6897a793d6de027d92ee1755cf535192dbc7f67fce1916b6ec7aa811b22394c4

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orbit.exe
Size 4.9MB
Sample260808-e18mzsttby
SHA256 6897a793d6de027d92ee1755cf535192dbc7f67fce1916b6ec7aa811b22394c4
MD5 734582f9ada459a3ebb8e47b06d1b4af
SHA1 70fc25ae872a83b4588d8e1b17229f9bf15d6193
SHA512 b710794075adc7d55414894f4ebed73745b2f82d3e5b31d79328bbba63620da83f4c033e206ed793eaab6f4bf02ffca886cee118558a66d3b0007f0f4f2d7eeb
SSDEEP 98304:yxt4rzyBE9HURzo/Y7mgTm05AwJHE6hDXLlZqL9PlF:Lrzy00REg7PAmkQZZqL1lF
TLSH
T1AD36AE82B3A1C598C266913CCA52D7A7D7323C090F2156EB33ACBE1A7F726D04E79751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3524	chrome.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306368000649390"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeDebugPrivilege	3300	firefox.exe
Token: SeDebugPrivilege	3300	firefox.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe
3300	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 5056	3536	chrome.exe	104
PID 3536 wrote to memory of 2432	3536	chrome.exe	105
PID 3536 wrote to memory of 3524	3536	chrome.exe	106
PID 3536 wrote to memory of 2432	3536	chrome.exe	105
PID 3536 wrote to memory of 892	3536	chrome.exe	107
PID 3536 wrote to memory of 892	3536	chrome.exe	107
PID 3536 wrote to memory of 3612	3536	chrome.exe	108
PID 3536 wrote to memory of 3612	3536	chrome.exe	108
PID 3536 wrote to memory of 984	3536	chrome.exe	109
PID 3536 wrote to memory of 984	3536	chrome.exe	109
PID 3536 wrote to memory of 752	3536	chrome.exe	110
PID 3536 wrote to memory of 752	3536	chrome.exe	110
PID 3536 wrote to memory of 3544	3536	chrome.exe	112
PID 3536 wrote to memory of 3544	3536	chrome.exe	112
PID 3536 wrote to memory of 2120	3536	chrome.exe	114
PID 3536 wrote to memory of 2892	3536	chrome.exe	117
PID 3536 wrote to memory of 2892	3536	chrome.exe	117
PID 4360 wrote to memory of 3300	4360	firefox.exe	120
PID 4360 wrote to memory of 3300	4360	firefox.exe	120
PID 3300 wrote to memory of 1800	3300	firefox.exe	121
PID 3300 wrote to memory of 1800	3300	firefox.exe	121
PID 3300 wrote to memory of 1800	3300	firefox.exe	121
PID 3300 wrote to memory of 3540	3300	firefox.exe	122
PID 3300 wrote to memory of 3540	3300	firefox.exe	122
PID 3300 wrote to memory of 3540	3300	firefox.exe	122
PID 3300 wrote to memory of 3540	3300	firefox.exe	122
PID 3300 wrote to memory of 2136	3300	firefox.exe	124
PID 3300 wrote to memory of 2136	3300	firefox.exe	124
PID 3300 wrote to memory of 2136	3300	firefox.exe	124
PID 3300 wrote to memory of 2136	3300	firefox.exe	124
PID 3300 wrote to memory of 2884	3300	firefox.exe	125
PID 3300 wrote to memory of 2884	3300	firefox.exe	125
PID 3300 wrote to memory of 2884	3300	firefox.exe	125
PID 3300 wrote to memory of 5172	3300	firefox.exe	126
PID 3300 wrote to memory of 5172	3300	firefox.exe	126
PID 3300 wrote to memory of 5172	3300	firefox.exe	126
PID 3300 wrote to memory of 5172	3300	firefox.exe	126
PID 3300 wrote to memory of 6156	3300	firefox.exe	127
PID 3300 wrote to memory of 6156	3300	firefox.exe	127
PID 3300 wrote to memory of 6156	3300	firefox.exe	127
PID 3300 wrote to memory of 6156	3300	firefox.exe	127
PID 3300 wrote to memory of 6348	3300	firefox.exe	128
PID 3300 wrote to memory of 6348	3300	firefox.exe	128
PID 3300 wrote to memory of 6348	3300	firefox.exe	128
PID 3300 wrote to memory of 6348	3300	firefox.exe	128
PID 3300 wrote to memory of 6360	3300	firefox.exe	129
PID 3300 wrote to memory of 6360	3300	firefox.exe	129
PID 3300 wrote to memory of 6360	3300	firefox.exe	129
PID 3300 wrote to memory of 6360	3300	firefox.exe	129
PID 3300 wrote to memory of 6404	3300	firefox.exe	130
PID 3300 wrote to memory of 6404	3300	firefox.exe	130
PID 3300 wrote to memory of 6404	3300	firefox.exe	130
PID 3300 wrote to memory of 6404	3300	firefox.exe	130
PID 3300 wrote to memory of 5652	3300	firefox.exe	131
PID 3300 wrote to memory of 5652	3300	firefox.exe	131
PID 3300 wrote to memory of 5652	3300	firefox.exe	131
PID 3300 wrote to memory of 5652	3300	firefox.exe	131
PID 3300 wrote to memory of 5952	3300	firefox.exe	132
PID 3300 wrote to memory of 5952	3300	firefox.exe	132
PID 3300 wrote to memory of 5952	3300	firefox.exe	132
PID 3300 wrote to memory of 5952	3300	firefox.exe	132
PID 3536 wrote to memory of 6864	3536	chrome.exe	133
PID 3536 wrote to memory of 6692	3536	chrome.exe	134
