01d8a70848fbc895dbf2dd1de6f2fc42832ed3c6eedd6c3d8fa80a1cb1d464aa

Resubmissions

04/08/2026, 18:33

260804-w69kxaxeld3

04/08/2026, 18:30

260804-w5yr1sbr7v1

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paradigm_Client_v1.0.html
Size 32.5MB
Sample260804-w69kxaxeld
SHA256 01d8a70848fbc895dbf2dd1de6f2fc42832ed3c6eedd6c3d8fa80a1cb1d464aa
MD5 4ef350c72003ca6dea8eb3cf6f667f7f
SHA1 2d814e6ad09784353b3a6c11c2af9648b27f4148
SHA512 59fb7a22dfe19c1b5bbfaf7b427af85780fb40daaefdbfce1bdcc73e003ee2a6b97c70a86413217d3ddd3fbae61e893ff342fda7e0a06c39120336a45dbf8790
SSDEEP 49152:ldE9UFrC/BxVEYH/kiiIu+6Ge3ZS5VuxVF0wI7eObikzXBIVrMWsGwiUSsZ+XVii:zVoqXO3j6/
TLSH
T1D8776D5A29F701BD32C0E27C809336861D195C13F519AE276A36E782CE3FC5BE9173A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	chrome.exe
2600	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303420258564204"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
6004	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeDebugPrivilege	3688	firefox.exe
Token: SeDebugPrivilege	3688	firefox.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
3688	firefox.exe
3688	firefox.exe
3688	firefox.exe
3688	firefox.exe
3688	firefox.exe
3688	firefox.exe
1144	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3688	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 5000	1144	chrome.exe	88
PID 1144 wrote to memory of 2708	1144	chrome.exe	89
PID 1144 wrote to memory of 3844	1144	chrome.exe	90
PID 1144 wrote to memory of 3844	1144	chrome.exe	90
PID 1144 wrote to memory of 976	1144	chrome.exe	91
PID 1144 wrote to memory of 976	1144	chrome.exe	91
PID 1144 wrote to memory of 4792	1144	chrome.exe	93
PID 1144 wrote to memory of 2356	1144	chrome.exe	94
PID 1144 wrote to memory of 4792	1144	chrome.exe	93
PID 1144 wrote to memory of 2356	1144	chrome.exe	94
PID 1144 wrote to memory of 4292	1144	chrome.exe	95
PID 1144 wrote to memory of 4292	1144	chrome.exe	95
PID 1144 wrote to memory of 2088	1144	chrome.exe	96
PID 2836 wrote to memory of 3688	2836	firefox.exe	101
PID 2836 wrote to memory of 3688	2836	firefox.exe	101
PID 3688 wrote to memory of 4480	3688	firefox.exe	102
PID 3688 wrote to memory of 4480	3688	firefox.exe	102
PID 3688 wrote to memory of 4480	3688	firefox.exe	102
PID 3688 wrote to memory of 4696	3688	firefox.exe	103
PID 3688 wrote to memory of 4696	3688	firefox.exe	103
PID 3688 wrote to memory of 4696	3688	firefox.exe	103
PID 3688 wrote to memory of 4696	3688	firefox.exe	103
PID 3688 wrote to memory of 924	3688	firefox.exe	104
PID 3688 wrote to memory of 924	3688	firefox.exe	104
PID 3688 wrote to memory of 924	3688	firefox.exe	104
PID 3688 wrote to memory of 924	3688	firefox.exe	104
PID 3688 wrote to memory of 2420	3688	firefox.exe	105
PID 3688 wrote to memory of 2420	3688	firefox.exe	105
PID 3688 wrote to memory of 2420	3688	firefox.exe	105
PID 3688 wrote to memory of 1376	3688	firefox.exe	106
PID 3688 wrote to memory of 1376	3688	firefox.exe	106
PID 3688 wrote to memory of 1376	3688	firefox.exe	106
PID 3688 wrote to memory of 1376	3688	firefox.exe	106
PID 3688 wrote to memory of 6140	3688	firefox.exe	107
PID 3688 wrote to memory of 6140	3688	firefox.exe	107
PID 3688 wrote to memory of 6140	3688	firefox.exe	107
PID 3688 wrote to memory of 6140	3688	firefox.exe	107
PID 3688 wrote to memory of 2608	3688	firefox.exe	108
PID 3688 wrote to memory of 2608	3688	firefox.exe	108
PID 3688 wrote to memory of 2608	3688	firefox.exe	108
PID 3688 wrote to memory of 2608	3688	firefox.exe	108
