7c9249fb0bb6e6af6e885b433f3f374c2cc60a83a5fd28a64e36942a84da0c3b

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yeni Metin Belgesi.txt
Size 51KB
Sample260730-m76e7swdmc
SHA256 7c9249fb0bb6e6af6e885b433f3f374c2cc60a83a5fd28a64e36942a84da0c3b
MD5 ed4bc33614a5acb6ee704f78a8e3e2b1
SHA1 20acec8f369f460a13a1df20c37fccaa1132e523
SHA512 365f2c2b45549116b34c093567d8242f77590b8d340b8aa02a3398f5847d7796e50a2896e0b8413b73a7499f817a891771b738a64888d70b5f6b339c186732af
SSDEEP 48:ozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzg:f
TLSH
T16F332366C02AAE00021B80BCA82638E2CF38CCA220008B3EA8300C13090E03CAC88808
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
768	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298832795987178"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2472	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
1532	NOTEPAD.EXE
1208	firefox.exe
1208	firefox.exe
1208	firefox.exe
1208	firefox.exe
1208	firefox.exe
1208	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
2472	OpenWith.exe
1208	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 2500	4260	chrome.exe	93
PID 4260 wrote to memory of 5104	4260	chrome.exe	94
PID 4260 wrote to memory of 5104	4260	chrome.exe	94
PID 4260 wrote to memory of 768	4260	chrome.exe	95
PID 4260 wrote to memory of 204	4260	chrome.exe	96
PID 4260 wrote to memory of 204	4260	chrome.exe	96
PID 4260 wrote to memory of 2204	4260	chrome.exe	98
PID 4260 wrote to memory of 2204	4260	chrome.exe	98
PID 4260 wrote to memory of 2472	4260	chrome.exe	99
PID 4260 wrote to memory of 2472	4260	chrome.exe	99
PID 4260 wrote to memory of 4268	4260	chrome.exe	100
PID 4260 wrote to memory of 4268	4260	chrome.exe	100
PID 4260 wrote to memory of 1804	4260	chrome.exe	103
PID 4260 wrote to memory of 1804	4260	chrome.exe	103
PID 4260 wrote to memory of 4052	4260	chrome.exe	105
PID 4260 wrote to memory of 4052	4260	chrome.exe	105
PID 4260 wrote to memory of 4192	4260	chrome.exe	109
PID 4260 wrote to memory of 4952	4260	chrome.exe	111
PID 4260 wrote to memory of 4952	4260	chrome.exe	111
PID 4260 wrote to memory of 1388	4260	chrome.exe	112
PID 4260 wrote to memory of 1388	4260	chrome.exe	112
PID 4260 wrote to memory of 2688	4260	chrome.exe	115
PID 4260 wrote to memory of 3540	4260	chrome.exe	116
PID 4260 wrote to memory of 4040	4260	chrome.exe	117
PID 4260 wrote to memory of 1064	4260	chrome.exe	118
PID 4260 wrote to memory of 2916	4260	chrome.exe	119
PID 4260 wrote to memory of 2916	4260	chrome.exe	119
PID 4260 wrote to memory of 5004	4260	chrome.exe	120
PID 4260 wrote to memory of 5004	4260	chrome.exe	120
PID 4260 wrote to memory of 3272	4260	chrome.exe	124
PID 4260 wrote to memory of 3272	4260	chrome.exe	124
PID 4260 wrote to memory of 564	4260	chrome.exe	125
PID 4260 wrote to memory of 564	4260	chrome.exe	125
PID 4260 wrote to memory of 2592	4260	chrome.exe	128
PID 4260 wrote to memory of 2592	4260	chrome.exe	128
PID 4260 wrote to memory of 3812	4260	chrome.exe	129
PID 4260 wrote to memory of 3812	4260	chrome.exe	129
PID 4260 wrote to memory of 956	4260	chrome.exe	131
PID 4260 wrote to memory of 956	4260	chrome.exe	131
PID 2700 wrote to memory of 1208	2700	firefox.exe	133
PID 2700 wrote to memory of 1208	2700	firefox.exe	133
PID 1208 wrote to memory of 5004	1208	firefox.exe	134
PID 1208 wrote to memory of 5004	1208	firefox.exe	134
PID 1208 wrote to memory of 5004	1208	firefox.exe	134
PID 1208 wrote to memory of 3892	1208	firefox.exe	135
PID 1208 wrote to memory of 3892	1208	firefox.exe	135
