902584a04274d0cfbb766ace6f0b52d90d4b43bd0c6bda89ca5a6547662f02b2

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vexor-updater.exe
Size 2.4MB
Sample260711-s8nvfaet2m
SHA256 902584a04274d0cfbb766ace6f0b52d90d4b43bd0c6bda89ca5a6547662f02b2
MD5 468d4be3b71eea444c233ea682ea2f29
SHA1 21559b0d04719811d35d2482c0b455b8540e581e
SHA512 5422b79836480232ce96f2be8022e5149e1bf1382c7c86ab26812953de41f821753f042606443348a1d7ef6ce4fd8257c0ff9b6d1ecff5b1018791ede7e2d168
SSDEEP 49152:HoaFRu674+P2Jn2fpJ+79akz2UsnE73nowWx2mk9GDBWASp:nDJU9Tsnzc14Dm
TLSH
T1F7C5CF4552A916ECC176E178D706A617FA3A34840B309AFB1BE14A162F63BF3577F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	vexor-updater.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	vexor-updater.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2204	vexor-updater.exe
2204	vexor-updater.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3404	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282585122490362"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	vexor-updater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	vexor-updater.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
2204	vexor-updater.exe
1276	chrome.exe
1276	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2204	vexor-updater.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe
4472	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4704	1276	chrome.exe	91
PID 1276 wrote to memory of 3356	1276	chrome.exe	92
PID 1276 wrote to memory of 3404	1276	chrome.exe	93
PID 1276 wrote to memory of 3356	1276	chrome.exe	92
PID 1276 wrote to memory of 4580	1276	chrome.exe	94
PID 1276 wrote to memory of 4580	1276	chrome.exe	94
PID 1276 wrote to memory of 4992	1276	chrome.exe	95
PID 1276 wrote to memory of 3856	1276	chrome.exe	96
PID 1276 wrote to memory of 4992	1276	chrome.exe	95
PID 1276 wrote to memory of 3856	1276	chrome.exe	96
PID 1276 wrote to memory of 2692	1276	chrome.exe	98
PID 1276 wrote to memory of 2692	1276	chrome.exe	98
PID 1276 wrote to memory of 1780	1276	chrome.exe	99
PID 1276 wrote to memory of 1780	1276	chrome.exe	99
PID 1276 wrote to memory of 4744	1276	chrome.exe	100
PID 1276 wrote to memory of 4744	1276	chrome.exe	100
PID 1276 wrote to memory of 2460	1276	chrome.exe	101
PID 1276 wrote to memory of 2460	1276	chrome.exe	101
PID 1276 wrote to memory of 4444	1276	chrome.exe	102
PID 1276 wrote to memory of 2624	1276	chrome.exe	109
PID 1276 wrote to memory of 2624	1276	chrome.exe	109
PID 1276 wrote to memory of 2796	1276	chrome.exe	113
PID 1276 wrote to memory of 2796	1276	chrome.exe	113
PID 1276 wrote to memory of 2316	1276	chrome.exe	114
PID 1276 wrote to memory of 2316	1276	chrome.exe	114
PID 1276 wrote to memory of 4172	1276	chrome.exe	115
PID 1276 wrote to memory of 4172	1276	chrome.exe	115
PID 1276 wrote to memory of 4100	1276	chrome.exe	116
PID 1276 wrote to memory of 4100	1276	chrome.exe	116
PID 1276 wrote to memory of 4344	1276	chrome.exe	117
PID 1276 wrote to memory of 3392	1276	chrome.exe	118
PID 1276 wrote to memory of 2060	1276	chrome.exe	119
PID 4132 wrote to memory of 4472	4132	firefox.exe	121
PID 4132 wrote to memory of 4472	4132	firefox.exe	121
PID 4472 wrote to memory of 2120	4472	firefox.exe	122
PID 4472 wrote to memory of 2120	4472	firefox.exe	122
PID 4472 wrote to memory of 2120	4472	firefox.exe	122
PID 4472 wrote to memory of 4896	4472	firefox.exe	123
PID 4472 wrote to memory of 4896	4472	firefox.exe	123
PID 4472 wrote to memory of 4896	4472	firefox.exe	123