PID 3536 wrote to memory of 6828	3536	chrome.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Orbit.exe
"C:\Users\Admin\AppData\Local\Temp\Orbit.exe"
1⤵
PID:1084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe0bf6c728,0x7ffe0bf6c734,0x7ffe0bf6c740
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,12281482237840112230,8175719411331876155,262144 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,8309729780075534560,11917295728055591464,524288 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,673073047652617823,7023154250928939926,524288 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,4978305684728231640,16321860215528156296,2097152 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,2586026556804578411,11643280848198518577,2097152 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,16131820009171567030,3696261325770084023,2097152 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,15815662722546885443,11958790797144898314,2097152 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,1012404476780986093,11502268013527589726,524288 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5832,i,6553187261951373292,4470296145298459119,2097152 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3520,i,11917053871078501792,4507817198613617227,524288 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:6864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3544,i,12677449284430048721,6132933572393539992,524288 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:6692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3508,i,468704702202836245,3269294886581998541,524288 --field-trial-handle=1928,i,3809930187651531020,1226678849893299456,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:6828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {36c8d816-f5fa-40f7-8d57-92283bf3325f} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {fb32120e-2a71-44ff-b512-5e4a545cb0fa} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27276 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {79e13510-67e9-4955-931a-e602d23029a5} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27276 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {89ad25bf-e8d8-467c-b1a6-93591c2168e9} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4488 -prefsLen 34775 -prefMapHandle 4492 -prefMapSize 270279 -jsInitHandle 4496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2524 -initialChannelId {01483f07-9484-441c-baf6-1233c8587e99} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4752 -prefsLen 34931 -prefMapHandle 4820 -prefMapSize 270279 -ipcHandle 4828 -initialChannelId {a23a9f79-8194-45e6-a670-c15d39643751} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {1fadbd97-f6d6-4c0f-9d7a-415de657f66a} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 32952 -prefMapHandle 5332 -prefMapSize 270279 -jsInitHandle 5336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {5d222bb7-57cd-4a35-9af6-667879695384} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {c6a93333-b0ba-4858-bd06-22aff1c56b2e} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6264 -prefsLen 33031 -prefMapHandle 6308 -prefMapSize 270279 -jsInitHandle 6248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6224 -initialChannelId {b921dc19-b7ca-479e-bd51-01cc28ea1df1} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6792 -prefsLen 35143 -prefMapHandle 6796 -prefMapSize 270279 -ipcHandle 6804 -initialChannelId {6f530346-31b5-4fe2-902a-7d49507a006a} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:5952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6268 -prefsLen 33071 -prefMapHandle 6576 -prefMapSize 270279 -jsInitHandle 6736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {1f3cdc77-5a6d-4603-9c9d-39acfab687dc} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6748 -prefsLen 35267 -prefMapHandle 7164 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7092 -initialChannelId {a41fa3f5-1d60-4170-8b0f-92b4fda8d333} -parentPid 3300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:6520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2b9391ca-250e-4a02-a852-e2725180ad3d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2b9391ca-250e-4a02-a852-e2725180ad3d.tmp
Size 115KB
SHA256 979ca3b1187544dc524f2639e3e068d18bcd39019814528d3937bdff6ac03df3
MD5 d39fbf9796df64b8c743a044788b5a3d
SHA1 b8c3e683a3f89a7cea1a6819276f2b89323c23de