PID 1208 wrote to memory of 3892	1208	firefox.exe	135
PID 1208 wrote to memory of 3892	1208	firefox.exe	135
PID 1208 wrote to memory of 2264	1208	firefox.exe	137
PID 1208 wrote to memory of 2264	1208	firefox.exe	137
PID 1208 wrote to memory of 2264	1208	firefox.exe	137
PID 1208 wrote to memory of 2264	1208	firefox.exe	137
PID 1208 wrote to memory of 3436	1208	firefox.exe	138
PID 1208 wrote to memory of 3436	1208	firefox.exe	138
PID 1208 wrote to memory of 3436	1208	firefox.exe	138
PID 1208 wrote to memory of 4704	1208	firefox.exe	139
PID 1208 wrote to memory of 4704	1208	firefox.exe	139
PID 1208 wrote to memory of 4704	1208	firefox.exe	139
PID 1208 wrote to memory of 4704	1208	firefox.exe	139
PID 1208 wrote to memory of 5660	1208	firefox.exe	140
PID 1208 wrote to memory of 5660	1208	firefox.exe	140
PID 1208 wrote to memory of 5660	1208	firefox.exe	140
PID 1208 wrote to memory of 5660	1208	firefox.exe	140
PID 1208 wrote to memory of 5932	1208	firefox.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Yeni Metin Belgesi.txt"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaa897c728,0x7ffaa897c734,0x7ffaa897c740
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,7800030258720501123,10352589557357461935,262144 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,3733996999505507081,553340680392240538,524288 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,16118563908267113716,15469089160652462726,524288 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,13485990601541275624,10455282151660593176,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,16878066025662223634,10966222345743571830,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,9455709874936077604,9892040079906098375,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,1364340200795912229,3870109766376911327,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4948,i,9392515965678633150,3175967508949470298,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,5633270393301740036,14570466125082332321,524288 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3488,i,9552124013560773303,5930959027196293506,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3288,i,12656990648797018670,1955216436671392923,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,9094895697770482366,9104269095775083451,524288 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,15839189490930538852,639183613489289,524288 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6700,i,5579915881410828342,1502807604128799223,524288 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6696,i,6734480375732788121,17904934442119192407,524288 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6756,i,4905875372085309309,11290739703235328686,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6428,i,2723402760134477460,3702200132981422093,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4564,i,6100905073707390976,366061842231510761,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4968,i,13266094589697093891,14018112667802923775,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3260,i,7487540169203640152,11328954554649664358,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5240,i,11245442375246806860,6739585265289514668,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3368,i,71425747242718868,5408649860242901872,2097152 --field-trial-handle=2072,i,13315853187821522655,9177368807466738601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2472

