metasploit | fb12d7211c0b4c02a944b7c11451ba3e8002487da7c0cfefdc06c301c8ffa9a3

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Copilot_20260903_024938.png
Size 783KB
Sample260905-tjqs6seq7s
SHA256 fb12d7211c0b4c02a944b7c11451ba3e8002487da7c0cfefdc06c301c8ffa9a3
MD5 dba223ee3611d812d4f50d0cc0bd9203
SHA1 737e635be81b26861f2c163ed2d9f632a15ebc78
SHA512 f0120ac6ee0d44065816388346332b043bf2455b88b4f1318cdc0e27742e2324c7dd0a049f733119cf07585f351c5b3bbd6cce599e2cb316c2181d7b7d63ddaf
SSDEEP 24576:/3RzyCtppm9Hl3LAlylYiIgPWWuUnz7RLk:/Bzyimj2viIkjz7RY
TLSH
T1170523F5D1BE9FB7D60594B01BE8C3519276F885E870896E4CD0D210B6AE3A48BC31DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery metasploit persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

3.17.202.129:17362

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Downloads MZ/PE file 1 IoCs

flow	pid	Process
222	5144	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5144	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330979423984118"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4480	mspaint.exe
4480	mspaint.exe
1384	chrome.exe
1384	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe
Token: SeShutdownPrivilege	1384	chrome.exe
Token: SeCreatePagefilePrivilege	1384	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
2920	firefox.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
2920	firefox.exe
2920	firefox.exe
1384	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
1384	chrome.exe
2920	firefox.exe
2920	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4480	mspaint.exe
4480	mspaint.exe
4480	mspaint.exe
4480	mspaint.exe
2920	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 2920	3516	firefox.exe	88
PID 3516 wrote to memory of 2920	3516	firefox.exe	88
PID 1384 wrote to memory of 5148	1384	chrome.exe	93
PID 2920 wrote to memory of 6024	2920	firefox.exe	94
PID 2920 wrote to memory of 6024	2920	firefox.exe	94
PID 2920 wrote to memory of 6024	2920	firefox.exe	94
PID 2920 wrote to memory of 4040	2920	firefox.exe	95
PID 2920 wrote to memory of 4040	2920	firefox.exe	95
PID 2920 wrote to memory of 4040	2920	firefox.exe	95
PID 2920 wrote to memory of 4040	2920	firefox.exe	95
PID 1384 wrote to memory of 5144	1384	chrome.exe	96
PID 1384 wrote to memory of 2068	1384	chrome.exe	98
PID 1384 wrote to memory of 2068	1384	chrome.exe	98
PID 1384 wrote to memory of 2212	1384	chrome.exe	99
PID 1384 wrote to memory of 2212	1384	chrome.exe	99
PID 1384 wrote to memory of 4720	1384	chrome.exe	100
PID 1384 wrote to memory of 1116	1384	chrome.exe	101
PID 1384 wrote to memory of 4720	1384	chrome.exe	100
PID 1384 wrote to memory of 1116	1384	chrome.exe	101
PID 1384 wrote to memory of 5332	1384	chrome.exe	102
PID 1384 wrote to memory of 5332	1384	chrome.exe	102
PID 1384 wrote to memory of 3824	1384	chrome.exe	103
PID 1384 wrote to memory of 3824	1384	chrome.exe	103
PID 2920 wrote to memory of 4024	2920	firefox.exe	104
PID 2920 wrote to memory of 4024	2920	firefox.exe	104
PID 2920 wrote to memory of 4024	2920	firefox.exe	104
PID 2920 wrote to memory of 4024	2920	firefox.exe	104
PID 2920 wrote to memory of 2064	2920	firefox.exe	105
PID 2920 wrote to memory of 2064	2920	firefox.exe	105
PID 2920 wrote to memory of 2064	2920	firefox.exe	105
PID 2920 wrote to memory of 5508	2920	firefox.exe	107
PID 2920 wrote to memory of 5508	2920	firefox.exe	107
PID 2920 wrote to memory of 5508	2920	firefox.exe	107
PID 2920 wrote to memory of 5508	2920	firefox.exe	107
PID 2920 wrote to memory of 3348	2920	firefox.exe	108
PID 2920 wrote to memory of 3348	2920	firefox.exe	108
PID 2920 wrote to memory of 3348	2920	firefox.exe	108
PID 2920 wrote to memory of 3348	2920	firefox.exe	108
PID 2920 wrote to memory of 4656	2920	firefox.exe	109
PID 2920 wrote to memory of 4656	2920	firefox.exe	109
PID 2920 wrote to memory of 4656	2920	firefox.exe	109
PID 2920 wrote to memory of 4656	2920	firefox.exe	109
PID 2920 wrote to memory of 1060	2920	firefox.exe	110
PID 2920 wrote to memory of 1060	2920	firefox.exe	110
PID 2920 wrote to memory of 1060	2920	firefox.exe	110
PID 2920 wrote to memory of 1060	2920	firefox.exe	110
PID 2920 wrote to memory of 4208	2920	firefox.exe	111
PID 2920 wrote to memory of 4208	2920	firefox.exe	111
PID 2920 wrote to memory of 4208	2920	firefox.exe	111
PID 2920 wrote to memory of 4208	2920	firefox.exe	111
PID 1384 wrote to memory of 4520	1384	chrome.exe	112
PID 1384 wrote to memory of 2188	1384	chrome.exe	116
PID 1384 wrote to memory of 2188	1384	chrome.exe	116
PID 1384 wrote to memory of 5720	1384	chrome.exe	119
PID 1384 wrote to memory of 4176	1384	chrome.exe	120
PID 1384 wrote to memory of 5292	1384	chrome.exe	121
PID 1384 wrote to memory of 6052	1384	chrome.exe	122
PID 1384 wrote to memory of 6052	1384	chrome.exe	122
PID 1384 wrote to memory of 5048	1384	chrome.exe	123
PID 1384 wrote to memory of 5048	1384	chrome.exe	123
PID 1384 wrote to memory of 3928	1384	chrome.exe	124
PID 1384 wrote to memory of 3928	1384	chrome.exe	124
PID 1384 wrote to memory of 6068	1384	chrome.exe	125
PID 1384 wrote to memory of 6068	1384	chrome.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Copilot_20260903_024938.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {ab83ea3e-2467-4f60-9cb0-3bcb52075f55} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27135 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2468 -initialChannelId {672b4425-ccee-454e-b718-dbf9e979dac4} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3876 -prefsLen 27325 -prefMapHandle 3880 -prefMapSize 270279 -jsInitHandle 3884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3892 -initialChannelId {62d5677c-773d-4286-9112-aa5013b4267d} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2840 -prefsLen 27325 -prefMapHandle 2844 -prefMapSize 270279 -ipcHandle 3876 -initialChannelId {3883a4b5-7abd-4268-b6d3-592dde213b74} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4436 -prefsLen 34824 -prefMapHandle 4440 -prefMapSize 270279 -jsInitHandle 4444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4452 -initialChannelId {d865637c-652e-4989-8fbd-462cf4a794af} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4740 -prefsLen 34931 -prefMapHandle 4744 -prefMapSize 270279 -ipcHandle 4756 -initialChannelId {00ae84e9-dce8-416b-9d55-bedb2d9b1f1c} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1652 -prefsLen 32952 -prefMapHandle 1688 -prefMapSize 270279 -jsInitHandle 4912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5100 -initialChannelId {8de14710-74dc-493d-a15c-295a854efbdb} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5084 -prefsLen 32952 -prefMapHandle 5088 -prefMapSize 270279 -jsInitHandle 5092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4912 -initialChannelId {92fed067-1950-40d8-ba3c-42bb5eac7ff0} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32952 -prefMapHandle 5068 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {82f8ae26-b32f-4855-a133-78c2157f164c} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa6aafc728,0x7ffa6aafc734,0x7ffa6aafc740
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,14577772305393294878,828203755581144707,524288 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,10099902871242071887,8734520829940521281,262144 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,14844159971867782622,6572309888398595261,524288 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,7681376164092205232,5458460958122164754,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,7654116144590045194,1103140404337694189,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,16863980253501288109,12743624309297459223,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,14792355313977991516,6491262258891841272,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,6348386331930299901,16415801076627854117,524288 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5828,i,15482679579103290920,40536572313268115,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,16397617452577454539,5829584619671650411,524288 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3896,i,2010174141809486895,13403771547808440427,524288 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3912 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3156,i,9550782163949960821,15119814321304715057,524288 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3468,i,15742439542634956763,16075958415874044962,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=244 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3196,i,2277209496881576231,4566694404905665255,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3204,i,11106823507090250454,4012693248719216400,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4456,i,1810312317953100417,11053510328652448711,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6304,i,4728906698095620748,948637933312523771,2097152 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6680,i,11388442851130276538,11473408193585588359,524288 --field-trial-handle=2044,i,13674933725681042284,14624395865696791079,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:2196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3424

