb5ab6418ae985938fa816acb7b874
MD5 fcd063b8ec3c8336337e92466cbcbaf6
SHA1 3f5be59b80e6629a05992da713e6ebfee0199ba6
SHA512 a108c86422c5fabc53fdec667394ea82a782136c5670b9271f390bb9a4d44477074428d31915570d012ea8118ad172a5c1a5d2c7bc72e227135b85b3e6f776ee
TLSH
T1B201243132A1D210DF247AF0E49D16E15D53210FAED0379BEE8580699CD2611515F263
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 143bed26c2fe460d7214bb083fccd5d6da5c86abcec023a413eff11b89bad6b2
MD5 c9fc3b8c0c883862597917b8075f781f
SHA1 c03042b91d7baab15dfe06e3adec9a8756e65914
SHA512 141a862cf545aec32f1599479b2de200142aeb0b506d11d3eb8184ac912ab24f9d56314e566338120b97b14e549f355a3c2ca71ab6e742f58c77ed91c62f0a16
SSDEEP 48:YALlqtqohchihNaXYfoKspgmzs1fsyosUKsFBs4+s14sXPs+kzsj/sYgqzsfBKsa:D6RakTaIGWvEzXLXTtZg/QIYdH+Nu7cA
TLSH
T1A7D15DF7C3D8893DC90155F8AB156F5ECE2E0A24432C3D66D8D8AE1B93F2875E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 a8c44b539c92c952f4278f2f4d21126a1cab61271e7499357d4c63241ae88375
MD5 aa6594c5e68a22d291d1dc081b98234c
SHA1 46b2f19a874c7a4a505d378c5ff0ff986a898cf6
SHA512 18422bd78167554f0eb1e83d7dcd8e87827859a7df96411220938390c92d8eeec8d2d11ea0861680f34a52f955e1fce863fa59e1a6dc451f83528c64eb8120ae
TLSH
T125113FB7E17EB41B107D46BB5E48B80E197674310251A4F9CDB7C17DF0868E72F15462
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f72930933b7abc04cf7e1cac2c90cb9b1c73b87c0bdeaf377ed7f9886a3e1b11
MD5 080904a44bc29894539eb279161dc761
SHA1 f2068a37f3a35f4acd4bf447e6e9dae116a57659
SHA512 8e5a56766c02caf96912b4b337b9548206f0479e035b0acf87032dcbd334c393a6ea35a7e099642961312423a05208108c3e94681592968a29cdc439ad1c1a54
SSDEEP 192:gRY9/SWReXv7lpAPRp2pBX+9+Hsb+WNUbkcshx22Y2UckwDagVyIsnAUgtaJ:gRY9KR/RUXb0w2U2H2pjak8
TLSH
T15E52D77FBD20257B6CCBC229FA65B357D3F4102162C42E88EAF88A1C18D79CC211B45B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 71f24432a50ecfdc1072e3fa410d13fbf800c2faba5594844dcd448b2b22b5de
MD5 4c895b59b592721c61027d82717969c1
SHA1 2f9cfa94a138ec7075a9ad71d87231932bba309a
SHA512 1fa8b0977ac6d690163dda83265799127fa529b7cfd72daeaf3bca45b3267550240f635d93e1bc40447325a91c62008e0e7902e920d00e677db6e06944ecc282
TLSH
T136B0121180029104C40201B8920354C861489F15D54D270193F0692698360628015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595615.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595615.TMP
Size 96B
SHA256 a36e7bcaff9a1a823cfa9bd1e79f046f4d82b54a1b492729825dc6672e2fdb4d
MD5 e75fe955344dda7383e32f63142a1da5
SHA1 2cb728af616a8929315ca399a49aa24ac43dc33d
SHA512 79c22dd74398c1a402c0327c6c73540d4ab4a4b83095eecc821926d7b140234e9aef14973ef1a5127c8bf9c6a5771a338ca07d7c94126403a322dde48dfd3a2d
TLSH
T171B0220AC2022202C08203F0288080E8B020CF22C2032202C3E00E2AEC2223002220A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 51057985d6f2136c6a9ac1de2e0d277f20b6e154a6bc8bfaedcc50d00c32ef4e
