9fc37f6eabb0fd0e9dcc1f2cac0a19f9c53498374088e7ade4a9dfcc3989ef0b

Resubmissions

09/07/2026, 16:49

260709-vbvylady6j8

09/07/2026, 16:46

260709-t929wsex6v5

09/07/2026, 16:25

260709-txan4sdv3r5

Analysis

user interaction
yes
max time kernel
1049s
max time network
1052s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
focuscli.exe
Size 419KB
Sample260709-vbvylady6j
SHA256 9fc37f6eabb0fd0e9dcc1f2cac0a19f9c53498374088e7ade4a9dfcc3989ef0b
MD5 743403af9053d53065eec0a4ccb8c3c9
SHA1 02dae7a212f624aed42ea76eeb77e875a50463b1
SHA512 cba4097ceb39b941f59659c0f576e512975019695a7b9a95d61a364b0c4b02be36ab10529af19046ff85e8030c20314d58c01fb7c695e807f52f20f8bb1520b2
SSDEEP 6144:y/q9hwf/jIhHitRUsw4YA0o7ItfV6IQRTigzl7ftpSm:yq9hHHhsZktQR5i0T/
TLSH
T1A3947E66D6A404FCE0ABD2788D575906E676780A03B1DBCF03E495722F272E09E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 2 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	45	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a188d2f38d30ef3d	5
HTTP URL	45	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a188d34368fbef3d	15

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 4608	2848	x64dbg-unsigned.exe	79

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280894026213248"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{6D65199F-72AF-4136-BDBB-76BF9738341D}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2848	x64dbg-unsigned.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2880	chrome.exe
2880	chrome.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe
2848	x64dbg-unsigned.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	x64dbg-unsigned.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2848	x64dbg-unsigned.exe
5300	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1076	4472	chrome.exe	82
PID 4472 wrote to memory of 3944	4472	chrome.exe	83
PID 4472 wrote to memory of 3944	4472	chrome.exe	83
PID 4472 wrote to memory of 4916	4472	chrome.exe	84
PID 4472 wrote to memory of 4644	4472	chrome.exe	86
PID 4472 wrote to memory of 4644	4472	chrome.exe	86
PID 4472 wrote to memory of 1968	4472	chrome.exe	87
PID 4472 wrote to memory of 1968	4472	chrome.exe	87
PID 4472 wrote to memory of 3220	4472	chrome.exe	88
PID 4472 wrote to memory of 3220	4472	chrome.exe	88
PID 4472 wrote to memory of 3544	4472	chrome.exe	89
PID 4472 wrote to memory of 3544	4472	chrome.exe	89
PID 4472 wrote to memory of 1492	4472	chrome.exe	91
PID 4472 wrote to memory of 1492	4472	chrome.exe	91
PID 4472 wrote to memory of 2664	4472	chrome.exe	92
PID 4472 wrote to memory of 2664	4472	chrome.exe	92
PID 4472 wrote to memory of 3752	4472	chrome.exe	93
PID 4472 wrote to memory of 3752	4472	chrome.exe	93
PID 4472 wrote to memory of 4860	4472	chrome.exe	94
PID 4472 wrote to memory of 4860	4472	chrome.exe	94
PID 4472 wrote to memory of 2480	4472	chrome.exe	95
PID 4472 wrote to memory of 2480	4472	chrome.exe	95
PID 4472 wrote to memory of 5492	4472	chrome.exe	96
PID 4472 wrote to memory of 5492	4472	chrome.exe	96
PID 4472 wrote to memory of 5652	4472	chrome.exe	97
PID 4472 wrote to memory of 5652	4472	chrome.exe	97
PID 4472 wrote to memory of 4952	4472	chrome.exe	98
PID 4472 wrote to memory of 4952	4472	chrome.exe	98
PID 4472 wrote to memory of 2692	4472	chrome.exe	99
PID 4472 wrote to memory of 2692	4472	chrome.exe	99
PID 4472 wrote to memory of 3336	4472	chrome.exe	100
PID 4472 wrote to memory of 72	4472	chrome.exe	102
PID 4472 wrote to memory of 72	4472	chrome.exe	102
PID 4472 wrote to memory of 5688	4472	chrome.exe	103
PID 4472 wrote to memory of 5688	4472	chrome.exe	103
PID 4472 wrote to memory of 5860	4472	chrome.exe	104
PID 4472 wrote to memory of 5996	4472	chrome.exe	105
PID 4472 wrote to memory of 4176	4472	chrome.exe	106
PID 4472 wrote to memory of 6120	4472	chrome.exe	107
PID 4472 wrote to memory of 2880	4472	chrome.exe	113
PID 4472 wrote to memory of 3404	4472	chrome.exe	114
PID 4472 wrote to memory of 3404	4472	chrome.exe	114
PID 4472 wrote to memory of 3104	4472	chrome.exe	115
PID 4472 wrote to memory of 3104	4472	chrome.exe	115
PID 4472 wrote to memory of 2608	4472	chrome.exe	116
PID 4472 wrote to memory of 2608	4472	chrome.exe	116
PID 4472 wrote to memory of 5108	4472	chrome.exe	117
PID 4472 wrote to memory of 5108	4472	chrome.exe	117
PID 4472 wrote to memory of 5576	4472	chrome.exe	118
PID 4472 wrote to memory of 5576	4472	chrome.exe	118
PID 4472 wrote to memory of 952	4472	chrome.exe	119
PID 4472 wrote to memory of 952	4472	chrome.exe	119
PID 4472 wrote to memory of 2284	4472	chrome.exe	120
PID 4472 wrote to memory of 5680	4472	chrome.exe	121
PID 4472 wrote to memory of 5680	4472	chrome.exe	121
PID 5392 wrote to memory of 5300	5392	firefox.exe	124
PID 5392 wrote to memory of 5300	5392	firefox.exe	124
PID 5300 wrote to memory of 5788	5300	firefox.exe	125
PID 5300 wrote to memory of 5788	5300	firefox.exe	125
PID 5300 wrote to memory of 5788	5300	firefox.exe	125
PID 5300 wrote to memory of 1372	5300	firefox.exe	126
PID 5300 wrote to memory of 1372	5300	firefox.exe	126
PID 5300 wrote to memory of 1372	5300	firefox.exe	126
PID 5300 wrote to memory of 1372	5300	firefox.exe	126