SHA512 a291a6324e238784851227d0d8099fe648d778c88d108e15cb9b3e6b53b7fb218929e1dac69bd3ad2029f06513ac12b3bcddd8007352927124017b3921bf8d8d
SSDEEP 3072:AcGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:km7Rkm1tYpBeh2BAog
TLSH
T1C8C3023B5D75EC3B5CB5A74EB08E0F1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 68bd66362a671e8b63072fa31d67dc227d31f6e0022e5af8d67d202bea94aa16
MD5 fd3e8187d41336939fcb1000745f06cc
SHA1 03e476a53b119e54db93a8ed61eae0004a339179
SHA512 7451eeb00209a9bf0fa8d522c33f665faabd8847da4468d15d4d1bba5938c50ff31bcddbc46375bab951e9ccdfa60ae3906042e9c47900271db9598267655709
TLSH
T153E02BA9CC31EC271DFD471D50508A86DF1013571B60C85F7B3CC1088FB06670686D9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 c1d6e50f444767b258422a269a25daedfb47a6cbaf1fcfeb0e93ebcb96f0d410
MD5 06ac2b5607bf41bf751099dab4e264d1
SHA1 0d7e1d1b63ad7b3e85443a67c6cbc6b9385bcaa8
SHA512 051fd9ec5b8d600bdff18992439461dc9576a1580447e1fc18235722efee2b4c1a949972b173e88baff67e6a29281b71ceb5078eb8fc4939e36369b8e267673b
TLSH
T14DB0220028888082CB800BB028F380C0B3F8CE3C020B038282C808EC88E3FF32000A82
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d0a7437e6ca7998db8d690d2c6e4abbeda6599b08f2962f577dbfe4a60e0ae47
MD5 ac594f146c68cface7adebbae2ebc151
SHA1 6c31b8b6de1342c16160985bd05ccf30c98d252b
SHA512 781dc16041825dc5d9abccb64feeee06502f8e2bdefab844448eda86fddfe0e68c91ee6a99d9d4afe8f1c773f2c87a674a1dc2a04b69f89290aa81dd6efd9b4f
TLSH
T1C5518DF7D3E89A7DC51196F49B216E1FCD2D0A14131C3CA6C9D4AE5B53E2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fdd6d75c3152624e561738b3ca05d999c47453348bdcece405ac74f863ddce79
MD5 98275ecc16ec4a71c016d37759fcacb0
SHA1 d0a7b471830d515c4c855b78373483b581143404
SHA512 84264e1eb72acaa356241dd29b2dc5dc32a8e9ec2958d47f9a1ebfed5fe479fb061755be381b4e1ebbbc3e408a6f5c0c490542d286480b9371a7373ec91da84b
SSDEEP 192:1RgmItP68Aomv7ApAPRp2GaM9qHsb+WNn+94Ol2W/jkwNVyIsnAUgtaJ:1RgmePjSkUXrkwkT20j78
TLSH
T1F752D73EEE10693B9CCBC219F9257B57EBF1102565942ED4E6FC892C28D75CC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6c389bd5ecf2623a58b874615ba654db6efa5342823c1a782583a18a65ff240d
MD5 ba59790ae786b4781c2f1ff1feed7562
SHA1 ee1378eee05bbd36183f7a9d84fbe64fd64f2ad0
SHA512 709a5132a31c400695af4cae4e1659e4be619d46da684d0c6e2e746482845d749a868fa545a427c57a2a5cccd38d0f2709f03f859bb5d8ebc69378e008463f83
TLSH
T1EDB02200C002222BC08203B02CA880F8B0B0CF28C303220282F00A2ACC32A30802A020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d89e94399621340af38fa62a06c663c9d33bc26a524ce9b5c5917fbb319dc0fc
MD5 ada8bc3338d6da47260f475afa932be6
SHA1 36d98e782affceae4e3d500ea30b942811de6bb5
SHA512 e709aa44c6a51e9348262e9cac149adbefef0e75ea41e681ed126c1649a53da6e7034c2fc2d56abeb6705f26efce2120fa2c7f05105838d7efac48c5fb0a2295
TLSH
T12BB0124080056203C0062BF811421488B114DF14970E270597E0BA228C291628014052
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 c61c7a5048061a67a408fe7f7145317900eeb6b5333c82b32b8cf3e7b88bbb61
MD5 265ae88ee85f8cecb1c6a6563f3080b8
SHA1 5ef6e7690e74558c63c772ab138e7445d2f9fffe
SHA512 0683b4c93cb29b4aff4cf0539b00fb5e746d4470aa97722904745b297d70e4feaea4624e987d123388df969415bb606cdd596c7a04833abb3a427456493594d7
SSDEEP 6144:CWPKO8VY/v/3uukrVEQ0nEkm7Rkm1tYpBeh2BAo/:DZ8VY/XznEH9oBGcAo/
TLSH
T1CC34127B5DA1983B1CE5371F708E2A295DF10A7BC2259D8BE4C87B08B3DA5D50B92D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 148f0051e69a4c3635b20dccb30c8a8c3c84191e7d0e82d1675bf8560dbe8259
MD5 4843ef46e7d5eb19ee92723001191fda
SHA1 b0cf473a0174908289d710b1d9b31822f6d7bf08
SHA512 bde5ca722cfea82ab6db6c20169d5dd5ed39e56a30eb21f4495e273a25e8bec1cd184e3b5da26f30aca48672869c75ee1d43f761f492998d54b533d07dc9ffeb
SSDEEP 6144:aPKO8VY/v/3uukrVEQ0nEkm7Rkm1tYpBeh2BAo/:mZ8VY/XznEH9oBGcAo/
TLSH
T13C3422375DA1983B1CE5371F70CE0A29AEF1097AC2259DD794C5B708B3D96C90B92E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3cc787c8aa5ed6e299e60f39a2034f57ab41b03f359f660a8ea3095330c16f5d
MD5 687e42b3ae668ad77ce925f40f62cb74
SHA1 00c56859deaebc58340cca807e5b5dbe50ab4ba5
SHA512 8209a1bf02b4e3a5b2a76f1f7920c320b0382e219c18e6614b00a92977234911288d3c92f5384ea082b252170076a578854fc70f5fe46c606c9d19f26e59cfc1
SSDEEP 6144:lPKO8VY/v/3uukrVEQ0nEkm7Rkm1tYpBeh2BAo/:JZ8VY/XznEH9oBGcAo/
TLSH
T12A3422375DA1983B1CE5371F70CE0A29AEF1097AC2259DD794C5B708B3D96D90B92E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03D74D5ED346B6A425AA45C38A54C3F6BCFF5085

