6f1a3caaa7ad17449a191f96ad9f72e3211b12cef7f0ef99fe55cee2142c0b0a

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-TKLFTLP-35163.msg
Size 217KB
Sample260903-qeskeshd96
SHA256 6f1a3caaa7ad17449a191f96ad9f72e3211b12cef7f0ef99fe55cee2142c0b0a
MD5 891642e2bae680ac9ac5a56aef3dc4f1
SHA1 8bf6b4a6b6a3ea870fd195c32f93382473ecf2d1
SHA512 2b69a3722957fbc98b23ecf952a043e3037685bd0fd9068857f451ae3f6a0507f2326d6b224c3bc703730cae7a149866791e816c58a0d450e6b5f3c1ee405cdc
SSDEEP 3072:ypG/vUiV9OaEzPoqu5woQiiZZ1vvJWR7qmThTau29Qjr5yCk/jEXXi:Htwtiin1vwxhyQ0CkYX
TLSH
T19D243A253AE65215F2B79F314AE680979526BD53AD21CB4F318C730E0771A41ECB2F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware collection discovery persistence spyware

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	OUTLOOK.EXE
Key security queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	OUTLOOK.EXE
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	OUTLOOK.EXE
Key enumerated	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	OUTLOOK.EXE
Set key security	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	OUTLOOK.EXE

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3880	chrome.exe

Checks processor information in registry 2 TTPs 29 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329146962414231"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\Registry\User\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-741851418-952148922-3690127480-452514987-3460514503-3240840361-3637640338	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-741851418-952148922-3690127480-452514987-3460514503-3240840361-3637640338\DisplayName = "OICE_16_974FA576_32C1D314_9CE"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-741851418-952148922-3690127480-452514987-3460514503-3240840361-3637640338\Moniker = "oice_16_974fa576_32c1d314_9ce"	OUTLOOK.EXE
Key created	\Registry\User\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-741851418-952148922-3690127480-452514987-3460514503-3240840361-3637640338\Children	OUTLOOK.EXE
Key created	\Registry\User\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_9ce	OUTLOOK.EXE
Key created	\Registry\User\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_9ce\Children	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_9ce\AC\Temp\20FA35DE.docx\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_9ce\AC\Temp\20FA35DE.docx:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KTKBFR3G\Statement Of Work.docx:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KTKBFR3G\Statement Of Work (002).docx\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
4492	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
1680	chrome.exe
1680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe
Token: SeShutdownPrivilege	1680	chrome.exe
Token: SeCreatePagefilePrivilege	1680	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2608	OUTLOOK.EXE
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe
1680	chrome.exe