C:\Users\Admin\Desktop\virus.exe
"C:\Users\Admin\Desktop\virus.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9e5c751bd321a3e0b197a00a096ff6f4fbed70e20c0b8c7557f503c45bd4f691
MD5 3dfcbbbfa75b30a39a6b6745070b46b3
SHA1 a983197203fc8568ae586341b0040e9ec7e5e643
SHA512 7fff2771ce8316068d712dad4efa7fdeae2c6b39c3c55bbc8531affbf3ed9ab7de292f7a142333e0eeb08f4f1877cbecdef5a73fc8991e885e1324f3ed8e1170
TLSH
T1D4E022AEC9B2EC7708FD175CA050074AFB94234B3E50898B3A3CC9198FB563A4696C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 17KB
SHA256 3b8130642ca2cbf33e597a8e37af388a76b81add178aa83e3d1f72f58e3c0b08
MD5 94be90e7d251df650130c032d0d11188
SHA1 f3ad07f47cd76839818635dcaaebc19a91e31119
SHA512 36a281ff05ac7cbc4a9e65ef041440178951fe48c0a32cacb9dd8fae0b39b32ce3da17ee4709f22bd7728e2aa2c70d848ff1d423f37e828fe21ddff83c697401
SSDEEP 384:1hUjaecTNeg2Hi9hmuBBgMVbEk6ZRM2+jqASPlrWTW77YM3FkxDiz:1hUjaeYUChmWbE73M2mq7PN7aDiz
TLSH
T13282C061D49EA313812C86984F0AD3F40019D37B0D79B979EA75E24F699D5B4A4B0F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 73KB
SHA256 f3d2fda12260ccf193da50e70fe5efb8b89d3c5d4e246eaa053f2cbf4fb07ca4
MD5 345c1023e3d262fb90bd367013335e0f
SHA1 30fd5c4da80ace38caa4fc0da1c950b6ea210787
SHA512 9ae18642326e9e10579bf7b137e14cf5da51953fd2884db14dc6050c4734ec9ad58f7afa35e1d9ee2d0672827845fba2a076bf25069ad40a31de93179c76c842
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQalSYnUxMv:cjW1b1U09DGyQPKzSUFVXCQalSYntv
TLSH
T1D87312C66BCE83A9791BCF3D0D254488AB74C4F0329AEFC3957AA08D7515134B1C63A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f946e77f1b8aadf_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1f946e77f1b8aadf_0
Size 292B
SHA256 7b119d4ea2cd6719c8ea7c0dcf7f9c1715a9d3e3afa09be5889cd93efb98187e
MD5 219c3a0c1f2821fc8a962e4de7d8a5d1
SHA1 80f42b968130c4144bf401f896d1464430fdf08a
SHA512 d81c75135da6b63c21f27707e512dab02891d7d2ac3f6d533cfc37e73edec800ab1f671aac7090d86157bdf076eca700b8387cb34d1749a2468955c483851e74
TLSH
T1B8E02BFB91607801D22551F4D3EE828A829608C45DE5D0CC740898F963D27E067D6315
MD5 SHA1 SHA512 TLSH

