64a55aba8dc4bb9eb7e56c92ee546f41c9e6f65a4b98024aa22cda6e48a5f3cf

Resubmissions

19/08/2026, 00:46

260819-a4pbasbn5w3

19/08/2026, 00:39

18/08/2026, 23:58

18/08/2026, 15:40

18/08/2026, 15:33

Analysis

user interaction
yes
max time kernel
150s
max time network
174s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bodysmith tales lobotomised/data.win
Size 15.0MB
Sample260819-a4pbasbn5w
SHA256 64a55aba8dc4bb9eb7e56c92ee546f41c9e6f65a4b98024aa22cda6e48a5f3cf
MD5 9335e3a9354ba1698c949739a4762ee2
SHA1 f4d6c01455f8ac97eb6d4c73e6eaa832e73ebe91
SHA512 53d6dab78e73dad1a8797d2febe25f21dba110dffe45fffed7847b75d9f660e92eebb625c1a1b225e0778ca270d7df868c9cc9880fb63acf47b5ac6deaebc3c3
SSDEEP 393216:GedXQwYkfepf6ZSsPHgMsT4NjU7GxSDqhNP:35xfAiZnsT4NjUqSOhNP
TLSH
T1EBF64AD2F504E982CC555E394E67D9A847323D36FE55861332C0BB4F3AB3292EA31786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3528	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2320	chrome.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315742340936364"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeDebugPrivilege	3612	firefox.exe
Token: SeDebugPrivilege	3612	firefox.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5852	OpenWith.exe
3612	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4628	2632	chrome.exe	93
PID 2632 wrote to memory of 2320	2632	chrome.exe	94
PID 2632 wrote to memory of 5076	2632	chrome.exe	95
PID 2632 wrote to memory of 5076	2632	chrome.exe	95
PID 2632 wrote to memory of 3312	2632	chrome.exe	97
PID 2632 wrote to memory of 3312	2632	chrome.exe	97
PID 2632 wrote to memory of 6088	2632	chrome.exe	98
PID 2632 wrote to memory of 6088	2632	chrome.exe	98
PID 2632 wrote to memory of 3276	2632	chrome.exe	99
PID 2632 wrote to memory of 3276	2632	chrome.exe	99
PID 2632 wrote to memory of 1988	2632	chrome.exe	100
PID 2632 wrote to memory of 1988	2632	chrome.exe	100
PID 2632 wrote to memory of 2852	2632	chrome.exe	101
PID 2632 wrote to memory of 2852	2632	chrome.exe	101
PID 2632 wrote to memory of 3300	2632	chrome.exe	102
PID 2632 wrote to memory of 2244	2632	chrome.exe	103
PID 2632 wrote to memory of 420	2632	chrome.exe	104
PID 2632 wrote to memory of 2244	2632	chrome.exe	103
PID 2632 wrote to memory of 420	2632	chrome.exe	104
PID 2632 wrote to memory of 5340	2632	chrome.exe	108
PID 2632 wrote to memory of 1764	2632	chrome.exe	109
PID 2632 wrote to memory of 5340	2632	chrome.exe	108
PID 2632 wrote to memory of 1764	2632	chrome.exe	109
PID 2632 wrote to memory of 5624	2632	chrome.exe	110
PID 2632 wrote to memory of 5624	2632	chrome.exe	110
PID 2632 wrote to memory of 6112	2632	chrome.exe	111
PID 2632 wrote to memory of 244	2632	chrome.exe	112
PID 2632 wrote to memory of 6112	2632	chrome.exe	111
PID 2632 wrote to memory of 244	2632	chrome.exe	112
PID 2632 wrote to memory of 6100	2632	chrome.exe	113
PID 2632 wrote to memory of 6100	2632	chrome.exe	113
PID 2632 wrote to memory of 1504	2632	chrome.exe	114
PID 2632 wrote to memory of 1456	2632	chrome.exe	115
PID 2632 wrote to memory of 1684	2632	chrome.exe	116
PID 2632 wrote to memory of 1504	2632	chrome.exe	114
PID 2632 wrote to memory of 1456	2632	chrome.exe	115
PID 2632 wrote to memory of 1684	2632	chrome.exe	116
PID 2632 wrote to memory of 4296	2632	chrome.exe	117
PID 2632 wrote to memory of 2728	2632	chrome.exe	118
PID 2632 wrote to memory of 4296	2632	chrome.exe	117
PID 2632 wrote to memory of 2728	2632	chrome.exe	118
PID 3864 wrote to memory of 3612	3864	firefox.exe	120
PID 3864 wrote to memory of 3612	3864	firefox.exe	120
PID 3612 wrote to memory of 3172	3612	firefox.exe	121
PID 3612 wrote to memory of 3172	3612	firefox.exe	121
PID 3612 wrote to memory of 3172	3612	firefox.exe	121
PID 3612 wrote to memory of 3240	3612	firefox.exe	122
PID 3612 wrote to memory of 3240	3612	firefox.exe	122