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
4492	WINWORD.EXE
4492	WINWORD.EXE
4492	WINWORD.EXE
4492	WINWORD.EXE
4492	WINWORD.EXE
2608	OUTLOOK.EXE
2608	OUTLOOK.EXE
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe
1604	firefox.exe
2608	OUTLOOK.EXE
4492	WINWORD.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4492	2608	OUTLOOK.EXE	88
PID 1680 wrote to memory of 4296	1680	chrome.exe	92
PID 1680 wrote to memory of 3836	1680	chrome.exe	93
PID 1680 wrote to memory of 3836	1680	chrome.exe	93
PID 1680 wrote to memory of 3880	1680	chrome.exe	94
PID 1680 wrote to memory of 1820	1680	chrome.exe	95
PID 1680 wrote to memory of 1820	1680	chrome.exe	95
PID 1680 wrote to memory of 4260	1680	chrome.exe	97
PID 1680 wrote to memory of 4260	1680	chrome.exe	97
PID 1680 wrote to memory of 1688	1680	chrome.exe	98
PID 1680 wrote to memory of 1688	1680	chrome.exe	98
PID 1680 wrote to memory of 3924	1680	chrome.exe	99
PID 1680 wrote to memory of 3924	1680	chrome.exe	99
PID 1680 wrote to memory of 2404	1680	chrome.exe	100
PID 1680 wrote to memory of 2404	1680	chrome.exe	100
PID 1680 wrote to memory of 4052	1680	chrome.exe	101
PID 1680 wrote to memory of 1244	1680	chrome.exe	103
PID 1680 wrote to memory of 1244	1680	chrome.exe	103
PID 1680 wrote to memory of 64	1680	chrome.exe	110
PID 1680 wrote to memory of 1536	1680	chrome.exe	111
PID 1680 wrote to memory of 5088	1680	chrome.exe	112
PID 4716 wrote to memory of 1604	4716	firefox.exe	115
PID 4716 wrote to memory of 1604	4716	firefox.exe	115
PID 1604 wrote to memory of 3568	1604	firefox.exe	116
PID 1604 wrote to memory of 3568	1604	firefox.exe	116
PID 1604 wrote to memory of 3568	1604	firefox.exe	116
PID 1604 wrote to memory of 2180	1604	firefox.exe	117
PID 1604 wrote to memory of 2180	1604	firefox.exe	117
PID 1604 wrote to memory of 2180	1604	firefox.exe	117
PID 1604 wrote to memory of 2180	1604	firefox.exe	117
PID 1604 wrote to memory of 4552	1604	firefox.exe	118
PID 1604 wrote to memory of 4552	1604	firefox.exe	118
PID 1604 wrote to memory of 4552	1604	firefox.exe	118
PID 1604 wrote to memory of 4552	1604	firefox.exe	118
PID 1604 wrote to memory of 3036	1604	firefox.exe	119
PID 1604 wrote to memory of 3036	1604	firefox.exe	119
PID 1604 wrote to memory of 3036	1604	firefox.exe	119
PID 1604 wrote to memory of 3496	1604	firefox.exe	120
PID 1604 wrote to memory of 3496	1604	firefox.exe	120
PID 1604 wrote to memory of 3496	1604	firefox.exe	120
PID 1604 wrote to memory of 3496	1604	firefox.exe	120
PID 1604 wrote to memory of 6116	1604	firefox.exe	121
PID 1604 wrote to memory of 6116	1604	firefox.exe	121
PID 1604 wrote to memory of 6116	1604	firefox.exe	121
PID 1604 wrote to memory of 6116	1604	firefox.exe	121
PID 1604 wrote to memory of 6128	1604	firefox.exe	122
PID 1604 wrote to memory of 6128	1604	firefox.exe	122
PID 1604 wrote to memory of 6128	1604	firefox.exe	122
PID 1604 wrote to memory of 6128	1604	firefox.exe	122
PID 1604 wrote to memory of 368	1604	firefox.exe	123
PID 1604 wrote to memory of 368	1604	firefox.exe	123
PID 1604 wrote to memory of 368	1604	firefox.exe	123
PID 1604 wrote to memory of 368	1604	firefox.exe	123
PID 1604 wrote to memory of 2216	1604	firefox.exe	124
PID 1604 wrote to memory of 2216	1604	firefox.exe	124
PID 1604 wrote to memory of 2216	1604	firefox.exe	124
PID 1604 wrote to memory of 2216	1604	firefox.exe	124
PID 1604 wrote to memory of 5520	1604	firefox.exe	125
PID 1604 wrote to memory of 5520	1604	firefox.exe	125
PID 1604 wrote to memory of 5520	1604	firefox.exe	125
PID 1604 wrote to memory of 5520	1604	firefox.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Set key security	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\2026-TKLFTLP-35163.msg"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:2608
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Embedding
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff88472c728,0x7ff88472c734,0x7ff88472c740
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,14846274048070021937,4166180366642079404,262144 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,7748024616302846711,1267059084302703975,524288 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,9099950403303226789,4357974611487683152,524288 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,8940243538315074069,5312235249896244701,2097152 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,13531033001490041702,11079868672844807175,2097152 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,8768302085088813397,9306204202884154915,2097152 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,11353321248907095268,7010588665209531415,2097152 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,4388998478659723556,3944195521576322113,524288 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5952,i,14357253983153094271,7806284454901630977,2097152 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,4931230411165292353,7952051646976411898,524288 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,7602315984714835624,10491111288901449180,524288 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3696,i,16959031327836495776,11622691346535086436,524288 --field-trial-handle=1960,i,14822718741647246639,3249478767403707083,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:5088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3928

