dc2d87f2fa2dbd94ce6d35e39be1bc47a85567634b0b27e6133940caf74b035c

Analysis

user interaction
yes
max time kernel
112s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
def/vehicle/truck/dbmx.volvo.grand4x2/engine/d13c.sii
Size 2B
Sample260804-mm8d3atvfx
SHA256 dc2d87f2fa2dbd94ce6d35e39be1bc47a85567634b0b27e6133940caf74b035c
MD5 3d5f42d53f9016d1b1b3120f6fe72602
SHA1 c2b272f1bac4414dab87fe33f97585ce098177a2
SHA512 7a416a24fe0fd0dafd238575a4572985b4df210b5573ef58d4c62dd7f89f1dfa9f125d639d15c97ca92d8af581fe1d6bc793f950d691f07d8d87707684d4e700
MD5 SHA1 SHA512

Score

3^/10

discovery execution persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2656	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4892	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303134003756679"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4224	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
1640	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4224	OpenWith.exe
4840	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1964	1640	chrome.exe	83
PID 1640 wrote to memory of 1496	1640	chrome.exe	84
PID 1640 wrote to memory of 1496	1640	chrome.exe	84
PID 1640 wrote to memory of 4892	1640	chrome.exe	85
PID 1640 wrote to memory of 3216	1640	chrome.exe	86
PID 1640 wrote to memory of 3216	1640	chrome.exe	86
PID 1640 wrote to memory of 2864	1640	chrome.exe	87
PID 1640 wrote to memory of 1880	1640	chrome.exe	88
PID 1640 wrote to memory of 2864	1640	chrome.exe	87
PID 1640 wrote to memory of 1880	1640	chrome.exe	88
PID 1640 wrote to memory of 4980	1640	chrome.exe	89
PID 1640 wrote to memory of 4980	1640	chrome.exe	89
PID 1640 wrote to memory of 2812	1640	chrome.exe	92
PID 1640 wrote to memory of 2812	1640	chrome.exe	92
PID 1640 wrote to memory of 3588	1640	chrome.exe	93
PID 1640 wrote to memory of 2184	1640	chrome.exe	95
PID 1640 wrote to memory of 2184	1640	chrome.exe	95
PID 1640 wrote to memory of 1000	1640	chrome.exe	96
PID 1640 wrote to memory of 4176	1640	chrome.exe	97
PID 1640 wrote to memory of 1540	1640	chrome.exe	98
PID 1640 wrote to memory of 1020	1640	chrome.exe	99
PID 1640 wrote to memory of 1020	1640	chrome.exe	99
PID 1640 wrote to memory of 1684	1640	chrome.exe	100
PID 1640 wrote to memory of 1684	1640	chrome.exe	100
PID 1640 wrote to memory of 4444	1640	chrome.exe	101
PID 1640 wrote to memory of 4444	1640	chrome.exe	101
PID 1524 wrote to memory of 4840	1524	firefox.exe	103
PID 1524 wrote to memory of 4840	1524	firefox.exe	103
PID 4840 wrote to memory of 1996	4840	firefox.exe	104
PID 4840 wrote to memory of 1996	4840	firefox.exe	104
PID 4840 wrote to memory of 1996	4840	firefox.exe	104
PID 4840 wrote to memory of 2780	4840	firefox.exe	105
PID 4840 wrote to memory of 2780	4840	firefox.exe	105
PID 4840 wrote to memory of 2780	4840	firefox.exe	105
PID 4840 wrote to memory of 2780	4840	firefox.exe	105
PID 4840 wrote to memory of 3900	4840	firefox.exe	106
PID 4840 wrote to memory of 3900	4840	firefox.exe	106
PID 4840 wrote to memory of 3900	4840	firefox.exe	106
PID 4840 wrote to memory of 3900	4840	firefox.exe	106
PID 4840 wrote to memory of 2148	4840	firefox.exe	107
PID 4840 wrote to memory of 2148	4840	firefox.exe	107
PID 4840 wrote to memory of 2148	4840	firefox.exe	107
PID 4840 wrote to memory of 4016	4840	firefox.exe	108
PID 4840 wrote to memory of 4016	4840	firefox.exe	108
PID 4840 wrote to memory of 4016	4840	firefox.exe	108
PID 4840 wrote to memory of 4016	4840	firefox.exe	108
PID 4840 wrote to memory of 4432	4840	firefox.exe	109
PID 4840 wrote to memory of 4432	4840	firefox.exe	109
PID 4840 wrote to memory of 4432	4840	firefox.exe	109
PID 4840 wrote to memory of 4432	4840	firefox.exe	109
PID 4840 wrote to memory of 4172	4840	firefox.exe	110
PID 4840 wrote to memory of 4172	4840	firefox.exe	110