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {6bded61f-a538-469e-b63d-0375cdc32ec2} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2348 -prefsLen 27135 -prefMapHandle 2116 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {2727ec14-50d9-4323-966b-3b0f21b28431} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3068 -prefsLen 27276 -prefMapHandle 1672 -prefMapSize 270279 -jsInitHandle 1676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2712 -initialChannelId {84ee054e-b788-4ccf-9f9e-ffd1acb47a3f} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3752 -prefsLen 27276 -prefMapHandle 3756 -prefMapSize 270279 -ipcHandle 1672 -initialChannelId {42b1e1f9-9be8-4faa-9ff1-0376079bac5c} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4320 -prefsLen 34775 -prefMapHandle 4324 -prefMapSize 270279 -jsInitHandle 4328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4332 -initialChannelId {c3ac3425-be65-4cfe-8a7c-76add13dfb33} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 35091 -prefMapHandle 4964 -prefMapSize 270279 -ipcHandle 4952 -initialChannelId {a9652508-8bc9-4484-bd5a-6c37f999695c} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5256 -prefsLen 33031 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {46e42db8-3184-4c0a-b974-42592424875e} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 33031 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4728 -initialChannelId {171231db-85a5-4ea2-9c5d-e65b268871f9} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 33031 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5792 -initialChannelId {573909fd-8a40-428c-8ce3-e2e900577b67} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2500 -prefsLen 33071 -prefMapHandle 864 -prefMapSize 270279 -jsInitHandle 6184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6212 -initialChannelId {a0f63def-ff16-40b5-8955-e144432871ac} -parentPid 1208 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1208" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 881e0cb385f3bf72cf3c3dd0eb202881ec6664d7f1bea423498040aedbc9ee24
MD5 0745d1eee575298a9fa8db2525ca2a28
SHA1 8c0c80632f366847c0a298a5148b809d9cf1c128
SHA512 4630785f5dbbf528ac9649eb2d81576ca65f441c69e895771108001ca70585a2e6d82ce13a50d0cbdf1586501e81c55467e8e45f4edde37803767c4e30e7c987
TLSH
T180E02B9AC921EC3B1CFD476D50504A46DA2123571760C45B373C920C8FF26B70A8586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0fa4c34dd4dddf6acd3af6a98d4e4f793262b7f99c0c5229321be5e1d81a34da
MD5 cbe9c2ce2cc34678013fea353157bed0
SHA1 a04e29da33426dd0a3ef97d3cfbbf056255eb790
SHA512 c8d5230f3d1fe9a5286fd8eacd271f1023f4e470ba771294260ccb24570e633874630c6f811b763392703f5b0b267d590ff58ef6825661856207dc79afbf3278
TLSH
T1C521222BD0F02257EF8EC979CB8C7807A42EEB9D1A253BD301204D359A4F6E84CD4AD4
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 6d38fbc8726ebc38e4ffaf19de282099c22e9e866ee9db2defd3e7d3782510d8
MD5 90eb2440b931a09a605caefec1ddca95
SHA1 fa3b0aa5b172199bcba0fb34f9372de8cc90f361
SHA512 f6d820651d5f470505f2c5bbf99d1d758c97d841e567a44354bf8dfbb79cb15e3c1987b473349ec51c7d4b675941b83d260c0fd0141d094fc97d8dafb39685b7
SSDEEP 3:MsEllllkEthXllkl2zE/lBmG/ll:/M/xT02zD2l
TLSH
T1924404047FC00D07C5045170C4D1D7501370D4100713774334F10433DCD77400C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 6ec422e8afa948db12bd4544f8b8988ba9221552c40e2f5a9d25dd4a40a4c03f
MD5 c479c3b9fbc5431338924b0035b9e349