C:\Users\Admin\AppData\Local\Temp\focuscli.exe
"C:\Users\Admin\AppData\Local\Temp\focuscli.exe"
1⤵
PID:4608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd005c728,0x7ffdd005c734,0x7ffdd005c740
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,4246370690183854783,1305673901297636897,262144 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,15220326230392056845,14155778857651718556,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,475199106382787896,16632597157091496251,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,14352882050529505478,14891013927889081975,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,9119837841074476239,6363191816903176832,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,3152358193228117386,47733792231821168,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,17752170392028343856,6889733155760533966,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,13742132663454006000,3348595060792263423,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,11086603901760565099,2376757772374541349,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5196,i,2571479242500615036,744415296342465623,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4696,i,3874159294082664284,14187059960581762863,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3448,i,18332741203233085256,180807692242396221,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3564,i,11575653044259080654,6616035136220812699,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5472,i,4322724530174256034,16640328342158941386,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4756,i,13184318496797197861,14002401629253570933,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,15248816268956739595,9782477319938601917,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6328,i,1707163764037970546,402304492554358431,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:72
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3280,i,7967063917294395783,919690812319479858,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,14215712135758074308,12976580778537493555,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,13389964586915568068,3222722689309588549,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,4531296164455351956,4602583011201629703,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,7577469698148391070,9611550120083767001,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  - NTFS ADS
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6492,i,18077506910366869026,5476627741051683900,262144 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4408,i,13140694009294516848,2569248655000945457,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4420,i,8929593884594734585,13697726554509781626,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6688,i,3421365256526788444,12339918897877120951,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6832,i,16362839920498828559,12720234890154047000,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6984,i,4184995894165872803,10792108821916336643,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7000,i,17148497780916762372,6664622804694574713,2097152 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4432,i,4589917044502695076,5929919849557039909,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6612,i,5720204362891069415,3305004984609104526,524288 --field-trial-handle=2060,i,6588661127515969874,13955665366246592410,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6580 /prefetch:12
  2⤵
  PID:5680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1968

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg-unsigned.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg-unsigned.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2848