PID 3688 wrote to memory of 4816	3688	firefox.exe	109
PID 3688 wrote to memory of 4816	3688	firefox.exe	109
PID 3688 wrote to memory of 4816	3688	firefox.exe	109
PID 3688 wrote to memory of 4816	3688	firefox.exe	109
PID 3688 wrote to memory of 460	3688	firefox.exe	110
PID 3688 wrote to memory of 460	3688	firefox.exe	110
PID 3688 wrote to memory of 460	3688	firefox.exe	110
PID 3688 wrote to memory of 460	3688	firefox.exe	110
PID 1144 wrote to memory of 5128	1144	chrome.exe	121
PID 1144 wrote to memory of 2088	1144	chrome.exe	122
PID 1144 wrote to memory of 784	1144	chrome.exe	123
PID 1144 wrote to memory of 1696	1144	chrome.exe	124
PID 1144 wrote to memory of 1696	1144	chrome.exe	124
PID 6028 wrote to memory of 6004	6028	msedge.exe	134
PID 6004 wrote to memory of 6048	6004	msedge.exe	135
PID 6004 wrote to memory of 2872	6004	msedge.exe	137
PID 6004 wrote to memory of 2600	6004	msedge.exe	136
PID 6004 wrote to memory of 2872	6004	msedge.exe	137
PID 6004 wrote to memory of 2872	6004	msedge.exe	137
PID 6004 wrote to memory of 2252	6004	msedge.exe	138
PID 6004 wrote to memory of 2252	6004	msedge.exe	138
PID 6004 wrote to memory of 2104	6004	msedge.exe	139
PID 6004 wrote to memory of 2104	6004	msedge.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Paradigm_Client_v1.0.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedb8dc728,0x7ffedb8dc734,0x7ffedb8dc740
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,13246523506501855457,5022747685305106010,524288 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,9319761212001133586,1066680064292014611,262144 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,16985098789321185346,1409151870423717306,524288 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,1214636951857354322,3238726488784626972,2097152 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,11270103828008360910,804380459055868597,2097152 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,14105180526113205505,4471680643246150491,2097152 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,14983848106406548131,1723388887300726945,524288 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,7036944462023986458,3722231645013684965,524288 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,18323261620601417171,10528102133972180087,524288 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,3510389707534570366,9288989449888843850,524288 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,12291110385083689177,10629809768884442822,524288 --field-trial-handle=2032,i,3711181831089050840,15323788499007367110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:1696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {cb01c056-27b3-4729-aad5-273f612cfc9a} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {08b7ffb6-dc5c-43ff-9aac-92ccbad40426} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 27276 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {506b5712-594a-41d8-969d-233478864f38} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3896 -prefsLen 27276 -prefMapHandle 3900 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {ac3080a5-1f21-4df9-95c8-2eea5c1bfe7e} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4316 -prefsLen 34775 -prefMapHandle 4404 -prefMapSize 270279 -jsInitHandle 4308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4340 -initialChannelId {ae96d86e-c160-4301-b7b3-d03206d2c8f9} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4796 -prefsLen 35012 -prefMapHandle 4800 -prefMapSize 270279 -ipcHandle 3036 -initialChannelId {49698f7e-f93e-4e00-88c3-fd934c148cd1} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4968 -prefsLen 32952 -prefMapHandle 4972 -prefMapSize 270279 -jsInitHandle 4976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4988 -initialChannelId {4d262723-27d6-41fa-bbcb-1431dfd4a99e} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296 -prefsLen 32952 -prefMapHandle 5300 -prefMapSize 270279 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3040 -initialChannelId {223b3c21-2425-48f4-931c-5a4096637845} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {85f2df59-2645-45bf-af39-f448bf475870} -parentPid 3688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:6032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9ced9990h4f34h4901hbf22hcf16fbcd4972
1⤵
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9ced9990h4f34h4901hbf22hcf16fbcd4972 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x254,0x7ffecdaac188,0x7ffecdaac194,0x7ffecdaac1a0
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14647762137034997306,13514088107668757764,524288 --field-trial-handle=2180,i,91932368954436279,3597014045923914667,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6465025197428449908,11112612044202401357,262144 --field-trial-handle=2180,i,91932368954436279,3597014045923914667,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,16189191429015142015,1200960695073704466,524288 --field-trial-handle=2180,i,91932368954436279,3597014045923914667,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,8395836733255443359,8739983220263574717,2097152 --field-trial-handle=2180,i,91932368954436279,3597014045923914667,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:2
    3⤵
    PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 39b849c8e0323475c4c36b3f263079b24c5ed494bd1f147bc009400cf9a865c5
MD5 3bd99fafdd46bd20e2cd3f72daca43cc
SHA1 1ec32861dadc394029182a76e77b4decd5615e29
SHA512 9e231d20ee8016d7d2c5d83daf7687d7100e77391739b8f461b8c73c6c24f9e4a9b6f2f778de7ea8bec9528250d92f59ea33c0f327a62b5e1c1096ec9bd2f520
TLSH
T140E02BA9C821AC2709FE5F2860140745E74513267F91C95F3A3D92488FB5A3BC567C2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 00c7b77dd0f7e81ed3a9302555beb7814bf7d4d963f11409c8817dc977ff8701
MD5 5e7258034238b90bacf3bb1dd48aca76
SHA1 88b98995402fd4795ebcfb4cf8264f67be53e5a1
SHA512 09b2b0c335c5094bbaffd3593bb2348b1f3a71254f990928aa3179831c8834775ea6ef47759f5dd41c307d0828cba17f2569a8a1baa80b7c1b776c704f3195cd
TLSH
T198416CF793B4957E8A1192F4EB156E1FCE690524031C3CA689E46E2B93F2972D10478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 0b1f03b250642ef95df909502a807989d34685b52ce9190e89b94c69697ee30c
MD5 e5fc4a68942b3e447ba21dfb99a686c2
SHA1 96b4633b8c80ae71c00a28fcec7a416417820aa5
SHA512 93438f21ff0c3b7e7aa4e567af92cfae24c12514853aaf28589246ac9da8957a9b20d42e36f0ab95fa4a8aae506287c149b10e22d7080befb38ea4549fdbf1a2
TLSH
T1CDF0E0679BBE7417507A45BB1D057C055575B43902C078F8CF6A826CD1D64F71B01467
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 97f1927bc5acafb09cc5a6bf6fbcad8855bedf877ab1ec6f26d1175da0ac2d31
MD5 1aa1027581993b1825a0f4ac859461e3
SHA1 a79dba914ea1f48b6aa126a5e1d327c482df7af5
SHA512 ea80cdeb25db90a1705c3a8f0f9820c5e516fd8b54ec43b185fb7143d342083c9de7f9820f54591f297c558f0344a674712fb1d266dc20966c8cbc7867fa3a0c
SSDEEP 192:4RVPYYXq9mv7cpAPRp2qOv9BHsb+WNnnFPSLe+kfdGPVyIsnAUge:4RVPKSwUXl8rwFPkkfEpe
TLSH