Submit Download

a0a559505d135d94_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a0a559505d135d94_0
Size 322B
SHA256 7bf2da046e55141b53415e17bce73f642b5735b20bf05c3759a5a0a364db8e6d
MD5 86065d49ed472d4c52529674a65139f6
SHA1 ccfcf7f5ac6a11de9b4b5bb96a61cd5c53277b3e
SHA512 5f89df9736cf0135897a73173265bbb55702a1e9bb5a71d7b705910770938df4534f57bd75af344ca057dade0317c96161b6f5bfddc50393d088c466644adec0
TLSH
T165E07DBF4604DC54C21299F456B7024AD22210735A9E86ED6955D0E3C70853E25C2543
MD5 SHA1 SHA512 TLSH

Submit Download

acb65b970fb95214_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\acb65b970fb95214_0
Size 32KB
SHA256 885a60281cd379adb0b6e3dddbfd3fca4fd93026cce17fac2b40bd26f6f8eece
MD5 d42fd7dca8690491cc4faef62192213c
SHA1 3ce9ec77aaa0c7e703186735fb4f23800ca4235a
SHA512 58de40c6cf7227a42d81c9fc62319505de8fdca86569d739302f48aadc67e9346b24f4e86bd5cbcdee319cfa3ba39a5d68716312769dc460e2a577e06b14ffa1
SSDEEP 768:AQvS/AU7zxbCEW1w4BiD2WkvFP+nwKKswmkjnNFgapZ:rS/lpuEO+SJFP+5+NFgap
TLSH
T132E2088AA355BAA6CF7243F98112CE2A3331448D3FD3D32725E5E36A1C453E58D96C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b03978fa36a8a615_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b03978fa36a8a615_0
Size 3KB
SHA256 a376c5a7b0248c1de87c96c6d5f81c4920288e690642d8c11f22d11ae610d061
MD5 6fafcf1b801c109e524d03165d65634e
SHA1 a2e62d7fd5e886d4f5db701d1c33324e3a3e1bfc
SHA512 61c9f9a34e9b04d6c921997678cfcdc8463c37479c835efafac860fa1831c0f6e15497511663230e5de5ac2f6ce7bfad78919250c67bf5cb5000df818b0a443d
TLSH
T1BF71849E56408A2ACB3203FD12638556333951047FD7D32B24D1EBA51C843F7B9B5D8E
MD5 SHA1 SHA512 TLSH

Submit Download

bebfa6c7c7b7cb1a_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bebfa6c7c7b7cb1a_0
Size 2KB
SHA256 c0ad4231aaefa8b7b8f4d5de083835024e06fc52834a6579d9243d7f1897275a
MD5 090d4fc2a16911345a746e7f4eb1aae0
SHA1 6aa59d5cb4828c98f07d7edad455577dae8c9642
SHA512 5a837f98a459bce5bc19ecfa8bb702aac6b4040a2b29ab98b88f6c53e247dbaa586de986b9d356b736f89bbc5bfb84348e24befa7dcaa1ecdc4d1348d309ceb3
TLSH
T1D1514AF6F7B8C950CB739AF8838B271587A06104AF92DF3AB012C8160C053F364E950A
MD5 SHA1 SHA512 TLSH

Submit Download

df53bad28ea1e322_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\df53bad28ea1e322_0
Size 303B
SHA256 a463ff5b19a6f0310ca6d45aff19b84d68cc5d3a04959a9837e79d017fa6e2ff
MD5 af07d3e9ac380cfd7fc5caca3135b4b8
SHA1 78ebc5f34adbd04179812351c4c08e14e538628d
SHA512 ce960215facf29696b8b1dcb9d0f53bb7c877a31ae9a9237ad8b38d9e13f47b583bd15a93887180f3256cfbe68f9d2aee7d3331f37a7b0b710438d9387dd0de2
TLSH
T128E0E7B784943980CD3D86F05F49136B412300C5849ED5CDB14424E15500AF5EBC5332
MD5 SHA1 SHA512 TLSH