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {fed5494a-35ee-4bbd-af40-d9a2106f6c58} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {21117bf9-203b-4773-8f9a-a1878d93e83b} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 27274 -prefMapHandle 3792 -prefMapSize 270279 -jsInitHandle 3796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {3a0f99e3-83b6-4763-bff3-d4f844dd3ad5} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 3972 -initialChannelId {d6025eb6-1df7-4873-a1be-b5b4508ca60f} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2864 -prefsLen 25213 -prefMapHandle 3064 -prefMapSize 270279 -jsInitHandle 3068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2788 -initialChannelId {b82ff282-2c91-4b59-80b0-dfaf32050974} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4416 -prefsLen 25213 -prefMapHandle 4420 -prefMapSize 270279 -jsInitHandle 4424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4432 -initialChannelId {6d64e4de-f257-47c9-b408-82becbeb1dfd} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:2588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4604 -prefsLen 25213 -prefMapHandle 4608 -prefMapSize 270279 -jsInitHandle 4612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3068 -initialChannelId {efb61e5d-42bb-4419-aae0-f04682c73529} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d84ed73c699bbacb6297c2b2c1f993ad6b3ce11b629de22f766e6d88e4ad9b8d
MD5 c3f45ec4afc5aa7081a492cd6b50e5e1
SHA1 a750403fadb08ef262a4521fdf9787f174942909
SHA512 2983ca0a4cc26e0c97aa68414bbb3742461406dc6c8d5c2f0879bfea08e00b19c497e0de97adecbde7f407c042f34331fb167758d2a7700a355ec3f2a1957276
TLSH
T10CE0ABA6C831AC270CF9575C54605B42EB0013471B60480F3B3C824CCFB0A3A464182C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 41KB
SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
MD5 a587d1a659231c3c59460569a5564da7
SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
TLSH
T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 76KB
SHA256 361d32e947648d18d94fa9284c2660c2ccaf0d11e1718e0fb58b61f7c171af88
MD5 17f2d3b8b64b6a484ab97c4477358eb0
SHA1 2ebdf89a3afb4a6e371c2e60c7ab6526f11e2a8a
SHA512 1287078549f6e53af667de4989a137af6d1f9ab5c3531e1f64085e13cdc85c5be748666d8e7e46b8881ec9ce7bb71225c25e38621ee5c8ae38d65fe846593027
SSDEEP 1536:9fZc4jhn81B1qeaUxJIkA4Gx5tpMFMttBpTvHqW+2lujSF:9fph81BUrUvo5tpMFoiL2lj
TLSH
T1567312AC18F68339FECA4C465028A575F01186F13B0D539DA76AB134B2A8A799700FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 9df7d630a9e482bc712b9e487bb364539e48fd1a273aef1e69a73f52bf65b432
MD5 a7de48462036cdf2296b8c7fde24b2ec
SHA1 8ac9e79019df0dd72838db7b3435239cf4abb005
SHA512 3579b8976fd00a5e22d0761741dade645f47455a0ce2e54e2f51531979a2348c13a713f4abe0866866f0230928daa62d6ea731749c5c44d3882cf3b56573cd93
TLSH
T1B321AFE4839318F1F7C740F0B4C59945BEF193A029579F39A176C3F97AA62E640420A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2733581a942f16a8f6316ea9f5e319075fcce3a3a32ab6965b30800c15dd8e27
MD5 63ef21a7082ac203788a00fd31826fa1
SHA1 ac68f6262923056e8dde6f6ede2342b0feb5b798
SHA512 aecec236dbb7f7edbd3722015a44111b4097d2c47671ee7780596618b8425709b1dd430c315c5240986e676f777716a491fd7c03fa9f03c84b5af375426210ed
TLSH
T1F5510D68A793D4B2FBFB4BF0B0C79D027B7AAB442C826BB950D5C1F562D77B94062014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 36878450b4d32f135c775632d161a26e5fa2732ba39ae23905f95b81fce7171c
MD5 7317b5c0add3a2c7efb9879afa160c6f
SHA1 0fda8c6af278cb3fdfb72198e31f6bed5c0e3a0d
SHA512 55880472d282d16d3a0c41d6caa526743bc1c01b87224f8173f924752071021e7d02794d13d497f85212c7ffd8b4b6cfaa0de8100d9b0c3c0c2b3498765ac7f4
TLSH
T167510D68A793D4B2FBF74BF070C79D127B7AAB4428826BB950D1C1F522D77B90062014
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 d78a077cefc4875d8484a40725b574848297a80255266581508ca6a79e8076f5
MD5 a9570cbcb14bb30e57bd0564026ed5c5
SHA1 965d492782bd5585d9caa05e6d23aa85e5861bf8