PID 3612 wrote to memory of 3240	3612	firefox.exe	122
PID 3612 wrote to memory of 3240	3612	firefox.exe	122
PID 3612 wrote to memory of 972	3612	firefox.exe	123
PID 3612 wrote to memory of 972	3612	firefox.exe	123
PID 3612 wrote to memory of 972	3612	firefox.exe	123
PID 3612 wrote to memory of 972	3612	firefox.exe	123
PID 3612 wrote to memory of 4216	3612	firefox.exe	124
PID 3612 wrote to memory of 4216	3612	firefox.exe	124
PID 3612 wrote to memory of 4216	3612	firefox.exe	124
PID 3612 wrote to memory of 3692	3612	firefox.exe	125
PID 3612 wrote to memory of 3692	3612	firefox.exe	125
PID 3612 wrote to memory of 3692	3612	firefox.exe	125
PID 3612 wrote to memory of 3692	3612	firefox.exe	125
PID 3612 wrote to memory of 6564	3612	firefox.exe	126
PID 3612 wrote to memory of 6564	3612	firefox.exe	126
PID 3612 wrote to memory of 6564	3612	firefox.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bodysmith tales lobotomised\data.win"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd3136c728,0x7ffd3136c734,0x7ffd3136c740
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,7616058465847656256,7749034681295156273,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,12662412992389357932,17703871744423093136,262144 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,11982882474217123170,15098745559909322296,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,14641655538772260911,12846577954917193552,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,3454591467146854629,10985223097231728940,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4724,i,12151935507993335499,16089508635336693052,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,11198238953254740454,13033966818778991662,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,5246374750359119642,13320902027179686590,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5492,i,13379238881531614098,11537790891136448426,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,9736692778858579993,16762193389666700176,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5780,i,15515754737592066762,12206619870716734467,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5584,i,4217285162845963520,12651161092100588907,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,2927515476888449568,15805298874408705635,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5536,i,10177638326669041053,16921159709411645528,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,18336789945573412954,7264250993402969476,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5648,i,10323587328797628017,12791282251573171128,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6148,i,18152231487677674132,12231400859976575678,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,7556636232179463976,202158646560676134,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5556,i,1296385592906780917,18307314876138254135,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5696,i,2259652872338901018,955229581316605190,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6244,i,4595592717740522055,2603994476845255493,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:9
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,13254118377259562430,11528207217017331782,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,13355407432654663557,11871655390769373321,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,11897337558757642097,6312427093104075936,524288 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=896,i,8100297296490813994,2414536728195887850,2097152 --field-trial-handle=1992,i,13584673034162332015,8068541190341331489,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:6308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1644