PID 4472 wrote to memory of 4896	4472	firefox.exe	123
PID 4472 wrote to memory of 4780	4472	firefox.exe	124
PID 4472 wrote to memory of 4780	4472	firefox.exe	124
PID 4472 wrote to memory of 4780	4472	firefox.exe	124
PID 4472 wrote to memory of 4780	4472	firefox.exe	124
PID 4472 wrote to memory of 1424	4472	firefox.exe	125
PID 4472 wrote to memory of 1424	4472	firefox.exe	125
PID 4472 wrote to memory of 1424	4472	firefox.exe	125
PID 4472 wrote to memory of 4048	4472	firefox.exe	126
PID 4472 wrote to memory of 4048	4472	firefox.exe	126
PID 4472 wrote to memory of 4048	4472	firefox.exe	126
PID 4472 wrote to memory of 4048	4472	firefox.exe	126
PID 4472 wrote to memory of 5376	4472	firefox.exe	127
PID 4472 wrote to memory of 5376	4472	firefox.exe	127
PID 4472 wrote to memory of 5376	4472	firefox.exe	127
PID 4472 wrote to memory of 5376	4472	firefox.exe	127
PID 4472 wrote to memory of 5632	4472	firefox.exe	128
PID 4472 wrote to memory of 5632	4472	firefox.exe	128
PID 4472 wrote to memory of 5632	4472	firefox.exe	128
PID 4472 wrote to memory of 5632	4472	firefox.exe	128
PID 4472 wrote to memory of 5644	4472	firefox.exe	129
PID 4472 wrote to memory of 5644	4472	firefox.exe	129
PID 4472 wrote to memory of 5644	4472	firefox.exe	129
PID 4472 wrote to memory of 5644	4472	firefox.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\vexor-updater.exe
"C:\Users\Admin\AppData\Local\Temp\vexor-updater.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4084c728,0x7ffa4084c734,0x7ffa4084c740
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,17421363773718625099,12089466839591104629,262144 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,5869919202685162501,1774033059249784792,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,9917978318519976153,8747661005006842439,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,7033770767478826659,9644494486566792018,2097152 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,9988388580791744528,3582582360606335118,2097152 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,9142739361809077456,10366708157227860981,2097152 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3936 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4620,i,1399325809442449104,15339073949151319820,2097152 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,8094853169368000878,15150535825848450040,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,813360783503662594,6258451328915810093,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,2008601805550471013,17472019077623147904,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4576,i,1241875036328696861,12822415975782760041,2097152 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,12330704734949879420,6449001651208904138,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,553535366328423706,9335139213268481619,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6028,i,6874895043158344217,174207315524354315,2097152 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6176,i,9484827970929309567,11268738025165309613,2097152 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,13887122278564290251,9710936749356192610,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,4819872094956326618,5137233507797544436,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,2230732554740737070,16118312461033028544,524288 --field-trial-handle=1896,i,198287119498918867,4366346608692395313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {c8d24440-00ad-41f4-abdb-db1bb6502413} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27135 