SHA512 245488399c9a1fefba75a5b00150b68da56f276013b199cf3e5d03b66d7df1a1f398e34c74f7b2a260d54b34d2d12405c4c8cc1e82ff09ff7481a7b37e79a7ab
SSDEEP 384:D0u00tLEMFpY+bwuFFPLujlEgpoksaINS7K9VGsXDCQgvNpsHbCVRCpWpXiulsC6:HME4G
TLSH
T13A72DBF787E8C62DC92156F497146F1ECE690624432C3C76C8E5BE4BA3E2472E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 51c561226a4c988a112ecacf6cc7c5efc3d6a2ffa4043e8a68bed30b85d49d98
MD5 034430017cfe595128876ac5294954de
SHA1 75051f5ca2ac3aa2a561a24b938ee109e2f13a56
SHA512 a2cc4466c1af29ac60912ddeb5dcc669eb1a1d554ef70379d95b9f5a9c6884e38343ca5ae94815d864c1c056650acdc3b4cb92ebeeba149aa0cfb247263fe089
SSDEEP 384:DTWKHtK9slJgbYseipGhZG0LB3YaINS7K+VGsZDCQKvNpsHbCVRCpW1XiulQpFgY:3wYDR
TLSH
T1EE82BBF7C7D8C62DC96256F9AB142F1ACE5D0A18431C3C76C8E5BE4BA3E2471E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 1fb2754f7de0d680e84ae157ac3ab431810a4c5cb08530d343efd1edf3c0704b
MD5 b37a2b54e30e325b42863efbaf77e7de
SHA1 f8fa62ace14f94a93566f7e36379bcf0dcc10fed
SHA512 8620169ff0305483c5ddeb94e4006614238aa2480a6eb214d384b5185d127713e69b5e991b7cfbd14bb4d1675d9275cfce683018932d36dead17c3c188ce0a01
SSDEEP 384:D0u00tLEMFpY+buFFPujlgpokw/AFKaINS7K9VGsXDCQgvNpsHbCVRCpWpXiulsT:/ME469
TLSH
T1CD72CBF787E8C62D892256F597146F1ECE6D0624432C3C76C8E5BE4BA3E2472E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 b58651b30be7eb07b942f121ec376d698fa5ed683db1e4f723474af86a736c1b
MD5 19a2a5f7e1140b6e480f9aa949a76323
SHA1 dcb9c953b01c1d7420419b1938e81c7f71fde33d
SHA512 6de0decc9587b4517b6f5c8b1bb4d8965b4ecfa8896d2ca8118bc991db318c4c23ff076c7277143ae64bc7854c17be02700c32643df4c33875751c52b969206c
SSDEEP 384:D0u00tLEMFpY+buFFPLujlgpokw/AdaINS7K9VGsXDCQgvNpsHbCVRCpWpXiulsG:SME45
TLSH
T14372CBF787E8C62DC92256F597146F1ECE690624432C3C76C8E5BE4BA3E2472E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 e34f7aac21d4b29402a24f78d760ca22a47dde451593d39cb2de3f48fb8d8972
MD5 810cdf485adb6406851e6e3fda600172
SHA1 8f8e9d3121d068ae17a661f6630305eb4aefe9da
SHA512 522ccf90ed2340b320c702bc47b793e782fd2245bb6904f5384ba6b02d9e6c5fbe2a7a48b7dbf5180f6dc2b2d96ae5bcf92e248db4bae2acf814d081bcbe445c
SSDEEP 192:DTWKHtK9slJgbYoaINgP+Z0/7K+VGsZDCQKvNpsHbCVRCpMl9HiulQC+dEf/X9QI:DTWKHtK9slJgbYoaINgP+Z0/7K+VGsZc
TLSH
T15142AAF7C7E8C66D896256F5AA242E1BCE9D0A14431C3C76C8E5FE4F63E2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 fb465bcce5efb6623a7c9d8361307af635fd5a35e0641f40a2e96cc117e9de53
MD5 71490227fb13d709b7cc2fed0a4bd7cb
SHA1 1c521fca72ed2f126c438bfb1d862d9f53a93501
SHA512 37f8a4c355d07d603bcb499549bfd943da5bd3376bc8d685c632f506c82074fd734d0b4ba1ef5f10e9002d8c84403e5ff53540783886706505c98cd79a2e9fa7
SSDEEP 384:D0u00tLEMFpY+bweipGhZG0LB3YaINS7K9VGsXDCQgvNpsHbCVRCpWpXiulsCFgS:mME4P
TLSH
T1AA72BBF787E8C62D892256F59B146F1ECE5D0A14432C3C76C8E5BE4BA3E2472E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 1029b3ac2c5b0fec4c4e0a888bb9d06c794da46080c293d299b0135976b0632a
MD5 59ec23d81eade74826a0d25d92d6962f
SHA1 e55c6b4e2d1401ddf026e7cd6ec5a891e8ebdfac
SHA512 4f3b77228841c5c873f87695b954793a1c26c00f136957f3dc2a296d0c421ce7099e696a37d7e8e7719d1a3dbcf8e56d547220dba2c4e823083dc3d73a4fdea5
SSDEEP 384:D0u00tLEMFpY+bweSRuFFPLuV3cL5zaINS7K9VGsXDCQgvNpsHbCVRCpWpXiuls4:jME4F
TLSH
T13272DBF787E8C62DC92256F597146F1ECE690624432C3C76C8E5BE4BA3E2472E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 562efcdeb5da4e52fa8cf877f8b43c8218441d4c759b11d7ba901e42c84b7aec
MD5 276fce3e06844c0bd3c2847d71c08c79
SHA1 4e9315869b3c5b6100699c7824189cb706fe64db
SHA512 4ca65815f6838005c4e4f152521056aaec138d7f3c2f407b18ce103463bfd802ceb3a13c39bd040db397d0e22ad037f43629998c4ba3b391bff9f09bdd194daf
SSDEEP 384:D0u00tLEMFpY+bwuFFPLuL5PgpoksaINS7K9VGsXDCQgvNpsHbCVRCpWpXiulsCn:uME47
TLSH
T13F72DBF787E8C62DC92256F497146F1ECE690624432C3C76C8E5BE4BA3E2472E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 8fd3c6b824c9bcb73a99b51779a0b0f1c1432295985ea0bcc74085db741adfdb