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {c4844a17-3926-4d99-992c-4a15b0bd8187} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {4ae2dbba-227f-4e16-8dc2-5107a1369559} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3944 -prefsLen 27274 -prefMapHandle 3948 -prefMapSize 270279 -jsInitHandle 3952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3960 -initialChannelId {674afd1c-ea81-4dd8-806e-c7f0f1066aec} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4116 -prefsLen 27274 -prefMapHandle 4120 -prefMapSize 270279 -ipcHandle 4128 -initialChannelId {4e681824-c8c4-4a15-a415-5a5dd48f5280} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1388 -prefsLen 34773 -prefMapHandle 2940 -prefMapSize 270279 -jsInitHandle 2944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {8620ef4a-e49e-4d00-b01a-036aeff5f042} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4988 -prefsLen 35010 -prefMapHandle 4984 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {d5d30f4c-ae0a-454a-a752-66e3c14c7c5a} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 32900 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {5e9c52bd-be0c-4fe3-8f76-02b51d0e7d94} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32952 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {c8964dfb-3336-4141-af91-2e20bcc86ab1} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5700 -prefsLen 32952 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5716 -initialChannelId {f64cdb60-1705-4d01-9608-4b3bc840c0e1} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 edfc525e62885a04b498ce59a9063ba54d62c24b9959d7e914a0f5190e76809b
MD5 9660752b7468f3eb0af995e7f1c062d2
SHA1 f195b0c992b3a2c218956e235e342689bcdb989a
SHA512 a5907fcb9a48c72777b7286d0d8d0dda1b2172019dcecf065aabfdc869aa0eecb1574c4782bf8b675f3715c8db15f2ce7954275b4fd450bcb9d0a45659c394b7
SSDEEP 192:JRJQaiav7pAPRp2o9XxHsb+WNnMT0F2za0ekhVyIsnAUge:JRJQL2AXjfwY04aMe
TLSH
T1D432952ABE14693BADCBD22DF9667753D7F6102121D42E84E7FC8A2C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b522613af9701ff9c13a89cbf1ad05f2518f1d74b538c93b1c96e676050b599c
MD5 ae21396ff514811679153a9973ebadd9
SHA1 441ca3c9d3e5f5c8458ce09407bb3ebd0844aa1e
SHA512 6276296885982f2707366a337fd7c187b5cba0a9bb14eec4523bc7ea55cd659bc7513abc210b3c283d31539818c59dda28b05e0c7db1b736ff2cbf06330632e3
SSDEEP 192:JRcQaanv7pgPRpft0E9XxHsb+WNnovrvk2pj2za0eknVyIsnAUgE:JRcQ1vUXvfws42pWa4E
TLSH
T1A242B62AB910693BADC7D329F956B793D7F5503121D42E84EBFC8A2C15E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 7b283de67b609a0b5e972a2438266e8904345bbeb749c96b3f6ef63951fa839c
MD5 72f256b01abc8d993a31c4fb44ea3058
SHA1 e6b8d24cd87af38d183f19c71e3ee767faf5ca29
SHA512 77f941ec07ea9b8d027e9087ed9d47516d3b663d82a765aaff86b9bdc2a071bc9ed35a8269a162c5d09c4bcfc2db6fc96d458a4da9a236316f2e883f3e829fb3
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU328HGSEM8Y/s:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4z
TLSH
T1C452F927684D9A3F0FC8D64DDC166F8FADF6015666B80D2497FA5D0803A97CF110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 fe12dd53bf85ddf14dff64d93bfb5df460c375645509b0b219e7eaffa448f5b5
MD5 4cb0a42d9f10290b7573bbbeb4e6084c
SHA1 d14e8274457bf9e580b9a58ba3e0dd9aa6cc3bc0
SHA512 b099fb434eec53a528511b63ac57fcff0d6cfd805b5e601ca40e482c07cdf2b90aad1309d387208716be321b5bb840c0f1b84989b496362bbf87a75619e9308b
TLSH
T153A0023447D01E13CD01467060614B457B92595D5572838368E2587699AB5E04601500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b7e83.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b7e83.TMP
Size 48B
SHA256 1e12695537e55cd47b8e2b47fbbe9a877743020bc9fde8e24733007974aca5ee
MD5 38fb99a54a1a27e3b4c98b4e1a6c0dc2
SHA1 b9a501121e7c71c3e41682c29e950933396f4ba7
SHA512 db8c44f0ccb08aea1abd796d0686fc9654c2c2b6eb1102b76c5e984f30e41f19273fb264668098c968da9644d961a4df3cecf3052fc34806ce02e885b7a02906
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 28daa6dab47aea1f80e29ad02fdd3be676543961c0cd42677f3ffc002b5ff784
MD5 143dc4801411b59e71864e7467810081
SHA1 668f1357035450d6a49069e7f920cca3fed97017
SHA512 73c01514091d94f0b3b1a75420833183c4d4427e129f922ea7ab85cbf7aee11d333b846669a5d6dc2c2adf7f2add2519997ffcf49bff12c8015bcb6151c0e8b1