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {8fbdb7c8-1387-45c9-82a3-be1531440632} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 27276 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {fb84ac03-0c25-417a-8383-693956b6cb91} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3904 -prefsLen 27276 -prefMapHandle 3908 -prefMapSize 270279 -ipcHandle 3716 -initialChannelId {8e256430-bc09-4bbf-8b88-1770d1a55616} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34775 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2924 -initialChannelId {a14bdea4-4a4c-4178-8fcf-ffa73feecee6} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4856 -prefsLen 35012 -prefMapHandle 4860 -prefMapSize 270279 -ipcHandle 4828 -initialChannelId {d64b8b01-afab-44bc-aa3c-2e04c2bad9a2} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32952 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {9bba0ec6-6962-486c-8c3b-bf9e952850f9} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32952 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {0b207202-0fe0-4aca-9ad1-57cfda0fc60d} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {187bcfeb-4871-4650-9376-f642705b7e40} -parentPid 4472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 569ae14ab1c4c06d978c243eee1b24cf1e607d6edd27e152b12b9159a60c9344
MD5 b06003183e9a203ffd97074e1ea55053
SHA1 964ee2c2c4f7cf29970665b50d7faf8e3a3c0677
SHA512 f3d089340dc1be41f06af3b5ec9533a20f7100c1005ffcbb54de8e86d0f1f4db16dbe39b16c027dda7f9c61987103e13411d0cbbd21fbb667cc0226109992f3b
TLSH
T142E05569CA21DC2724FA0718A0001782E754239B2A40C94F7B3C810C8FB0A3A4681D6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f1cd821fc78ee94441a6f4247b66aea4980b3d9bbce999c881899324a8820e4f
MD5 9160173f67b4aa98444cd471f9f0a29c
SHA1 76a42232cbba1a911c4e9f0e959538002248d463
SHA512 dcb1b4e60daeb777f5aaf97b55d600a49642e8bf4a2b23622fda4dab1f6479ebc7b494f006b58b5f9c7611c9b65b86ce8112f7beeefd5c1aee79c4458ce137b8
TLSH
T1FD5188F3C3E48A6D851156F49B216E2FCD2D0A24132C3D66C8D4AE1B43F2876D201B8E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 712fcfed0c7839b891d6781221540441c436df5cd7349029aceb9886abe43cba
MD5 0bc7ba45cf4160b6a8ed6ca5641de25e
SHA1 db9b64e4b6adc853c37e1fbab3a71f31b9ef95f5
SHA512 1bd90bc5644ca5adac0f7a8704986b902178ca52cd520e3dcea5d57caf30ebe28572e7b3c132fec90972b8f2fb06e4a6668129f23cfdf1239f923f4064ab208e
TLSH
T1E8F050B7D6AE746B4079067F1E407C0D69766475118059F4CE5A926F90884AB0B224A7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 19c5e3fbac32240b5d3d5c932fdc8404fbf8d4c328f7ef894226707ebac2c637
MD5 02d10b43a67f0195e030532c33f35067
SHA1 41c786e4f436c161a908261c3109c40eb8050d9d
SHA512 afd2133a0ef5782f397e49d5e96e98a6972cb7e8cd51ee2928005d7cc244e37bd8ac5585e87bba069be055bf502a144d7d6ee414d1ea0da42efc91651e034618
SSDEEP 192:HR9p+VdHqVdvv70pAPRp2dj9+HdLb+WNnlCnxLW21eCtQ0qPyIsnAUgraJ:HR9pGAngUX68r0nE2J/ke
TLSH
T1EE52B52EAE10697B6CDFD219FD527B63D7F6202161912E40EBFC8A2C15E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5439d21486153bf02bcd4768d00f5dce3640fa30ae08ae1bdddb4bb52384b382
MD5 3a35c08e3984dc2de701a4456b539c8f
SHA1 baa73c4d05026af911140e58f5146f8ed14285e4
SHA512 2810dea156b7cec70b8d78812e6dcd9f034e57e819f7aeb5b2c265f46ba4cef8349a8d1e65a00cc23c263e37d6a56779b4cddec5c0c1fde791e4e2bf8e796254
SSDEEP 192:5R9p+VdHqVd+v70pAPRp2dj9+Hdvb+WNnoX0NLW21eCtQ0yVyIsnAUgtaJ:5R9pGA6gUX68X00A2J/y8
TLSH