MD5 6db3f7442a3c10aca0f368321a923a5c
SHA1 19de9f6fccf599d5df8f9ab01365872b10c52ca4
SHA512 c25f26b9daa61870537a73da01e7b7fc64e4157bb09814eb6e5acbf850f9fc4c484f8e607d10a56b5c87566cbf15a3c39c03d698e7d4aec1c46c504b85da0eac
TLSH
T15641A0A3A6FEB46710794DBF0D487C096A7AB832155164F5EEBB822CA0959FB0703023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d96a4fef50ab05dd44d26a1ac0c4623afbda820bf14aaf8f44d4bfa07804e489
MD5 a998c315e0b53cfc87fbf0e784bdf240
SHA1 29f5fd6e3f3d3d8f2865d21148692d27b4e60a0f
SHA512 d4145b97047d66e48c9dc9631883fb2c98cabcff4a1047a662ae21fe57e69488b6721bd6162f2d22688cc91ab724d9befa22493e8f1ce181d860a65aca923b70
SSDEEP 192:hRg7QACMZ1v7mpAPRp2YFxF9EHsb+WNnmmdVJ32uM8Oo6ae0ZSE+VyIsnAUge:hRg7vFaUXJawd72usaR2e
TLSH
T14A42D56EE915693B6CCBD229FD2A7757D7F6102122902E84E7FC8A2C14E79CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 344f02fe12e527b08da53951643a462d221a5947478cafc297dc1622d05fd8f3
MD5 68d35161d89b64e34e2c95bee32fe36e
SHA1 fb316474785eea0af03a23dd7cb1fcec2276db90
SHA512 3597facb1f3c3d91216a2440cd168639f8a64fe36994147fa99f6b954827c82eaa1a3d2b0ba1aec4a5973d0611de38dc6422955df62662f0ce43f97ba763f1d1
SSDEEP 192:nRIcBz75ACMkOkv7AwxPRpVWALrtJF9EHsb+WNdfOet0J1YuG3J3268Oo6ae0ZSL:nRImz78AsuXDawJS4F2OaH5e
TLSH
T14462C56BE8256A3B6CDBD229F92AB757D7F5102127942E84E7FC8A1C04E79CD3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 006ddb78d3465593d5a89828e042fd9d2139097f3d304ebc658469b0dfa93e53
MD5 6d023245191f87ccd12e41ad76d47629
SHA1 cbbb370a035b631c61cfb0ab9d11c8c0fe112060
SHA512 b7000189ebdd759af47b114c86f7f04a556095aa0bdff61d24d1869c6015088e63285817544ba104defc8d6aa7c3bf3487e6e3cc257d6bc086f8edec33a98775
SSDEEP 192:nRIcBz75ACMkOtv7AwxPRpVWALrtJF9EHsb+WNdfOetecYuG3J32M8Oo6ae0ZSwE:nRImz78NsuXDawJT4F2saH5e
TLSH
T1CE62C56BE4256A3B6CDBD229F92AB75BD7F5102127942E84E7FC8A1C04E79CD3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cdea5d2a97b0effe66c3b96c5e234a6ed238f7aac14010c765bc990c56cea772
MD5 b17afe277ef121cef0c33180d97c6a2a
SHA1 afcc2007fc79fdaccdf7accd4ea24bbb637f3b97
SHA512 6c9d2627feb418aa4b73fd6d6bd243c4aea261bcd4216b5ccbe8d5c0879fcabe00502d499c1f30428d983449b803c228c3280319f34e731736d5c3ffb2ee361a
SSDEEP 192:nRIcBz75ACMkOQv7AwxPRpVWALrtJF9EHsb+WNdfOet444uG3J32W8Oo6ae0ZSwE:nRImz78MsuXDawJVYF2CaH5e
TLSH
T1A562D66BE4255A3B6CDBD229F92AB757D7F5102123902E84E7FC8A1C04E79CD3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 974309761bc3e56d656fc8e74ae4bf59611801c8c219a5319320c2f757ecbc1b
MD5 93f1b81ff6f12ae761cc8427ad2efb2e
SHA1 0c2f4df0da65b1bc259d1afe5bf23374f3ae98fc
SHA512 30472e8b2ecf6b2747bd64a72a5a580ec7cfdeafe493ee7a2335f4ea26388bf7d395c4524da4438e3edd1bcf19a7a598ce084b1adeff0f168d8036247b316334
SSDEEP 192:nRIcBz75ACMkOCv7AwxPRpVWALrtJF9EHsb+WNdfOet8SIuG3J32C8Oo6ae0ZSwE:nRImz78OsuXDawJjoF2maH5e
TLSH
T1C462C66BE4256A3B6CDBD229F929B757D7F5102127942E84E7FC8A1C04E7ACD3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 57379c2a216dfe2005341f0a9adebc9b8173aca93b1c6b70471ccb7f46d60b14
MD5 d14407a5d4d5991750a19daddd9df50a
SHA1 bcc863ae0cb84f7a7821df800fab5590a4f407e7
SHA512 2630c50e618300b33bf06c56da90ab64a3edb0cd71d53fe28f3cbd27241b0c56051e1bd544179bc61ff45b58adbae3ef3d5400d412515805a9e754a4efdddc44
SSDEEP 192:nRIcBz7QACMkOev7AwxPRpVWALrtJF9EHsb+WNdfOetB+ouG3J32D8Oo6ae0ZSwE:nRImz7NasuXDawJ2IF2PaH5e
TLSH
T11662C56BF8256A3B6CDBD229F92AB757D7F5102126942E84E7FC8A1C04E79CD3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d2c8c64d36c8c0923f4e0cf0633500b1bed3b54062904eae33cfb92fa8033253
MD5 373e344418d60724f3e157548625a08c
SHA1 52144adea94f9286edce908dd7b7f47ce715a3eb
SHA512 fae3fb69b8abf2f01422d82bf66a596b663f86efa765178698823aa4792b290de771a6090e321f7fedd97c1b8e4e5fab0920ccf824ae5783f9e8585950c40d62
SSDEEP 192:nRIcBz75ACMkOB2v7AwxPRpVWALrtJF9EHsb+WNdfOet/3jJkuG3J32rd8Oo6ae9:nRImz78wsuXDawJbEF2paH5e
TLSH
T1EA62D56BE8256E3B6CDBD229F92AB757D7F5102122942E84E7FC8A1C04E79CD3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3d3ba40704828c1dc3f7005933db39258d018ec40b0e8093860754afd22cb704