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {a0855b97-1f52-4046-b5da-ea8e43dc766e} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {3e70ce49-7ebd-4a7d-bb35-b336f4b4087c} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1664 -prefsLen 27276 -prefMapHandle 1668 -prefMapSize 270279 -jsInitHandle 1532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3684 -initialChannelId {9d478d7b-f13a-42bf-9b7e-a7f235def6fd} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3848 -prefsLen 27276 -prefMapHandle 3852 -prefMapSize 270279 -ipcHandle 3868 -initialChannelId {5acfebae-32c1-41bc-b978-b5d7811e8663} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 864 -prefsLen 34775 -prefMapHandle 1004 -prefMapSize 270279 -jsInitHandle 3100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {92bd1336-8ae4-4973-b120-751159a48865} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4784 -prefsLen 35012 -prefMapHandle 3256 -prefMapSize 270279 -ipcHandle 4868 -initialChannelId {473f0e69-c52f-44dc-830c-c5361f008fd5} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4996 -prefsLen 32900 -prefMapHandle 5000 -prefMapSize 270279 -jsInitHandle 5004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {1c6676f9-59d3-4576-af6b-b9f2c695662f} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5300 -prefsLen 32952 -prefMapHandle 5304 -prefMapSize 270279 -jsInitHandle 5308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {4d289b98-0998-42ae-99d9-1d96382011dc} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 32952 -prefMapHandle 5072 -prefMapSize 270279 -jsInitHandle 4996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4988 -initialChannelId {488a1290-6f58-4c90-ba7e-641c21af17bd} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6508 -prefsLen 33071 -prefMapHandle 6524 -prefMapSize 270279 -jsInitHandle 6528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6544 -initialChannelId {6f7d6ef4-f8ca-4122-9367-ea8385df086a} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2db1fc8a40ef85043db604d8631e1bfa5719065eb846affb4e5633d9ba4a2b1e
MD5 0d846f1d719b5c870a380815d9add214
SHA1 0321f7f6b5ecd2f5c5b2dd9e4af7854776f83a7f
SHA512 242bf022eb7b97627ee2f2c2882ab89132d4cca898e53ede4469312222c8dc9f34610f7e9f4677d4b3a36592a9954190063cc30ea35614145ad9f9aa657c2432
TLSH
T1FEE022B9C921AC770DFA1B2864504646E74113567F91C94F3A3EC2088FB5F3B85ABC2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 343KB
SHA256 07afd00bc6b13e35f702104aebea04e61d7f90b8447559279895e5f72cabd471
MD5 f39ab38ee79b1eb354356116d49017c4
SHA1 b97e8c1d90d46d372791af31561daa69e132d7c0
SHA512 01217bff1fb5b28e6d1e5e02473ea3154c97f36f87b8973da56e8ca84b636e0de2c318cedffaedf0c76ee90d3eb2e26e6689d5a973538b6f0f91bda10c7a5253
SSDEEP 6144:nQbTrYgHjNyXvc/D0GyVq9bk72B3QM/lUs7Jv2zjWriqGfkMzZh1RqXOzKY:nmTsgHHLlq72iM/mPzjWrykMzZhXqXSV
TLSH
T1177423D43C829CDEB5717D27911A93A6C213B4052D40E39377DB808A7E8B5E852FF86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 d12406f0f7efea1e9f07ec8fc590e8798679f7efb5b06237bb9ec2ebe1777883
MD5 9d527e0bbc9290bb3cf2997b976b9a00
SHA1 a4ab49a0bfd871969678cfddfe81491d34d70710
SHA512 6aea38a224768f3b1ce5c0835362eaaffa12ac25ab214b73640329d53ae9dab438eba7327f39a020d563f0c877827fe6a0e4970a07e6ae30c9e397ea2a03e4aa
TLSH
T13AC09B2D81454037DB2812F415554D446C647DB5117355A1C4E0D09944977B7F501450
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 8e78dce31312431f9db2a3a02a8eec2bdb3d6b5e44ab09203c965f7b68185e3b
MD5 59251b34cb9f534f7d821e1995ad31b9
SHA1 4562c3f39a2cc145c09614df9bfbff6878c65843
SHA512 d44c443ce3aa3ff55793476560f178c86b785eed6166c4b9d3cdc8a814b9ec530acff4798aeff3e509fa1a938f3f9f7c59eaed7c97681074718ac81e6e91fbf1
SSDEEP 3:MsEllllkEthXllkl2zEklwl:/M/xT02znwl
TLSH
T1F04404057FD00405C74010304013C3540777F43305115743347144135CC55D40C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a8280f986598132f81d84e5bae2b83377fe45304e64cbedde912fe0c6d632b00
MD5 4843cdab07b0484385f742e3ef990f52
SHA1 16b3d36e597989bcf728c0e179a492512d1c167f
SHA512 3aa2556bb9c46df0c9421f262fe94030e084ae6cfe92446a06d28c95e0d25f396f44afb8043cef6035bebfd9ba48698451e9de9c611b4620051dc381256ca33a
TLSH
T18C519CF783F8C56D891196F4AB156F1FCE290524432C3CA6C8D4AE6B93E2972E14079E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 02f61a497ced0d898b92e378c72ce17cbac4c4950bbcfd30e5573a443b80147f
MD5 9e3749e66f86f99780565d4179b05a4c
SHA1 524663bcf305208579b08541587498526133693e
SHA512 db6a198d98a83a94955fe165bd3064c0431ae3ebf706d77e4541c0cf0e71ffd8351db35e1ff2253b9e5d5eb27fcfafdc4e6c570713343bcd580e63cc016d2631
TLSH
T119F059679ABE7427107E49BB5E097C096576B43402C178E8CF6A826CE1D24F31B02467
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7f8b86f0a6ee686c96657639291c26ddf8bf064d895b61f9b649bf9f6ab0c94b
MD5 d1bf904a048ffc0b83f1830342ee1109
SHA1 4204a6d7ceaf1ea8734948115cfb3668ae9e4e9d
SHA512 16f41dfdbaf50b8eafee194076534eef342fce534c84161bb851098444bfbc36d9bcbb7eea44e37543dfe24dac279770ba60677bdceb0c172aa75c77e3f88a70
SSDEEP 192:GRZQaQ2+UAgLrv7cpAPRp2qFmp9BHsb+WNn164o/2y72jAkwJa/pi+VyIsnAUgtK:GR6R1ETwUXl4rwsn2Q2UpaRi28
TLSH
T16C52D72AB92029BB5DDAD31AF915B753D7F9103165802EC4FAFC8A3C14E7ACD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 40c0d8d925bf2d7179f3974698d437e4040c038d85b8124bec9885088d908951
MD5 c4b9adc902472e18236b88976e434978
SHA1 dc408594cad516d3b606ad007cdf4a56a833228b
SHA512 870c1227fd977299cb5ae94fb39d1ca7213ec6c809e054c58b1850827f002af309f707718af81cadd46f6086abfa2461ebccf9adf557d2e91b16ac7b69465474
TLSH
T1D5B012508002B102C04212F026522498B1149F12AB0E170643F5A932C82557680540D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59301e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59301e.TMP
Size 96B
SHA256 3ae8b51b11cbec0e44b1654f13e4a918764e22e9f03ef1a49ac22b6ea562ebb1
MD5 73cc581b297697880002cf85dbc0236d
SHA1 748c6fa73ac722d86ed77f2e432ab98b4de9e8e8
SHA512 22b2e0178d8612ce91e1b89fc6fcf7647f9650c9bf3c377891915bf9261ea592dfbdfb5347a221f81e8068da7bdd7a1315de2a9dc325effcae638f187a29a50c
TLSH
T184B02288C2033202C00B03F0308080F83020CF20C2030202AFE08FA2CC28E302222030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 2620a1f3b6cdf82ab0519320a1d6762700f89923570600439a2fa8980143ac1b
MD5 00ce14797a90465376962e259fe40bc6
SHA1 6643200d402b77edc5007ae748307f0ccd19db59
SHA512 15fb4ec46948e918635da56f72bd06cfb37872ccb771a0d3042448d0129754bc51a82a32e83b49c465c71547ccf103b4473bde5fb6637befbbf7e3be070183c4
SSDEEP 6144:VvSoFSdIxUBB/UJCbbYZZUxXFmUi21rSm8uUVNSlzYa:VaQSexUBB/tlvfi21b8j8zn
TLSH
T1F33413209937BC339F9D305830EF191E9EA44E919846C264C6612F8269FB34B57DDF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 27083e6623bdf1320ac0bc1b078b3c120d4cf01042e2d7a2773390ca901b77ba
MD5 27ba59d3feb5e6e33caf7a7e87da33c2
SHA1 a24dcbbaa055a96fd2b7ca213dd839a37111c6c0
SHA512 6e7e2882fe7f5612428739c28214bf5486cc570f60cbcf12335be33b3f239bcd09fa56d4a638da889516edf09cdabb4311fbed3ac52935d453128b7d64d178dc
SSDEEP 3072:SqFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:DFmUi21rSm8uUVNSlzY/
TLSH
T110C31300BAE3E8F2EE5930447BEE2A145D6C4D818191C6415273AD419DEF3C75FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 f220fb924808678adfe1f00f9e229ca75d16c832c8fa445907a90b1b686f517e
MD5 ecb6eeae0b8fa3de009f7ca953d53cdb
SHA1 f2160c0e57ddc2d3f6d08fd3792b15e0d3e5bcab
SHA512 36028a079d60e059b70319a0c5cf4044f975c8340e2b1830277ba10c1e730fca6eadfc82711c65540370ddd28f38d505a83b0a260f563d4ccb59a478e51c8c63
SSDEEP 6144:NvSoFSdIxUBB/UJCbbYZZUxXFmUi21rSm8uUVNSlzYa:NaQSexUBB/tlvfi21b8j8zn
TLSH
T15B3413209937BC339F9D305830EF191E9EA44ED19846C264C6612F8269FB34B57DEF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Statement Of Work.docx

