881fc31ab407d9615a84cd967ba7d61958958996f804605a11c1c501303b7a8d

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
App Launcher.exe
Size 2.5MB
Sample260825-raqqpsap9w
SHA256 881fc31ab407d9615a84cd967ba7d61958958996f804605a11c1c501303b7a8d
MD5 b0aff322a43c49c3c23ece17cc66eb06
SHA1 1a2c1733fe05eaec36d3508432b21ce22042459a
SHA512 4df1cbb9231830a2c73f1bf7eacc9d9436d867aa41e97c6e36774fc6989c045dee19246fb1025f8819c2402d66f224763156052f3f3cd232abc19d997c06559d
SSDEEP 49152:adEMhOqvCgJp8ehSJ6kGLvHDZkBfUfz1Zbflqj+jzbPU1aHm5R9Tj0a3gu2U:5MOimSZ1Zbflqj+jzb5Hm50pU
TLSH
T15EC5AF5B967801FCD077D1B8CA62D607E7B2B05903306ADB03D08ABA2F576E15E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3012	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321399991467598"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe
2852	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2852	firefox.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 228	1116	chrome.exe	91
PID 1116 wrote to memory of 2784	1116	chrome.exe	92
PID 1116 wrote to memory of 2784	1116	chrome.exe	92
PID 1116 wrote to memory of 3012	1116	chrome.exe	93
PID 1116 wrote to memory of 2728	1116	chrome.exe	94
PID 1116 wrote to memory of 2728	1116	chrome.exe	94
PID 1116 wrote to memory of 4520	1116	chrome.exe	95
PID 1116 wrote to memory of 1160	1116	chrome.exe	96
PID 1116 wrote to memory of 4520	1116	chrome.exe	95
PID 1116 wrote to memory of 1160	1116	chrome.exe	96
PID 1116 wrote to memory of 1488	1116	chrome.exe	98
PID 1116 wrote to memory of 1488	1116	chrome.exe	98
PID 1116 wrote to memory of 4128	1116	chrome.exe	99
PID 1116 wrote to memory of 4128	1116	chrome.exe	99
PID 1116 wrote to memory of 1764	1116	chrome.exe	101
PID 1116 wrote to memory of 4892	1116	chrome.exe	105
PID 1116 wrote to memory of 4892	1116	chrome.exe	105
PID 1116 wrote to memory of 4052	1116	chrome.exe	113
PID 1116 wrote to memory of 5036	1116	chrome.exe	114
PID 1116 wrote to memory of 2076	1116	chrome.exe	115
PID 1116 wrote to memory of 4600	1116	chrome.exe	116
PID 1116 wrote to memory of 4600	1116	chrome.exe	116
PID 1116 wrote to memory of 3256	1116	chrome.exe	117
PID 1116 wrote to memory of 3256	1116	chrome.exe	117
PID 1116 wrote to memory of 3252	1116	chrome.exe	118
PID 1116 wrote to memory of 3252	1116	chrome.exe	118
PID 1964 wrote to memory of 2852	1964	firefox.exe	121
PID 1964 wrote to memory of 2852	1964	firefox.exe	121
PID 2852 wrote to memory of 2108	2852	firefox.exe	122
PID 2852 wrote to memory of 2108	2852	firefox.exe	122
PID 2852 wrote to memory of 2108	2852	firefox.exe	122
PID 2852 wrote to memory of 4520	2852	firefox.exe	123
PID 2852 wrote to memory of 4520	2852	firefox.exe	123
PID 2852 wrote to memory of 4520	2852	firefox.exe	123
PID 2852 wrote to memory of 4520	2852	firefox.exe	123
PID 2852 wrote to memory of 3508	2852	firefox.exe	124
PID 2852 wrote to memory of 3508	2852	firefox.exe	124
PID 2852 wrote to memory of 3508	2852	firefox.exe	124
PID 2852 wrote to memory of 3508	2852	firefox.exe	124