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
Size 47KB
SHA256 9200b5f6ea6199ef26a43fe4b0a7c5d06d05b1c21712a25e59e3f6dd0e805e2a
MD5 43531957508c09503b41d1bc210c1603
SHA1 d4fbecbdaf494226a0a519edbf235fb161b134a2
SHA512 061f0d1cd9475a710c414d9d6b82d87f3bcca35b336f89d4bb8bae77cefd75e06c452cead1307f57eded19e8e905cdf7560c025a6c3f303b4bf21fa7b1654d1c
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3usSON8:eUEEoBVQDjeQaLnP2pfZTqgSEXow2/
TLSH
T1AD23E133184A3F508241F250D0DEB6457D47F5239FE299A8D0787BC742093D95FA66EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 bb78b5374ed4776d15232fb18c8dafb5b6968716604357c353af7ba6a6fdef91
MD5 12d3d9e491fc60cd84f3c4cb7b2db8a5
SHA1 5a3aaa04a96575f465a3870ad80c8d6df9631fc3
SHA512 1e11ebd6da3e961b025da0059a937d36dfe8f2758c47e9bd0ac7d0f92199dd551cb95383816fa346b924e1e7d1cbdc2253f4419e1d87ad1692f7bcf9fbe52363
SSDEEP 384:HwCe7iO024YTDL84KKDL849B7SOEAd9KVRaAcP+AWRMAUeW:QqZYTDL8lKDL8CB7S/AmVAf+hRMjeW
TLSH
T18D729E7D9F413CAC19A7C0E8C0F942D98D1976A7CFE6806D21683D0DCB98A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 6d8763110f6510368ea3dc4f806008e8205914f3e0c7170b4670b3745363a66e
MD5 c2f4a500eeba2453f722acb4586784e8
SHA1 c52b549c7e7cd16fe455e3213b4ba22de3a748a1
SHA512 0109e0a3598ffabc093e276b2777707d13abd1e82001c85f388bc47ff23c692f67cf8e3aa54751abaf42cafd6b4ed593fea8b6e0289363daa0af2a4c3aabab32
SSDEEP 384:HXkRyiO024YKDL84KKDL849B7SOEAd9KVRaAcP+AWRMA2:3mZYKDL8lKDL8CB7S/AmVAf+hRMv
TLSH
T1EF727E3D5F003CAC25A7C0E8C5A593AA4D18B7A7DFEAC0AD21183D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0aa856ca-3085-4f3d-b24a-58dd767cc5db.zip