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KTKBFR3G\Statement Of Work.docx
Size 111KB
SHA256 0d9be3bd34e91ac47f35b698eb2178a2fbeb2025ec518e08b0d542b2fbe9787b
MD5 5fb8cf5574230d583ef929295c3f1d91
SHA1 742207aa77ccae8249fecba130562721c557b896
SHA512 923dcd4ad5e11416c820b4a4d4ea7c89d97917c3a9388607ad022e78b2b86b53f28e26c9a86c2e52581c89e47f0358980f0eddd7d0e56fe14d63a3185441a63e
SSDEEP 3072:TzPoqu5woQiiZZ1vvJWR7qmThTau29Qjr5yCY:kwtiin1vwxhyQ0CY
TLSH
T141B3F12BF696B475C5BB893C106800BABC269203A280FE5B7D8CF54E0F41B4F5E9749D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 e6c81c0e842492bd64c67821d4370e0648307a79769746ea5a516dedf59fa108
MD5 54f8843fe0a4364f8756b52376c03fc3
SHA1 1170b9b3028da8e04f041cca2a47f70dcfdf0919
SHA512 8db3fc9ecf9284dcf7bbf2c39f82c0c1e1a523af194885fb05b7bbd1de00c3e73902978cac97607f11caf8ca41a671cd0630b0b5ee0746954ea30a1558a22359
SSDEEP 384:HkCjiO024YbDL84KKDL849B7SOEAd9KVRaAcP+AWRMAJ:EzZYbDL8lKDL8CB7S/AmVAf+hRMg
TLSH
T1AB729E798F003CBC1597C1E8C5F552998D1CB7A7DFE6806D21583D0DCA98A6AA0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20FA35DE.docx:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_9ce\AC\Temp\20FA35DE.docx:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 18KB
SHA256 13265a054be0fe477a583072bff0ee0727709f2a77b9f09cfd7eda889e7b55a0
MD5 9cd88e07b2401110638ddbf3097b1448
SHA1 c0d91d34f8282371f6ee13db63c4b7663420295f
SHA512 d1d45e6ab2f6ee920e5e05d7fd13a716eded39bff5327c842d0c08b744d778f9313846bba48aa95aad9079d36f9c3079f158aa4213525035314154c34f4e8a8f
SSDEEP 96:kpL1JRtqMGBahI56tOwnFJ8M/pFwyx2aplyI0zozfr4:gYQ822
TLSH
T1FD8276F72B756462F0A28FF44098748C9C331325596CE584CA44F4F746C6BE9A13FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 10KB
SHA256 f9f2ea1113eb3c3be00f13e131653a9990ad3f705dfb7452a7d535870a6668e3
MD5 23ccf312d2abf1b340733a848ec9885a
SHA1 067618dba2d41e53897a67d5b91ac966a349d801
SHA512 d0b5e8f01a7898087bac7750d62a7280dc2cf2979bca8808b1e94ef532352f67aedd4e248ff7a79c4bc199911be7fc485481b417bec285735525dde6c48f5d54
SSDEEP 24:AuhMZufy91Xm9x+i9BiL9FYq7P9VvUqe5q9F55A5JqIs9l8q:cRcoQkp5RBP0I560IeV
TLSH
T1C42288E77B75A462F0A28FB440A9718C9C335726197CD184C744D0F746C6AF9A13FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 969418ab6bb0a1c9efe24bfa939c1892bf37d91b383245880c77792dca19ecd9
MD5 bd29d3917c39514ad2958c3605081a6f
SHA1 7e6cc2bbebddc519aba696f804b0d2036bff8a01
SHA512 9229409802eace7e9d4e7a62489334d0ae882f6fc032d3307ef87746341c54666587a5e5406441fff70c01634da69e50e1e391442dde59f1b4093648699f9c33
SSDEEP 768:aEAvIiPz/u9OkAEYILqHGcmhuJG8+zUKcAqjybNbLfsDhxfSN:LiP7u9OkAEYlf+zUiOhxfY
TLSH
T14A23F084EB2A403FE91491BFF8941B281635B85049595F0B3AEC14692DCB3FF3D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 580ce299395837a8599a973437a5f86b99ea97c663787ea57176e58d55d37439
MD5 f62c751a14fa643d9bc54df2e8ebf1b4
SHA1 187ce03e8504d5666d9316219fe23c8e0b29465e
SHA512 c92421ce169de2897e616c1609a858fe5b3f5301752613a8ad728d713174ac0c64eaa36267d48f587358e9483c7b1cde63f29a807247a1609f7655c2434796af
SSDEEP 192:+1d66JozGzgCl6mc0dFQcOv5zbowbxLpyjO1O+:Yd66JozGzgC1j6bowbNpyjc
TLSH
T1BFD11C64F628463FC448023BDCA61B414F35399BAC4E7F2935ADB5092C8B29E778D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c73b4bef545473b90f9dddfb7e405451482236caff6c50195f6347a0fe81e934
MD5 479fa7f387ae2af6a5e9dc278ed21117
SHA1 80df7c006096aa8b78437f90132a44ff73c6be4f
SHA512 1f4802c1a0e5b300df7143803bd96203994d4e5fa2184649bc04266e929c5d76615f94f282c814bf53838d7d936c47e26c6882056fb1e8d26df2246c282c1805
SSDEEP 192:nQcOv5zboPsZxLpyjO1OD1d66JozGzgCl6mc0d:mbokZNpyjHd66JozGzgC1j
TLSH
T1D1E12DA4E629863FC408027BDCA61B414F39389A9C4E7F2935AD741D2C872DE778E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a30a0da833904778fdf59a25e4e0f5982a691a17bb72be946bd2bb9de57a9b98
MD5 7bc9fa68cfc74a4dbed1219f54e9df1e
SHA1 2c509fe8fd33a8b3c99f3c5c042aae51a9932aa9
SHA512 7065211ad99da7277994915bce839d2fae878eb34941bbfd038ae8163ead7e0b5dc46714fc55368a15362dbe733fc556da262ebf0aa39fae7ce4e7f5d0d06fea
TLSH
T180219E4C3DF84DAAAAC7EB9C7441018E53924E4704975D834D22FF8DCE85AD9326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 5KB
SHA256 dd30c64bc09a635061a65c6a9d1364785f14607bb918c04a7cb891277217fdb0
MD5 646832a3c281a7b4d389f5c8b33210e1
SHA1 5cbbd44a239681def78dd8e0a81c2d91150993c5
SHA512 e353e97fee40eabdd40dade7eed46b43d4463a3068fd868a1513c5fb69967f51c2c573b95942b94660bfb22efa82594170e85bed82ad50678d63067bf6edd0eb
SSDEEP 48:YavJHOYsL4cD4wjP6z6tz5+i/zOQwxaX3+5k4PYG24BsQv7dKM2+s3dQwWIW/yFW:KR6utlPwmtcYl4xd4ndmrq09KiXOmg+
TLSH
T131B1111D76B90CFE6AC7D79CB44102CE86DD4A4290871C478CDBFE49CD86A9A325E039
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