T1BA42B72EAE10697B6CDFC219FD527B63D7F6202161952E40EBFC8A1C19D79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e8c7d3ae6facd05acaef19cd87c0399395ea105e53de7a36024fb7658d6a7ab8
MD5 30154a4053005a83ac97480d4e7bb856
SHA1 f9c29636a526cef325c4590dc2a9c0ff9d6b1e03
SHA512 0bfe826c584867a64e5aacb803232d731106335dae70e6e930e24df9d06e1f18ed52626fac4fa041c923d7f8921d4378c81d55782e0e9faf35fb009485737ba2
TLSH
T19EB012048402D102D05302B012C36498B154DF20A60E1B0143E06D72C82516B80340D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b3da.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b3da.TMP
Size 96B
SHA256 1c3eb62d65d77ef3855080b14f0436f5f2358f2cce7066868ca5678dd8bff452
MD5 4c5f5c35b6510fbf571fa85366464893
SHA1 ce78ae40ed6d30813c3c85525cc1227fafe921c0
SHA512 28b2ba9050adc9d263ab31ac7a17a6cbae1337420fd9bbe1f0e55179cace8bfc4b214e41d6fc2eb04e922049269cfecf1ffd8cb987db347fed146d3b44a4cd56
TLSH
T1E5B02200C2222202E08203B02388CAC83030EF20CF030A2283E00BB2CC20EB00038030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 9c3307be1fee005827e637ab8c647f31f6129da3f163dd6199a71bda709c3f63
MD5 5e98ad2b4f5909a4d905a65c99bac669
SHA1 ab685fd39607abd2e454243701faacf6af472f41
SHA512 ed88379a772d0f61429f363baa2d5130c3fc763d73bb49a66b1ff316aba998e2cb1d3c325a64078851de748db1286715d37e75d3ace3bd869b8ae84768b7c553
SSDEEP 3072:LaVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5ePqfd7NtZL8cHQRZEQ6Spsb:T7WmVGS2WkNRdYAPqZ/ZLW3Exb
TLSH
T17E341227EFD20F371E56823876571F6B37B25C999064C205BBAC3BEB98435E435058AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d822a27e2a5b78f752ba0b96643097b8bca27fcf7f22847f304fa4d54d606ccb
MD5 ad266e6c07fbb85368abb1d053461f44
SHA1 22ef57d501a3c61adfa6887f5d765392d7874b92
SHA512 579be13330901f7c160e0432c516ce71241561aab06ddeb73f7a978042d26b6f59c5a054a641330ee6dc7534e398b5cca5d0333395563a1ad6e1de9cbed6ea9d
SSDEEP 1536:bNLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:vqfd7NtZL8cHQRZEQ6Sps3
TLSH
T141C30237EBC21F339E96CF64B9130FD667B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 0fc763c726ba563e2063dd8ba77f1a0093f9bf40fe1a5b0a695bb8e034abd988
MD5 a8e3b095fd209a08cb27348956f8788c
SHA1 4397f33cc046e4428717349fab0a4d86a74b1ce6
SHA512 c654de72c8b2472f3a3a2a858d4fc02ba427b94fb130f1ac3f34b5b3d270a7c8df8a64747c38f5ccfd7ef759ca9d8620460e5cec04e0ed36e2ebf87cd8bca18d
SSDEEP 3072:seVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5ePqfd7NtZL8cHQRZEQ6Spsb:E7WmVGS2WkNRdYAPqZ/ZLW3Exb
TLSH
T1CD341227EFD20F371E56823876571F6B37B25C999064C205BBAC3BEB98435E439058AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 e4c6574e3871cfae1b785eae2f35faa964b4fa19089f23c4517c4dba5298bdbd
MD5 08d190c07e8c5ab0ae6ddf8fd8c2c8fb
SHA1 68f62620a82c3bb41b3bdad320d8ef1aa421adfd
SHA512 a2643c47e8b6fe4e5c4e2b4aa894545d3b6cb3506da109831f83cff47ea699ef840fa132f104888e204bb860477bb6e3783955faa9ad3be18d1a0409c5d96528
SSDEEP 3:MsEllllkEthXllkl2zEklNLE:/M/xT02znW
TLSH
T14B4404047FD00505C50150304135C3D103F1DC100715774734510C177CC75400C50004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 7d65cf5d1fc2e24ab02243936341bcef89ef9d0b3f086c5e220f467f5abaad3b
MD5 94397d35c6b96e05d601aee2a725516b
SHA1 daf7fc9bb0dfb6aa053721a6bac985a2d94cbfac
SHA512 cc7b96f3f483ccd58867a47087321364f184b508d93ee10e176326852a45dac516da1e4a97d118e983e8f6aefa0b2d1d8a44596b6ec4f096c98ef93c3c2c06b7
SSDEEP 384:H9XghOiO024YTdcs3hk2nhfdDE2Ba/rIVy8eEj9mj9O:dX+ZYTdv3hk2nhfS2sDIVy8R
TLSH
T16C728DBB8F506C5D1957D985C8AD9369DD05FDBBCBF690B608243449CB8432AB0FA0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07206639-046b-47fa-889a-b368eb62b446.zip