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5AmD6B6nGyvn0b4T8AEybJv4a:xC0ITo+TQ0InDUDPqPPb4T8AEybl
TLSH
T18CA1F835A0284D774476D54AB1626A43CFB9B067E9B3AF90EADD0E0D15F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 511b9613f58a204f806a59def40fc7f1233e67e5f229f4bcd6d13a9bf185309a
MD5 a3845a707eadf19c627d2dbc36d9ae44
SHA1 e4033223e7bea2f2f64c1052f8887165eeac40b5
SHA512 8316843e32c89ebe7f47b1d455487edfa960514232588803d8f8e52986f175b2947c57e81f1b12a6659e767ba3a18c8318e60f39677a276f76ede2b9e897b930
SSDEEP 3072:zBEBhxH+fkWcz4x8spKVpcYfBQ9A9xhP3u8KaHyZumd4dX5S:zByfH+cWcyEtSQxZu8KR5CdX5S
TLSH
T182D31272E8407AB7456E5DEAB00526438C8DF0D55F10AADCC78C1FA72B2ABC45207E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 96e1bd746e39be2340dadac8e18c4c5b02fa11674845d046e6c450f4aa7381d7
MD5 f19c7b076cab02bbcf6c6c9e12bc7c68
SHA1 b835c715047e034931d4c61ab3d08188b74b88f4
SHA512 30e0f231e316143b5ae1cd0bd980a3102bd0e2c8ce62f1de0f166c28a947504cf7dc7cc6bc6a252c98b091310360fe7f6602804059c863b6291a860d515979ad
SSDEEP 3072:IsBEBhxH+fkWcz4x8spKVpcYfBQ9A9xhP3u8KaHyZumd4dX5S:IsByfH+cWcyEtSQxZu8KR5CdX5S
TLSH
T1F0D312A2F4007A7B416E5DFAB1152147C85EE1945B119AD8C7CC0EB72B7AFC05207E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 6d2d6e52b87e33a89ed2313320b4d51408571f9859c563a429cabc69e89eae45
MD5 5e69961fadea1cc642873f661fa80995
SHA1 b0dbe8b41438326fb5d6cbc2a31e64c34569016c
SHA512 e0ccb6d5bc290aef8c6394215e6aa6ec5f3392d82148796d61642e1c9a15b34ea90074d3bd19217c23517d476921e63bc633e89f9cdf09a71da894ace89bc73d
SSDEEP 3072:9sBEBhxH+fkWcz4x8spKVpcYfBQ9A9xhP3u8KaHyZumd4dX5S:9sByfH+cWcyEtSQxZu8KR5CdX5S
TLSH
T1E8D312A2F4007A7B416E9DFAB1152147C85EE1945B119AD8C7CC0EB72B7AFC05207E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 3868885942ff9eca584875a3450615da6612a7ba37ac60cc1dffcb4e67f0e157
MD5 1b36532627526b08f6090b55f2f3a0d0
SHA1 5bf08e594831312f856bf0bb2b6fd3ce72c32b68
SHA512 23a548bbabba3be94a4e4335cb9dfb29ebf30a1b6a881e16cda9c0c9a09a817c854dc076bdf78c540ac382b0ae582c952b84b32d848e71bbee6181d824a287b1
SSDEEP 384:HXkRyiO024YODL84KKDL849B7SOEAd9KVRaAcP+AWRMAl:3mZYODL8lKDL8CB7S/AmVAf+hRMs
TLSH
T18E727E3D5F003CAC15A7C0F8C5E982AA4D18B7A7DFEAC06D21583D0DC698969B5F948F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2632_447670788\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 068f1e67d86a81cdb5ea1ddcdf79395559770869a2e6d283b311a2044503751f
MD5 0fb74898341946d65d4a55b78cc7e2e0
SHA1 12788bfcc59708fa09d42b58b66e765dd7bfa058
SHA512 2f87c56e3bfa6b5490594b1fae9a6920f9fc5143bb142759fc896763160107c9e021b4d5d0d20b6de26f4c2b6088b75cb1c8fc2a8769b1fef47c9cce0fd32db7
SSDEEP 192:3He1d66JoztdzgCl6mc0dLOv5zbo7RZJnyjLRw:od66Joz/zgC1jWboVZJnyj+
TLSH
T1CBE111A4E639863FC404027BDCA61B414F39394B984E3F1935AD651C2D5B2DE768E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5fa381f49839f161b04838e1c1c539391954b86acaea90ff8dfc72c47fe7c93e
MD5 5ed1552a117e5cb2e30238f6ce655686
SHA1 c3a86095ef44853f89103c35fc14a9dc9d7f3e79
SHA512 189a10291fed6c28cad85b15767fc780555dd95b541f62b6d7d19ef6bda203348e2bb9464220378baa33bfbcebae3c8132f98d70622a03f81b81857ea25d9cb3
SSDEEP 192:3He1d66JoztdzgCl6mc0d/Ov5zbo8ZJnyjbR:od66Joz/zgC1jubo8ZJnyj
TLSH
T132D1FF64E639863FC408427BCCA61F414F39398B984E3F1531AC651D2D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 1ac22e2cd894904f3283684ce955f3631e8150ee8071f39ec5c20557909c8873
MD5 935f7160a0db65ddf2020be4b4c51c80
SHA1 8ef477b713b505702fba1d4b038fc2bf41a73dbb
SHA512 7ca4c3579945904ca83a5f7a50c64ff3b1ce0e57c8066e1abc2d71ecfdbdbf465746a3ea9a112cd144aad30e82fac2e97d610b3c90c94113499c376ee78af510
SSDEEP 768:5MEvslhnhrGcm+umKiuNG3KJS5M1mxb+bjbNbEb7b+bGbNbxUJfFi1/:/vslhDHtUJfFE
TLSH
T10FF2F044EB1E913FD46812BBDCA50B002F79F88959192F673A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ab859f9eada9a647de5699ff2113bc213646202ef392256813a0858c838e8e63
MD5 d1c69fe3d6062eb577e220cda583b49d
SHA1 989f4e58a250d1df164b03f1451e29e73c99a251
SHA512 133b0a1032afc2dd4cb768771d3976ba7fee09ba32797aa3cab7131953e283fc5d2c91de1c46353df26785e6abe9b1701ce3fe7a34669ff71a08731f22cb9428
TLSH
T1CE212C9C79F98D6A99C7E25CB481028E93754F4B45472C430E03FF8DCED5AD9316A439
MD5 SHA1 SHA512 TLSH