334372c6-6c4c-4172-a1e6-32180727a073

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\334372c6-6c4c-4172-a1e6-32180727a073
Size 235B
SHA256 c6951d87a4b788f52cab1cf7b5b4c8de20ba03691afa49c9f700cb36a3c77c0d
MD5 990db75678c66cf10db7e6bdf35c152c
SHA1 da0366299901d6a999307df9d4705ef283ffab9d
SHA512 0d3526cee78f238730ad8af896ac3b8aa49fe9a5cbfed2616af2c78022332dd7660003b16f6be95ec560aeb79e6d3f9b7209993aefd41b21557eb77c387489ee
TLSH
T1D8D0978824883B5D08001F06B1F12DCA30888C3328706820E6B84034D9BAEC88261D16
MD5 SHA1 SHA512 TLSH

Submit Download

4e2cce14-a7e3-49ee-96f8-d78c9456fc75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\4e2cce14-a7e3-49ee-96f8-d78c9456fc75
Size 2KB
SHA256 03933100dbb07ed1ebde4e29360d932704466b48e8163b5b9a631e8ef51edfb0
MD5 33a2dde5053d33fe7d1157cff5488365
SHA1 8eb382b147178cc491783f9c14014452ed36561c
SHA512 9bda488523fa7d529140208b1ca4e1fa1d507cabb5e76795fcfc8b8f4331abc98f6b5575f11bfca9ed836ee3232dddc3af15c95cb82d6136039650c7d46c6391
TLSH
T1CE41415C35784CB68CEAE59DD0E2338E43648A0344C65C436D61EF0DDCDAA99236A87B
MD5 SHA1 SHA512 TLSH

Submit Download

6cd07f6d-54e5-407e-99b2-54d4c1a32df3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\6cd07f6d-54e5-407e-99b2-54d4c1a32df3
Size 16KB
SHA256 bfc928ec3bc100b156a617354650f1f38a98dacaf0919522600634f55ccea4f6
MD5 d41e5970f4b8e9405b3556fe5b9a6131
SHA1 00e4814e79256e6900cd3331c1c74174799f3218
SHA512 dc978adca68e6d2aeebb8c56431abdd3fd91fa08f41be7f3371acfb259effb6fa86bbf7c3f5e528ef3dc2559838e1b5cf48d3ed067563cd425b7cef52395b12e
SSDEEP 192:WERISzx7cmRSUSfQ04OuM1g5GWPfklizQ4KxSMEF7hd540M2YsF1EBa3mRI+WrrT:WMISl7cmRnSY0zuM+wWXRcyrYMIaH
TLSH
T1FD72E916243045BA8251E7A8D4F8BFC3E2F528CB4C419FCA9BE4BD086DDE0AD512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9edf36a2-b8ed-4c81-9705-0095833be0b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\9edf36a2-b8ed-4c81-9705-0095833be0b6
Size 886B
SHA256 8f2b4d341955e92a5f159cd969b61d86428a6d036d5c4cad5e0e47ec65978c38
MD5 99af51aa86639c72c690004a5e4fa25e
SHA1 10c29f7a51caf7fb840d763c9afff99aee1e18db
SHA512 5fa978a5ded66153ab7abab0608be24ed24fa3b0eb87a3f61def3967f04dadb7f2c0368d9c77c6531d01f2e4f40946c889f5f76ed5e529c24c8fd2a88fdd5b98
TLSH
T17F1163809A3575B18C68D28BA1A077478BF07223C0C64D243DA1AF280CEF41E937B30B
MD5 SHA1 SHA512 TLSH

Submit Download

e16adcdc-a9bd-4210-ac0c-35f721da49be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\e16adcdc-a9bd-4210-ac0c-35f721da49be
Size 235B
SHA256 ab9347f61bea52febea44cf2af2f9f7581c1063d8bb29b2d44680e88b9f8c8f5
MD5 13d850a327fbde6bea3dfd995c438a90
SHA1 715b5459a569ea1a35c3fdab7b61aec6cee00414
SHA512 93f3b01f820157be469d4961d2090f901038acab817a77103e6576f790f282ba2143991466e764614ef333346f348c344817b49a15dbb2cb17984a862485d486
TLSH
T113D0978068A8232E0C240F03F0A0B8C330998C3314B8A850C99000789AB9AC88121906
MD5 SHA1 SHA512 TLSH