Path C:\Users\Admin\AppData\Local\Temp\07206639-046b-47fa-889a-b368eb62b446.zip
Size 3.7MB
SHA256 25326972e41839bf5e2215fe16f654f3ab0837021cdf85301d4ac1e8f9173a9d
MD5 7da8127d70eca1b60ac2eb927d145a0e
SHA1 53a2dfc74992e4a772a8d494b033ad1425c79259
SHA512 2e1848d2c9658bc56317a383a65ec1b19087a4689cdd6cd9ff22d68d22e605b01bda01fea410b9d844bec4dd5c14cb6d2b99bab3c44620011245eec8df1d656b
SSDEEP 49152:M3vznYVJ5jQhrUOjmO59sJDtpuuTc6dcWWSe1M7+6GoOKus5v7iykxbcKwMfwIwg:M3v7UDcUtpTJO1M7nGod5NoJfwIV3
TLSH
T17406E035D6DC1A09C9CF83BA870C3FFE98CC4FB68054A96B7A6E9D715CA31E61B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 f893ffb737c6d86c96dbf518947689cc31421eba5e78b2191e1e45ba96ef0563
MD5 e0ef50e45ba35311350ff8f49efc0b3d
SHA1 e5853e9b394eeb9cee513ad0afb2bb2cfea5c1c3
SHA512 3a799a368115dfa252fe66ff0ec78e867e4e69977f25761b316859698d11b5bd856a5e7d02ac14c08041e098912bfdc34f38774352fd7ab26d911a496acabfee
SSDEEP 384:9UCIc0PRBZVOKVGcmhuWkd0ZKqqCgHb7buKPfbovmlyjkd66JozGzgC1jd:9UFPRjVGcmhutyKqqCgHb7bHD3ME/
TLSH
T1DBD20044FB2A953FD41552BBDCA50B002F79B88698192F673A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8570f22770f4893f3cd4ba931d825e0fb62b3685b402800454ae86af735bf2e2
MD5 c626b1f88d4b06413dcbad4d33709fa2
SHA1 2cff23098bffedcfb0a19a16edc538d685075efc
SHA512 635742314b1f63ec7397743d06a8e06fe4eca3ae44b0bf34babbb0ad7b1d147ce5709879d9059d1b33cb4bf62944f77ee4d63fbb6d790a87a5bfcf458c37d4cf
SSDEEP 192:uOv5zboPwZmlyjQM/1d66JozGzgCl6mc0dz:lbooZmlyjzd66JozGzgC1jd
TLSH
T162E11DA8EA28863FC409527BCCA21F450F35389A984E3F1935DD614C2D5B6DE368E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d7bc9370e6c8e1e4dc22f7fac957facce645664d414cb96dabffe951452c224c
MD5 9c00bea8cafd5a1a79dddb40cdacf180
SHA1 b21ebae329a2cfc5ef5e0646c92b6c377817b283
SHA512 dfa31524e1c824f7bb45068a9e4879322ef5a44f0a5336dc77758b136a4f47afc2971f710cb39a4f3e99cc3858879447050e3cbbae28470d0b9a6148099b301a
SSDEEP 192:gOv5zbowMmlyjQM/1d66JozGzgCl6mc0dz:LbowMmlyjzd66JozGzgC1jd
TLSH
T12FD12CA8EA28863FC449527BCCA20F010F35396B9C4E3F1931DD61082D5B6DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 02eb6c4beb5bee49a29f872e42dfa77328cea7697308c36c2db73f1d38171bb5
MD5 9dc0d5f966195f36354d857d8446f0a5
SHA1 b5f367a397037f2b4edb474ab60fada21ea27009
SHA512 6f2c44474b689a3939ac359f34fd5397548091bbc5c204050c1c87010e5e871f4d450a796b0ff759b55a68b5ca0bb05aed665d8f91967aa2128fd6365faf8ed0
TLSH
T15821375C3AF94D2AA8D7F29CB481018E93558A0714871C431D12EF8ECE91EDD327A43D
MD5 SHA1 SHA512 TLSH