Submit Download

4cede2d8-65d6-4c00-bf26-5b6e6b7a4a10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\4cede2d8-65d6-4c00-bf26-5b6e6b7a4a10
Size 2KB
SHA256 b4ff718261f5b67317d6137640fc3e30133569b6306c01e3878cd576be6b14c1
MD5 c704c8637b2af7958b97148ce13709f1
SHA1 c5a84809a0cacdbabc539482c04f68544fca37d9
SHA512 6b23080390750c603bba1984b746ef72574d22d5a69b1f2f47ede14c04b573505d4a8e3b2dc4bb38a93bb13e1634e639dee0f6d47c14f2fdd8ab39dfef9d5e6b
TLSH
T15D41315875788C3BDC9AF24D948233DE97709A0300C61C936D95DF0CCEA279E736A42B
MD5 SHA1 SHA512 TLSH

Submit Download

5677441f-964f-43e3-980c-c4e9c9ec4b44

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\5677441f-964f-43e3-980c-c4e9c9ec4b44
Size 235B
SHA256 f142cc362bc82d19b09501367005cb31f6c59fd37849b86190557838809c7c3f
MD5 22cac4b18a1e909d9574ae70e3b00be0
SHA1 008607904853ab904f0374d9cd89f2eecb879e4f
SHA512 f1ae50bc468c331b67be10f00cb80dce3a35151d55f758ab57efb218ffbcbc686991b8e02377f248d5b03c2ce5025cdf405aeb1cd38029ddeb23ea2b9441289c
TLSH
T1D5D097802498232C0C140F13B0E02ECA32468C3310B5A820C591A0348DFDEC8419386A
MD5 SHA1 SHA512 TLSH