Path C:\Users\Admin\AppData\Local\Temp\0aa856ca-3085-4f3d-b24a-58dd767cc5db.zip
Size 3.7MB
SHA256 e9c028f3f7c77b2fcc2c8a280e20a862eb5cf106c8a7ffcfb5c278dc8f9b5875
MD5 21e8ebc10f7f3deba5c248255c3ce7a8
SHA1 a846223e4c97fc85f8649f6c020255fb0c97404a
SHA512 371493c7d3ad719a9954292e488b6d304713a78dd7382ed44287a77d5dc65f83194865866a3041e2bf1d7ee457d7b0d33f2ae43f5f555321eae5d4173d34a327
SSDEEP 49152:F/9JNuWPB//PzyD5qMUKMRXlGR1VCa5gjOhpIGb+QlmQi1hLwiyPe6BG2SBqLgO5:x9J4D7q3GR3TwGb+YmQIwoRMLgOkkRr
TLSH
T10106F135DA5F1609EDCF83FA890C2FC2B84C4FAE8854A56B7E6F95715EA31E21F44840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 36KB
SHA256 5f03140504dd6df78d075aede5ea0563dad28398717bf5e5e32342dcebff0699
MD5 14eb489195813dd12f2558dfbc465d76
SHA1 7e61318548916b7b98026a2ff2a342c29ceb92b5
SHA512 354d110aef6362c9e5edc50fdb2cc48bacf2252d9911abdc3052a6d4a4d38ad8f8d42fa570d20b06d8b658125584fd4a8569872acbb50c466de04dd7b3095129
SSDEEP 96:AtdNv0cFQQFeoFcmFRYjiOOFZzpJBAqEOEkK2kYf3n23O+QtNd5LL7BF+I56+z37:y2hYnQC22LOZZDFt
TLSH
T1CDF277FB97B6A8A1F552CFF040AD704C8D3316254A688DC4CB5490E703C5BB5A27FBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 10KB
SHA256 88626c25287e3e108e5d834e73f9a74cc954de2414325ed40997072835a47545
MD5 c465c43e2d808ad74ffbecc8d2caf3ad
SHA1 a8ceda31c2b9a9fc4c6a90d105a9fc13866f4996
SHA512 1478ed84d9c6c53fd2faa40dd45b8523bf8f147d3e0d63c9110d6f047aa08f0f4fe5f197753e74b81986f51a170cba213645c001b73057151f251ac34a371802
SSDEEP 24:rWuhMZLS4lh24FTh141EEfY4FufL3fdL4B+kat4xkh/jH4xNiOc:rEfDLNhGOmgVUKewbYjiOc
TLSH
T18A228AFBC3FB68B4F4568FB450BD7088892315654B618DC8CF50A1960786BE1E27FB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 104KB
SHA256 47e17e2244b869cf6a047cb1e38df13972af43b9c9ec88bb0bce901015fba7c5
MD5 3894e69c2c40b6d706f24adad3d2154b
SHA1 075c2e739084eb6c32050ed27439467e50436929
SHA512 f27b0390167a96a6106c507677bf063693d7e8c68e41a86e1657c6c9c75489896a2f9600678d492a562216284fb27093eff4a74e73bc896657793a5766a0d1d8
SSDEEP 1536:+47ySuy5DWTwpP/54biNqub3uHh2Ucam++PK+Y1EMWUoVUkUGWTv:+8yvykc/GWYuCHDWzPB7M+VUkUGWTv
TLSH
T105A3EF84DB1A403BEC2446BAB4D617283735F4644B5A5B1B3AAC04752DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 107KB
SHA256 867f19dd5340ca936292873d4b91231e932f40ee37a3528f59c2f1b43d0c630e
MD5 f6a9e704e47ff5eaf9d4e5cf5abc3f8a
SHA1 3d8585bc0f7ac5a0cc3b1299a926f41697bc47cc
SHA512 a4e4652563cd6ea6a05cbdce6d4fb5a84ecb5d7f1cbf0f84d34299206a9c45cc2eaa1b60ace47928c8af5780bb78f22827134d024e962076c9ecc80264a88058
SSDEEP 1536:NS+C/uy5DWMzdg3jbbiNqub3u9hcsIxm++PK+Y1EMWUoVUkUGWT9:NjCmykEgHWYuC9vBzPB7M+VUkUGWT9
TLSH
T1BFB3EE84DB1A403BEC2446BAB8D617283735F4644B5A5B1B36AC04752DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 85579335d5915b4776d7a9b1ef6a2da6cf4117fb1cbe1657f4af1710af4a03cf
MD5 1f4bd28c01432168cb4ae6c1526ee506
SHA1 db26b84385fdf2a24cb3a4a1b1170ea880030dd6
SHA512 88e42b5b70b6f6418cc2c06930c6fefd5e285096d7d313e79c27c9b9dfe72e57ab9294b030fe4a59340e0fc6e26c1af279fe0126e4665abdf7ef238c54388fc4
SSDEEP 192:vPOv5zbowZqmyjFOHl1d66JozGzgCl6mc0d:vgbowZqmyjAjd66JozGzgC1j
TLSH
T1F8E10FA8EA28863FC408027BCCA61B414F35385ADC4E7F26319D755C2D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 107KB
SHA256 21a69e8e0f001fe235e9143955836b286c1f86be415de6e0d768b14b2d410587
MD5 42fb6acd684fd7cfbdd88f58f82ddfb1
SHA1 b90d6fd03baabd0925c7735c7dcb04383b995192
SHA512 7657af845bd906a16896e7647df1385f36a4a6dfa614fceac76f8d422c3803a14ae31527277160c825f28bbf10aab9fda446660900d20636220eceb41fbd1e16
SSDEEP 1536:tS+C/uy5DWMzdg3jbbiNqub3u9hcsIxm++PK+Y1EMWUoVUkUGWTj:tjCmykEgHWYuC9vBzPB7M+VUkUGWTj
TLSH
T123B3EE84DB1A403BEC2446BAB8D617283735F4644B5A5B1B36AC04752DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f421fe1fb17a5f96271fa4d1d9c630b9d9c75d21eaa13f6a9a11cd6dff2c410c
MD5 b152ca3454af7a0b23c20122c8c16514
SHA1 70b49b429fc5544086dc6b703072b96767070fbc
SHA512 cc65c314479e15af5552db456cbd3ba33931df5b71f3536f2a812018526c04c1b8fb78d3d0aa5e7abd2212635dbaf05179993534cb7381e19599fcb5bac44060
TLSH
T172217F4C7AF98D3A58C7E2AC7941038E53514E0F05871D43CE22EE8DCF816D9326947D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 4KB
SHA256 f53210600a9e75c04679ac49bc69d520619b941cde190aa8dd5cae1d4011f330
MD5 e4622a053fd1cac18ebe71e8c4f2cc5e
SHA1 11bcb8bcc05b5d506bc960f6b8f59c0db2098d53
SHA512 cdeaf9a807f216f500a8062317afb194c795f6db26975e8d5a85fdfc53e98b23807ce73175c124a9bfe18d75e397bc2a22f8ed616f2294e6aede62b3239da8e9
SSDEEP 96:jvKNGN6vjPcLAmOpF4wEFhdksBSdtTxL9Bv:jvKXBmsLkfksBUPL9Bv
TLSH
T13AA1231C79B90C7E65D7D39CB881038D97ED4B02448B1D43CD97EE48CE89E9A321E179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