Submit Download

0157ee2f-196b-4a4b-a405-cae36a61e830

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\0157ee2f-196b-4a4b-a405-cae36a61e830
Size 826B
SHA256 9854919db6e9212848292ea7bf5adb06f8c91fd6511beac138ce71cb9a8459d2
MD5 6622d2dee541c186f92d9339e2de439a
SHA1 dcf5474fe015352187e713e78bf08e9a5a642ba9
SHA512 a197ef48febe3782ec521392e6f0237168046819cc614a6c31f85d1cc69f55f3a9dc0c1936ef46f9fa8a5f526d07483983d936b835e914fe38423425f7a46c66
TLSH
T1A101AFD556116463ACB8D20EDA667717B195E433808B41096EFC48250EFB53F916331A
MD5 SHA1 SHA512 TLSH

Submit Download

126a0862-eecb-45c8-8807-2ad76f3e05b2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\126a0862-eecb-45c8-8807-2ad76f3e05b2
Size 16KB
SHA256 95e41dd4bace9e2afd2429bdb1cef370507521039990e61932dbfd0b77bb0203
MD5 e851a70c586439a4ba5846f00f9feb20
SHA1 1c24f941bba81be848f4a3d5c82f81c5a91e91e1
SHA512 24c4df0c636eccfad0889b2ec6c12743361a1a8613419906b8de64d28d3ffc3b4b148c9ca72d1d3c86c02ccf4fb59fa8847c45be1ee5f402eaee873c96d0e05d
SSDEEP 192:7PsOQ/cDnrctIB5r79rHKu1aFXmzT1RjbSNcn2J49goBn8+iQ0hANBQ0dP1+RtRa:cA1RjbSNcn2JAgkn8NQ0qy0YRIwu
TLSH
T16A72B856686045BA8251E368D8FC7FC3E5F528CF4C419FCADBE4BE0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a371a89-1d58-4d79-af1e-f8c3a7c05af3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\3a371a89-1d58-4d79-af1e-f8c3a7c05af3
Size 235B
SHA256 4bf18aa6729d87d95dbab047f44e4f66be6612d77d0da3d9ab3259a5eb80e305
MD5 217b82b18e548d52963d176cc5b3a5d0
SHA1 ddad009f0ab63a65a4d7060023932cc2a07331e9
SHA512 d8b78f6f3df36a79f67e3b34df81a24e5ff8f169ab16092b8605d37086ab4cde4d2eed5ffff23d71a788f0f083a23ff3d43b705cbdba24ee80c12eacbc8fdfa5
TLSH
T154D097C81C9833AD98001F13B0E0A9C630844C33507468A0C59002B4AABADC84292D26
MD5 SHA1 SHA512 TLSH

Submit Download

56ff48e2-09bb-4893-8759-9f8e62f949bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\56ff48e2-09bb-4893-8759-9f8e62f949bf
Size 883B
SHA256 e54b52a2ee65a1ca62226aacd3b0a05e1b6f5c5bbf46c23f23fd5678c39acc89
MD5 a9fa5677c41b24e5ed1c79170e1892c8
SHA1 88e30ebd3ae4a20fe4c430a187715db1d43645ed
SHA512 89c03df83ce7c37dab5ebe9462eebda98e992277129965385e9b32c123322791e15c6ce6ef547d9aee799c5d8bb131ce7d5a8791f9ee8e032cc5295713f8c7f0
TLSH
T1E3112781E63475B38CBCD15FC555370197F4B51380C540083DA147180DBDD2E536B207
MD5 SHA1 SHA512 TLSH

Submit Download

631b80ce-7ae4-4ab3-a213-8ef11794546e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\631b80ce-7ae4-4ab3-a213-8ef11794546e
Size 2KB
SHA256 7219fabbaaf3cda8b60e66b917a82cb9f769a6ab24d675fb681367f41faf9b2e
MD5 7c220ed4f8eb00ddbc8b669887188838
SHA1 f2cadbc0abb46189445998ca085c9e14fcec34c8
SHA512 686880ba27d713479328b6e079177b9e6bcabf6c8b0687902badb3051ba1e8c19c2a306d9e88280a1ff0729474a2daea0e0e0dcacb1689722db9aea9f88d5d4a
TLSH
T1E641F15836789CB75CEAF1DDD592338E53F48A4310C628432DA2DF0D9C967E9736A03A
MD5 SHA1 SHA512 TLSH