MD5 c6a75421c93c07d40d90d2242fe54c6b
SHA1 d2d611102c3f58f28319ab57e42bb346141d174a
SHA512 e39f776fbbdb184547f84c605fc2623676d1783cd6941c7942038c51b75563e8a6fcebf87123ce78c4562787423ca690c999ce98a39e23420e1841770398b8c5
SSDEEP 192:nRIcBz7QACMkOMv7AwxPRpVWALrtJF9EHsb+WNdfOetcSMuG3J32y8Oo6ae0ZSwE:nRImz7NYsuXDawJnMF2WaH5e
TLSH
T1A762C66BE4256A3BACDBD229F929B757D7F5102122D42E84E7FC8A1C04E79CC3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b1a71949e71e7a1dc2462f15f73432e98469546f27278a18d2a7fc0209fb11f6
MD5 271389f947380a6c0af37e7f9d538e52
SHA1 1c85668224955515ca3040cd5d1b8035a25e9c56
SHA512 e9c27f7c6f4e3f3643c2894af4b7edb0a6c7d1bfa5f19262898a020382cccb722cac40013f939c9a4f3dbc5ccbc4004a15f9e19c99c2447d02ca3f3d1312c3e3
SSDEEP 192:nRIcBz7QACMkOcv7AwxPRpVWALrtJF9EHsb+WNdfOeBuG3J32c8Oo6ae0ZSw+8yr:nRImz7NIsuXDawJ9F28aH5e
TLSH
T11462C56FE9256A3B6CDBD229F92AB757D7F5102122942E84E7FC8A1C05E79CC3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7e2e6080558a2545818e95e36f6417dc5b7806665466f59efcca7926ce6ba239
MD5 530929b4972e33186fd35461a04c304b
SHA1 c7a7af86ad77c12e5ea1ee59199ed263e5ebabef
SHA512 40738093b3cace3d8f3c2ba62869ff30677c362dc760bea5443cbe8f020bb6315fa11ef74d6f9ce1dca0d9268958243e034eb663bdbed1b5a0c787d263b577ba
SSDEEP 192:nRIcBz7QACMkO/v7AwxPRpVWALrtJF9EHsb+WNdfOetoLI+uG3J32e8Oo6ae0ZSL:nRImz7NXsuXDawJ8IyF26aH5e
TLSH
T1D062D56BE8256E3B6CDBD229F92AB757D7F5102122942E84E7FC8A1C04E79CD3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bb1d022af7f1ef572032f724fc64425cdbff2a960a5db4b5bf34d724918c64a5
MD5 13bd10e6df993267975cbdc5378b8a48
SHA1 41009febae7439dbdf17ab10da13c3d636ecc166
SHA512 0e0b3b54cbbd295c58b900f1db28e51872ef7350e3aa5b4d593eaf6521ba88a5770bef3985690f1a1aaa16faf83dced7ad3d535778514b0d55c2aeb603362c74
SSDEEP 192:hRg7QACMZFv7mpAPRp2YlHF9EHsb+WNnmmdVJ32m8Oo6ae0ZSE+VyIsnAUgtaJ:hRg7v1aUXzawd72SaR28
TLSH
T18452D62EF915693B6CCBD229FD2A7757D7F5102122942E84E7FC8A2C14E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4e8cd52f3ec5cb984aa8f18100dfe5b7568aee5e997c537a95803ee3db238b8d
MD5 ca7d074b0f46588da075ae98b2d10d01
SHA1 ad0ac6558e4f34664640e7e10e09c5a2b656a8bd
SHA512 f2690852f2f3786595f7211fcde9d0548b609400b6bcfa8209757ffb688f5c1279c764fd83268060f8d4b8a55b8f9a9132351e6fd9527769d46443b44fe8f4da
SSDEEP 192:hRg7QACMZcv7mpAPRp2YlMF9EHsb+WNnmmdVJ32m8Oo6ae0ZS2+VyIsnAUgraJ:hRg7vIaUXiawd72SaT2e
TLSH
T1AA52D52EF915693B6CCBD229FD2A7757D7F5102122942E84E7FC8A2C15E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1b09b9c38f47ea3504ad8cac514db7e825a8c8aaae43722e79c4fa21ab207c79
MD5 bde1a501e38db89f13210a94de546f67
SHA1 ec4e5c80231437461a4aabdc004132390c94a64e
SHA512 47d920537bb9460feb98b3b44a67cb47933a84543b9ea8af0446954c0a1e94a757d3bb1e3036576b60f3d378c8fb047a3c2baad20d4d80609be424fae2e2843f
SSDEEP 192:nRIcBz7QACMkOlv7AwxPRpVWALrtJF9EHsb+WNdfOetB+ouG3J32D8Oo6ae0ZSwE:nRImz7NVsuXDawJ2IF2PaH5e
TLSH
T11D62C56BF8256A3B6CDBD229F92AB757D7F5102122942E84E7FC8A1C04E79CC3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6f535cb104cb968741349eec8e78d0eec0f48b32cf0ba3cb98e1a013f9d86db4
MD5 ae319763700f91c7a756f96a2cb2c835
SHA1 0d0398e347e5602adb0140776145c2e7eef7b7dd
SHA512 c43101aa9f9751230d8177fb157a7edcd8abc0266a26cf648aed865ddcac56e95e9177a8c6697ff622439c44b1279104fa0add680f2b6df440186812b74e14ab
SSDEEP 192:nRIcBz75ACMkOmv7AwxPRpVWALrtJF9EHsb+WNdfOetrx2uG3J32N8Oo6ae0ZSwE:nRImz78SsuXDawJzKF2NaH5e
TLSH
T1F462C56BE8256A3B6CDBD229F92AB757D7F5102127942E84E7FC8A1C04E79CD3207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 78f2b9e9ebc08798880cb4679beee8aef2e584a4e9691c5edb1c0165ca1273af
MD5 f3fb909317ed06709bfdddf6e293f823
SHA1 f9840b19b75e8120807aa0784c1bde6154aba029
SHA512 4bd189ef0e2f72445f5af07954ee4d6ebdcc450090a92b283a2c281a3cf530c9eff525dfd48ea12519fb7f49e455434598bbe11f388dcada8c12c9ada348e50c
SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLuLcSjZkXODnq+ErU3BHHGu/n0To:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pU
TLSH
T18172E9A76C4C9E370F94CACCDC1A7B4FADB6024B65E9886443FA582503D5ACF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 aa71b6231035e898213a36a08da9d6b5d2f99f51b6a0abbab11a9f4e876d8aca
MD5 a09d0d8cdb2f068e93a4b58bc97fdd12
SHA1 9d5fed6ff11c6ba83236f5183b5c5417713cf76c
SHA512 59dad015fba103ef1ae258476a18144bd50d04c161b5e9795a1526de2f2719f1b68b7513d47f332824941533d21deb9f26bcae3e0a5486fe0feabcaee38d20ba
TLSH
T1E2B0124080025601C08306B01246148871185F24960A170543E0AA22D9255638016050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591255.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591255.TMP
Size 96B
SHA256 bb55d56a274b9a932bc3840f1d007b79aea27693073276779711f332b393d401
MD5 cab2b6ee1daca216fda03e9d7f0c9d21
SHA1 0a38ac0a53588998f90b064e5076d61684dae027
SHA512 ba984f1f50cdee1fe8a02da61b0d452cd65e4d62465c89e26cda08e8e3ac497c3b3be434dc75655913f860484bfed9b99fe4fb0aac65728f0719856cd5c4b427
TLSH
T12BB00299C103B616C94243B0259595D97F60DF6DC7031216D2F01A6EED6A7718A35162
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 2d3e7e251c79be3f5d46b10c4c9f7e4b95c404782cb9b20c0bc9d7b909597f06
MD5 5f6813df3fca2981dc534be5cc1fb307
SHA1 a95d874bcf4450eca3ca75da7d5838c61f39b23a
SHA512 2e3633713c19cb524103220d3be5e05088a9981e51ccef91a136fa452e951bc319eb9b6d54c080c733199a72407fa0cf427d6b51e82ef7bb295554a2c966d14e
SSDEEP 6144:lQEPqiEFoxVXoKGQUaRrLm7Rkm1tYpBeh2BAoC:lShgmbv9oBGcAoC
TLSH
T1D73423765E75E93D88A5A72EF14D2B1E6FF006FBC1359D80C9D84A4CA74A6CC5E0C870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 d33efb1bcde9d7b39a0daaa87fc795cba4187f5c6b8629d1ea312d3bc92dd5fe
MD5 fee8eb11a03f24b19f2e678a8dc0a03c
SHA1 f5c0a4dcf8140e676713f5ac0c88225134617670
SHA512 8ce780dbfd3729d1470b862db214b9a6fcd25faaf9f574fd357d95085f7835adfa565e517a42d3b3ba162bc1f1c23202f897a849c56cb46f654a144b13c9b08f
SSDEEP 6144:dQEPqiEFoxVXoKGQUaRrLm7Rkm1tYpBeh2BAoC:dShgmbv9oBGcAoC
TLSH
T15F3423765E75E93E88A5A72EB14D2B1F6FF006FBC1359D80C9D84A4CA74A6CC5E0C870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 385631fc3db7b391253d8dce0c2994c5b3f62d83d7d0e844ac007de4ac1b6a6f
MD5 0667ff57e7e17eaa4759e335f523e68a
SHA1 57af0f0236fbc556a49189b9e66085e6b8d4ff85
SHA512 964fb41ace4cf2039c9145442e56ce6603462a027df807048af2d0a1665cd2ced7aaf2c7491829ceaa0d7058514faaae2e4051fc58447005a4134895ead6d3e8
SSDEEP 6144:dhEPqiEFoxVXoKGQUaRrLm7Rkm1tYpBeh2BAoC:dxhgmbv9oBGcAoC
TLSH
T1F93423765E75E93E88A5A72EB14D2B1F6FF006FBC1359D80C9D84A4CA74A6CC5E0C870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 958f3edc46db55aac8c8bccec0a4dd6417307ef2267ad1d96695720c64fdf27c
MD5 3a935f25b54c5b69f7262572dc1d57fe
SHA1 07d8c7b6ae237068654654d75eb2588ea05f9e26
SHA512 67dc17605a99a4b8ff6c8da9f8cc5e904258221096df605a5dc5b7621706ab19230ca5895dc2fd779b406aef7df5b332ad69c64cbfa2e07560043bdc50eedc4a
SSDEEP 3072:3qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:3tm7Rkm1tYpBeh2BAoi
TLSH
T1A1C3123B5E65E9375875BB4EB08E0B1E2EF149A6C930DA92C8D85B0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2d63992545589c765cd40304ab95258a1a86c8a86cbcc4df6e39ff80e563e23e
MD5 7cf7186b0af21be1a0474fad9ad3ad2e
SHA1 e3935cd360e6c17e769d2fdee5f37dfce5ee1603
SHA512 5f6def5f0ce9a8792c876e1c868719e7f8188a403ae1a3ea542d6dfa9971eebaa04e47ae12f16e7319713d0ef88af1349aac6c82cd874acc0a0a2308bfaffc36
SSDEEP 3072:+87Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMT:+8im7Rkm1tYpBeh2BAoT
TLSH
T1ECC312379DB4E9365DB5BB5EB08E0E1F1EF149A7C920DE92C8D85B0423E97CC1A09934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 6064755b6858aa2c2428dc3f42496a8ba3fbc96a651202f05da6eee18026938a
MD5 b9572c0bbaf77c54a5e22b99a8710ecf
SHA1 a3210aba361230a8db61350417ce898b9072d4b7
SHA512 7f4a9c0b5e87cbc48fc348fee67652fc2bfe07fd84ee05a25e2896486edeeb678c807e02bb7c3fc3ca78a75617354344bc7dd587e03486f7163f9fecbb0d719c