PID 4840 wrote to memory of 4172	4840	firefox.exe	110
PID 4840 wrote to memory of 4172	4840	firefox.exe	110
PID 4840 wrote to memory of 2184	4840	firefox.exe	111
PID 4840 wrote to memory of 2184	4840	firefox.exe	111
PID 4840 wrote to memory of 2184	4840	firefox.exe	111
PID 4840 wrote to memory of 2184	4840	firefox.exe	111
PID 4840 wrote to memory of 1548	4840	firefox.exe	112
PID 4840 wrote to memory of 1548	4840	firefox.exe	112
PID 4840 wrote to memory of 1548	4840	firefox.exe	112
PID 4840 wrote to memory of 1548	4840	firefox.exe	112
PID 4840 wrote to memory of 5396	4840	firefox.exe	113
PID 4840 wrote to memory of 5396	4840	firefox.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\def\vehicle\truck\dbmx.volvo.grand4x2\engine\d13c.sii
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee45dc728,0x7ffee45dc734,0x7ffee45dc740
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,11663407994755090054,7909938684899859822,262144 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,12638664245964266304,1835115297438869886,524288 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,9458828259987291728,3572142965561489817,524288 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2372 /prefetch:13
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,7971894034577415240,4394024457166521876,2097152 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,15206083623476973930,5508104298920562320,2097152 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,4853490575137282048,831098956549371057,2097152 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4796,i,8892123047342783331,14046448137095644235,2097152 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,5999800835840110928,6544285798414313907,524288 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5736,i,411717305061296486,10344992326772825393,2097152 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,12342002544915139416,11550386249704477852,524288 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,4019852335548166089,4334924091424115387,524288 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3668 /prefetch:14
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,17558077093929228330,14508115959141702038,524288 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4484,i,7178202310609558156,3159001249967274216,2097152 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=876 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3492,i,6476237415430247745,11565365627008118173,2097152 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4828,i,9178081230293929396,3465722749879205142,2097152 --field-trial-handle=1988,i,3931379939353202521,11037126665372146996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 1928 -initialChannelId {a8cdb671-76bb-4641-bc2f-99fb4e771939} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {b2f50604-3a6c-4e53-9096-cb94f7600143} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 27274 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {cc9f44ed-77e0-4cde-9875-93afdd0eede7} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27274 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {5e614860-3360-476c-96e9-f76e4b10a8d7} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2780 -prefsLen 34773 -prefMapHandle 2784 -prefMapSize 270279 -jsInitHandle 2692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1592 -initialChannelId {b05de707-17fa-44fb-bce3-d599241cd7ee} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 904 -prefsLen 34822 -prefMapHandle 1228 -prefMapSize 270279 -ipcHandle 4796 -initialChannelId {8dc8c210-c986-460f-8ab7-c813785d8431} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5500 -prefsLen 33031 -prefMapHandle 5504 -prefMapSize 270279 -jsInitHandle 