Submit Download

645dcbff-9366-409f-8cae-2dcb4a6ce62a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\645dcbff-9366-409f-8cae-2dcb4a6ce62a
Size 886B
SHA256 f91eb57fdb6bb9e60c03af423edc89d7c6b6a8960d3b55ea9e9e9340b17ea594
MD5 6f3f4a3088ab9379aa77f02aaf87e033
SHA1 54a6c90509cb18abf5c6c446ac844fdb9ecef4ae
SHA512 7210b2a6350cd913340a74b31c393e7da4dcbdf8b05e40a97f935ce7f798c8cfc4f0d7b46854027bbefa3f74fb04b796baf2d89240cfadef90d188c3c2096e68
TLSH
T15E1127959665B5B3DCB8E29B8491770287E0F523C0C659087EA157180DFE92E5367207
MD5 SHA1 SHA512 TLSH

Submit Download

e3df03ee-566c-4f5d-bf0f-1b302982458a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\e3df03ee-566c-4f5d-bf0f-1b302982458a
Size 235B
SHA256 11e220c5ad6a9aee6d4c6477145dc15148a512849912f375003db019e0d379f4
MD5 06dc1113dd6e588eb4aff53f4a5a114e
SHA1 5e058d3502d6998ce74f63036c37b21504579ae2
SHA512 ce240c7ac57c5826dd62305f392a386e6963f4be3033e7a2fdabae713b655f1d22e527f5dec9c51305fef2fd5212223e9698014308a99c9c17667a841563a248
TLSH
T16CD0978064DC635D08040F06F0E269C231454C3714B49810D9E240388AFDDC4021191F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\extensions.json
Size 16KB
SHA256 ba9c6101ac18edacc2c0c3e5e57a18f01a235ad6ea39edc2873076946597c702
MD5 e47335715194dd5fc7e71fb2c72a3774
SHA1 3be7ebb22909b8f5d788993a6ad3ec426cb5944b
SHA512 246d9726011f5e308970410015283dd6b640e557bf2816e0c6d589f7716f71f05abd2c74e376bb3fdf98c8960771443bd61ec83cb66a3eaed1a1ec1ac571fbd8
SSDEEP 384:okI4v2UmldvV8dhWk94zH96oLL4HkL4PRL4HgL4HuL4HCQ4hT:/I4+RfmXt4Z644e4R4i404/4d
TLSH
T1A472531545049EB8294FA79BAA367E02C37D533B70845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 8KB
SHA256 e35401a419be3b4a706e9ef8601a90489ef551ac0f10918e6bf32eb884985e42
MD5 e0dc16c1bce78aeaf9e8b3de6efc2563
SHA1 bf95fa5af5a0cc5b23f5f75291bea16301fe22eb
SHA512 9e205b02812a1a3ca2f1db944916e88d3a41b115ab44312f0a6b00fca3fd719287ced32d894a97ef3629665c5cddf3bc614e20be8cf32c9c0892454600737419
SSDEEP 96:xHBZTUxVqGq5fmceObzSzhSSlWdv9jlsnqWR3r8KBw88s2D7QNejfw8L4cn+wGL9:HTR5fmcephSSbRXBw88sO7MejfAB
TLSH
T1E2021E789044CF7F74B676BCAC6489705AA2023BB7BF68D710B95485051CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 12KB
SHA256 a79caa398daec53b9b910140d3af9836d846d32f41e521a1601bcfd1f4fa8785
MD5 ef6537c085646e6d74a7ae2d0ce98c05
SHA1 9d28a1ccd6a33f63f90aba75014f72a69c6dae3d
SHA512 83c4ea870b5f4e37f76d6793388e76ecbc4528c1a024caaceb9e6754c7a5785d040c245de301f1ac598a3df0c30c12d7c534a815621f6f12e8963f1d567aa3c9