PID 2852 wrote to memory of 3008	2852	firefox.exe	125
PID 2852 wrote to memory of 3008	2852	firefox.exe	125
PID 2852 wrote to memory of 3008	2852	firefox.exe	125
PID 2852 wrote to memory of 1240	2852	firefox.exe	126
PID 2852 wrote to memory of 1240	2852	firefox.exe	126
PID 2852 wrote to memory of 1240	2852	firefox.exe	126
PID 2852 wrote to memory of 1240	2852	firefox.exe	126
PID 2852 wrote to memory of 2588	2852	firefox.exe	127
PID 2852 wrote to memory of 2588	2852	firefox.exe	127
PID 2852 wrote to memory of 2588	2852	firefox.exe	127
PID 2852 wrote to memory of 2588	2852	firefox.exe	127
PID 2852 wrote to memory of 5960	2852	firefox.exe	128
PID 2852 wrote to memory of 5960	2852	firefox.exe	128
PID 2852 wrote to memory of 5960	2852	firefox.exe	128
PID 2852 wrote to memory of 5960	2852	firefox.exe	128
PID 2852 wrote to memory of 6008	2852	firefox.exe	129
PID 2852 wrote to memory of 6008	2852	firefox.exe	129
PID 2852 wrote to memory of 6008	2852	firefox.exe	129
PID 2852 wrote to memory of 6008	2852	firefox.exe	129
PID 2852 wrote to memory of 6028	2852	firefox.exe	130
PID 2852 wrote to memory of 6028	2852	firefox.exe	130
PID 2852 wrote to memory of 6028	2852	firefox.exe	130
PID 2852 wrote to memory of 6028	2852	firefox.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\App Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\App Launcher.exe"
1⤵
PID:3556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe6b1fc728,0x7ffe6b1fc734,0x7ffe6b1fc740
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,3266397996647129421,15891391884846937806,262144 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,15461360086763443645,15452349663207371900,524288 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,1039161082289629134,17545171828358580516,524288 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,14109445719817462766,6207970527595151549,2097152 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2868,i,14341689476300542093,9033038870916350498,2097152 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3976,i,57136332161967958,17036346551526521778,2097152 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4040 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4568,i,14729844890136719966,10468976790239363113,2097152 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,4236771638605403336,10016531388069048349,524288 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,13831494809642456801,11420130543769683034,2097152 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,5186493396138648539,15746135435210105022,524288 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,4853976506302614298,11070521059619318265,524288 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,11142322058657438691,5285487042819206149,524288 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4608,i,15810782936772314947,2065917192229422759,2097152 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5876,i,1621997479692258594,6461474055191986003,2097152 