T18542D729AE50697B5DDBD229F9263B53E7F6102225902EC0F6FC8A7C15E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f5215cee3cf2edd58e3c65ab3fab3d635566876fdec5dbeca8b4183a51b6835d
MD5 a4f05387b6fe73369b2118c0678a67b9
SHA1 79616e110891b9a9503f8cd3846f729457836973
SHA512 3cc2c2aeda315c6fdb1f7d69fb06a79c4aae68d1996f5d7ae00666c12264b4320b8461f30249fcd6243cb36559d674dddff4927a9799636f96fe606e954c642c
TLSH
T187B0125080465241C40202F41183188CB1149F119E0E2F0543F069238825150841D070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b428.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b428.TMP
Size 96B
SHA256 5ea3e4da6e819752cedb4516b06c5fa1f0bc54bf2131a530b43cdf648d6d3b88
MD5 dc2b48c959c300cc0f722e8d3b16c19c
SHA1 12771adddf13cc8ea7cbee457f02d60209e76e4a
SHA512 b56b7123fa29dc8920a678c1e8e63b4c36fb4c73cf89f2abc390cd358877140e33af820f78240a69b32d9ea03092c08cdfa4236f74cd7d596de8af0e4b342e38
TLSH
T1AFB022B0C222B232C00203B02A88C0C8F020EF20CB030203A2F00A22CC202208A28030
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 8f7fba64f5f5c702400c77b438cc23399c9337144ef2759ddc8fb4ca92ea65c6
MD5 57d088aa03160971294c6fb3aad19aef
SHA1 fb57c318b5239315d90aec1028e367ae66473881
SHA512 cbf6c70433b4bae05e0193772df9c1c460c2e89624bdedb5fe0489ee43ca74850aff468fb71f3e5891521921654239a3c8bc04273c802a74910317ffd8026713
SSDEEP 3:MsEllllkEthXllkl2zEklQT:/M/xT02znQT
TLSH
T1574404047FD40C0DC50014305011C3700370D410453577C334510453DDF55500D41000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cdea715a685a5912a167c4cabaedbb23c17be6f4d00eed92251da6919ad6f88e
MD5 3c79327eccbfc52b6a2f3d38d20e4b9a
SHA1 9413803956d8550e1bcf2f6a4a10d387ebb93670
SHA512 d8ca9f215031e9df32a98c04e4d5252c7dbe9f5f3aaaf05e4246854b9bdc9f774835131e51bfacaa31428bab84d92961d5619c6361fa159b8d4b70c3cf1a507d
SSDEEP 3072:SsFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:nFmUi21rSm8uUVNSlzY/
TLSH
T1EDC3130079E3F8B2EF99304476EF2A159D680D818191C5415773AE419DDF3C61FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ce25fadf6a924f5a715f6364016e602b7f5204c9255435d20edce29346b2d2e8
MD5 49c768a850655ad0bff17558e05f1b9d
SHA1 74b5428f938737072066b1b156dc58bb70eb4f28
SHA512 e3cb6520626dc3eb032551722b6bd94d4e2c6f43a12aea7b0508eccf6e2dd740cc0a75977a2b40aec18e760a8bf403ebb0a9c0ce8bbb36186ad0c0fbc3ebc872
SSDEEP 3072:SgFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:bFmUi21rSm8uUVNSlzY/
TLSH
T161C3120079E7F8B2EF99304476EF2A159D680D818191C6415773AE419DDF3C61FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 307611f96e4dd2c31153fd37b7f25bf015d70f82aac40821354fcf1c332abe67
MD5 1f5afb77ce04d28c9c425d6321df7982
SHA1 32d919c964b6a7f630318fd91e0454a8debd5738
SHA512 fb79ae428df47e4f22e4298f9ec5bb5a598421808ed8b5457169c3685928767a3a32829044c6785e1682f47cf749202a1d4c82f02d29dbc9b98188a79abe4f2a
SSDEEP 3072:SMFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:RFmUi21rSm8uUVNSlzY/
TLSH
T1F2C313007AE3E8F2EF5930447BEE2A145D6C4D818191C6415673AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1b0b02117a29ddc7da35f067bfaa77b9d5bba85009ebf8db12e7045592ed9718
MD5 37a3940b95ecd79e3f9342555e2c9d5f
SHA1 9f89d60f00f7259b2cb3ef1756355fbac913abeb
SHA512 949d367f167abeb14245b0f91705bda168c113c63afabe69bdc1b6655187b8f0b0a91369f85f480e84ce4447f4d0f42036be869576f73c4dcee40c17ef926d24
SSDEEP 3072:SFFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:8FmUi21rSm8uUVNSlzY/
TLSH
T1B4C3120079E3F8B2EF9930447AEF2A159D680D818191C5415773AE419DEF3C62FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