MD5 e3175e79fcee0515bd22005918065229
SHA1 b4f6626c4906777fd1fb61310b5d6c183d4b8e70
SHA512 ad49e2679cc618cc2be449ff6d03ef5f6e092d728d3319adf412844d83011dc57bb4068cc9477136d5fc08978fbb3d275bed276d7e8c9cffeebaf77497735a48
SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:bm7Rkm1tYpBeh2BAoa
TLSH
T156C312375E71A9775979BB4EB08E0B1F1EF149A2D920DE82C8D85B0437FA7CD0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 2c95d3048a3f1ef921f97c745e3d1a522d0227f80f40f80b5e6760da208faaf0
MD5 b89f7f1668dc1f68bb7b34e20f662a81
SHA1 93507ecab9b0fe3962b4f1e952f037099d6e7faa
SHA512 31ddfe38c84989ba74f4753fa5a942347fd9d0e256041894a940d3624dd7b176ca90e8140c4b75701863833cf7568c479d2212e3bfb93723c01ea717a75afc9f
SSDEEP 6144:p2saoajPH/Gc7qlgYl4XEZcKTm7Rkm1tYpBeh2BAoA:ztazH+ZgYl4YNi9oBGcAoA
TLSH
T1483423335E3569B65DBDB7A7704F0B1F5DF18A32D420CA928AE50300ABD1BCE4A45DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 0083f99145063260cdc886d659ce3092d6f0775b01a810c257e152432465eb05
MD5 d8bb01c3a4718bda53effa7de7f91eee
SHA1 4aef1f21ee7732641dadb43db17b4ff734ab7217
SHA512 d536f1eea4416e037344e5626fe75da343d2e716c06ab3f71a8b972dda6fa5501d2bcf458df894becf4d5505e736821fe55dcabc85f9e47f2363618d58c5a757
SSDEEP 6144:l2saoajPH/Gc7qlgYl4XEZcKTm7Rkm1tYpBeh2BAoA:vtazH+ZgYl4YNi9oBGcAoA
TLSH
T1543423334E3569B65DBDB7A7704F0B1F5DF18A32D420CA928AE50300ABD1BCE4A45DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 8e5b8f4f775cb628d74788f76ee7ae3527bf8c69fc368dab0f34c3eb4e851cf9
MD5 c71d8b94da0d9297483ba93ac7e79585
SHA1 de428d3d85e0c829f5a8132947e9a800788954e7
SHA512 1f85d8c16ee55f5467d527490d6df59f4257cf36b53bc01539fe101afb6f7430998633ee0c0bae70d4dfb44fd9bb521035486bd5a75d516634a014b1617d1f89
SSDEEP 768:rgtRZZXGcmhu5RI9M/sH8abpb3bybGm0nm/:rgtR1k5O
TLSH
T152D2F044EB2E513FD41912BBDCA54B002F79B88A99191FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 33KB
SHA256 3c3471d81169b71c9d5b55eda607ceffe97e10f4d255a84830947989e5587fec
MD5 a887415f5c5b1206f25d1e4db41ece3f
SHA1 ae0acb53b4900a918e0fca890beed04ae910d941
SHA512 a50d9059c8ead8418d62c896a5c2df92a2acb1d5350c04dbf7e99a8902f559428bf8cff8c9923a945c4aa1c4c42bf284c1f94409009e6cde6faac393ce71dfd1
SSDEEP 768:zBPL9JiZjhUGcmhuogKPrf2t/fGbibQbJbnbhDvm/:xL9JiZjFgIDc
TLSH
T1FEF20044EB2E913FD41812BBDCA507002F79F88A59192FA73A5D64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8d46956b8e289fa93da476dfb2f241cfaa6537a3a8d3a859de63208f37ac3d0e
MD5 a9b595942bedd68373aa2b2743acc6ee
SHA1 f69c9cedc5bf27563e9f36f4c7b72c3d64ed9136
SHA512 f16cd75bec36cedb5f3b786254332be4da654b7c4020b6c052c140192de2639902592324cb1924eac8eb93e9b9b1ea6bb518733189b35d7cd7a6eb652407ac24
TLSH
T18A213A5C3AFC8D6A68CBE29C7441128E97554E0604871C434E63EF8ECED16DD317A42A
MD5 SHA1 SHA512 TLSH