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3304,i,13507537868749563706,7591621470871996926,2097152 --field-trial-handle=1960,i,6018343673985102550,4005821925537298332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {35461633-446b-4c1a-aed5-9fd45de1e1f2} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27135 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {b4a08120-9f27-4040-af42-0c61b2a6263e} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3900 -prefsLen 27276 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3916 -initialChannelId {762fe7fe-f528-43dc-94ec-14916be14411} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27276 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {5824a831-c360-45c1-bb75-4ece0231f9a9} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4392 -prefsLen 34775 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 4400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4408 -initialChannelId {43c34dcc-79f9-44a2-baac-21ae3e36be7d} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4868 -prefsLen 34931 -prefMapHandle 4872 -prefMapSize 270279 -ipcHandle 4880 -initialChannelId {e37a1950-1bb1-456b-9f3d-dcc2033207a7} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32952 -prefMapHandle 5184 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4632 -initialChannelId {372c106e-2a33-44f7-ba93-e6899fa8e721} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5384 -prefsLen 32952 -prefMapHandle 5388 -prefMapSize 270279 -jsInitHandle 5392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5152 -initialChannelId {1ebc0c23-3f70-4fb6-a7be-d722892fc582} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4568 -prefsLen 32952 -prefMapHandle 2932 -prefMapSize 270279 -jsInitHandle 3048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3292 -initialChannelId {fa6c1291-0e95-4c6e-9a28-51331c644f3e} -parentPid 2852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bd8ce0a67d4f483ddf565abe74ba3bc35252ae67d6857def7ea71caddbd7501c
MD5 78126d6aee213d33f19bc047394d7603
SHA1 c2bb4b38aecae57888706cb37f0fda8849e24fd2
SHA512 9f23f19825db844da63a88b06e5344c83d41df95510e6ee046c379fd0851f14a328ab0b243e00745eaa38f6c89490618dc31733b1d4e9d758df7e8ed3919c7f6
TLSH
T1AFE0AB96CD20ADBB2CFD071850914706EF5103572E80591F3A3CD20C4FB062A4486C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f538014a01017f8ee8bcd31c4328586299a8006c3e68e555693d9ce9b0005412
MD5 bdfc4b90a6fab09c3d5d24503386768e
SHA1 0d69e78365022d26bab1c3191322dd58dfbe1544
SHA512 8e4abfc2096dd473d244210dce8a92d726f0df9263980f6dda41a8c3930cdbbc42bd487a5521046172c84ff9bdc83dff0c4777e64cb5e55484b94aeda2eb21a0
SSDEEP 3:MsEllllkEthXllkl2zEklu:/M/xT02zn
TLSH
T136440405FFC00C45C50030304015C35003F0D4100511F74734D514375DC75400C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6bc6ed000ea7ec704cb2b2cb39922bcd0c4fa176900cd1edc5b09394f03b0230
MD5 a7ed8aefb20586535b32c982c48ebfd0
SHA1 0767c0e3c6cd1511c73d5185d975bce2689ce963