5ddda801-a102-4da8-9599-29d5e0a4326b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5ddda801-a102-4da8-9599-29d5e0a4326b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 23cf390b19d44a8b44250cf196323c297caa62e0faf02fb4a9943243d0229c01
MD5 fdac06c77212803bc3ce30c51b4da371
SHA1 2f99fa101aa8a0072623b86e5878c69c209be73f
SHA512 eafb06ed49eb4faf49502429aaa418c51f3811230965adc0d0efbe4eb9057e2b0acb2178955ed34931b64b8434782ac96f792dc2ed96683b8fb5837498eb420f
SSDEEP 96:sa2jTiEDWHpscnb9pwBdHW+i046W6hfuH9EOx+WVoMfm+uecpYQj6J67M5wUhgNr:sxPuJsf7rpMHW6+WNGYhxhgF
TLSH
T136F1C8826E74693F4CCBE11DFA267B53E2F6502165C5194CEAFC9A5C099B6CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc6130fa-3e77-47a3-915d-815049031839.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc6130fa-3e77-47a3-915d-815049031839.tmp
Size 26KB
SHA256 c00a9d5793fe0a8d040e803d7f2394d693f4db053bf6d2f9d7e91c2263faf6bf
MD5 0d1efbac44f6d0562b72af3d05d5225e
SHA1 1fe9a5d595f5cf09e0ce6e5f4f8de68360cd3d63
SHA512 4a14d7f79c9ac2fd17ac61cb6070b02a9217c51c92669a4a7c07c92c259878ec31c8e487e5793ec90a69581044244ff75a1684020f50395512e8461c8bf59c29
SSDEEP 768:7w0ZmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+F0IrofpU5ay:7w0ZmjYDmWvmKyEu1jakPLZQF0zxe
TLSH
T1A3C2EA3B244CCF7E4F801A9DDD5A6F973EA802C7AB588D4047FA954C02C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2b95cd57050cc56812d8e651cd1c02663b6c34c9b1f9c374c31e4a6df441a93
MD5 edafda9fc26edb2ae7a1d4e3a13839d8
SHA1 b5426dd506c65f5111d725936b4602ffa8a9d71d
SHA512 1b0591f5c1846bf712b469189a3707cd43e78a849ca4819bc33f3f533e9615052581d4a5b15514346f379c05e102e7f6fe86505612ce05351aa7883a0c02fd04
SSDEEP 192:EONp6hZ0QmiUyaspc/+jV6jzorkZk5wOZJxU6:EONp6oipu+w8kZb2DU6
TLSH
T1CC02D935A8687CB78EE2AE45F48737135FE5112BADA56F84DAE85B1D00C769C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f115a62bcf1f525620dd54033cfdbd9e7a1f6118b344bb680c280ceb32492a59
MD5 e8b7dd024b6c798316186f6f35ce2833
SHA1 a76cd2e3b6f647634cc43bde27c9f9e94be7d943
SHA512 b558e5eb9ca4972aae192d1c8f010d98f20412aaebbcbac07da5cdbae85e710862a133761e4845e8de5f35960f65ab3849f205a27932301e8d2dfe407e3e3a07
SSDEEP 192:zUsNw6hZEZFQmiUy8nPH/+jV6jzorkZyXH+255cOTICqEWUO:zUsNw6A1zPf+w8kZyXH+2scAUO
TLSH
T1E5121B35A868AC274DD2A655F08B32639FE520779D86AF88E5E81F1C00C779C374BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 af765f4151c5cedc9fdbba818ebf0464e95d44a7368e4f1922e07e5c65631a19
MD5 3beb80c0b46af34b0d80ec07b9cf681f
SHA1 3b770cf4773907647e59dc43da9450ca6332c62b
SHA512 833cc36bdce5286b7c76d9bae6e5a817623d117bce39fecf593ee028501cfa075101833e1cd7be94783e95e8fd2e76b56c3efceb821cf90ea21b407e463259df