Submit Download

54a4e174-7b34-4965-8d43-2ae2ad3d7a41

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\54a4e174-7b34-4965-8d43-2ae2ad3d7a41
Size 886B
SHA256 858911df615c12815c2233e67671e1079141775df67b32289c9eb49fc92409f2
MD5 01220ba08eba13908a2a727f1b70d0cd
SHA1 7d1b005bb98bf97b317528bf8f2e12fbf5a30a29
SHA512 2179d19e862bb6bf7802b20b74fdeac40304d3574b70979aeae1710a72c6ddc883091910904bdb1f72d07536430cf1e01a4e3119d5a429f99764711e79ff8c4e
TLSH
T12A110051D664B5B38C68D18BA8D1B7428FA87423C1DA0D147DA49B080DBA52AA36B30B
MD5 SHA1 SHA512 TLSH

Submit Download

592ca04d-a7a6-4cfa-be7f-83fc7067270d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\592ca04d-a7a6-4cfa-be7f-83fc7067270d
Size 871B
SHA256 5e1764341f8776f7773cd054a2745f838db345031c7f79a921dd7aa5bde1d427
MD5 b5715486388881677a5d4dd16c2b0352
SHA1 3e2adeac4b544338b3986900451d23b2d6d13cb8
SHA512 3c70fe0250fc842ac82fcbee1a3ce41a94294e144a8737cf4a3d2fdd4ec0aa48c65a15957272be1b7d0cd915852e736654a0301037b7755abff4a0a393fef368
TLSH
T19211C051D63575B3CC78A24B865577014BB8752380DA89143DA05E140DBE62E63BA70B
MD5 SHA1 SHA512 TLSH

Submit Download

99fbbe69-fd31-4683-9862-1ff9aa103d7b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\99fbbe69-fd31-4683-9862-1ff9aa103d7b
Size 235B
SHA256 4e484f8a88cb6fa413d3f5fe6239750404edf2d2eb03f7818d985837763e6750
MD5 59e732166bed3c550f3e0dc70bf62c12
SHA1 e3e932924f0b7f6f54456c30f5d711ebccbee01c
SHA512 f87ea505175ca1f34f5bae2ab2a75e86b2acbe366b4510520a48ff7bb97043d744faa2e5955374cd5140046a3be2d8b8a33f654117b4718a261ff178142d39b5
TLSH
T140D097C024E82B6C48141F0EF0B068C631858C331078A8289AA445B8ADBDEC80161C1B
MD5 SHA1 SHA512 TLSH

Submit Download

ac40da27-a963-4850-88a7-9d27cb65d583

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\ac40da27-a963-4850-88a7-9d27cb65d583
Size 235B
SHA256 8fa3d5d0a9121a1e50af3ea6bc929f57ca45cb99143b1bfbb1874129f68d2750
MD5 e3b05f98b5bc60f06e8d2c43f9c07a53
SHA1 678e31d95baa45e03db890fc35e3a7f8607efb28
SHA512 ea5d6b71dc7f2c4dca9d25f039973df918ee6cc5f7e08db0e1e8f58b6999f5341de7666383c873ec6c1b6b8d40f4ac0c4468d53de5a9b940fdbfe02013c3446a
TLSH
T1BDD0A79164B8676D49182F07B0E079CA31458C3364B5A810D9A145749AF9DC941A2997
MD5 SHA1 SHA512 TLSH