SHA512 673fc9eb4022aeb5753753803346040e82e0ba33cc6414887244f9d23f451aeb203e5e724a2ce15ad2525932e5803b21e85018cde6bc55a5a0e6f1b30f90efcb
TLSH
T1D3519CF7D3E4D97D851156F49B206E1FDE2D0A25122D3C6288E4AF5B53F2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 76cfdbcb54fba924e1142ae9fe98177ab5b32d1ce1f69dc03ea5429afa02de06
MD5 cdea2a1f6ecf4e3a93518319e6641de5
SHA1 5f66fd0295a769076fda81b7723f9b5d27ebddef
SHA512 d7fa5c54e251a9b101744d0c3cc027622d76af83b62c7fc29ea5bfff59bfd6afdd7e4c638a0ad0844df99f282b5cde354f560a5461bd8b7d8b8a53698848900e
TLSH
T188F050E7922F745751BD45BF2D04BC0A25B6743112855CF0CE5B516CE0815E31B01443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 170724df91b8c1b3252c0276712be5454d8b5142a0bf262e922e3e6cd84d804c
MD5 f5f90f6ffd6d1216c0b581057938d408
SHA1 e04c7db7bbd2e1c1add1b5049e06782515cd7296
SHA512 382c4f3f09bead59ca2f9a567125214f8ebc9ca686da9b76720d1574c0ac49b60e5991ad234e4f749c51fc2efd0492cfcb3473b11a8ed13384eb53e3ed0c88f1
SSDEEP 192:ARYyL+zK9vBUv7hhAPRp2W95Hsb+WNn+t0t0DaZqzgVyIsnAUgtaJ:ARYsmWQ98Xtrwg0OaUk8
TLSH
T16E42E82EB910793B9CDBC21AFE227763D7F6147225A42E84E6FC891C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a55f163985dee150be9eb916265e869493eb24157a457e6451bb7c25bc3309be
MD5 76c8e0769c56225686f17c6763875344
SHA1 cb5ca8f7d12cc09051dc8e933b78fc5e715993de
SHA512 a2aac4e4e8ef78b04f691bad63cf3fa9853781a4d314a3acffcc89e8e91ddfe60498ff6789e0e128b9fcdaa8f7887c340af9d638bb30aea62d84866381f51fa3
SSDEEP 192:tRNyL+zK9vB/v7hhAPRp2W95Hsb+WNnRJ8hg0DaZqhgVyIsnAUgraJ:tRNsmWX98XtrwshHamke
TLSH
T18C42E92EB910793B9CDBC21AFA227763D7F6147225A42E84E7FC892C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 50af3644b946e1e9135c093551e3aad28758920168757bacefc592fe87d5d045
MD5 9a3dc12cc95cf18d11f25203b4d1809e
SHA1 ce961fa11768e9c96470c3c726302c95c846fa36
SHA512 0436dab67634610a6c7c25a5390dec37be5ec014bffe4a84e462963693cc134e6b99706644f99f7e97a0d32c5870ef1facfe568c5b580adb486dd5c683d37963
SSDEEP 192:ARNyL+zK9vBJv7hhAPRp2W95Hsb+WNnvzLst/O0DaZqzgVyIsnAUgtaJ:ARNsmWJ98XtrwMtxaUk8
TLSH
T1F642F82EB910793B9CDBC21AFE227713D7F6147225A42E84EAFC891C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 62ae4a72b4155ec81ef85e4f41292bf4a386e6eabb6f66d31453d52471216fad
MD5 48cfb1ed2ca479cc4140e51739b5ffba
SHA1 299fa63b2ce13e6f9497fb1c65034d5c64e1b2b8
SHA512 060c0c259dae90cf6180e24372a3a5b1ca3ad7508598ebbf2730f9dcc94edda74938aee543819db285b89d8e1744e13d872a4a23ff441e8b2ec60cc46592c719
SSDEEP 192:tRNyL+zK9vc/v7hIAPRp2y+95Hsb+WNnRJ8hj0DaZqhDPyIsnAUgraJ:tRNsmLX9JX4rwshoam3e
TLSH
T1D252E82DB910797B9CDBC219FA227763D7F6143225942E84E7FC892C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 af41177b865e25eba2d3f0ae1b131b3b0f1bd153ed5f4fadc21371ebe03a03c7
MD5 150f527d9ccee5519407ceac0416bf16
SHA1 9cff55d9b1d0d2f09f2d73dd20d3adb1e86fb55f
SHA512 506937bd09ad33c7d2fa682a5244273c2453888efe4700259de595b7c77893efcb9124f82eb17c1f44629a32c90b8eb12c272e777f1922ed92b2482590a4c276
TLSH