5508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {446659d8-ffd1-4fd7-bf95-f110dd5dbb5d} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 33031 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {cb80992c-108d-4fc2-8a1c-9c0ce0e07c2f} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5932 -prefsLen 33031 -prefMapHandle 5984 -prefMapSize 270279 -jsInitHandle 5988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5996 -initialChannelId {08897bae-8ab1-4ebc-8934-0bd3f71f4020} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6304 -prefsLen 33071 -prefMapHandle 1976 -prefMapSize 270279 -jsInitHandle 2856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2864 -initialChannelId {8d7edb1f-0d13-4434-bb72-64341563ca5d} -parentPid 4840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dd84207af94c6906ab4d8b1586267f5ec698f9701c440039ba2776ddb01c883d
MD5 01e0756bc6545bc0e158b26ff2acd1b1
SHA1 bfab3aad8bdb3375957e3f08db7e6aa2678732ab
SHA512 d78ad1a13dd1f1308e762d644b9caa3ee854961f58dc52220000df62cc7f086687b5a762c8441f1740fd2fc8c85d3d8109d421b1080922d739efeca77c0a4ee6
TLSH
T169E02BA9D812EC3B18FD071D20500706FBA023A72A418A5F3B3D51188F75737018586C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 fe0f8f04a5757530f771daf50717a8c547cfaa4b8a12c440bb0836df3fd8ad90
MD5 71937d2441fc82564dab507041c36ab7
SHA1 7e8f2e6eaacde44222b901015a8f8cc3c31e9ca4
SHA512 754912d0e0aa2f69565d03c4abafa826083bcbe102559ef78e490015461f62f2bb5bee394dccab25a7a687a7e266e8d2b7079ba9bcb15984eb14f5928a35f214
TLSH
T1F9C01224988020C3C72DE5F6017B358127EC3F3696A7B9D681E102ED94236BA8802A12
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 dd874ffc85752e5c70369ebf5094a1def9ce6215766c975e481e26a977df83f8
MD5 54d6ccc9fcf8915d12f5385e0c072854
SHA1 b3a1018dbd099e9b66da6755f30e755693d2a55d
SHA512 e63e1fd0bb988a5142900c087c1e77979298f87b5b7662fc55f505ced454e6d09affc81035b7998d76ede059b1234ec565e661d2eed404c35c65a940be634519
TLSH
T19DC02B04898004C7C720D672903B048113EF6E31423142038090824C49334D645E01DA
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c0e3ace1821c8c41d0379c08595937b61c48b4e25d32c335266c9e35b2c50b1b
MD5 3733e4cfa283714dce3e3dac09b00478
SHA1 8e4876bb2687cb741065d019a5f677a62b034137
SHA512 dcbeacb57e308378fa978c51b1e3f2af88b762827476b9bb19ed5a1c3cd630f05449b1d097dae14dd00402a7b8551a18624a52c9b4c2985a70e8af888f2cac06
SSDEEP 3:MsEllllkEthXllkl2zEo4:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e836e0596f0be266bd6f89d649e86b4d5e2dcb55134edf69c5368c1872023131
MD5 cd3b5fdee228e92cc93a3f0bd33160db
SHA1 2bff25cfbd4b4e2c1bfa64d552008f3050dd83f0
SHA512 d4ac38c6f800673f622127c4b9b1a8f6ad99e5ec479251bb1d4076ab8588d0422500593f35a6bcb93a16d2300992db6f00e741f6a3a714e996d10e4ea73b1369
TLSH
T10671ACF7C3D8892D851156F4DB116E2FCE2A0A24032D3C66C8D8AE5B53F2872D21578E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 16eb0e3c9ea28c538885c005d84b22f0dad63ab7793b0fccc9bad8c87b43ce1a
MD5 5b14cd58ea89323c48b03197ed408540
SHA1 a493a90290ccbb342dbdf60a9dbb064d3217828b
SHA512 f75d73fcf195a8b981a2f595c2b438c827d00da17ca8ccff853646de3cc7a29c698cb648fbbcb812addfbca13642dc6399ac5f385a1baa6f975e56e889117ccf
TLSH
T1284148B7C7D8897D890196F8A7156E1FCE690E14532C3D5788D8AF0B63E2875D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3d244154b2cf66a675486ed43da482a7a2364e6e766928aeac04a3b61b6e8750
MD5 686b85614d1b9df531c0d159faef44f6
SHA1 7854dad3b68b668382933cec640ce9e4bcc67435
SHA512 04a1cc82263e59e58c5eccfcfd9f8a65a8481d6f8cebf299a2afc5c464f4fd598674d32813bfff31c7eec27dab7a01ddf32c3f37751e8c7498f2e1ad253dba31
SSDEEP 48:YALlqmqmhXkhihdhzzaXYfoKshgmzs5fsKUosUgrs3KsZcsstsQ/qzsf4se+sT/T:D9/yML9aI2qmEhfgJ/e5T
TLSH
T164919DF7C3D8896D891156F4DB157E1FCE2A0A28432C3C66C8D8AF5B93E2872D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 8a86d1a501fd0f31554d149570badb35223a06c20b7e420eaa785e8c7c17b901