Submit Download

f1c5c872-cef3-48aa-aa6e-dd2723b2a82e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\f1c5c872-cef3-48aa-aa6e-dd2723b2a82e
Size 883B
SHA256 4978a6c0a9daa68c005f1c4cb2e7fe1e1266a68d33d00d4eb763d8703a69ddc1
MD5 af75d04a22627f901e8670099c700d4b
SHA1 be84d39883364923de60db70239c511010da531b
SHA512 84e3102a783f9c67e9b89b4ef3251dcb399a0def5e32157f2a6f8d015d930137fac301db10be6ee70776fd2502feeb4a95a599785df5b7e4eac5fcf11a751e42
TLSH
T1DE11D981A635B5A28D68924FC9653B028BF4772380C944243DA1AA190CEF92E936A24B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
Size 16KB
SHA256 62b73e37175dc7ad8fe16b84b5b6ff3a65856b3066aba57fcb1f17e80b114f4d
MD5 43ec0c8ade4a3ab647cd4db7c3e867e6
SHA1 91079a01696971462ce3931d9f80c535d58bfb5f
SHA512 8232735e87f6d6d8065b95ba0c775b2917b7baa20f06b36031a8e39602ae11c42f483e33594329f01762c4ac594b1e82d093b11fa78c6ec83074a5ac1dfc841d
SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4HKi4h9:TI4vRf2XZ4D634q4V4c4D454T
TLSH
T1DD72521545049EB8294EA79BAA367E01C37D473B70845C78F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 2e7a89d70095c2970bd95a77429b9c038aeba6361275ea0d1588c4fd35e0068e
MD5 af636741ff43c4c318551ab629d64dc5
SHA1 03d5bfb256247ff15bdb9f736cdc5d9ff2e7497d
SHA512 5f5cd7d26cc573ccd08297140d5bd7f18e0a9327cd4975fd20ab91ab598484d0c865a2dfb70407cb587dd8911138978957f7410d47b53e69161111ff9bb53daf
SSDEEP 96:xHi+UTUHqGqgaf0BTkzS7ctSSlmdv9j3nuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0BTBctSST5lfWTBw88qO
TLSH
T139E11F7891088F7F74B677ACAC6888715AB2013B77BF68D750B59484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 8KB
SHA256 761629b5b4146827d7c8382fe581a0bc4c2dc1ee34770c53a4a44ef6b285ae83
MD5 5eae6a4724843b622d330922b930035e
SHA1 806d97b8241b12e8dc40d8ab8e1a8b1850821663
SHA512 32d637c3d6712b6ac84472ca9875dbf28bc673cdda784f43e996aeb175014bb70e4095f1328c0871781db20155a23e5cfef174489db91fafe6e7bfad35609caf
SSDEEP 96:xHi+lTUHqGqgafHBTNbzS7cyUmSSlmdv9j3nuWRT9lNdHWHIBw88Vvyl8L4cn3XO:k+PRgafHBTScyUmSSaRJlfWoBw885yUO
TLSH
T14D02FF389004CF7F65B67B6CAC648C715AA2023BB7BF68D750B9A8C50548F3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 9fcfa7e1693d921ede559cf249761371bd375998bfe489ea8af62beaff619f6c
MD5 7e1335c35b3785cab673ceec44388fe6
SHA1 2149fd8b1ae285a1d9ef798206c4572ebbf7bd99
SHA512 f18688493f24087a53d7d5494e15316f521058c449fc4675600580bce87c69e318e319defdb8e39489cedfe36eedf840d9ce0832969a2daf997fe047cb053ea9
SSDEEP 96:xHi+UTUHqGqgaf0BT1zS7ctSSlmdv9j3nuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0BT+ctSST5lfWTBw88qV
TLSH
T18EE12E7895088B7F74B677ACAC6888716AB2013B77BF68D750B59484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 f13cff6ca35ffdf69f76d8c3d8804612dba9334cb99b33b3d7dbb3d5e14a8d39
MD5 d20276ad307092ea2ae22f10dbbcc0dc
SHA1 13af4f8d8f99c2e48af98e7b81922fb6e7f83069
SHA512 ae8188f55adb659ff4e71728defdcaada4200d8fffa7c7be7c73eebe7b28e68ecb6b8c958b015085565c825901e35ec200958ffeaf40332b55e4163d8d24d00f
SSDEEP 96:xHi+UTUHqGqgaf0io1zSbSSlmdv9jGwnnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ioWSSIA5lfWTBw88qV
TLSH
T165E12F7894088F7F74B677ACAC688871AAB2013B7BBF68D750B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 3b4a85e5eb584a1c44b3948a3117f6f20757046fdeb04d78dff552e465866723
MD5 8d890ac5eb930621c586e0e5507648a5
SHA1 8c46c44cfbc20ff87952362c1f2ab8ac90777e32
SHA512 40eb461c7baa52c11e73cc31f7d90fe359d8612d6fb2547add9be8c2af31de0c098173d42af746d74549f1ba5553db290a40246018b0f0e10956023580dfa783
SSDEEP 96:xHi+UTUHqGqgaf0io1zS7ctSSlmdv9jGwnnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0io+ctSSIA5lfWTBw88qV
TLSH