SSDEEP 192:sONf6hZqQmiUy0sPc/+jV6jzorkZyXH+255cOqyqEWU6:sONf6i4Pu+w8kZyXH+2s9VU6
TLSH
T1C8120A35A869EC274DD2B655F08B32639EE421779D86AF88E5E85F1C00C679C370BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 97521cc891af21b5e5a459e8c32f5c730017a0a8b0e7f54f27d86a9f2b16531c
MD5 f95c7a0c2048c7177d2c0ddaa10d146f
SHA1 bf7c3d055afc39728a750081fe70a071af34947f
SHA512 fe4393bf9411eb675fd15c082318f6b79b8341cd40de24d6267a609518d968643ed742f7045c89748312f7fc916231ea7535a498064c69f9527a70a75d39da7f
SSDEEP 192:zUsNw6hZEZFQmiUypnPH/+jV6jzorkZyXH+255cOTICqEWUO:zUsNw6A1WPf+w8kZyXH+2scAUO
TLSH
T1FB121B35A868AC274DD2A655F08B32639FE520779D86AF88E5E81F1C00C779C370BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 a1a0a1fd15ec5bd07cafa8da3a25ddf79c51c032b0e0030b32901e0d7fcf5e9c
MD5 39528aa274ac5e7322e31f16cdf7141b
SHA1 573005c46044719e852d4da42e8e7c4e4e04f1a4
SHA512 edc068aceece9a03d88bef4bce24d897c8d5ee09bd8972586db20b3d995eb4b6563b67d271b329dcd733a3a27773ef6ddf219f2298507e17f2615123c07f3de6
SSDEEP 1536:jTrliLTpCJPl8Aa3NLl5cbjDo0IunkNES3r1BU4ayo9HGE0ZTHho/2QeiTXEHoOL:j3l78Aa3F3lES3fG5YhZGJwQNPy
TLSH
T12FA3AEF7EBA2893D65FF901CA7C2893EFC266404F3A32005D963271552C6BB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e0b2fd1ebd35c25e89405e25f38d6b1aa360b53a1ffe1da146082a11e15fb5e7
MD5 5c35b7be364f8339ba432d35db9bba95
SHA1 c927f0ce1320231b970e3b4d39c09065a2a3dec8
SHA512 6db2c5f080fe70f8b4ed0226385d720125b0672e6174a3e77068acbdae91aad930b223c4ea873a2fa97059748fbc2ba0a551530cfa69061eece8f40cc79c6eff
SSDEEP 192:EQcOv5zboP4xLpyjO1/x1d66JozGzgCl6mc0d:RboQNpyjad66JozGzgC1j
TLSH
T169E12F64E628463FC408027BDCA61B414F39385A9C4E3F2835AD741D2C8B2DE778E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 9f878e6910c9dc0f4e8294c505e2b403a2b13d21e8830c5e1efaa64f8581ef97
MD5 3da7674171d51c912218da3c7e140d4a
SHA1 9f56e9b180cde892a528f2a22bdc46045803ba64
SHA512 3b3bf608d18a60f293d559234af6020b378b3ec406755c0651ab24197dc8667c5adf362c080bebf38ba97b01b747efd8bd460d8ef2d0467cc798ad0e0a1bf08c
TLSH
T19181FC58F629863FE449413ECD961B405F307056A8AE3F2A31AC644D2E5B3CD3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b3fe29fbcc0b9db5ef009913a53941106f9a977d188a7df2b22336d830787199
MD5 2aa9db0035f2f684cb903fe5164e0d6c
SHA1 e0f494216160bc5b464de5533f27496430a9310a
SHA512 c48f721eaed7a2a5e06507ea08fd6a9bedf677c6774e37eec007ceb1d2b0e5a8bcdea2ca22732e4c8a4aa501c2ee747256b43013b96c0de2c4cda849da6a6fea
SSDEEP 192:C1d66JozGzgCl6mc0dEQcOv5zbo9ZxLpyjO2/s:Md66JozGzgC1jDbo9ZNpyjq
TLSH
T1BAE12D64E629863FD408023BDCA61B414F39398A9C4E3F2931AC741D2C9B6CE7A8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