Submit Download

ed3640c75eb972c9_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ed3640c75eb972c9_0
Size 310B
SHA256 00b62928bf86d5256c548a9463db6473d59e66c5e4c1068268a4d61a5d58f239
MD5 22f9138050e5c20d322e0de6db959d48
SHA1 036f5b3f474efdfeaf185d5382fcdee2d3379752
SHA512 3bbec4d9fa8b5443b37e89897ec71f10eda4fb52daaf67be19965fad3d229f0d34b26623a955d12ae6bd2c4c5a589d949e5e4eba7778b6ddbfca53cd32bb549f
TLSH
T1CDE07DDB94243520C07A44F0839D811B83A700C65DE5C49CA41560726A157F1628E623
MD5 SHA1 SHA512 TLSH

Submit Download

f1050f142d2c3282_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f1050f142d2c3282_0
Size 31KB
SHA256 6579fe62a46f0ff6fb087f349e3d3e3fcdf4055a03049325b86961fce80fda91
MD5 3ab1599520c608c6ed9dfc457841b210
SHA1 e065b9cf18f978c94273c8c73a5207f7fc110f77
SHA512 bfcbb326016afa52f34208b2364fa7284a3e1bbb7903a9fa285b2bbe8bdbd6bff403088d0c682164edc9848d19ffca6278872871fb673841b7ad9dcaf3c96a7b
SSDEEP 768:Q6Mf89lP7epZE+aQPNj2ROLKN6X6FDnhopr:TMk9Fq3E+aQPlKgKBnhopr
TLSH
T141E2C585A394BAA6CF7A03F90213CA6B3335494C3ED3D32B22E6E7660C152F59D45C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e51d5f1df8892c098a34d16234a9ded5c9ae6b10717ab9d56111bcefaaf2c968
MD5 25da6d685d1fe99b3c4b7e60f4d4d632
SHA1 53e04d07787b931f9d99e9b34b925dfccf70c35d
SHA512 ab7b31c70bef0b5498a3128a40708cf6ed357ad0ba2d08b51b2963441086fd325597b09eea199734889b55de37d91e9cf6fd47c014e6d76822533336cd24d19e
TLSH
T192310DC052C1E02CFFC60A720A8F0E6B18D97266990D275B43D3CCD469637EAD38559D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 030cbb089dfe4625c8a3fc27259a73c4cce799153b7698d2d2adad0f748de506
MD5 e56cd3ecaca11d45744131db738a09c6
SHA1 ebcf97b7e906b114c58284f15a11d67bbf4641c6
SHA512 a072c646cf7cb4089e2a0cee4eead5b412f5533d23b357d320a638da89fb86bd859586cdd33e46cd53348f99c082d46e379fd6b9d5c66d46ce1f4cd2595f38e1
SSDEEP 384:Dr1eZb5EYKSCaF2AehJd7jpgBeEsaa8aHdLFbFsNn+JIuIhIpIXNIPTp+zMVemVb:YTzR6SetCe4LrVe
TLSH
T1C38299F3C7F8866D891152F4AA246E2FCE190A16432C3C5BC5E5EF4BE3E1471E25198E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 f90d7f96a0ebc697a81673d5cd4c407ced333ddc63332c62cc27386bde89f6f6
MD5 8911c5c6323346837c392ff3ad8e0bd2
SHA1 241ef3a9e72267cb039d70bccefe002fbf8ae0b1
SHA512 0f8abc262ec35df42d41516ba7adc0c7832ae7406b09c9680061d71a8521b4e9634c6030a10f07fa3420d27ab97b06bef816a0eef993a33a5af0ec2fcb3eb066
TLSH
T1B5519DA3D5BEB55B517F18A70D007C4516BBF832078278F8DA56817DB083AF31B124A7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8dc50ee569c2caa18bfe05e2d56381ff587c76d868cb4107a3bded46957b02e2
MD5 a86691d0a3d80b47a0956abf2f291f72
SHA1 59f524bbc9f155ddc5476f607c1822231b32e243
SHA512 83494c01b91d7ed542fe9377da65e78db7674b967359d86f218141881f3bf49c4c8959dd0a6e40814ddfc0e35c4ff7fa3f3e297181911aca4e40bb1f45634cb9
SSDEEP 192:9R9v/RQTpcSv71hpAPRp2g92Hsb+WNnyB0gBMvkwOVyIsnAUgtaJ:9R9v5Qi+BhUXDQwk0oMvm8
TLSH
T1A242D66FA910657BACCBD22AFD613B43D7F5202565E52E80E7FC892C14E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 90b8ffcf5fe79dfaa76af182299498840eae34ca686683ac4244469a7c67e874
MD5 b4ba8956463d33f80f64075101afaabb
SHA1 1a38c69395db7b146433d1b645a80e35b9d0f6f3
SHA512 97fdb5715d2e9dab81cdeb9c315b64b3217b59c3437dc7f3175e5f3ab9dfd43f9ed995d0b0755445a866b69d2e884a1131b575f3a208d6e6e8860f1817d49de7
SSDEEP 192:9RhcBzvkGTp4Sv71hpAPRp2Fro92Hsb+WNnyB4SR2wBMvkwOVyIsnAUgtaJ:9RhmzvU+BhUX/Qwkf2YMvm8
TLSH
T16652E56FA91065BB5CDBD22AFD117B03D7F6202569E52E80E7FC892C14E76CC212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e40452e82236bc8daaf55d1deae792ef72b516fa8c975c055c86b8a41a4e5199
MD5 59122d9a47bb203043b5fd2aa9159688
SHA1 fe21a27aedf7e7b0c1f1631693b27b3d33c65eb5
SHA512 275806f87a8c9fc409dd9cd5469f5ab72c6f1146a8f2836c6533ac6570d1d8f3e54c40f93feef0c7d76e15469f057abc1cb795da24747d6e9282fc88946a5b37
SSDEEP 192:9Rw8cBzrkGTp4Sv71hpAPRp2FBlIo92Hsb+WNCy+yB4B2ecWBMvkwDPyIsnAUgrK:9RdmzrU+BhUXSQwpXehMvXe
TLSH
T10F52D66FA91069BB9CD7D22AF9117B07D7F6202669E01E84E7FCC92C14E76CC212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3b7751357d131ec1d41b621ec0a51baae7772e8b113171806b191b87b5cc44b3
MD5 dde06e8c1f80dc3cb5dbd6dad6647373
SHA1 34eb94df7ddf7739454f60cb9d5ec4a10d9cd73a
SHA512 e96ff652cb99ace4df392e0e975cd8e69aa3130657da8d472c42de023bbcf809434aacc66a6878b68809d5effab368dcb70d2028d0ba29a179d32cac6319acbc
TLSH
T1F6B0120080025251C05702B015521CD87154EF11960B270543E0BEA2EC251618118055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d53d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d53d.TMP
Size 96B
SHA256 a51988f1faa534eeffd4603c66077473a0551bb7a830314094e03fc9753a7426
MD5 69371cc64a2a647746fbeae0aff4c6f8
SHA1 d06bd20a78189cbf13b7f0cb82c190f8e52b41a8
SHA512 252603c735d8899a9bcf9d5eb2a0d5f9b53b57506053f0d01793d8ef9cc25afc4f80e9d7e78d0ceb30c31cffb0d53e5d47b81c19f3116e725374e71e8b810eff
TLSH