MD5 fe79f54108b683db8baf720ca3fe410a
SHA1 e35905597b7c6bd38b9de5c86937759a5303f057
SHA512 78f581a85ff6f6a468186022981eba8d951eda3a90917def1c410c340836065eec9e2e5d748fca17c95009cca3ff1c24b85ebb8baa6629740b82a5ecf7608869
TLSH
T15CF024E7E629B477207D08EA2E057C095DB6A830029158F8DFAB817C91855F70B02497
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9e57018bb7c504b7cdfff47e48992c7a42fb873ad5fc74df9995ceaba474d258
MD5 baf40536ecd26924763ebfc59a04f888
SHA1 d3dfb34d59ea97966120146b817fe954d37d0fb2
SHA512 9988d9b0006816c0a0bb016e0494434eb67e499f3ced22fb69e31a697cf758651f96559e0acc6d9e3accc372ebbb16c058852d0965c61951e6e24be4d6f288ad
SSDEEP 384:ZR/yn2v2bVF7xy1CyohZDXdrw0i+X26je:byn2v2bVF7xy1CyonJrw8X23
TLSH
T1CB52D61EB910697B5CDBD229F9217B17D7F6207125C02E84EAFC892C19EB9CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b169f47ac40bdf9177dd6b0b79f568fd39097ab512cbfc273963ecb50806b39d
MD5 a3214c560fcd30890d09961af6d32e9a
SHA1 77059a7c20dbfc643a56a8dab3b0421de5a10c53
SHA512 3192d3e714d9f59dcf97d5296cef3f66756025ec2c41fde30855d05ea6f1e99dde0104bef5940c4fe9ad880c7c156b47bc09c7dfcd53641b37101d7a4160be01
SSDEEP 192:yR/y/+cuzMpv2bVF7xy1Cyoe+rtv7dhAPRp2F99Hsb+WNnZG0dX2IBXPFVyIsnA4:yR/yn/v2bVF7xy1CyohZ8XKrwY0B2678
TLSH
T13F42C62EAA10687B5CDBD215F9617B13DBF6107525C52EC4EAFC892C19E79CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d739eeab4bae6359bf3c5481e6f7387b124f2f5f4300693df7d25bd67b62a81a
MD5 67fd25112d943c60ad8c0262f3409e62
SHA1 ab03d3095d9b45cb37daf251cde84e565c542824
SHA512 4282c1f45ebecd9f9668ccc5b36a9077615da468fb81186f299f8dc98e8e97338f8354c55529bcc5ae83ebbae62313fd22bfefed322778fecb0c1291ae7c3698
SSDEEP 384:yR/ynmv2bVF7xy1CyohZ8XZrwYX2q2678:Aynmv2bVF7xy1CyonurwPq2T
TLSH
T18342C52EAA10697B5CDBD215F9617B13DBF6107625C42EC4EAFD892C18E79CD322300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 639931615f16caa418109113659557161a284b855d27fcb61b5218aa2ccdb14b
MD5 a591ee0ee00ae9d5e2eb45b505dfc964
SHA1 32692f9b949da90282a618ba078d789aeaf23dc2
SHA512 8689ecc84e502e9b074b8fa8ce36d3b4472380d9879af40ec5974ffdab9edfb9b37b6ba06a9aa984996f1860b706fb8c93402e2cd9ce214a1334f67f261accc5
TLSH
T1F8B01242C4015511D00206F45682949C71149F109A0A1705C3F07D22882B1A0C014890
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5880e3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5880e3.TMP
Size 96B
SHA256 888fd1692a7b0550231e49dcc42ec18a6f1de359431767de5e6f2806ed1e42b4
MD5 4366543da15100ab85b5447c932d4bfe
SHA1 2c868465c8517fa145430e7a35b010a8fc39d217
SHA512 a704d92600acdafed106741c5fe5a5b4ed940dbee71d7ba891aceecb8ecc6f71dcf81fc4449bbca4186779cda8e12b90cf60763eabee95f47b6da46df3ae0706
TLSH
T11AB02200C8022203C00203B02A80BAE83020CF30CB0B020AC2E00A22EC302B808220A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 290KB
SHA256 2e5006e2b5ce68e46b6e56134f90cecd1ba5f3aa58d6faf15e38d47e4b7c1e66
MD5 e5670de58c0f56a455d219b4e81c3ac5
SHA1 968d696b6f31363b9a9363bebf3922aa8d5e755a
SHA512 8e9e7b1da3e07d3d8bc458861d80b324d642fce1e0db3a2ccd36cfc504355a0559434c0c465dd3f812a72e9ba3a5ed497057a1e276c3e7a4f871504d92eb2dc1
SSDEEP 6144:rjMb01NXW2DUIKiZUH8uHJhHcWeyfp5E4am7Rkm1tYpBeh2BAoE:nVDXWBlazuHJbe8U419oBGcAoE
TLSH
T1CD5423739D639E366D7DB659314F0B1B0FF25E93843A5DAE18E09D0865C89AC8B02D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 15195ee060241479ebaab6b32c2ba31e3bd541d9249591ec1858e3199d725731
MD5 af1850d717df5d2732fd6a0b97255421
SHA1 bd7b796e8331efac4939c716d32bfea3153f56aa
SHA512 91641210f76c8e2125cd7cd02875fe33e13fbda7246bd5ce503a336bad65dfe5b5c9c493b010805e7cdef7245176da70336bee6fb7bb36b7e2cc5e53ccd86a81
SSDEEP 6144:OpW2DUIKiZUH8uHJhHcWeyfp5E4am7Rkm1tYpBeh2BAoE:OpWBlazuHJbe8U419oBGcAoE
TLSH
T1C8341327ACB66D7679ADF72A220F0B1B1FF24D5386363D9A58E0DE0CA5C89754901C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 4c7b3d7a0ab22bc886995f0ea31690dc3d4c5df1db64ea5b549497b3f0e7b25d