T15DE13F7890088F7F74B677ACAC6888716AB2013B77BF68D350B59485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 7KB
SHA256 02bec25ed503df4e4d2e369746c89405c0462cc0be0e85bfbca5f4c618df84f1
MD5 8aca566982a922859ad8d96873abc76a
SHA1 c527bb21326bb5e5f1ecd78c5f2c5dd83585c945
SHA512 f01445f28b7e612e2cc73ec4bf4e5f13a44b59d301b328682e16a90ca54ed468e765e9adc07a97d6f225b52306841e8a698961a1faaefb499e97d3a77caa22af
SSDEEP 96:xHi+UTUHqGqgaf0BTNbzS7ctSSlmdv9j3nuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0BTSctSST5lfWTBw88qO
TLSH
T17EE11F7895088F7F74B677ACAC6888715AB2013B7BBF68D350B59484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 7KB
SHA256 b89465937f5e7b7221f738cadd6800fa3c5059ba2b56c9d1ec8e8185cc2878ac
MD5 7fe4c5cb8bf54a00143b22558a484fab
SHA1 f5cca4cf33023b9ad0b62880a7ce62caf9f6dc52
SHA512 2c3aefd82d6e7485f7dfee33cc2727ff93c1c6d2c44809544f4038891b9c035fd7f50d5d7798703e18ca1588d21be7c447b61e7bea38c62f291fcbf06b16af6b
SSDEEP 96:xHi+UTUHqGqgaf0BTNbzS7cyUmSSlmdv9j3nuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0BTScyUmSST5lfWTBw88qO
TLSH
T126E11F7895088F7F64B677ACAC6888716AB2013B7BBF68D350B59484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 19KB
SHA256 08c5ca5046a142ed69592f12de295c5e2859c74d350dfefadaab580d5acf6591
MD5 5e13c9d366a7dcae9c6689d6cd46081d
SHA1 0672560a013af43b4a50b23cdc889f6c9558e020
SHA512 5f883fcbbd6b98eac762e665740d41def4811c5e9bfcd1bc8308ac58ae963f213ad002b65a1e069cae54b1e705efcb24f96e7b29ab4c84967a612eb48fa6c6d3
SSDEEP 384:UN7USF8ilsd4Guo47CNcRD+2nQZWtGvFdUDliSN:UAilKmovon8FFiDl9N
TLSH
T16892CF7FBD220CB1F6DD559144AB634D5AB01C954BFA0F81CB02B84904B8D171EFB66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 acaa01ad2ee5f3710d5bd4c4f0e794f438447d5560bd34b68aec1d5cce7290a5
MD5 c635dadc194891f592b811737dc18d6b
SHA1 28355985fb61189cff9d1eebb4b058985890c7e3
SHA512 bd395469556cbfef16c23b2dcf4752fcdea8c4878d0bd1d5ecad33f5a1bb413d8df667f303e8b37815b1c43f5328a926bce7adec2a6e347dd9d52b1734f78b60
TLSH
T1B221CAC2EE2F0DF16F715329D0894F6AC64C3823487D64F0E179A60611DA50E634665D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 21KB
SHA256 91ca1f66d7bd4878f44414a7a0fad0dd841ef7e6175a1a9d400caef67c2ba681
MD5 133be8514086c83305d57137662e55ee
SHA1 fe7d2537bd07e6260c25b5e5488569dbb6d8990e
SHA512 78860be98df52e2565c161aa638e9655756e9b81ccd74f73f3df444651f1da2580d2892fd54bc601b837bf02d67f5097cc729673b58fa7e2b6438fd36a204d76
SSDEEP 384:w4gVFYZt6kbBAHEid1UBkP2po98TzvzGeSvp1ko/d5wE6wFKYy7k:wws/d1wpxz7/yJLwExF0Y
TLSH
T1BEA2C0BF5E091DB1EFFDB183D68266854EA00C5B07E48BC5D801F9640DBC406A6EB79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.jsonlz4
Size 21KB
SHA256 d8fc09d5846dd4fa1d1579989dd17b848c87aced5d3d9744dfc59e9d62dbfec3
MD5 4420444f70d5633de1ed87291a49e4e6
SHA1 1a45a557f2b4af6823b576cbb8e3036251771231
SHA512 10983a0f134628d2b339835e2341d8855da537fd0c504d1bf0fe9d74d4dd2228ca6ca6efb838063833a16bdf6f5827adf5a6fe261d275b2363f0d92fc6811cb3
SSDEEP 384:N4gVFYZt6kbBAHEiq1BBkP2po98TzvzGeSvp1ko/d5wE6wFKYy7l:Nws/q1Jpxz7/yJLwExF0R
TLSH
T1CCA2C0BF5E191DB1EFFDB083D68265854EA00C5B07E48B85D801F9640DBC402A6EB79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 9a17112212ffdb515083e91cf04ebb8a787e5b331e01f235e81afab578d1833e
MD5 5ecac4a6683879a4da1508bcfc3aa315
SHA1 438cd638a67bbecab3ce0b1b764c391cb00a8fb6
SHA512 885ada90e17edd92f9ed4b044ebb3543ae395120df6e760ed023e9f410e6335fe52c54cabd668d962f2bc16675ecca4a41363182f7966cbe5b3669ad64a18e92
SSDEEP 49152:NiwbkMngvZR+Uh3YdAn50Q9hJTHkda1NPUTx:AwbkMngRp50Q9h1HkdQy
TLSH
T16F1639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-9-0x00007FF8AB5B0000-0x00007FF8AB7A5000-memory.dmp