T196B022C2C08232A2C08203B020CA80C830B0CF22CA030302A2E20F2ACC223B00828220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 3312dadf8d33e360b3dfcbf2eca4c1955292d99539bdc4c90df791cd39b85e43
MD5 82fae491979a8d3c8e6ca3008d8fac53
SHA1 73138246ef890bc1116fc35dfc14d59a30eae515
SHA512 36d7cdc816614d20377fcb97a8fe763c6ec346dd1a6b6e236d468a40b396d34fd7140302d228098dc9098a0344b48b28573239a2159f9fd845c5d10f690e6582
TLSH
T127A0029902490323C4750B74B39221C023186A5413830F0191948485E99414AC599254
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cfb950f96d10cbca72b8ee42f79895867b0788f571de3f9bf12e58edd559bdf8
MD5 0b4f0a82495f65c26f1099ecea93fdba
SHA1 1eb27c6b4b1573a0ba4bc0b611706d9c270a85ac
SHA512 54d0927e238afcd1219ea76d3656b481bbd979215a118481c249edb497a9a8ec6b8a6526bafe63f7860a4991cff70c304af14f6a94f0f2320077cb56b001e983
SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:rm7Rkm1tYpBeh2BAo3
TLSH
T1DFC312275E71A9375D79AB4EB08E0B1F1EF14AA6CD30DE92C8D85A0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 fb2f4a0c1e1d437547f29048b76ddf2466aabd311d463dc5cef80ce7b7679e0e
MD5 d1193f030bf0ac318bf708a71b77f3c6
SHA1 c5b7f0f7d9c77d46618ff73908c32827dca5bd06
SHA512 8adabe1088a4f281371f78058941ebb0e655f12779e78069077f2bf6ff627846dfac12d476799fd0d3cd38d2545300df83fefd6903c389b04b6b52364fc85c58
SSDEEP 6144:XgyHdua++A6CsEoU/+Zn26tbtFm7Rkm1tYpBeh2BAov:JHllCjWZNs9oBGcAov
TLSH
T1EF3423639DA49C36A85DA3EE344E460E5EF219E3E90891F0C5D19A48B7FEFCD1409E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 83bbe30f83afc85ee585e8034a58823a4a8a4fb73c66d09008e8c65cfef84c5f
MD5 5c46f46f120c0ba5bab7961c91ff5ed7
SHA1 a6c6887fb0ec019b908925d5e6143f572dc5d770
SHA512 16947f54846bd78db63fb9d08b8723c76a17f22eef8e8836239a1210ceb35f8d5c25be9fbc755070ee2971001e4429b6bb1b9af001800a7d4bd4a07aef0c0853
SSDEEP 6144:KgyHdua++A6CsEoU/+Zn26tbtFm7Rkm1tYpBeh2BAov:kHllCjWZNs9oBGcAov
TLSH
T1F93423639DA49C36A85DA3EE344E460E5EF219E3E90891F0C5D19A48B7FEFCD1409E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 1be78a76f3077161c99f1f0e69baf72f679271d5077db1d4aeafe763730c0a6d
MD5 7f15fc12976606a5e6fba6fa10a60e2d
SHA1 7a1366e746f4db85b4f461e8835dc96eb36819ef
SHA512 2e2baa1169aed3585ce60b2796736a04c9e662f4ffef9d58e4a8f78f06fc7343ffcb7a56d127614ddf49ef7f737f94be6d3826cd1693870d9768e71b62f53b50
SSDEEP 6144:fgyHdua++A6CsEoU/+Zn26tbtFm7Rkm1tYpBeh2BAov:hHllCjWZNs9oBGcAov
TLSH
T1653423639DA49C36A85DA3EE344E460E5EF219E3E90891F0C5D19A48B7FEFCD1409E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 fd0fc5fbce5f7780d1bd73e847f54a00acea2f876f412369369f4ff45feb2143
MD5 8957273b139fe45bb5282aca4507a372
SHA1 3f99cb5ccfd044e18d42204fc2753b1c9b4593ba
SHA512 e205216889a0b8cd98915b9a97780e2aa3f8987a65ad1e67a8fbc801a5e23fca1359996189144ec7a830ab935589821b71e73278a945d6aa449a73a2e6189743
SSDEEP 3:MsEllllkEthXllkl2zEkloa+l:/M/xT02zn9+l
TLSH
T1CE44040C7FC00C05CD0450705411C3700370F4100515D74334515C575CC55414C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 63a7b268a9ae66719f28b88f4967bf5cef25c48080061a3e353b902a89f35137
MD5 fc5b215bf2763d8bbf93d18e7f4bbf0d
SHA1 45684677986e1c8bef419d966794c894088f2b58
SHA512 98ac7cf04f46c828b6e1b2e2917ddd6d81a18cf2fe701a5a6f7d310aad462b00ac8455e5379233005e2ec4450f59fb36b96dd5087b20bfcd9af766eccb8dd338
SSDEEP 384:HkCjiO024YrDL84KKDL849B7SOEAd9KVRaAcP+AWRMAn:EzZYrDL8lKDL8CB7S/AmVAf+hRMW
TLSH
T174728D795F003CBC1597C0E8C5F592AA8D18B7A7CFE6806D21583D0DCAD8AA9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fqkq4vem.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 f8f5f2c9e9be17696dfc062230b02c896ee052c3d8f675df837f566a6b2cd66d
MD5 febabfc23ca780f8a8c0261e16ac77a9
SHA1 16ff9d384ea9c3c8cbddc33f165498e14c8af2c1
SHA512 fc89b2d53e80cc2ea21ef5b0b8238e2bd56a6ca157d8a1ebd2b76cc5efe3572c55af6d8c9b3c135810133ba9f8a161516da72530795d400a8dcaee0b6e006f34
SSDEEP 1536:jTrliCbLTDLn0xm9IOVhsG8/nJdvKZ7NVdi9Mw7GM/s6tA6IOfdEmGvhjC56eXsY:j3lRSm9Zv8/rKPY//Dads/5/X54A
TLSH
T1E0A3BFF6DBA2CD2E69FFD42C6A91843EFD266400B3A7300DC927635052CAF747679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fd96e74596f56811e75d162e1182da54806067559153b6dc722b8f9709c530f4
MD5 374e5de92330a14ef21dd07317e868c8
SHA1 ee3e92b814fff2ea3cb97f8034988858035bd567
SHA512 c22fd809ac77aa89632776e926bb0aa731e3e36031332499461e19b3066dbae3d11c26a66ddb3520258044c953c796128c586ceb98d7c609c3888229acd2d014
SSDEEP 192:pG1d66JozGzgCl6mc0dtOv5zbohZVTyjDO:ud66JozGzgC1jMbohZVTyj
TLSH
T1E7E1FD64E639867FD414027BCCA61B410F39399B984E3F29369D604C2C572DD768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8c350361531e32f5376b8675cdcdf0983f558f551a7631a775034291338577af
MD5 2b23f2137674d19898d31de991deed02
SHA1 dbbc81dc6155c9b7ce1e22d2635188854a7ae80f
SHA512 c47836bc889803b4e52fd44c80d1e2d9ba0d28586acb8b8d07931ca6ce0946aea3c39fadd294d5566b0eebcc300c8fcd14c9852788b8a333198a501a355abacd
TLSH
T1F4217C4C7DB84D9ADAC7E29DB440168E93518E4748871C474D12EF8DCF82AE9336A879
MD5 SHA1 SHA512 TLSH