T1B7B01211800292C1C49602F4115214887114DF50D60A370693E07D33D836163C114060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591ac2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591ac2.TMP
Size 96B
SHA256 0b4a8fc24269fd7620fa2bafe735ac9c21f04af52be94e9eaa2bdd27022efc19
MD5 a94c347c435e27e0db9d171e12bce38c
SHA1 d26e7383db78a9d9e818c6bba93489dcfab9e500
SHA512 964926932cd1c65ab27fa83e8a74890b77e39486bc3e80c6766c6ecafcf05c8d11f0de043082acdf723a95618900034723567fb4ad27cfdfac76f826b0b8e2ee
TLSH
T130B02280EB022A83C00A03B82C80B2E83020EF3BC203232283E20A2ACC22A3080200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 d64fc089a3ced8de876b7bc670b87107312140f4d6e98b259a40551655437fee
MD5 5fb7934b7c17aafa02712a2c1b65c95c
SHA1 6cf2e3cd94a206b7b59f34743b74a51597a4d4c8
SHA512 176fe53a39b9dc6d5d05629955049f11ef994fa11201df774e43796e62522d8268898776b3cb5ed388f57711c145eef6a247ca172e23c8a898cd1efe4c89c39e
SSDEEP 6144:11MqKAM7YMrAukqqwEKTYeVYqZ/ZLW3Ext:bVKAMFrAubqsTYeVYqZ/piQt
TLSH
T161341227FB952F336ED3CB20BB130EDB877E64D88024C2416B9B29A796536990147D7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c010a5402fe9d446ff69c346d2b35e634164379d39f6e776df0785bfecb2e19f
MD5 dc8fe745b9f4c46a520b286330f7099e
SHA1 7a59e0468661ad135f51dd25f9b4c3240d904e0f
SHA512 50839b1710b381c7e79ba0f3883cec2ab80c2df67285888a9f115f990a8b154e915fd3057a47c10f06d4de4c78adda64ef0970ddc1206bf5549c80ee8837f137
SSDEEP 1536:6RyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:iqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1EDC30237EBC21F339D82CB64BA534FD6A7B644A99030D301AABD3BFB6C5345164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 aebf2acef7b9222a16582c65811a5afa40ea6431b1689ee9aeb62292e3babce8
MD5 194290e3da8544ba6885f0ca672ee19f
SHA1 83147206d9dfe0b3e3142892db2c3cf4b40ad0b5
SHA512 4abe990b4439800e727e59ac190aaa7ec95c31b4030fb797eeb9b10dd0a14c9fd8330519f6e9b22091eeb0080d3688acdbd694159d361b879d25905d63f3ecb2
SSDEEP 6144:n1MqKAM7YMrAukqqwEKTYeVYqZ/ZLW3Ext:1VKAMFrAubqsTYeVYqZ/piQt
TLSH
T1E6341227FB952F336ED3CB20BB130EDB877E64D88024C2416B9B29A796536990147D7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 35e76faf36fabbbe5e1506b8921f0564ec5e3c350087f525e8a0834db764e7c5
MD5 cdda7baf774daedf951c911dda38a3e0
SHA1 71a45543b6615f6f65f74e81237ddd944bd834f3
SHA512 cdfa1e749580707d54c7ea15970275b5e0eb80836feb744f2dfbcc170246c213fb0ac1b2259e758ca5476b76c952f09424ae78460db32d9f686aa9be83407fe3
SSDEEP 6144:O1MqKAM7YMrAukqqwEKTYeVYqZ/ZLW3Ext:+VKAMFrAubqsTYeVYqZ/piQt
TLSH
T1D7341227FB952F336ED3CB20BB170EDB877E64D88024C2416B9B28A796536990147D7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 808f4a7d3a5352a7312b54b2e47d6975c618258b5b28f2dab9a3a300774012b7
MD5 084a8c7543d25c0195f50a398df4a9fd
SHA1 195f6bc3c28d793919c13241b7e493cf2d349253
SHA512 9ef416e0182e3eb7ec444b99a335d00cb370b9261226ac5c8318559d36e1ebc292e7e553c9903e9ca15a9b66cb8641ecf88a37e6645653dac98d81f03f21e92e
SSDEEP 768:ZYwWsqVqKtGcmhuBYRO32ETzbYbtbwbElE/:pWsqIKrYR0
TLSH