SHA1 3bda990d813650b644214b43b5cde8b842f6c882
SHA512 df10e62226d9aa1609ae69c8b00b41f2ddb7c84e368506e6c4bad24a55af7f2f3f8546b4935c9c21f09c3946db3f11994eb4957b1b9b7964d43b74c8a39e18a6
SSDEEP 384:DhvActtLsBsdJE0mnJnyN6kaIUWhtMHKVM4vaMVwn1eHSGR7Azb++VEahbNyxMGh:meu9P2XgJSVwc
TLSH
T14E527BF7C3F8C62DC81253F8AB256E2FCD290A15422C3D56C5D5AF8B93E2471E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 6f7730b5352e17f7a2a8e7a3ec0fa644d940569e8a1650a1d29961409b183c20
MD5 02f49dac79729557722f0ef6f30604cc
SHA1 61dfa8941a7145ec864b1a2442687ea00fe7d469
SHA512 e73b7d03ac8b2f74b81c035efc1114aa03edc4b8e8eb9822d4e687220c3b040c7121f09c89e03c9a34b9e88a20bc7df1eefdc68cc26502a9491834a8d76e230b
TLSH
T1AC3181A792BEB467106C49EF1E447C1E1A7DB8304682B4F1CA9B817CA4D1AFB0B15932
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2863fc957e1cf8abde8d3892d889d087e76fb07f18e3bb3ac66ede51c3b60366
MD5 682030aa0d4ebe3e066cf393244ba425
SHA1 843f3d828b3105e8759a50e343cad34cc4b96c2c
SHA512 db85ea0d6c3270e7e1a87635b3029bf069e7769f8125decb63b80e52fee9bf4b24e5317dda08fc5bfd1bff43a4e1b92c97db5370635ec18ca3a10758f4eae92b
SSDEEP 192:8RROPkA8nyTv7ApAPRp2l9qHsb+WNnDw0cn2TeHbahVyIsnAUgtaJ:8RROhrkUXmkws0i2AaH8
TLSH
T16242B82EEE10693BACDBD219FA267B53D7F6102561C42DC4EAFC8A2C15D75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4ab7a19b71138855f3e5f5ef167fb42ca6c1df9a9a34b102ca405449252cbf22
MD5 b53a1d30a344291b36b1f1672c259602
SHA1 0a7340a4c457bf1348d852695d480b755ba6135d
SHA512 79084427d928945e4d607030f7572e768bcc43a122ebd65459b070b7e4438ba5452dc95dc811932ba251a37f0b37e0d8101413e52449c81310f4acc236fbe9f6
SSDEEP 192:8RROPkA8nyvv7ApAPRp2llU9qHsb+WNnDwbjI28n2TeHbahVyIsnAUgtaJ:8RROhnkUX5kwso2C2AaH8
TLSH
T17E42B92EEE10693BACDBD219FA267B53D7F61025A1C46DC4EAFC892C14D75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f75480de2adb642f6899132f80c7c0b6ab8e972bfdecef6b2a8a9c63159f8c62
MD5 fb039f1e517921a4e41e3af5195a24fd
SHA1 0e475368fe76886b94b45fef3f2d328724cd7c44
SHA512 11344e1fb7a5d36a75233965be2bd7f0113d833303c0ef99668b63f11c8280490831122f49e9deabd5d9f16061c14f190f5a1b52049ff536a5d60fe0d048c93a
SSDEEP 192:1RR+PkA8nyEv7AwAPRp2llU9qHsb+WNnyh2Z2eHn2TeHbamVyIsnAUgraJ:1RR+hgkBX5kwEJeH2Aa+e
TLSH
T18C52B82EEE10693BACDBD219FA257B53E7F6102561C46EC0EAFC8A2C15D75CC2217127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1af98f039559156e4941c4e121a4891961e0bbb1b701bd066d9b8ad695ab7a17
MD5 89a6e737b9d117644a0238034e917288
SHA1 3c694869c46d700c8db55749f0100bc8c4bb6160
SHA512 9e8f64d822c8f7e32fcb1e07d7fb500e2b2e0dc63eac785c49f3e94afa271d44dbfe372522b7ac6487ee46b6c2c19a2498214511205f09ff94d023ef131fe743
SSDEEP 192:1RNcBz+PkA8nvEv7AMAPRp2G7lS1l9qHsb+WNN8Nyh2Z2Wy527n2TeHbamVyIsnB:1RNmz+QgktXYkwxJF2L2Aa+e
TLSH
T1C152A72FEA105E7BACD6D219FA257B57E7F61025A1C06DC0EAFC8A2C14D76CC2217127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 560e17105f353edca0f5765f58b23737c867a6ded5fe65ddfe4bca36b21b6b2c
MD5 3f10578bd8ea00d20714be79f3e1a5ac
SHA1 9232866b1b6e6a012af57deded6be0e1bb64642f
SHA512 90a133ec6c671d41874b3d947e80de9146455a3ea8d434e7543b20d85ecc6cb73a2f06e7a538055a7a13343e58e13fd6eab7e06293057e0a0c920763ebc4ae64
SSDEEP 192:1RNcBz+PkA8nvmv7AMqPRpQG7lS1l9qHsb+WNN87ayh2Z2Wy5Tsr2nn2TeHbawVK:1RNmz+QSkfXWkwcJFY2n2Aa0e
TLSH
T19E62B72FEA105E7BACE6C219F925BB56D7F5102591C06DC4EAFC8A2C14D76CC2217127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 7f29330dab7da32e0ac171624797c0291e2655803e5366a0598eb6b5d65bacd3
MD5 d493298162b0fdee2f55ca1d53e5fc7b