MD5 39d3328435c3b1c3ae983cbbefdc5503
SHA1 65a921e1fa6cfcdf70ddf42275cba93cfeb96612
SHA512 7f007eaf6dee011a464cb0ef10af0d21f412f751d74c2124de369eed6b1e4bbbb6bde982623663707b980f58ac1bd6fa20dc10e4ce868ce512e49f094a366a6c
SSDEEP 6144:5W2DUIKiZUH8uHJhHcWeyfp5E4am7Rkm1tYpBeh2BAoE:5WBlazuHJbe8U419oBGcAoE
TLSH
T1F0341237ACA76D7679B9B61A320E0B1B0FF24D5385367D9E5CE0DE0C95C89A84A01C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2d9a71b902b2a2030a27f82c5fedcbbbb0ee495233ee1b3374dbeda912531333
MD5 d02e846468ffe0d5e4c26e973aa6a43e
SHA1 43b5c0021d3f127a65137e0b4f88d6874054e83a
SHA512 aea4403d46be4333ad2b2dde10d6f8c0e389bef40edb85117c127a7eed22e7729bb489a1edc3d92b9c2665730897fc919e7b243457a344446c1240735d84b035
SSDEEP 3072:eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:5m7Rkm1tYpBeh2BAoi
TLSH
T197C312375E70E9365D79AB0EB48E0B1F2EF149A6C820DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5ec6f16b0c02cdaff877c52c82081d859083b1feb3cd78d343cdc87d1353ac12
MD5 c3340880b6d34ebd884691833c56dc9f
SHA1 3d2e3b9227f3fd19d9efea9387af7d81fede0fb2
SHA512 a0d96fbb1bbea9ad84cb4cc7890f73ee9aaad125a6b201037f04df7b96b5846fa805a64511b33905b69aca84495d9e9dcfb8b37aa033a9cb7dc7026ed1536ce1
SSDEEP 6144:lpW2DUIKiZUH8uHJhHcWeyfp5E4am7Rkm1tYpBeh2BAoE:lpWBlazuHJbe8U419oBGcAoE
TLSH
T18F341327ACB66D7679ADF72A220F0B1B1FF24D5386363D9A58E0DE0CA5C89754901C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8e8f3e0f577b8b25a3c89da2aa9112fbb801368254783fd15940ce8c59048b02
MD5 97fdde4a0c49d3b4ae912d7b5faef3a0
SHA1 c0cf9463ae28b73e85123008535480fd98b64fa5
SHA512 54d6326943a4aaeb701cb510f61a9a892c5f4e8e29e06bfa9c20a0f6e741bf23593efc4740fd38641cfcd4c4770536d859291b7b5a7e606679f32b8f4d869dbf
SSDEEP 192:cOv5zbooZQgyjj11d66Joz0dzgCl6mc0dz:fbooZQgyjXd66JozQzgC1jd
TLSH
T113D1BC28F629463BC458023BCDA60F510F36399A988F3F2531EC645D2D972DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ab32cbd67877d5cb0ac07de82aaec2ab27ae740ec7640648f1ca1ddc8c05a114
MD5 fdf5c55d6eb367037e05c54650ec1863
SHA1 be2a8837b78e3d9bc5d7a05c36e098747f900e95
SHA512 eafbfd5c93983b26c620d1eb19d1be805134ffbacb2a5fe1b3af3a12c96497fbbb6eaf958919a2e43660e7f4dd1e20c889ea4b7b4941bb0878d7971bd48a9eef
SSDEEP 192:z1d66Joz0dzgCl6mc0dnOv5zboEZQgyjj:Rd66JozQzgC1jeboEZQgyj
TLSH
T1E1D1CD28F629463BC458023BCDA60F510F36399A988F3F2531EC645D2D972DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dcc0101f6ae3adb74379c69166c5416ca744507830346492a3679625be99b404
MD5 86f15e2ce5a045e957ad57c2c46a1ccf
SHA1 e3e1bc46ce3d954de4b9bccb1960d847071254f4
SHA512 152d543d496d8ac997d45e12c847edda10400d9e07dd63e8fee1598103b9155894851eb6ef6fb40b65ad9c98f6e96dfc1340a3507ded5ad8b7d7cdd574164965
SSDEEP 192:wOv5zboHJZQgyjtBa1d66Joz0dzgCl6mc0dz:7bopZQgyjgd66JozQzgC1jd
TLSH
T1F1E11168E628863FC414027BCDA60F450F36399A988F3F2935DC651C2D972DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 339f8c1792164de59e700638233f2ab114b6d311f5c79a3a110437cc45a1c59e
MD5 68cabcd0d5c7ea9832c05e8052eca993
SHA1 8c65a459eb0a13c341a91cfa96b9346d46fdadde
SHA512 4c6f1a1dc533373aa50bd35c8fb305896faa36344155e75155534acc6fa47f66b175ef40f754e1ecc36acf7b1feeb4e7dfdff416ab4133f57ca5a3752caf4ee0
SSDEEP 192:vOv5zboHAQgyjtBa1d66Joz0dzgCl6mc0dz:AbogQgyjYd66JozQzgC1jd
TLSH
T1B7E10168E628463BC414027BCDA60F450F35389A988E3F2935EC655C2D973DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7067876e9040ac5cfe5644f2b6683be34e33998a74cb1831e761813f9014c4e8
MD5 dbd45bffa0ccb1b3ef0cb6357d742069
SHA1 bee9cc01d7c244e08cdab2bd3ffda52027f73663
SHA512 778b906e3a2a5f33b15d632861fbdc2f252f352c1b84905851b147271f134b085e1736be8aed4bf8a097abea9c1bc4b06ff7feb2ba19691501ba2aebed4f524d
TLSH
T16721674C3FB98D6AA8CAE79CB452068E57A14E0604871C435D63EFCDCE91ADD326A439
MD5 SHA1 SHA512 TLSH