127c44d3-7ad0-4bca-9a47-6625e7a6083b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\127c44d3-7ad0-4bca-9a47-6625e7a6083b
Size 883B
SHA256 2266ac1b5519a0d25a16d27f0dfb011070bedb8e6ff41a5efcead723c3b7832f
MD5 af1b6f8ba0fe2e1c93bdd2909d60fa9b
SHA1 602490e7716f3b0cca578001da36990372805d8b
SHA512 c3829b06c0fb4ea318f83a3c184daf6b448e457683b552eb484216f962d7118888c4d4936b93e6bc9f22f337ef59de316ebaf85b5d9c1b9e08bf0e8dea60bb94
TLSH
T122110481A63575B28D7CD24FC59537468BF4361380C950243CB69D140CAF91E936A60F
MD5 SHA1 SHA512 TLSH

Submit Download

72b2364d-4c89-4649-83b0-c4f69d3fb28a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\72b2364d-4c89-4649-83b0-c4f69d3fb28a
Size 235B
SHA256 00b047fff50e59defe541d6cf2dd94b099ab9dcc14a5fd14b4a5f54d3cab6f72
MD5 dad78a02e0d61024d3bc40e7a34b0a3b
SHA1 97fd34d8c051d7136bb4e61e12e21790a30d4655
SHA512 4a83c60bd060738fd1f4eed68c55716281d74d92966c12c597e56f9c408c6bd5bea589afd07178015d216c9e6ddbdd8f573266f7ee5dc70538213b66ad2f4044
TLSH
T1CFD0978068CC6B2C4A244F0AF0B039C230884C3320B05810D661443589FBEC85262867
MD5 SHA1 SHA512 TLSH

Submit Download

9bf786af-90a2-41e8-8598-ad2900fa4356

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\9bf786af-90a2-41e8-8598-ad2900fa4356
Size 2KB
SHA256 380f1f310d59d1153fcbf32dbcb6d76b0126d05c06e1f49b3ce3bbc47bd7ab14
MD5 df6a9d34f5ff962229e95a6ec2614ef1
SHA1 fd0489f2e53165444e7eba1721e56c7e8f00c30e
SHA512 64baea12467e2319128f172ffed7d2958ae725070b063e5995b1c8688867236c9cd4857f57a412c0c7643accbb7cc9bf675c4636d4ccae8a3768ce5c40b93b9b
TLSH
T17041545C35788CBB5DDAF18DD192334E53B4860344C218532D72EF0DDCDA6AE236A53A
MD5 SHA1 SHA512 TLSH

Submit Download

a67bf914-576e-4caa-9283-4ccf3e58f82a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\a67bf914-576e-4caa-9283-4ccf3e58f82a
Size 235B
SHA256 04f0d52f21cbc1a7f1d2b3aa2558d556095b0d42181cf95bbd47755f708b5ec7
MD5 3b7c7ac5320b6d911da44a02bbe4b448
SHA1 ef9830e1c4060d1c5ba2cb4451184fc833e7456f
SHA512 48d30c0e58d23d20663344939bedc120318bde32dd7d5b6c78e05107b4fd058de77d323fdbed1596a7e7157a04521365983ad8ca475a63a3dd1850ad4766dc48
TLSH
T113D097D264A867AC08001F03F0E0A9C7304A4C3328B09C6085B105F48EF8EC85151C0B
MD5 SHA1 SHA512 TLSH

Submit Download

a842a396-3b95-4b2a-960a-77a11ad54ba7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\a842a396-3b95-4b2a-960a-77a11ad54ba7
Size 886B
SHA256 31e08f9fc4037f29b521c9732405912658825abed4dd257dfcd875ba8dd34e15
MD5 686f9dc18a9170c47359ecde2556ee7c
SHA1 274cea6794f6b0b1f91e570d3da769a0f7390ee7
SHA512 24100ff9782446533eb25d66234938b2819aa163213cd724681d2944a5d1e6645fdd7034590ec89b500ebad198a7b77753098f3860eea8c139a98c6f3b7ba6d7
TLSH
T14C1140805675B1B68D6CE28F95E1774687E03213C0CA48247DAA9A190DEB41EA36A30B
MD5 SHA1 SHA512 TLSH