SHA1 0328010c81ae99895fd37be1e038790e233e9fa5
SHA512 675a931fa31a0f4b4077d141fa8cdf00956d6fdfc07b3324b6e1794d0e1f874348e949dca6f4fa1bac1203cd8188645b313f91faefd1b4dac060ddbc5c2148ed
TLSH
T126B0120180017101C04712F01A46A49CB1249F50A60A271153E17A23D8251628014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592e1b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592e1b.TMP
Size 96B
SHA256 55d8b0afd4ac6634958699e9c22efa458f628a9b3d543a7cd5acca5fe327eea7
MD5 ef970b4cb5cd52a24cf772cd2a499a11
SHA1 9e5d358a894f91841b1d7f3410e295b1bdb24046
SHA512 53e312689d12940a55cb294d448057371a6a7f41eea9ab4e9cba9aaa57863d4cb1d4e42a16648ab51b4ab84e7571f38114ea84c5cd275463c6e2bb5ff5e9855a
TLSH
T128B00279C1026717C44213B077D9A6E87161FF25C717636293E01A66DC266754526260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 6198389d3e45f8933e5832d6e5aaf8b8ce125288bdf48972e9dbbb07205f6992
MD5 2fceaf18095ccef11725988553b3a076
SHA1 9058a3f61de61fdc135fdf514b2a7577e0b0cb5b
SHA512 6ac5e991d5847fc55c74b6e76fd8a3be548ff3d209f29b38cab1936bbe45c8e0961d238a6272e4705d4caae476736d2c21a39e96d8a794bf2a0b10fbde32b68f
TLSH
T142B0127002000547DE1803B002D1248463A06C100381502280704901C42414A5A25108
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 bf501935215ae885c9be0d0b08865816050b061c4b4b261c523ef90212e94a8a
MD5 1afd450b741311092aaf8974dd376ae2
SHA1 fe58ef11293c9bdf2a4fa463f62b0edfb2c1c153
SHA512 cfd00286f9c94bb79d45f4dd32fa3a84546d78ce97d3e70b44e75f13356dce130f3ecbaaec92856d1501934589286b35f6ae48e1a477e159e58794cfbd39f48a
SSDEEP 6144:jw+7CPE4mn6RVwLUGqm7Rkm1tYpBeh2BAoc:kTu6Zu9oBGcAoc
TLSH
T1003412279D78BD762D69970E704B2D1F0CF49962CF29C9E394ED1A083AAEB8D1D05D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 12c7154eef82d7c1209afa0facaccdf1e794095d1de81f26ee216b0749f51285
MD5 727e144ddeb538372e98d6f4d9663e48
SHA1 01e4aec4471a3f3656852e8093c770ff335c3a03
SHA512 879a515e7faae7631782b14e36493f18712a20125dd989f22e76f2acb57e2336df8d75aa19ddc816882a44b220a47f4275c5c5e84dab43cbda93f9ca8abd7f99
SSDEEP 6144:if+7CPE4mn6RVwLUGqm7Rkm1tYpBeh2BAoc:oTu6Zu9oBGcAoc
TLSH
T1603412279D78BD762D69970E304B2D1F0CF49962CF29C9E394ED1A083AAEB8D1D05D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 cd0241df8b74c582ac1c5a9ab337d350ccedca82a1af9c4f32c22d896607fc96
MD5 5b392cc0fb699c823de6dd536614df88
SHA1 5d8cfddfabde8d8ef0892aea849cf550fe05507a
SHA512 77f3a87869d88c0419cb72e9087d461d2da513315354086f49ea69c69eb09138223a536bbb72f18c90ee37685f9d1841afb15ff646c37c355c622497e337782e
SSDEEP 6144:Y5+7CPE4mn6RVwLUGqm7Rkm1tYpBeh2BAoc:STu6Zu9oBGcAoc
TLSH
T18A3422379D78BD762D69971E304B6E1F0CF49962CF28C9E394DD1A083AAEB8D1905D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d84b29d6b04c60f459cb79cafa2c01118a41a5e619d1aed92946f511cb07da3d
MD5 5cdbaf8c45d001fca0d6fd5a5590299d
SHA1 a66d01609623cb49c2b7ecd98b66dc1a86fd6eef
SHA512 7dd737d59cd33f932c85e1336be7752690d05cde5ce93ce959f22d9ebd8630317c937e0949ceb9b6a8f18a131caca074765e03df32b0081dfea0b027e845f8b3
SSDEEP 3072:A3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Bm7Rkm1tYpBeh2BAog
TLSH
T110C3023B5D75EC3B5CB5A74EB48E0B1E2EF249A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 c604740a8b990dc052a75f1c3b0a98e770e9b57d7b90a8f779087738fcdfd955
MD5 17120133330643ab48f873a9c7d6db43
SHA1 ec04f98f7a5f0a58f4fb0e4ee3ea4691d9e75071
SHA512 f83e6f88f9592ff9c75998346deb4964e5fc15734b7c315da37a49835cff846a52ab4b1c61e592879abb9b2013e012d30d6d20901b8abd80d089350e7ee0792e