390cacd4-7b2b-45f5-a34d-2ead628f5180

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\390cacd4-7b2b-45f5-a34d-2ead628f5180
Size 2KB
SHA256 2dab9be95de0fe198a0791e79c90063d8c688e3ca81289542bea0941e852ee8f
MD5 507a5c943756e5093c891000798055ec
SHA1 a542937bfc60d553048a56640a144afb658655ee
SHA512 80ccb472d79973244a7b068928f3bb926618d17cf11b76bedf18c96cebf9b5c4450438a1555ceaf4a1179755121d6250860750816d67768583c3f16752d42760
TLSH
T1ED41116839785CB64CDBE18DD581238E57A44E1310C618932E61EF4C8CDA6A9336E43B
MD5 SHA1 SHA512 TLSH

Submit Download

7dfcf774-7ae1-414c-a3f1-6b7e160a99f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\7dfcf774-7ae1-414c-a3f1-6b7e160a99f0
Size 883B
SHA256 21a5fa15ee49b394a85c481f6584fc68e1af1f5ed88b084034826b17622f7b8c
MD5 d41f2a5e79822eda7a5d058cc6e9691b
SHA1 36f7198875b6655a69857d896f18ab710faa4190
SHA512 ff1ec83db235d7f50aa0b462daa0c8618c195b7ea3721f631ab60de20179e13dcb0a38dd373c4c9d857cdbe8548ba1ff337a8fda897d25ebae07bbbd727b6734
TLSH
T1051127C1A530B5F2CC7CC24BC79177514FE46533D0C540143E616D280D7E52EA35A607
MD5 SHA1 SHA512 TLSH

Submit Download

7fa459c4-9230-4173-b5f2-368e71d50369

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\7fa459c4-9230-4173-b5f2-368e71d50369
Size 16KB
SHA256 e2304a2b9c7a1430a272ac88c728860c579e33a6b6e0c4229cfd44ff8de9578d
MD5 ddabe7aad47435060b5d25af5ff7fb42
SHA1 6b525289fb10263548904817e35f16ce04e1409c
SHA512 dcc62e85056fbf35524ee5deb0c5e7bad94f0abf2748799e7561e9f6a8d37e8e2c8b6b8d7934f5cbf88a2166c7b49ec23103f013e89e7ea10dac7474ccfa5c5f
SSDEEP 192:Dgqfw+eKFLO2FFC/WyuOI3/gAQaHipI879K+3moR1icRuFzxOV/jRODde10KWBA2:DgqY+zI9K+9R1icRYlOV/jROdxc+P
TLSH
T13B72D956682045BA8651E36994F8BFC3E5F538CF4C419FCADBE4BD081DDE06E012794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b05ce03a-47a6-43d5-9089-375e05ef7b6b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\b05ce03a-47a6-43d5-9089-375e05ef7b6b
Size 235B
SHA256 c2787d7b0cd2c1a1061b1aaf1f2118695dc594eb36452625436b11c1cf39377c
MD5 7e248dc68daac835313407ac372f35aa
SHA1 97a9e2ce3d1ed03f77531a8ba378ddb74a4c08cc
SHA512 8a827afb7cdfea7a55ce92568c96fead1856ad6433603327dbc77b7d4673389ca0e7455a891f64fabc21dfb80ceea6e4dbffcce60a4d36f7752264ad740fe77b
TLSH
T16FD097A4B4986B6C08154F23B0A068C2304C8C3764709820CA9185389ABAAC81256806
MD5 SHA1 SHA512 TLSH