Submit Download

08c5a987-4032-4b29-8e78-1718b9712bfa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\08c5a987-4032-4b29-8e78-1718b9712bfa
Size 235B
SHA256 a58690ed460fbe197700409ece9d292bb646601876f887245dba27ef6f40decb
MD5 eefe5beda9983e112d35714a866d9c20
SHA1 f5cc6034d5f527b668a7eb85f49fa6d9f8cbb4a0
SHA512 d5afc0be6819eb47972027e859e789b95e8f9a2e1a707152a5b5e43d9159160e8a347495c18353e6ddcb1bed8fab7c2740700fb0ef0427259979bcf39cfd0bf4
TLSH
T1FDD09780A8A8635D48041F07B1E038C630458C3310A06C60E6A24578DDBAACA825380A
MD5 SHA1 SHA512 TLSH

Submit Download

692b7dea-53c2-4d90-8f44-c328d33f21e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\692b7dea-53c2-4d90-8f44-c328d33f21e7
Size 2KB
SHA256 359fb4f8cb3af456bac04b1bb23202988ccc93daf098531be76eca64e9f5ee79
MD5 2dfdc7db791a5b11736eee6ebbff225b
SHA1 11e1c914a11d5d8055457aaa262ceab649bcd2d8
SHA512 a8c36027d62f666edf9ab43fdc779c7d35984089d471eae27596ef01cfbf9d7469d98ef75f04159417ed0823050e4aa1b16e10c2af4c35eb49be31066ddb811d
TLSH
T1FC41345C39789CB75CEAF5DDD48237CE57B44A1310C62C432E62EF0C8C8669A636E47A
MD5 SHA1 SHA512 TLSH