Submit Download

fcd6c60a-72a8-4c8b-8f76-da5ee8a6291a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\fcd6c60a-72a8-4c8b-8f76-da5ee8a6291a
Size 2KB
SHA256 a2af2898289c1d19236798bfaf8ae3c3555ce2e80b59a3e4e75c22bdbbe7ce52
MD5 4e844e2f65a2e5d7cecb67ebb92dfdd7
SHA1 e15caa1bb9559f6a26f49008f73cb6e636efed8e
SHA512 95fc17236853a3290e404ac7bf584a180d1cfbc3d613a6369545032bbf778cee725f12d795e1cd881895c0dc9ef6f0b9e47bd8fda425ecdf877eed9eb604c50d
TLSH
T18541426CB5788CB78DDAF18DD542334E57A48E1340C61C832D62DF0C8D9A7AA236A52B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 dcbc09a57abea8c7a60a2d99babbb3095584da4663c4452bbc6d89b06f893a7d
MD5 d1900703ed68382c4da9230f38581b9d
SHA1 420de95b7339228d4b3e6b2b097b20ad6e04bd10
SHA512 db022a0402170703336a088d1dda1d5a0de0d24f5d4e37dd8650153aa56fe29d6d67a704ffdca40bebd5a7314e4690b2d7c02a9cea72a2765adf8db1f730877e
SSDEEP 96:xHkUTUNqGqZfLD21zS1FSSlqdv9jXgnumHb4nNzw9Bw88H8L4cntev:+gRZfLD2IFSS2ob0sBw881
TLSH
T1BDE120789508CB7F74B676ACAC688831AAB2413BB7BF28D750B65485050CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 22b33856d553feb66e66637b868b0c68acef90a8f35919c567343701033e46c5
MD5 0e20de48bc4bc14ce1502aa9cfa8577c
SHA1 6f8f0d2ac4c656ad98395c63548823ee5cc1595c
SHA512 aecc6e6b8716b6ca02477d4ef73829692e5d5acaadd5fe5c49e02a55e060eeb183218570290fd3403afbb0d38daf496284b37b33ec43c2560739abdb32418e38
SSDEEP 96:xHkUTUNqGqZfLrHObzSXSSlqdv9j2numHb4nNzw9Bw8OH8L4cntjv:+gRZfLrHFSSUob0sBw8Om
TLSH
T136E1207895088F7F74B676ACAC688831AAB2413BB7BF68D750B554C5010CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 d7844a34d0bf0b630946d2175c5ea735eb8b74ee73d04c3d1ce722cb6467a71f
MD5 3eae61416d74ab18a6b3149c486fd9a4
SHA1 501c503078b2bb4ac252b02e44bbcfe0632ccce1
SHA512 97c2fcfbabd5c6824918b68d72ff027a4d7253c742dbc1f368252173a7055d215f42ec2903b00f933258c83464b161ce17a1dd55a879ecc1b4354552365b59e6
SSDEEP 96:xHkUTUNqGqZfLrH1zSXSSlqdv9j2numHb4nNzw9Bw88H8L4cntev:+gRZfLrHySSUob0sBw881
TLSH
T11EE120789508CB7F74B676ACAC688831AAB2413BB7BF68D750B55485010CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 48d0ecbd47c1347584860d1dab221bc752997f953e2d3d8ab4ca02679b8205b8
MD5 3205874e89c8877275b7c6ec538ea846
SHA1 cdea3f2e20b39c9be5296a6c7f0ba3d45a17ff7b
SHA512 d77af67b7865e63660bbdff07fa2313bf1cb1b0e25a936deecb3b820739b6d149057b778fbbe32de366a04eb73c08676d6d51642d38a64a83c085645dea1b0ca
SSDEEP 96:xHkUTUNqGqZfLD21zS0hSSlqdv9jXgnumHb4nNzw9Bw88H8L4cntev:+gRZfLD25hSS2ob0sBw881
TLSH
T1FDE120789508CB7F74B676ACAC688831AAB2413BB7BF28D750B55485050CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 9ae2579aef5a37fe06b34fe1dd536f88356fd190e8e99639864304909a2c1f43
MD5 f6aac5aac6e6ba97129512cfac4aa0fd
SHA1 aa0f98577b2a2bf9810751fa718fcba6550879a7
SHA512 d4c4484c784099f09e94f3c3c8449b2e694541cf94bc5ee3ea666bd3cc0d3214d4566dc6b8ba57a9eb6e7fabd23208d3f47a4b4306e2fff1df67952c5134eb92
SSDEEP 49152:7wtRK8Xdg+ziwU7RnY7SrxXtXfotSv0sTuMvd:8tRK8Xdg+zMrRtXfoQv029F
TLSH
T1711639F824D2A257F3814037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download