Submit Download

720a8073-9444-43df-8612-603f8ee5abb5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\720a8073-9444-43df-8612-603f8ee5abb5
Size 886B
SHA256 2d0ee674c16d9fb81dc3ebd2cac216e7b027efe7fcf41076ebc39889c4851409
MD5 159c16f941ed473963deeb7a994c7072
SHA1 929e2f05f03e08289ccf37dc1db4681f7bcbb45e
SHA512 86c9641d7beaaaac009dfb893186e1d40566dd067a8736f38823087cc1b0eaf7637a49f638f4a66c3128bdd009260bc03c4c02f3b905b3ccf64a886f4aa78c2c
TLSH
T13E110040CA71B9B2CC28C38F98A577529FF4B41380C609147DA88B284DBE25FA767107
MD5 SHA1 SHA512 TLSH

Submit Download

73acf824-d92c-4584-bc3a-c6ec7083cc11

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\73acf824-d92c-4584-bc3a-c6ec7083cc11
Size 16KB
SHA256 0d03bb2085028e89db1363ce7e1a5b8de9252f5b70d3368b761517c7d1707589
MD5 ba65cccbd1db9e4c9ad858e3ef706010
SHA1 5e489a93afba32c4ca49ef2adcfcf6dc8b6482da
SHA512 e9ec1911e8cc91e684ca2bdb7b3292812da9374ee02c56f60fdd7a3e0bd38aca82a4d47ff0807bbb4c971d957abca3abbfae3d1a649986cec7d241824dd4014e
SSDEEP 192:g/FbOMFJ3NTreDjRRm2mO1yqOquBOeDfRBnLCKhpJLBa2ZwIkh5uRKzStVfl:GSMjVeDtROqWJD5zw23kh0RKmtVt
TLSH
T1B372FC56586056BE8551E3A8D8FC7FC3E2F528CF4C419FCA8BE47D0859DE09E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b563b6a-2fe0-4374-af18-1be4eba007f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\9b563b6a-2fe0-4374-af18-1be4eba007f9
Size 883B
SHA256 6b39ca34ac0d431d6f4a0f5b0c37a7d4ca94fa3ad5b64ec0bfc341eaf599cdca
MD5 1c7b26d0c88436f0cd54b507950630e3
SHA1 9ba575cb3cf5324b708578812cabdec4d66530f5
SHA512 dc5db8841c8c3e619bacdec58993b404fa067edbef422db191fbf5b7ac10410baa6aecdb4b6532df56924a4e9f776932542a819500f3ec0085206016b092c780
TLSH
T16E112380D6317A72CC38934FC9A937168FF4BA1380C645047DB58A084E7D64F97A7207
MD5 SHA1 SHA512 TLSH