Submit Download

0db25f62-f2e2-4bc9-a3e5-a3b6a669c31a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\0db25f62-f2e2-4bc9-a3e5-a3b6a669c31a
Size 16KB
SHA256 5f2a410a8d25f622672ae3181ed0cbb3b1ef5ba8cff87184500a4a0e7aee8825
MD5 f80f17bc0a65c4fe00035ab62d8a14cc
SHA1 8459024d012858d3448083f1ae12376b0f224964
SHA512 30c1470dfca6da151d1c93813388ed8b927f3065236d47fb08cba7931a3cda8465dc5ff6453141b40fdad3fb479efcaa204b6a7bd5ec70cee01bf6db078ecd7c
SSDEEP 192:HCYTgBMuT1UI5U5hQ4vCvmivcm8kRjXy6SsNVHbYRmn+ccnNsGcRHzXRb0pDrjKH:9gi7I5Ujtav5iTnNJc9Vb0pDrjKH
TLSH
T1E172CA162860497A8691E36894FCBFC3E6F53CCB4C419FCA9BE47D086ADF06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d4f8ac1-40b5-47c5-a758-35856c04008a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\1d4f8ac1-40b5-47c5-a758-35856c04008a
Size 883B
SHA256 1df474f160c9c52d7896b0b3fda3c4d39ad8f0f7ca837df5e088dac8aad3b474
MD5 ec2e9b5544824f7ecd1871d126f7dd0a
SHA1 d6a51ec7d6d82350ba9ed3c2c57236baabf5f8ce
SHA512 5eda893542dc1c2f822411b51452aa621672bc4d4054ccc6c2b94cefded8e3c79f8cb915497f92a23cf00730ad76f02ad43ca250ed9d5af2ff6408a98de7b8b7
TLSH
T19E112341F638B9B2CC38821BC69577424BF4752380C599583EA14E180DBF62EA3B674B
MD5 SHA1 SHA512 TLSH