Submit Download

aea5fbeb-6cf1-4bb4-b3d5-fc8f1f3f40a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\aea5fbeb-6cf1-4bb4-b3d5-fc8f1f3f40a3
Size 16KB
SHA256 f4fe8c7c1d3de8f2ffdc59e84c646e5daa365e692ec29358b9011e20db3c9744
MD5 94c898c3035a284b4f9188e0769b73db
SHA1 95f26a3cf3516ddd980d4e4678069fd16873c036
SHA512 0256f81e1d95591037d5739faddd89387d295bb8638d66e510ad4b35868eecdb914be3f6562e5b52ff4092cb278b96b0d9ee85638601e068b8a42899f887ddc5
SSDEEP 192:omTNOAC+Nki35S8uDzFyaF8KRFaB6QFDXuBFUzUN+1pJv7eJYnYSzx1bSgjNLRA7:jT+pioQFTuTUPJv7HnYSl1bSgRdA3L
TLSH
T17E72D916247045BE8251E7A8D4F87FC3E5F528CF4C019FCA9BE4BD0869DE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 b83bd1f67823aa1abed07c837973f1d13ae65ff3afb95fbc5f64b41eb279a485
MD5 064b32b9d24ffcb3b9c164ad954e3588
SHA1 bd15d0bc0def28410593c815d4adcda902652266
SHA512 5fbbf4c31456a904c67880f2d7446e4ddcb2c460b86c50a039725c4ee86ec299bcf801e0461b6cb2eb6fa13f7ab00c4ccaae9d2e55c6170e843aabcc835e5517
SSDEEP 96:xHi+UTUHqGqgaf0gdc1zSJSSlmdv9jRnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0gyQSS95lfWTBw88qV
TLSH
T113E12E7895088B7F74B677ACAC688C316AB2013BB7BF68D350B59485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 b82231301c930b88fc855b13906dbbc82340aaab77ba5ba1abd825e958c235a5
MD5 367e81806e7f25b77aa2d51936dab3f0
SHA1 ea539ae787c47f85984cb1bfe66783398fa86fe5
SHA512 22fef7254c97f8abe0e6b157a1618fcf2ca0658d6ee91e234b26eec27ca27e93d49cc394622d1061115ae8a48dba02807a2aa3d2851c09ce729384d9b5b6bff5
SSDEEP 96:xHi+UTUHqGqgaf0io1zSISSlmdv9jRnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0io9SS95lfWTBw88qV
TLSH
T1F9E12F7890088F7F74B677ACAC688871AAB2013B77BF68D350B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 921063e886eb54261fe1e815b4df0e4bdb9dac98d5e1594693b3a631ccc0eaa3
MD5 d752e624d878fd6e4e43be931953cba4
SHA1 4c44692d66c1c1d9721a3a597be265de66f2b6b1
SHA512 d83bf42b99d4f359d97e98b3b3781a929480f7c37f799ec9825a2ce2b429d8f021776e0a1e9cf2b0097195d43f679c18dbd996f9c3a895d77858d9b2a0546c6a
SSDEEP 49152:ViwbkMngvZR+Uh3YdAn50Q9hJTHkda1N/UTx:owbkMngRp50Q9h1HkdQC
TLSH
T1CB1639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6032-540-0x000002AA51C50000-0x000002AA51C51000-memory.dmp

Download

memory/6032-539-0x000002AA51B40000-0x000002AA51B41000-memory.dmp

Download

memory/6032-536-0x000002AA51B10000-0x000002AA51B11000-memory.dmp

Download

memory/6032-538-0x000002AA51B40000-0x000002AA51B41000-memory.dmp

Download

memory/6032-520-0x000002AA417A0000-0x000002AA417B0000-memory.dmp

Download

memory/6032-504-0x000002AA416A0000-0x000002AA416B0000-memory.dmp

Download