SSDEEP 6144:l87EPqiEFoxVXoKGQUaRrLm7Rkm1tYpBeh2BAoC:l87hgmbv9oBGcAoC
TLSH
T1E63423664FB4AA3D8995E72FF44E2E5F6BF006E9C1319DC1C9D84A4C6B4A6C85D0CC70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 e4b8c2f7d57cfcd038772ee3bfa760c7b742735effaa41b171efbb5576dfc41b
MD5 5238c6a56993e0058cf2b38e4cd1795d
SHA1 9ab55d6be551a8203e30e70bbf24582c093ea44a
SHA512 0feabe4aa037706f06ba2ea77e63ddf6f8840887aea5e49b9aa42f2f3c95b26c3ac2ccca964bf4cd442e3fce83bfda41dc9ba16f7caab81de2f055a1e509b31c
SSDEEP 96:TF5QFR+FRqRVFRo/dd66Joz0dzgClKtmc0d/UiSdF95/7bkW6QXC7NEH:k2iJo1d66Joz0dzgCl6mc0dvOv5zbo4H
TLSH
T1CAA1BA68E738863ED449413BCDA60F404F707496989F2F29319C640D1E872EE7ACD27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 dc82e259618b75030d4308ef6d75ef177bcd232f25a6d94c0e3f335481ebe448
MD5 bfc288d8bcc1d106b975d5a732ae43fa
SHA1 e8383214bce447210fd96055a1e75242a71734cf
SHA512 8039d3d87da06a9733fa72de9cf91fd289dcb46ae0cf06cd295c78a9600e9ea28c9d28aa56793e119be0f297bee11fd6e8904e727e01406ab05e29bb539868c3
SSDEEP 96:wF5QFRzFRqRVFRo/dd66Joz0dzgClKtmc0d/UiSdF95/7bkW6QXC7NEHy:DTiJo1d66Joz0dzgCl6mc0dvOv5zbo4S
TLSH
T1B8A1AA68E739863ED449413BCDA60F414F707496989F2F29319C640D1E872EE7ACD27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 fbbd9f99dd948a99902359c2c4152dfed48962d5e3b35cdc86c86fb9dd1bc040
MD5 ac4df14edf10a56c6f753206cf55be0d
SHA1 bb91380ec7c17ca20cb70f7efe8952e9367c7997
SHA512 3e03a9764fb8a507b1e83cf58ca4c223fa0ff68fb74ce5831f24c62a25aa447a48223622b38246f1b205024150b6c43d6b4ffc9769f0884428a1b343b102fecf
SSDEEP 96:TFa2FRzFRqRVFRo/dd66Joz0dzgClKtmc0d/UiSdF95/7bkW6QXC7NEH:9TiJo1d66Joz0dzgCl6mc0dvOv5zbo4H
TLSH
T132A1AA68E739863ED449413BCDA60F414F707496989F2F29319C640D1E872EE7ACD27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 64bed06ebc1534d7b158f2cb79b7dbd63e0fa6faebaf3ea6017780ac36594c09
MD5 da34babd7b430cd429b3f17576b231db
SHA1 a815fa17c83dbe308cf7b4169379c85a69d65287
SHA512 fa5444d2ca80755b874adadb8a6e2b812b37954f84824de2b9adac11443711708d2e0ca3b00402de952f5c694a9c0e2d7bdf0b81b0528f1a6f8ccff079f8b4a5
SSDEEP 96:TFa2FRyFRqRVFRo/dd66Joz0dzgClKtmc0d/UiSdF95/7bkW6QXC7NEH:9iiJo1d66Joz0dzgCl6mc0dvOv5zbo4H
TLSH
T1E8A1A968E739863ED449413BCDA60F814F707496989F2F29319C640D1E872EE7ACD27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d62add1a3fe673f454642c299282043f78e37739b073f70c0c094f9ddf39303e
MD5 ee2bb66b1a8f973d0cc4a9cb4d67daa3
SHA1 59077d0ee219533ef0a0bc2e83e4bbb431bd5852
SHA512 d4cbc847f9d7c433c5ad4034e7bf0010eddeea20d262fabdaf2b855bf3d4501535f7dcd0aa8bfd2d20d22e9468928894d985e2205b2bb1077c01acf11d488109
SSDEEP 192:Zd1/66Joz0dzgCl6mc0dsOv5zboHjHVyjvNw:5/66JozQzgC1jdboDHVyj6
TLSH
T1E5E11FA8E638863FC054427BCDA51F450F36389A988E3F29359C641C2D572EE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs-1.js
Size 6KB
SHA256 81a66b5851e599c4f47e8611449a4ea12f98577f81bed45da7218463fc45fc30
MD5 6e873bb0c27ded37afe9dc9cf9b8a0c1
SHA1 52a4c66ba073935ef8e086b081f1d4175c0554b1
SHA512 7c50a5c48074f0e2e724291ae780411b293284b9fed653379ed77d3f5767bc02704496529b4eab266a3897f703ef9ca5198d75d0dbc6f9498f3894e612d5d20e
SSDEEP 96:xHcHUTUJqGqzfBt08S1zSuZSSlqdv9jLnrH1WknMBw88H8L4cnzZ1:eHERzfB6VbZSS4NMBw880
TLSH
T143E12E7890088B6F64B677BCAC688C315AB2013BBBBF68D710B55484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_2026-05-27_12-11.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip:Zone.Identifier
Size 232B
SHA256 fa0904ecf5b431d47f53517706388b05daa059c3eb0bb36876bf92a3e6f8a4f3
MD5 6058da4a28e5d1966c79915e30fdb993
SHA1 0d23db98f353baf0efe361ec39d11bf6875cf0ee
SHA512 930ff849ab69ae0f213e4770b9749717199a15a70a70a806fdee249baccdab2ce32bde6a39ea6edaecce27e68203b3b8cad3c3b4255e83618e9a83808cf38f58
TLSH
T187D023C78E04C43957753EC92BA8EB1D6417FA15C5595178FB10404B54D40FD6CD5A06
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2848-361-0x000000005A390000-0x000000005A3A5000-memory.dmp

Download

memory/2848-335-0x00007FFDB54C0000-0x00007FFDB5A15000-memory.dmp

Download