Submit Download

c51cf339-c9d5-40b1-971f-e09e4c2d6792

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\c51cf339-c9d5-40b1-971f-e09e4c2d6792
Size 886B
SHA256 c0e87da785ebdea9c2d1da327d2f7d6983e7f710a9e45d75cbe588745da7c0d3
MD5 9b1256216482790f99c3dbf455165184
SHA1 ae1c25d8caa145a4f68713fc7ec0a08793609f2f
SHA512 93e50c4007f180db6ca8d5794efe8df63aef9a4b960d94e41fd94cc54d4586626f8ed8d0122f73ac0e7a738682b876221424434535b2db481a66674d15c7aea5
TLSH
T1811104D55A3475B28C6CD14BD5E577428AD43523C0C904507E612B280DFE51E576BA07
MD5 SHA1 SHA512 TLSH

Submit Download

f87a11de-9b94-4a15-bf08-a48a4ddbea7d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\f87a11de-9b94-4a15-bf08-a48a4ddbea7d
Size 235B
SHA256 b071f446f0521067573e6559ad5d4d064a4b61901bec22f37d6857792334c08a
MD5 78e63a3f8b0d134d2133177da9777c54
SHA1 261e74d5d593005839c1e500cb80bc615c70c9dd
SHA512 f3182df26971ec6af0774aa82c69ca70036118cf41c2d32ef9bab462acf65d0946fff0eda474ef199b26fdf449c4f18640d04b19d1186aca0418e57b3d4c534f
TLSH
T106D097812C98B31C08140F07B0B068CA30C98C3B10B4A810CA9050748EFC9D40312C2B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 7638e1455b4f2bb585005460f00fd4c696cf89d18bca2cdfb0b6193048f9cebf
MD5 5ebe4bce265be03ee69c4289f2f7a59f
SHA1 b1d262019d44adb3e0ea21aeaab84da6093992e7
SHA512 7ff75ec0c889499d2b8fdef3393a1cadb12be3fe82aec29a4f7c51a5411bed0a465ab93a2cad58ea99176bc3ffb21d5193bc6b5059aa0732af406c67b3fe9ac7
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4HwU4hD:ujI4VRfOXN4e60434L474f4l4N
TLSH
T17872531545148EB8294FA78BAA367E01C37D573B60845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 8KB
SHA256 7897c20658bd1e73ab45485d9efa3b82922624074d08801d3803dfb02ba53303
MD5 5e6f6e0123e9e850785b4c2c6c96c54e
SHA1 d3093fcd0b47960eac721622c3200acd66bb4c28
SHA512 8e296796e530c5cba004b77cc93e58f03761da2d28d9cd707ca4ccba5c46d4eaaa5804d41a83afa5d105533c138371ba10aafcb353c9c2f25ad010a339eff67e
SSDEEP 96:xHcxTUuqGqdfvtfNbzSr35SSlDdv9jgnERWRpBO+y8C0Bw88ac8L4cnrzBHjGS:68Rdfvtfu35SSn8R68pBw880X
TLSH
T1F1020D3C9004CF7F64B6767CAC6889315AA2023BB6BF68C751B954C5064CF3446E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 12KB
SHA256 973ef608f0ee2c16af199f4c42fab9743c062ad32f6fd6636068a596b26cc17e
MD5 342d7b8287d1db495bd3d43f261f0a57
SHA1 afc74331df2351c193b34fc6c9aa954bc8c90193
SHA512 9dab982f31d1e5da92d9e328859a18fc8d37bd53e0617b81c8d4717a80126adcd045d358bf0f19d09b54c6a26f6278e5cde214d928ca53c7736b0f12b617684e
SSDEEP 192:G8Rdfvtfu35SSnXLR68xOBw881w9Mdrfl:/OR67wqkp
TLSH
T1D642BE3C91448F7F24B2327EAC2949B019A14237B6BFBDD346F994C1465CF2441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 531604cc4d7f2c8a19a3c5b602c8229ada8ca7238d701c46f3a37cfb810f8e92
MD5 f8312ed6f8f2584057cb62fd6b2fb6a2
SHA1 dd26f7ea6cf7f247be0f45a26e22a1d1ff47de53
SHA512 19b970e8e551e2b1052875c66bf9aece021de5739aab80453f7ac5ef22707ae51b117fae97a6a191c44241412027f7520a5b299d988dca98c417e83a625eb97f
SSDEEP 96:xHcUTUuqGqdf2oE1zSsGSSlDdv9jCnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEfGSSN9A1Bw88+w
TLSH
T109E13F7894088FAF64B676ACAC6888716AB2013BB7BF68C750B554C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 7KB
SHA256 ff29e806e2747056febbd5f655a50329affdc3b3c846133f408013ed66e5a8ed
MD5 b4a65a483a059ded3ed8a25d1f29eee0