SSDEEP 6144:f+7CPE4mn6RVwLUGqm7Rkm1tYpBeh2BAoc:fTu6Zu9oBGcAoc
TLSH
T1273412179E78BD762D29931A304F5E1F5CF458A1CF29CAE384EA5B083AADB8D1905D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 2523b1791cd4c2b45fa7dc53a51670444a62ccce5b5637595282877d7a49a1c6
MD5 0d68abf054bfb2a8eae7f34f07b19ac9
SHA1 5fe418d6eeff5e0dd2060c17d728ffdaac990cbe
SHA512 e84345fa60ccdfbfc88ae8423af396af88fa058862c24df89a2bcf38319d0487635cf9b6c17ffb9f773db3e55f3afb9f5bb30fa1cf4f75f4034e390fad649325
SSDEEP 6144:A+7CPE4mn6RVwLUGqm7Rkm1tYpBeh2BAoc:ATu6Zu9oBGcAoc
TLSH
T1F03422179E78BD762D29931A304F4E1F5CF458A1CF29CAE384EE57083AADB8D1905D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 10KB
SHA256 140ab9f5643cda29a96bbd043e6b96383233d020790dda62904b9010805f0caf
MD5 663aee9c82d900f160c808c1b3b84ad3
SHA1 350fd4b4156d81319179db1aaf84c85cb3226c7d
SHA512 d30688d38ab8423e46ccc1d22bf7bcd55472e41d541d0d5f7549dc963b82847e0a5410e03aef134f39685d18ce2c5a50e846871dc1adccfe11cecde287d29651
SSDEEP 24:kuhMZtCv914z9xUe39B4eJ9Vvyes5q9F55A5Lex9lKeL9Bb3:CgqhVNRrBtuI56CDPp93
TLSH
T1012274F77B7668A2F2E28FB48069714C9C331325597D9584C604C0F356D1FAA903EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 10KB
SHA256 c4e48849edd746c6ea9928aacbaa75815ad94974699492dc0d539ca9bd323f5c
MD5 6d56f8500f5b5d76bde09d30d671adad
SHA1 3fa67717d3ebccd9d18ae85d9377832a8946f4c6
SHA512 22f401be9d229babe51f381031c854d5ccca0612d79a96b08a33ed7266a5bd342777f2ab929761b4305e5f79446017a93122c41312b8acff1d956fa2684f5353
SSDEEP 24:kuhMZBY91ai9x2K9Bim9VvAgG5q9F55A5nS9lY69Bb+:ySYQ4oMcBAgsI56nAmY9+
TLSH
T1012232E76B726CA3F0D28FB44059B24C9C320725557D9684C744D0F346D1AAA917EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 43479891f89e1c25e361d6a47c28a5c0e4b370b099e900a420a474316cef0089
MD5 c57766a0c1faffa2d951a2a2e4a03b8b
SHA1 2938e13666d6c1bd2f5321418d581b650d9ef50d
SHA512 11cbff50639a47bff1a4f807f12b7fd843bc70de9b4b30099e0d38f2baa1aa08170af3d700b60e2cf3ec3991ae89a1e9bc0326871922e14049a8bfafdde638eb
TLSH
T14661CB58F229863FE045413ACC925F422F30745698AF7F2A36AC604D1E4B2CE778D53D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1331ba15a215fbd4e7dc2969bc482237874957cd82c116e7da0847d22061bfd5
MD5 d653b693bfb89b34d1251c057e085e2c
SHA1 afe464317b2fc66f1d555b74ec9c82c23bf4ed97
SHA512 ba33737668a348aff3c2ccb2ecde2900b4e786b9d92733c8d36c3e7ab9f652bac5d05ce96b2d5cf0111b8fec8b06079446c40d5bb83fddf53ad3d8c55ace718e
SSDEEP 192:x/1d66JozGzgCl6mc0d6POv5zbowZqmyjFyC:xNd66JozGzgC1jUgbowZqmyjl
TLSH
T184E1FDA4EA28863BC408027BCDA61F414F35395AD84E3F2931AD741C2D5B2DE368D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 a82377c9549db0f36420b649e9d3facd43b5463c84dae9441d90ab974ae6245a
MD5 c31a80ee5f0d8b7e715cd7aed4b91c45
SHA1 b71b95ba573ca0b96fbafe685eab62f2fe1a2364
SHA512 77e0f9affdceab52d9b50faecb71446ce2b105b8441ee30850642aa7ce92ec7bd304f730e3fa3ae4a5629011fcec670def15cf1145cb501db8e6918b5a85a4b6
SSDEEP 768:xi3k6IPedhtnGcmhusRKD1gnjbObhgmE/:Ck6IPezyRaU
TLSH
T1D2E22140FB2A953FC41512BBDCA50B102F79B889581A2F973A4C646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3d7e2ccd580449b0c109df8794c4fec42892cbee40a7869b1bda6f2b2d8209a9
MD5 2ef65fdc93cadfbd60b7d777831e8360
SHA1 58202e196f7a359a12d60c262df362c0ef262ec2
SHA512 b55cae5def310c9ecee8fdae4b9c6e0dc5cc88b4c8f943c52c983a74bec3c3225a98ed0eabaa835fa5b8e82aa205e816a6faa02471286685affe65a25c638be6
TLSH
T1C5213A5D39B98DAAAECAF39C7441038E53654E0745871C430D12EF9DCE81EDA316A53C
MD5 SHA1 SHA512 TLSH