T18FD2FF84FB2A913FD42552BBDCE60B002F79B88959192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 68bf275297569140fb9b606a8e827950087dc4233731ae3947dd56560df5e264
MD5 f92fe361cbf2c22017cd6e4ccaa39843
SHA1 b3b0660bdf136bf84bf2ecdba8a882476b164711
SHA512 71e27be35d2e0ce0874b12b262c5bf0bef07362153703de84ab481c2128fa2922c32a76586747224b0fd5bd8b50a594104f06aebf4a2696632b65ec2f2abd235
SSDEEP 96:/SdF95/7bkW60rcPyUR6rWZJPFkQFtFjFrFx/dd66JozGzgClKtmc0d/UK:/Ov5zbowCyjCDr1d66JozGzgCl6mc0dz
TLSH
T107B1CA29F229463FC855423ACCA21B400E36385AD85E7F1A36EC745C3E672DD768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f3cc7ed9656b7fdba51999497304c036642336405d2b2766a2ba4b163994b88c
MD5 ec27ef4937cd48c83d4496ba7ce7e015
SHA1 fc55fd6a738f90842c4a5e00e69059d5bce69ac3
SHA512 3eed6150257c5fd12f0b955da53af5b81e525fedaf1b54673aa12cc124fbb08038f7d0a68b5df8653f38799eae10789feee99b398d234a78fb6bf47485fb4485
SSDEEP 192:FOv5zboPmRgcyjPGOe1/66JozGzgCl6mc0d:aboOOcyjH4/66JozGzgC1j
TLSH
T17FE110A8FA28863FC408527BCCA11B414F39389B984E7F15359CA41C2D572DE76CE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a9e65523c03a1a223d3c350937042f4a2deb4deec10d4cfb18a3a73c8a3f7e47
MD5 0d3e211ecc6d1cda6f056e3cf8829aad
SHA1 49b04f7608f841090ad7b9da144fd021a084b062
SHA512 335b8ac0048329a2b81efdc3c128b14adbe308c525ccdd32ce8a85dcf0a8e411e7ea4ee4c63e9250803607afe1704e94340698c44255da42ff62dda0fc477015
SSDEEP 192:OOv5zbowZRgcyjnxDa1d66JozGzgCl6mc0d:FbowZOcyjlEd66JozGzgC1j
TLSH
T18FD1BB68F729853FC459423BCCA61B410E36389B988E7F15319CA41C2D972DEBACD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05d4940e-a4be-425a-b0b1-b7b60a313d9f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\05d4940e-a4be-425a-b0b1-b7b60a313d9f
Size 15KB
SHA256 569eb0bb7fd9231b60cff3d476f7abca1ad693d740fd9ef2a395d6738989a38e
MD5 3b33af9183b91c2006caeadff1476837
SHA1 22219eb19743e08ad4704e0363b8597db3c8788c
SHA512 520167aa40bd1928471249f23e520988a449356d18576018a2773a127195c15baa81dea89a3dba034e4b2527aedb9e7736f53e1d38b104f97732509433fb5ee1
SSDEEP 192:EQaMRU5CjX3XMUjoZ1IJHixyBL13t+OhgwDnLj6umzA+S0RicljToK4pMXKByc1r:zaynxtxmM+S0RicRToK+IzCvr7
TLSH
T16672DB166830457A8291E368D4ECBFC3E5F538CB4C419FC99BE4BD086DDE0AE512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

217e1228-d7b9-4835-8761-d97659428e3c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\217e1228-d7b9-4835-8761-d97659428e3c
Size 883B
SHA256 04883060706344a2bc86e328aa8fbf29be9138ce31fd241bab96835aae905813
MD5 93f46c6a3ad6d6df9f818be4667b87a3
SHA1 2ce8b5d5ef4717212a3332b3b43d57c443018018
SHA512 6d54ef7ced10ec207416dfaf47e491b4ffd07d380c29ea40a3efe8728e2764ecbfba3db7b48e912697073302eb4882fec69f17ef6b3600bbaf2cdff1a9038f65
TLSH
T1C7112791A639B563CC78D20BC55137428FE87533C0C995043D90CD140D7E51DF3AA50B
MD5 SHA1 SHA512 TLSH

Submit Download

6c08dcc3-eb6b-4387-9d35-4c833df956b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\6c08dcc3-eb6b-4387-9d35-4c833df956b1
Size 235B
SHA256 8b35765f7f03bf135b233575eb91cda08ce540aad72cc7dea596c92e88ac6c1b
MD5 69e26a032a020d29530ba83ed52527f5