Download

memory/2608-6-0x00007FF8AB5B0000-0x00007FF8AB7A5000-memory.dmp

Download

memory/2608-10-0x00007FF8AB5B0000-0x00007FF8AB7A5000-memory.dmp

Download

memory/2608-12-0x00007FF8691B0000-0x00007FF8691C0000-memory.dmp

Download

memory/2608-8-0x00007FF8AB5B0000-0x00007FF8AB7A5000-memory.dmp

Download

memory/2608-4-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/2608-0-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/2608-11-0x00007FF8691B0000-0x00007FF8691C0000-memory.dmp

Download

memory/2608-7-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/2608-5-0x00007FF8AB5B0000-0x00007FF8AB7A5000-memory.dmp

Download

memory/2608-1-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/2608-2-0x00007FF86B630000-0x00007FF86B640000-memory.dmp

Download

memory/2608-63-0x00007FF8AB5B0000-0x00007FF8AB7A5000-memory.dmp

Download

memory/2608-3-0x00007FF8AB64D000-0x00007FF8AB64E000-memory.dmp

Download

memory/4492-62-0x00007FF8691B0000-0x00007FF8691C0000-memory.dmp

Download

memory/4492-61-0x00007FF8691B0000-0x00007FF8691C0000-memory.dmp

Download