SSDEEP 384:TqCRRwWaU1vZxzIMLK2uK6RzdkGcS3/Ej+7mo4:nRpaU1vZxzIMLK2uK6RzdRcS3/Ea7mo4
TLSH
T10042B97C5145CE3F24F3327DAC6149A069A24227B7BFBCD605F99482055CF2C41EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 c1bbe967ec613a4cc075b53cf26a229ed5045c5960198198a551de91b75956cf
MD5 805a54227569eb22069b718e1a368d56
SHA1 d431f5b3f10aa7c7971e2c79d995d335df703814
SHA512 d8a1aaba22dbb0b5dd5e266ba9af561d7343cbaa22e9784d9a025f0fb04349d9cd5d84acc7fde1db3714e87a9b51926a9624a6ff69b3cc02740a6e4f74f7fb37
SSDEEP 96:xHBUTUxVqGq5fgce1zSzhSSlWdv9jlsnqH/8MBw88n8L4cn+wGC:HyR5fgceAhSSOdBw88hC
TLSH
T157E121789408CB7F74B676ACAC688C715AB2413B77BF28C710B65484050CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 7KB
SHA256 775b4eb1d646c91b4bade8c78ecbd20fe479d9e33d54374ade7eb410102c93b5
MD5 7885ff6527a296c160fcd5b698dfcd4e
SHA1 b52a5b02978dc8c2f4cdf51e692fc6aee3254125
SHA512 a5288a2f3084bc788871f1c3cde67a21d192039fd800bcb811a44e870bae76c92dec74ff8504ebff952f9c02d7ee2e722b9a7bc23bdde035ba4ea996e8ede5bb
SSDEEP 96:xHBUTUxVqGq5fgceObzSzhSSlWdv9jlsnqH/8MBw88n8L4cn+wGLGS:HyR5fgcephSSOdBw88hB
TLSH
T17BE12F789408CB7F65B676ACAC6888315AB2413B77BF68C710B654C8051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 fb5433acb0a32d0d64dc8fcde8731b0f5b8f6a9ed86ffe27aeac2f295a250272
MD5 d3f2bffcee28ff84304deeed5acc1a52
SHA1 cdb537fd91b3bb837d9a48f72c29163ee5bf0f0f
SHA512 4c919df2bf2685706d50b1dce81d92a419e7e5592c1da5b2f25847ea2e0cc881c35b8350b07f44fef18c70cfe5aaf77e22d956c313ea574ec90888d1944354b3
SSDEEP 96:xHBUTUxVqGq5fg9o1zSzthSSlWdv9jCnqH/8MBw88n8L4cn+wGC:HyR5fg9oAthSSSdBw88hC
TLSH
T173E120789418CB7F75B676ACAC648C715AB2013B77BF68C710B65484051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 1021B
SHA256 25d9612e21a3c6f35f2efc8201d8c406f89f40bd65b684cbe7aba3a46f539565
MD5 e68f0df261c434ec086ce14feca9f029
SHA1 16b8b5b2644de538c61439db7dd13b955563a8b4
SHA512 edd2d277f1b0a135a7ee97131f3f8a0eba2957e078e6cc9d67b73cd4aa3f54eaa65703157c5f66327968d63d7bae19316ea38b4acde33aa5924cae3b112cd9ce
TLSH
T17611A890359F15F7BFA6641EC8DA15B557D8242A088700C470DD6B506E683EF037B501
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 efe3ad71bf288cbe265a2a35290c02e3e8be6b50c04aadfa2452b551ab548831
MD5 457e36b830819656e776de951966be15
SHA1 3590e9f0470166ce52727bd15252fd97e412c253
SHA512 59b61abb5d485a8de64c7ea244ff34f2d94bdb3531be698282151a6fdce87b93b0cbf2b4a9d6441002bccc4a6bd3a69c7e7113dd8ca4b47aefdc1573ce49e5f5
TLSH
T1BB210A5074E91DFD8651B00BC5C523F02B4874370A8E50E0F6E60600A3E872F03BF24C
MD5 SHA1 SHA512 TLSH

Submit Download