SHA1 13cfe1a63bb433829cf3ea0af5a969ee329cfd78
SHA512 9c3c3e385c94dedfc64266ef9f98782e3eadc795654e7403acc9e8b11381227f9c35ad4d4450cfec747ebd7261c1897792c7ea384281a1c906d1354dfd46b22e
TLSH
T1EDD0979124A8239D8C001F02F8E038C630884C3320E4A8108A6246B4EAF9EC801A1807
MD5 SHA1 SHA512 TLSH

Submit Download

8510e2b4-f5a2-419c-9860-7557bc51896e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\8510e2b4-f5a2-419c-9860-7557bc51896e
Size 2KB
SHA256 7fc07bba11393164eec4e77082b9b1c03fedb73df14f0720581bad587d431a93
MD5 20da1565d1b925629436d9cc98d2969c
SHA1 371d6d38a6f72cc1fd24ef502e00198b62014fee
SHA512 1e36b43e9f9d63e6cdacad053d98fef7411b80d10f90b82a70d5292668ada5157784724762a1d0810c6170ee1dbe2bc0b33c69fba4ba59c38757f66f8da645b6
TLSH
T1A041245C35785C7B4CAAF98DD442378E57A54A1340C62C432E51EF0CCD9A659736E43F
MD5 SHA1 SHA512 TLSH

Submit Download

85d687a4-433d-4f6f-b565-67b108e63b43

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\85d687a4-433d-4f6f-b565-67b108e63b43
Size 235B
SHA256 83bac6b0ce795abd04f0ecae7d43833f643200e06c29221ea394daf83dc1968d
MD5 991987e44279c1555db2c2e93022e72c
SHA1 0b4ce6a4db7e0c6c5ed364a719d3eb59a2e644a0
SHA512 00936ca4f3461e912cccf3c6eb012904845fc2e6eb9031f4bf99bc0dd7154045a12edbe92f93d3eb80335cd1bb439ba2d6938b2b609934398c0ca8769d1a63fd
TLSH
T12ED0978938C8332C48251F06B0E068C6708CCC3314F46810CE9002789ABDDC883E2C1B
MD5 SHA1 SHA512 TLSH

Submit Download

f4f783d2-7195-48ef-a5cd-d3623d92bf03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\f4f783d2-7195-48ef-a5cd-d3623d92bf03
Size 886B
SHA256 417ecd82e0252f3b8116d2942e4ca1cb2d4e0d5bed5bca1f75ece108ccf80c42
MD5 eece8f9847c8e170596edaf52aa873e4
SHA1 b8a5afd5553a8cd9c612f2830b900d56d3ebd1a0
SHA512 424224ee1486de77a713060fb0853b0e2733dde56ef7a0c9e623a5e40ed17ef5a682b37451280351b2912e2ff6c9d76f5ee50418ae5f29328a46067df3816f88
TLSH
T1251127919679B4728D78D74B88E1B7028BE43523C0C55D043D419A180DBE51EE3E670B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 6KB
SHA256 98bc218446ab7411afb9f9ee6ea5ac31f2c0df01f553164b2d3933f1489eeb24
MD5 03021ab3b6c7d8140e62dd3a2ad0a151
SHA1 76a11c303b4277c54dcdc18c58af553e8e2d23c9
SHA512 edbf2990034f933bc5ec614f744ac2ce01ede62a01d46b6a4429664c416a5bda2bc36e7051d07f83f08dc08642e47a37edf41d153f05d132d34c8cc5fcbdfe8b
SSDEEP 96:xHiUTUMqGq/fSO51zSpSSlmdv9j/nytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSO5ASSRxisIHzsBw88J
TLSH
T1A2E13F789048CF6F64B676ACAC688C316AB2013BB7BF2CD650B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 9df3021e7408e13baa38316d10c05cbe8417828e4612f5dd5105e2391280cbb5
MD5 2bb6c36a1708d38649db5d1aee20003c
SHA1 252577f46c05a2465e08f94140585a914ecbe338
SHA512 c19350acfe0c3eecc360de299da27440e857f9069eb8425a30bb409da26d8405ac0682b686f5ab5f36ed4e01bf9ea2a8dc81c43a6e0cf1a3a3cff944d9900414
SSDEEP 49152:FBj3QLjgCSizDGYwul0MXZaW3sal0yUuEwiG:3j3QLjgCv0MXYW3ZlNUciG
TLSH
T17E1639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CDFAE05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download