Submit Download

eea863ce-ac7b-4513-94fe-6b177e90a929

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\eea863ce-ac7b-4513-94fe-6b177e90a929
Size 235B
SHA256 2ba0a550249d0547e3a45471a0864d9b80cface996b6ee34c97095f24c80e79b
MD5 9fd8f366c9b731f9bf781fbbc5d8360c
SHA1 9403ec5559f1c39acd29d0b74a008ab557a27cb6
SHA512 f39f2d253531c2750ba9854915a487ffb1368b49d2f31afa5e638f14571972fc02b4e1081488e706e92abf8bfadbbcbc14cccd1561bb26d6a7f08f5357eb6001
TLSH
T1E9D097801888B79C8C184F06B0B169CA319A4C3310A09890D9A24A7889FCDC40191D16
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 1c381901ac2126bc48e7a79185400ff1a17707e8735b827af25bfb27e3f82010
MD5 eba8b7116b024d897bae35d0c368a6be
SHA1 c2d3ef7db805843010cbe15f01fb47c06a9d4d33
SHA512 7a1b85477e22e2a437be770c5211cc24b91d3b8d2e39f98dd7ed71e290eba2500f632ac13bc0126c3f3608e1b4215f88e1274510bb015895fce8c8fd57120420
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4HkR4hs:NI4fRfsXH446+4V4Y4N4Q444G
TLSH
T12772521545048EB8298EA78BAA367E01C37D533B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 8KB
SHA256 5e7af607e65171cd31cb6422fa7d05038c36394ed25452ff42472d21fd841a67
MD5 d865b0b569d2dad3274f480065b84d32
SHA1 2a048a567161ddf5740ce7e9b61f55833d3b2cfb
SHA512 9564c8a32ebc91c7a8a68c252a380406ce9073b925bb05ad5934a20a0f97036ce1ac65c23d46f4b83249d1e3974c84b785b72a2480df217e684cb5be8d494a11
SSDEEP 96:xHp9TUWqGqPfvuGGZObzS/SSlvdv9j/n+cWRr6/CanBw8814r+8L4cnAV7wb:vwRPfvuGGZxSSuRC7nBw88eraU
TLSH
T1D202FF3C9004CF6F64B6767CAC244D316A72063BB7BF68D610BA9485019CF7445F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 5bd0f8b822faaa0b3a71c47a63928ced56b2d6c35c076aa3b093c5420e20dd55
MD5 627d9f52314af415e07f4564ff4f5e07
SHA1 2c16ec91458800bf86e352fb667e8436fdf2be0f
SHA512 577d611c41d1b8bb73cc5faf0dbe201a44654619eabeaea0fc56a37dc4243e9757af5477ebc14fd4f481255db3430b93e5896653f097d4133743bc08e4e892c2
SSDEEP 96:xHpUTUWqGqPf2BMi1zSp7SSlvdv9jUjn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BMiI7SSCj7/Bw88qU
TLSH
T1FCE1217894488F7F64B5777CAC688831AAB2413B7BBF68C750B95484015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 644bf33d85c09598b0f76570da775f9c01c02ac078abc3e140d567cfffd56947
MD5 1de8ee37723feeda6f7e97633370f765
SHA1 c6825dcd1a1d444044be8e9ab38c42dcd3631faf
SHA512 6cdfb6290899041967e6f3251d772786f9c360d72aab22ae8266beb6ce728ad3956691ce4787623d8e36016b5d4b813134a8dc27550e19ccf5c968b1eeded04a
SSDEEP 96:xHpUTUWqGqPf2BGZ1zS/SSlvdv9jUjn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BGZuSSCj7/Bw88qU
TLSH
T11DE1217891088F6F64B677BCAC688831AAB2413B77BF68C750BA5484015CF3445F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 0920122d6bf0fbb7137020548916682e3b36a56bb9589f6198818e5057f6b0b6
MD5 93fc1743b13ddf32b63d798f42bce820
SHA1 fcc8edf509f18a1789cb61680fc222060d5aa2bc
SHA512 bd9be1ae08c8eb932269be5c130efbcbc182d15991af666240b5a379620fcfc1b1f135827460d912e2471de3377e7d0f8c82465e56982c8152309c9c6d6595a0
TLSH
T17521DA46FE6F2DE62666C44BD0C61FA4DAE56091833CB4F0DCE9675163C460935DD30D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.1MB
SHA256 5024dab4a7c5f2b2f4468e6873d73d69e63e919eb10cde2633c18377cff36c65
MD5 d9a44bcae860b7f564d3c6f6da05f430
SHA1 e78472fcb3cef5eec8183b2d6d1753059aa0209b
SHA512 04a653b3475829af2a6751366112b3b7b9bfc0039c5f413677521c2d288ccc4c32913606f40e1cf27c0f45b37e2b1abe7411631ad97bbcce758fb2430f5ae870
SSDEEP 49152:A7VViMT/yDYHqwb4nzjZVO1oZtQdo0dfvq:+T14nzjZVQoZ6o0d
TLSH
T19A5629E860D09247F3864073B24993EB21EFD00D5037DA0857A55BE9A5748EF8E27BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download