SHA1 2462e8534d3453b4d53f8b509954d60ef69f183d
SHA512 f0249c3b6d25d88647e9fc16bbae1e7b7cb8630cc3b33b3b87e6f51e7d142ddcb82c26adfd23388a78919db4ef296ce2e7eb6c4f3f18d9a734990512a2c752f1
SSDEEP 96:xHcxTUuqGqdf2tfNbzSr35SSlDdv9jgnERH9O+y1Bw88A8L4cnrzBHjGS:68Rdf2tfu35SSn9A1Bw88TX
TLSH
T1A0F10D7891088F7F64B2767CAC2849716A72023BB7BF68C750B954C4054CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 899cb1897c96c8812529c9a39b093a593d85e0872f6ee854d40e87976aa4adf8
MD5 74178bcd99aaf7a2bf26322e5b8d43e2
SHA1 98b237701ab2c1134b6bb0680c2a89facd31766e
SHA512 043584cd1a1d5b4d0dd3b016132b096228d4de33b8f47c3afa7adfa3182d0a9025ed96f8990d60b6e6189668e985dc4c3040bb79b64fc9b09cab6fa34a216f68
SSDEEP 96:xHcUTUuqGqdf2tf1zSr35SSlDdv9jCnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2tfS35SSN9A1Bw88+w
TLSH
T1FAE13F7894088F7F64B6767CAC6888716AB2013BB7BF68C750B554C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 4bbae8a4c10a00f34301858c8728a0b89e9ea312eaee07dbda7a73bb1629ba57
MD5 3f2e6b5b922c21b508933bbadd7c2fee
SHA1 73318e95ea39a79f94c75c195f75fe6772031977
SHA512 5fb44212a30bcd331b3b4e4d98e3771b14a4936071f2e2e2f04ab2dee32b74c675475e62c507102b0874aff006da710c9f8552f10291b2cce14bb97aaef77ffe
TLSH
T1CF5118D2680D80F9066F80D58482733C0EAF5C87D34A0AE8E14E2F28C8B86DD31AD74B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 6586a9014407d7fea05b012a2ea90313d6134506ccb0b83a2598db373fec864e
MD5 a1ab3196cf978953ea9ede26757ba303
SHA1 9554313950b2cc1703610f41945bb7bee8e0814e
SHA512 53272f11616d44ee29cc8537ecb1517d90e9cdc30238fb27978c167d0d7f27a88ca40427b22cbe0cf1e0b4f6b98940c4a1d0ef66dfb10bd2e63dca76f6817095
TLSH
T143513DD9DC1D4CF8162B00C504C61BB48E5B5C8593A50D98E50A674CCCBC69A71EC69E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.jsonlz4
Size 10KB
SHA256 3f7e2482ab429284c8f3394a38653e8e4d162fc5a6ccbf0644fc7f1db8a7595a
MD5 6d69f9f68c66e35944a30b89bdd3128e
SHA1 089b55bfd8f90b9821c081e4d886f88b5c9d56e6
SHA512 6dc026d72f7db47ee28ff9ce659aafb2f575673336971604e743a55f41d22b3d170f08bdb0e0402e866f651c2452bed0ab1b927aef6cc87a1c6eeb60ae21eb5e
SSDEEP 192:UgMhTF7uzTizPXSqKs5tv+49aWu+XdXGtZQrxT8F50AsKtmI6RI7i0v/4Ptf:khTzIAvdzu+mZQrxSXs2mI6y7pg1f
TLSH
T1C732B0EAA8292CDEC77685924C760EF80DB314D6DAE70458AE1D5E74C0F8348E1F035A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 11.0MB
SHA256 e618888211b47cf47b7910d79bf8c0ead4f7ec379944620020d92824519d064f
MD5 7eaf40c6c078b845908dfd9cea848a61
SHA1 028db66fb1ead688222d4a70032b15ea3091214b
SHA512 a44a4e3a69f6e461a992ae7cda30b46aadf68a7e8fd72ec61642da5e6e3be2e9e5a7422a6e8203616a3849c1a23677e8a8d996c1d4bf7a9c14ed91d39266d652
SSDEEP 49152:cL9LyAaeUkm2ZmJTClpMqX6QC5zYY+M5CdkGnga8FviAznpfGgJC3+7JXCeQs+jr:dA8UAznpfGgTZQJ5jel
TLSH
T190C66C9560E0D691E70149F7F35F43DB31BFC08C20A5C98017B8AAB858665DBEE6F368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 e6e866d9dbfefc1209fadaa0c991a05ae1f840d446f8616f42ca312c819c966e
MD5 33a39248764dca6e6c565436059d1d22
SHA1 abc1ecd51b1d29cf23586c57dd29860993340d2d
SHA512 358489fb85de6f3577e38d22c63b1a4d654ba8840c77dbc4e0d3ff9fce35b0f82762f9e12ca1ab3c92e230d3383476d1d07f1f1f625115a919d59737a09f04d3
SSDEEP 49152:xDmgBuOjA5lUT2loNcNeaKvgmRBbFOYTg/:xmYuO856T2KOeaKvgmc/
TLSH
T1D61639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download