Submit Download

b34425a4-9fc2-4556-888e-86f34ba9ca6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\b34425a4-9fc2-4556-888e-86f34ba9ca6f
Size 883B
SHA256 7a2a34fbb58f717d0a06a1ef62fe0d996ef840d5584d29ec00d59e93da4e4da4
MD5 70cc600b7ada346ec0f5c4968abbb8a3
SHA1 f0388c68d21accc583ee939e5aaf927b1e4d406e
SHA512 e938a8291007db38f91078c1113beb0f835c385c9d32714395327b9c16bb39bdc6e00a1ed736c9cbc87d6e10749e9f42b0c38c5164330e73c1ffb8b3cf46aca4
TLSH
T152112740D635B9B3CDB8D15BCA563B434BE43633C0C668143EA18F144DEF52A9357607
MD5 SHA1 SHA512 TLSH

Submit Download

bffe6e86-6c20-44ad-8735-5b9667f256fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\bffe6e86-6c20-44ad-8735-5b9667f256fa
Size 886B
SHA256 44650195515e04c98b6686012828bb397086b3517c786e0bbae6455ec6fd06d9
MD5 a74e8ed7649c5e86483b66952a0dd696
SHA1 202bc34d14b5b83eeb9d39c95f2c8d394479a627
SHA512 d31cf8718530b26c2433de17bb30a4f4082fba6998cfe00586cc63ad3a7d62c3cbb18693f285ae02a8227397a8ca44ebdb3d3ec65a014d5ce40a2d3ce56038c1
TLSH
T16D110040C6A9B5B28DB8925B8A927B834BA03133C0CA1C147EA55F184EAA55B975760B
MD5 SHA1 SHA512 TLSH

Submit Download

f14c33db-74d3-40d7-bae9-4a87b03d3221

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\f14c33db-74d3-40d7-bae9-4a87b03d3221
Size 16KB
SHA256 57cf17f2797c96b807f7345d020210e259273481aeb819fc8a220c2399a911a7
MD5 edb1436471105bf77cb4aae4f9d78075
SHA1 98234bfd50635d5eba6fa54e8b665ca59c346488
SHA512 84cb2e33fc463fca65f2d48c51138109d7bc755ac178a4fc78ede1835bd21c62eaad6396a6d12788e1dd076b597fec4d48f9e12750eacc945fdbf68517c79f13
SSDEEP 192:fk36l4QDXBB1QjFhdsPsC77bCQQSzxo0ZZrjGdEivLJsIHXeolFaEujWN5u79:M36KSXCxfAbXQSlo0ZT7W3up
TLSH
T15B72DA16682055BA8251E36895FCBFC3E5F52CCF4C419FCE9BE4BD0869DA06D1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f49ff361-5b08-4d6e-8181-a2a0a5bb3f12

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\f49ff361-5b08-4d6e-8181-a2a0a5bb3f12
Size 235B
SHA256 8be8b7a9c27dee88e3a6514352ee7320ac7d24f3c3c6642e5cc6cca66c574e17
MD5 59050c23cc132635937a2008e9288137
SHA1 6b2cc66cb4653e44331108ac108e81d1c40e5b35
SHA512 dcf5a72fbe683fe9b295b2f123965e8b151bf1fe8422f3d591f7fc6b6bf5f6ac4a9ef7deaf3a0ba7af38c1f39ab3e340e9eb84ced0b7aed79fde603f87b71c32
TLSH
T1ECD097801888635D88040F07F4A16CC63144CC3390785820DDE184F88DFC9C80252C16
MD5 SHA1 SHA512 TLSH