Submit Download

0992b57c-e7ca-4ba9-844e-0fabe763d33c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\0992b57c-e7ca-4ba9-844e-0fabe763d33c
Size 235B
SHA256 51844eaf14affc139ed5bd7346f3ae35b064592e73b5e36b7ec42792d2b4d5f8
MD5 0141162b139fd3c3966de9c49a222148
SHA1 59512d00ccf35414b9c83e6c85f758a90adbc96b
SHA512 cb87fa352372a677a6cb95614e309527b1ce7aeb884c2dd1be469639cc716e5e2277c3436544c43695a83c7813d55353c26e99610bc6b9fb64462967cd9f651e
TLSH
T1C9D09782649C239D08000F1BF0E06CCA70884C3B1062A8108660843499FC9C8411280B
MD5 SHA1 SHA512 TLSH

Submit Download

56b84cb1-1226-4735-9908-3611abe4db37

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\56b84cb1-1226-4735-9908-3611abe4db37
Size 9KB
SHA256 7dfa92bf97a4726d5413008fe3e4c04bd793337a283d6345ee1d74c9c6227fd4
MD5 3e3cd13e2fcd858cbbd526e77260f79a
SHA1 dc832ffcb89421d07ed1d1f539789399b5e87ad7
SHA512 6ecffe68018f07bb3da738805fdeb09023d4c268fcfe48add9d8759f697b5f410583d11783c5722ff485f54c90ae15e52619e11bc72c08639b231d6316769331
SSDEEP 96:na0vhNdUMQtfz6Mpcaybbhszr6Vy9DaKT+T2Ym+9h2w0BJLHOBqBKo9QmwC8akes:dvT0DzTkS/a9OSDwjBjA
TLSH
T13512A9FECD2240433A69F62DF5A9FEAB005A293149D8C79D6AFC483A32D69B71117305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64addd72-446b-4f54-b160-2d34b82ed031

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\64addd72-446b-4f54-b160-2d34b82ed031
Size 886B
SHA256 52191b18ffd51798a0d01b3df8f66d3e62eb098f0458644a529b7b95c939bda2
MD5 692e38a913c831c0ccc48dea628794cb
SHA1 94dfca81e6b81244f9559b82541e210a04fe952d
SHA512 f3df486d88843601655394ae1bb671c600a0187c7003187d9fb9cd2a0adf3c2297209bce4a4da463dc5f16aff5e2f853c48e68092eadb70f0fa86826da36ca6d
TLSH
T1BB11E3D1DA31B972CC7CD24BD9D1BB438FE46433C0CA58143F617A280EAA51EA35A61B
MD5 SHA1 SHA512 TLSH

Submit Download

7cf19fa3-ef48-42ec-b7b2-d00c45b9d4d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\7cf19fa3-ef48-42ec-b7b2-d00c45b9d4d4
Size 16KB
SHA256 e3acfe998889ac3b083b67cd3de6e6fb6c4d6647123666e45b6216e07d70fd36
MD5 7ba16fcec8652eae456e1c25e1f484c9
SHA1 b50834545e8042672995bd2683d23993fa4bfcdd
SHA512 bd09aa47e8aeaf01fa0d2fcb57f7aeea88ab0eee9c9568b0e9ffe8c8418d40b255f41d3ed11b17e94e44f8eadc52cd59b113931f5531c7df7799b03d91a098ca
SSDEEP 192:RjQOCO+HJiisBZLrTUzbqTsIWT26DG5rAq2zGxS5aFrXevo9yQ+fBxVyU13R5h6f:ZoXaQpq2zGxSQFTa3Q+fBypJ1kFxmMFc
TLSH
T17C72DA56682045BB8251E36994E8BFC3F6F628CF4C419FCADBE47D082DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ef27a6a-1040-42cc-944e-1d1d4e34d816

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\8ef27a6a-1040-42cc-944e-1d1d4e34d816
Size 2KB
SHA256 f7e44eddadd227bc789c730f79bf2121882d1195181cd77710b9417c2300041f
MD5 64152773ec18019683abdd3d51d6034e
SHA1 3927e046f27f617cbdcbd5c773d8996a71dd98d2
SHA512 326fc966f30e875d4f996bb1dcbbba5daf4b7816738e07a952204b6612d5d6454f1a2308c5b34eca497c891e65f70a46a15e37ea73747f7191bde9e5c05b3186
TLSH
T18341546C39785CB75CDAE18ED581328E57648E0300C618532E56EF0CCCA669E336E43B
MD5 SHA1 SHA512 TLSH

Submit Download

c456e12e-0bb9-4253-a8b6-6aa820565290

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\c456e12e-0bb9-4253-a8b6-6aa820565290
Size 883B
SHA256 f436f776d70e05c6ef417a043c2d96e6a2ddfe078409bf654b2c1a3280f97259
MD5 2ffc1c109dd5d483793d31d5dccfb9a0
SHA1 153fac6fee17ae6db797a6f81a2e511255535c73
SHA512 63be886f90c7f83f75462d4e256b12345664772d93155032986e00df5b251ccd6636897ad54d6567e2069db843ab199954235f07329ab6da7b53210f1d39dae5
TLSH
T13311E391DA30B972CC6CC247C79177429BE47A33C0C954143EA53E2C0DBA51E975F60B
MD5 SHA1 SHA512 TLSH