Submit Download

87af9f8e-185d-47e8-b819-dee53818c497

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\87af9f8e-185d-47e8-b819-dee53818c497
Size 886B
SHA256 c35b2f75e8b2d3efddc71d37f435235108af311b98afec60c722e7cc4f6a6a08
MD5 4a17d26da7fc065ab6b3ee0ba3198de1
SHA1 90df14295aeb81bbffffbf8a3344c11b845ce238
SHA512 72cf70834eb3e99cf92aeddf625bdbb1b977d14b0ea521778bb5841f3ddcbc7fd26d4b118f9b59de55f1181e133f13c0117c4b9dc5fc8676ffdd15de94eb6563
TLSH
T1311140419638BAB2DC7C824B84D1B7438BE4262380C65E583F614A084CFB22EA37670B
MD5 SHA1 SHA512 TLSH

Submit Download

c65f0203-8f35-43e9-bddb-a3abc014113d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\c65f0203-8f35-43e9-bddb-a3abc014113d
Size 235B
SHA256 b72f1082cb03ce7fb67c943a7a511ae8c0e9125b2b2a098ed1f0f435aa226915
MD5 58212aefac211b60d2c9b8dfc36b7b90
SHA1 d392abc0c4f89e4625a54b614ecb6599243e9ba7
SHA512 a5c9586f3b7b93017170e619b001b89fa05921ac43430acdca40b51dedd4dd8a902db770a2feb29704f8d04c2442e8a7ddbc0fe7660f69f51dea2fa6c5891945
TLSH
T126D097C03898A76C8C100F12F4B06DE630848C3350745C10CBA08438EDF8DC982A182B
MD5 SHA1 SHA512 TLSH

Submit Download

c6c7e41b-c494-4f4d-8cdd-cc68e078e0fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\c6c7e41b-c494-4f4d-8cdd-cc68e078e0fa
Size 2KB
SHA256 7565f8f875e7728ac833088f9f67ef5996674c51d739f53d23df7b4eb5cae3b8
MD5 5b230744e909eee559e685e56ee85cb6
SHA1 0080a3474ab4c17e91eefbd95809802c47a3f784
SHA512 302588a5b01dcec7ddbfa22db2fd195f5267b9e7507a1d45fb3783b58ee66da7bce54fae0c2ce12a61a723448090878aca327058d261a7fa6c739dee912eb6c4
TLSH
T1A041366C357C8DB69C9AF29DD482334E53A08A5340C52C432E52DE0CCCA6A9D737E56B
MD5 SHA1 SHA512 TLSH