Submit Download

f88ceac9-66cc-4179-a51f-64f716f9eb9b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\f88ceac9-66cc-4179-a51f-64f716f9eb9b
Size 5KB
SHA256 b63f7199948d5f534a01e984c182d1520da0cc7dfae8bc75bcab11716fde3ba3
MD5 9c9e02519f6f43ff9afc6252e865de86
SHA1 fc60ca01dd82a0e10f57da2cfaba139c56f77196
SHA512 27a0d9a965ab0041202577aa881a49468027f594041578cf2db60605363b7111010f94b0db7744a4da7a9a8ef9f15c25df0d42cc538d30afcc0d558531932162
SSDEEP 96:Y+UvjSNkGUzWl1UzfREIsn/aUeH3fQshT2kEI4FksVV/GDbODBbVlPJBDuzmwd3p:Y+UvlYLpsfSHSH
TLSH
T1A7B1EFFEDD2201437A25E62DF1A9FEAB005A293149C8839D6BEC0C3A37D2EB71557315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs-1.js
Size 6KB
SHA256 5203ac517d8c0591b71f46fd58aec615a27539f8f96d04d24e474ab2c7ed319b
MD5 d2e3b509866042dc1ccb2b444f30e703
SHA1 6e42b546cbfda886338aef35d4888157f9a3fd78
SHA512 039e1acb35e5b40fa1bb94c157dce498c1d2b703e65b7876743744cf7d7934e92c17d9cd64bc446421f5c81e809f6299eb5aad090a929e735e0a004eab477b93
SSDEEP 96:xH8UTUgqGqLfQGi1zSxaSSlPdv9jwxnOHtqmoBw88H8L4cnU9qFGS:y7RLfQGioaSSVtqFBw88c
TLSH
T1CAE1307890088B7F64B677BCAC688C319AB2413B77BF68D750B95485015CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs-1.js
Size 7KB
SHA256 bfdcf8724aeef906e0cadb54f228d47e750862a3ec0f1593f3fc6087221293d2
MD5 ce90126ad3e326978751c44204336a7a
SHA1 6bcd60afd4fd3672359725957528e7d570950a37
SHA512 d831d1cba433853bd70676e6e086e97faf2244110d9977b232d153a60c451dc97c04f3dc21efa7202f7e255bc04c808d5328015553eac1f1c454cab02c65bcd6
SSDEEP 96:xH8UTUgqGqLfQGiNbzSxaSSlPdv9j6VnOHtqmoBw88H8L4cnU9qFGS:y7RLfQGiUaSSYutqFBw88c
TLSH
T1FDE1407891088B7F65B677ACAC688C319AB2013B77BF68C350B594C5010CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs-1.js
Size 6KB
SHA256 92e53b0c6637cc22bdbfa3291ef55bc0491c1408290257336e20487e992fb6a7
MD5 ac53b7689decc54c5baa4bf04aecaddd
SHA1 3de56e25e53428c71e909665d9861026d7073f8a
SHA512 330013a4354fa7cbc7b782e5887289fc3161c5e8245fea9c1d8b4ccb4267bfb09d4d26355ebe0e0f93b0cfda9a89f6972d418268afc7ea3b27d85797f36ebb4f
SSDEEP 96:xH8UTUgqGqLfQGikzSxaSSlPdv9j6VnOHtqmoBw88H8L4cnU9qFGS:y7RLfQGiHaSSYutqFBw88c
TLSH
T19AE1303890088B7F64B677ACAC688C319AB2013B77BF68C750B95485010CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 6KB
SHA256 9498a57f72b2bfeaf4a4665f821b20089587c0f512a53f125324752032c910bb
MD5 8444b98f2b69dcc30cfaf332f8a9d96f
SHA1 d9f29c0b36b0205fd35f37ab180a20696a6e7c6a
SHA512 cb715e214d2012ab2684ce49b163c9bd5915963b21ebd6c6f494821823e5384574e172ec404bc18c016c3b0d794c45647fb1eb1f01b22060f73c12e4e186be70
SSDEEP 96:xH8UTUgqGqLfQuO1zSXHSSlPdv9jwxnOHtqmoBw88H8L4cnU9q4:y7RLfQuOOHSSVtqFBw88b
TLSH
T1D8E1303890088B7F64B677ACAC688C315AB2013B77BF68D750B95485054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 a6c9f6f8344ddb3ad819367890c876bdcef6d12b3503d00d82deab4e5d242e27
MD5 8415755a523af120f828f325f720efde
SHA1 329d017e064e0e7f1c8186ff151cab669f565c2e
SHA512 ac6021a1afab59597b5b0ab4acb262c3afd0f3dfbc918b6ac6cc3f1366408c924de58a1e44b527138f7766f6fd819ab6d4fe7d4ab12423ddc1efa922907157b1
SSDEEP 49152:GXg3QAjgjKR7bWqYKGu4GwF1+B9/ERli4oIp:Og3QAjgmqu4GS1+//ERCIp
TLSH
T1811639F824D1A257F3818037668563EB21AFD00C6477DD444BE966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download