Submit Download

d99be64f-f757-4877-ab31-d207db38c332

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\d99be64f-f757-4877-ab31-d207db38c332
Size 235B
SHA256 2291eca0f0bbbe55c082ccd71efb7e331dfdae4653911d50827cd04c59a5151c
MD5 4fea5e153d1fc0a643f53947f2b07b87
SHA1 67a741043e5e94b22e483278ec691e07bfca7612
SHA512 900336b00ac7dcf266e8c541419a3e4400def1834f54000db340a9c1f4d4d22decdf0ef221f41f623c21e4a151539129f3f77d7b1a373eb546d4b91ef0b185d0
TLSH
T1CAD097C0E4D8739C18000F87F0B029C630694C3314A5A820D6A24634EEFDDC58112857
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 1557605e1a1cc07b95b5fb879c63c50d62d02d45055b433fd96a8759394df2a6
MD5 7d4e844366418927c4f65c9d25440b04
SHA1 6b90a302c3daee583dd7c494289e3d1b6a95be7d
SHA512 ea0b4c2282b5f40ee0c87f52caf40c0d824957b8de850a3a83060d8322e1c09c589d307d8899ddbc7116c29f4d7167dfdbd61bde176cbbda9420980af29a8e64
SSDEEP 96:xHcUTUuqGqdf2z/1zSwSSlDdv9jGnERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2z/FSSp9A1Bw88+X
TLSH
T18EE13F7894088F6F64F6776CAC6889716AB2413BB7BF68C750B954C4050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 7KB
SHA256 a3ecb1da7b21182012fe8bccce7c7ea0f26f8390c8a22dca9a26566e04cb7ede
MD5 527911ecf63b584223a55cd587e1dc59
SHA1 8c7aa2c805392d6abaad865ad15c019e30901a05
SHA512 a65dd96fe693ce3dba66c551874cd4e13f2e67336d5ce578fe51373de2489ee274fd7a876b908863fc20b42c2ecb246c7135bb6de8b27f998a9393cad80159aa
SSDEEP 96:xHcUTUuqGqdf2z/NbzSwSSlDdv9jGnERH9O+y1Bw88n8L4cnrzXjGS:65Rdf2z/JSSp9A1Bw88+1
TLSH
T11EE1307894088F6F64F6766CAC6889716AB2413BB7BF68C750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 fbd4c1add0424fa47efd83d0f102e59c8e2faacc01bb26ce2b7ebe337e6d3e60
MD5 41c345fc1178ba9cffaf3a86f02db992
SHA1 91acb513b57c8ac2af80c60a91727b23340af70b
SHA512 8d43972d7b85adf83f6252ee1425c794253765b409a538e87808ba1e15041500500b65a83c2ee180cc2ab4159e2697e2d07adcea61fb89cf359c12905e146667
SSDEEP 96:xHcUTUuqGqdf2z/kzSwSSlDdv9jGnERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2z/iSSp9A1Bw88+X
TLSH
T197E1307894088F6F64F6776CAC6888716AB2013BB7BF68C750B554C4050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 c18602663c6866658e0627cd1649fbd52a69764a46e79763aa98dc06b1c9e149
MD5 a5ead95ca920af098eee5bdfb79f8d18
SHA1 f733dd446119be4b7a0ecf6c0106413af1a6d4ab
SHA512 43b29b4d55fe2428674e4decdf02458eff01eb4d4b77845388d36b957c5dc8f6d9f942d8b07f8d36136788ce787012569bf65a7429facf346492252533a300b6
SSDEEP 96:xHcUTUuqGqdf2oE1zSePSSlDdv9jeInERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEzPSS0h9A1Bw88+w
TLSH
T19FE1317894088B7F74B6776CAC6888716AB2413BBBBF68C750B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

craftrise launcherszi giriş.rar.crdownload

Path C:\Users\Admin\Downloads\craftrise launcherszi giriş.rar.crdownload
Size 23KB
SHA256 5608a967cd1f5083d0404be9c8275b872d8b2ac28e1d921780e566dacdd7816c
MD5 d446ec80a5c54e50b55c3e412ac84176
SHA1 344f7931dfb79b1a8e52199f471d8570b5a87ccb
SHA512 f882ed49b9c4d17d111d617214b8a0d09e727efffbf84dc090aa9bf3406ee0c3df5ab7b6a41859d60940acb99a4f47b1ca83a3292225d606d43a134e26e87bb1
SSDEEP 384:fQD8fTQkaDMGXeDjkm+cj7KHNHd45v9nXrsS7C0ZmoiMlY3LjjZfoDw6TAK6wL8S:IAf2AGXeBANHcveACsmvmY7h4OIL8Zgr
TLSH
T191B2E073C0FA18DB7100C7939D3C09A4E4A71C72DDCBDEA9529E9A4C2A5C86B447B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download