Submit Download

da73e4d3-7132-4550-bd73-919cb07fe37b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\da73e4d3-7132-4550-bd73-919cb07fe37b
Size 235B
SHA256 09b96dc0aab5e6c9c7edcd7cbe8ce9f61f31719af6ec08a7da6dadbbdf66cc93
MD5 1f86e1ba0068e282ef30707d87447375
SHA1 79d3b92cb0360a3b2756e5ce15dac2613a27a68c
SHA512 724ce0bbf8791bf93e096e71dcd442dc5824a7cdb3fe58c698414956f0ba798682ed5cb5e3260456357b470f6c2461b40a233c788128676f44d545d0cf74ce62
TLSH
T169D0978028A8672C0C085F13F0B02AC6348A8C3724705C50C590023889FFEC40151D0A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\extensions.json
Size 16KB
SHA256 7e0ec002095539fdbfbc107ddb1fe8f0c4a252b098be202d7b165293909f9a0a
MD5 2f0e92b37cc203c7e80e7268c11498d6
SHA1 0824faeb0d8249455f268f0fa55e0c480fedbcb6
SHA512 83683d94341c996876d6081f61126319053293aa671df2d4d209e8b187b2c3744314f692acd10abbb688bc4de30bcabd6bc1ad2fe1c27105e7d3cbc98b9cb432
SSDEEP 384:vkI4vJUmldvi8dhWR94zE96oj5L4HtL4PDL4H+L4HRL4HAjF4h0:cI4BRfHXc4c6G4N4H4k4p4gR4e
TLSH
T18772531545048EB8294F979AEA36BE01C37D573B60845C38F4DD8FC802FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 7KB
SHA256 201677c495fc18655fe9c8faf7feef70117bb39ef069ed0a0008d7df61bf584e
MD5 3935d72203f86a92aea4ea8a4954be3b
SHA1 fd102938a0448f9aa176dad6dfb5aafc78171495
SHA512 8f549161bcff6857daf33450e2d7f346d551af5a278b75819c4df5524c06dd549a1cf5ed8e0191742c87aba1c5102f09d46fc88a281e992846decf665d96a04a
SSDEEP 96:xHX5TUDqGqd2EfkkyObzSDSSlDdv9jsnhWRFKZYu97Bw8848L4cnaVQX:tDRRfkkydSS1RGZ5Bw88as
TLSH
T157F1F078A408CF7F75B676ACAC6448315A72423BBABF68D710B954C5010CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 7489c83f6c1c334bc8b063bf900934ac3ff96abf9068bc52d0f05e6f94f6b5b0
MD5 dbbf5afaf18fc1955764dd58f3f1c632
SHA1 20b9a20785b0774b3367182be30c9d486f0c9a35
SHA512 f4d212e0ea2f2eeab498c89203495008d4d5a15f7baa6006e0ab16eefaea930cc4ea155bbbb1a7366ae0e14f90b9f40bef31a0b59e5c771796d32502b779fd89
SSDEEP 96:xHXUTUDqGqd2EfNt01zSDSSlDdv9j5nhHOZYu9fBw88n8L4cnaVQX:teRRfNt0iSSF8ZxBw88Ds
TLSH
T15BE100789408CF7F75B676ACAC6888316AB2413BB7BF68C610B954C5014CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 b43a1459f65cb03b6800116a57ffd25d6b8622d65ba2bfc25838093fa50792aa
MD5 d811f763e0696c897240d20c401b0afe
SHA1 1e5139725cb8ee57c36ea1ff213436bf7cf66039
SHA512 dece50b0729500461769a033d7989db786dabb5baab5cbf616947cbbaac7db32634bd08515e678223dc5c58c05fb4ca32c577405add3c86cce0f3808b82b431f
SSDEEP 96:xHXUTUDqGqd2EfNky1zSDSSlDdv9j5nhHOZYu9fBw88n8L4cnaVQX:teRRfNkyiSSF8ZxBw88Ds
TLSH
T18AE10F789408CF7F65B6766CAC6888716AB2413BB6BF68C610B954C5010CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
MD5 c8dc58eff0c029d381a67f5dca34a913
SHA1 3576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA512 b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
TLSH
T1F8D02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 a295cff86c72d3a3822cf64e4c566d38be24082f39234ae32931dd1d5e4aed98
MD5 528bf395fa756488325a53c57466b7a7
SHA1 e57d2093bbca30a8437609561d910af0fa769214
SHA512 c7259141df184d84a112ea15b22e1991e033670ef1ca5bd4e0c30dad3baecb6bd71ee0179bd91e99f6c5217b99c7b0fd5e3e77d1c8f9ea8d7d562c34c3385b0b
TLSH
T1DD21C6D3983B0DF6BE6A5266C0CE4BA2C25530324C7945E0E5DE050262DE21E3789019
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.7MB
SHA256 4721da35ccffe3ddd7e226122c4e1582e98d7e31004b4409378a987fccec86f9
MD5 958e0cce551ab9e11527d358ef224809
SHA1 7e82f73d7d6b2eceeafe308a1a415657fcc5f01e
SHA512 d5b749defadeeea53f7b4a7ba013fe65ff468d22a1f10c322e2f288465f419400047ebc771bdc5869499d32cedd4344b479e5c328d1ce15fc600bf0028b5a65f
SSDEEP 49152:b9yWkfn/X1ueKy2D3/YVgLyJ4ltSYtSyoWD0Y4A0Xcz+ZZwBcctqgwQCrU4rL98P:8EDC3/98Kf+b/E7MBya
TLSH
T11E665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 15bcccf47831735f7d246cebec6fcee9f366b7927eb3a56ddd1dbe8ff2ef7b7a
MD5 fc23303b09b8cace5c0e2dc85597dd17
SHA1 3284906947da383402bcaf74f081eed545704845
SHA512 18db9bfb251bee0ff10c6b204bf76be2c83b29a19804ded35fff0ce1e5db9bf2c186637d16d8e2731ee8dfd5e2ec8e73f0cdbbad39ad60c81f104ad4e4b72011
SSDEEP 49152:fZ+wdLrUSli8KV+LMC48YRUcCkX7MpRAFtnF:h+CLdli8KV+TkX7MpR0
TLSH
T16D563BE860D1A243F3418073B58993EB21FFD00C6077DA4857A856E9A574CEB8E17BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 483192fff3792a2391d8413cb24d8b292209dbad30ef185a6cce1665e8f76f4c
MD5 ce3cced7a55cf02683a35df768afc169
SHA1 5a689428ee32c3cda4d8d25406efdc004078be9d
SHA512 28d107a18d7b41c7e2a8824cce4d5c054a29bbbeb2cb594fb6d7f670bb1f0b4c47c1939f901723bec6218a96738acd58a39b75506fb74c99e86bb4f064aaa908
SSDEEP 49152:wZDwO0rUSnU8KV+VgCdhYRcc4QT7MpRAFtnF:sDh0dnU8KV+zQT7MpR0
TLSH
T124563BE860D1A243F3418073B58993EB21FFD00C6077DA4857A856E9A574CEB8E17BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 968031.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 968031.crdownload
Size 72KB
SHA256 9b4e3718bb031b287972e371087544eebc7015102343f8f885d6654de066ee8b
MD5 db1af8db93035e7d79ec78e0151ae530
SHA1 0cdb435a3cd50c0df47acabee8dc6dd54eb9c797
SHA512 7136551ab50afb1adc5a29b4526a14c3b6dc1e6f57d53b2e0b0a2c15eb5d2afd3e87149046b4cc09d1a86c1734bdc884bc5b38ef71da39be24967e445c80b055
SSDEEP 1536:IiBJqYDpNDYb2sFN77EzNca6KhFPU9JMb+KR0Nc8QsJq39:bJjDHMb977EJc5OCe0Nc8QsC9
TLSH
T1D673B083E9882525D1A2113D27B637B59A74F5BA3201C2DF758CCDF5DBC28B0926A3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download