8c2c17001c3fe560d4dba8ff3b8f47366fcd0f3d6252dd9fd3b82420289ecc04

Analysis

user interaction
yes
max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HLS_Updated_FGD_File_v2.rar
Size 20KB
Sample260924-cx13macb67
SHA256 8c2c17001c3fe560d4dba8ff3b8f47366fcd0f3d6252dd9fd3b82420289ecc04
MD5 c67f247eb7021dbae18bb2fd9f1cdb5b
SHA1 af8029903f267f94264303ec9843bbf54bae2c79
SHA512 c443d4b7387ca1ea465794790dbe7bf89fa40fc6e50446851be5a90544fd9114910ac19baaf60f7211588a4092cab469ac7244be38a6fb2dd936b93a125ba2fe
SSDEEP 384:SWnxPGuOOCR/AVLTlSKp0ADFR3itVSwcdawaHEBlFQ82WB/XN:SvuOOoAVTlSHA9lds6FQk3
TLSH
T1EE92F26EB7A49537ABF9BCD7F057427C02D7A43A2B86AFC7E9C45D52F2200030696C85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	222	https://www.whatismyip.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a3fe5e85cda27796	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2064	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346905839084668"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4068	7zFM.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4068	7zFM.exe
Token: 35	4068	7zFM.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4068	7zFM.exe
4068	7zFM.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4144	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4144	3980	firefox.exe	115
PID 3980 wrote to memory of 4144	3980	firefox.exe	115
PID 4144 wrote to memory of 1008	4144	firefox.exe	116
PID 4144 wrote to memory of 1008	4144	firefox.exe	116
PID 4144 wrote to memory of 1008	4144	firefox.exe	116
PID 4144 wrote to memory of 4612	4144	firefox.exe	117
PID 4144 wrote to memory of 4612	4144	firefox.exe	117
PID 4144 wrote to memory of 4612	4144	firefox.exe	117
PID 4144 wrote to memory of 4612	4144	firefox.exe	117
PID 4144 wrote to memory of 5184	4144	firefox.exe	118
PID 4144 wrote to memory of 5184	4144	firefox.exe	118
PID 4144 wrote to memory of 5184	4144	firefox.exe	118
PID 4144 wrote to memory of 5184	4144	firefox.exe	118
PID 4144 wrote to memory of 5208	4144	firefox.exe	119
PID 4144 wrote to memory of 5208	4144	firefox.exe	119
PID 4144 wrote to memory of 5208	4144	firefox.exe	119
PID 4144 wrote to memory of 5412	4144	firefox.exe	120
PID 4144 wrote to memory of 5412	4144	firefox.exe	120
PID 4144 wrote to memory of 5412	4144	firefox.exe	120
PID 4144 wrote to memory of 5412	4144	firefox.exe	120
PID 4144 wrote to memory of 5328	4144	firefox.exe	121
PID 4144 wrote to memory of 5328	4144	firefox.exe	121
PID 4144 wrote to memory of 5328	4144	firefox.exe	121
PID 4144 wrote to memory of 5328	4144	firefox.exe	121
PID 4144 wrote to memory of 6456	4144	firefox.exe	122
PID 4144 wrote to memory of 6456	4144	firefox.exe	122
PID 4144 wrote to memory of 6456	4144	firefox.exe	122
PID 4144 wrote to memory of 6456	4144	firefox.exe	122
PID 4144 wrote to memory of 6464	4144	firefox.exe	123
PID 4144 wrote to memory of 6464	4144	firefox.exe	123
PID 4144 wrote to memory of 6464	4144	firefox.exe	123
PID 4144 wrote to memory of 6464	4144	firefox.exe	123
PID 4144 wrote to memory of 6544	4144	firefox.exe	124
PID 4144 wrote to memory of 6544	4144	firefox.exe	124
PID 4144 wrote to memory of 6544	4144	firefox.exe	124
PID 4144 wrote to memory of 6544	4144	firefox.exe	124
PID 4144 wrote to memory of 6036	4144	firefox.exe	128
PID 4144 wrote to memory of 6036	4144	firefox.exe	128
PID 4144 wrote to memory of 6036	4144	firefox.exe	128
PID 4144 wrote to memory of 6036	4144	firefox.exe	128
PID 5440 wrote to memory of 6176	5440	chrome.exe	130
PID 5440 wrote to memory of 1464	5440	chrome.exe	131
PID 5440 wrote to memory of 1464	5440	chrome.exe	131
PID 5440 wrote to memory of 2064	5440	chrome.exe	132
PID 5440 wrote to memory of 6444	5440	chrome.exe	133
PID 5440 wrote to memory of 6444	5440	chrome.exe	133
PID 5440 wrote to memory of 2796	5440	chrome.exe	135
PID 5440 wrote to memory of 6924	5440	chrome.exe	136
PID 5440 wrote to memory of 2796	5440	chrome.exe	135
PID 5440 wrote to memory of 6924	5440	chrome.exe	136
PID 5440 wrote to memory of 1124	5440	chrome.exe	137
PID 5440 wrote to memory of 1124	5440	chrome.exe	137
PID 5440 wrote to memory of 5368	5440	chrome.exe	138
PID 5440 wrote to memory of 6160	5440	chrome.exe	141
PID 5440 wrote to memory of 6160	5440	chrome.exe	141
PID 5440 wrote to memory of 5828	5440	chrome.exe	143
PID 5440 wrote to memory of 5844	5440	chrome.exe	144
PID 5440 wrote to memory of 5820	5440	chrome.exe	145
PID 5440 wrote to memory of 2516	5440	chrome.exe	147
PID 5440 wrote to memory of 2516	5440	chrome.exe	147
PID 5440 wrote to memory of 3288	5440	chrome.exe	148
PID 5440 wrote to memory of 3288	5440	chrome.exe	148
PID 5440 wrote to memory of 4176	5440	chrome.exe	149
PID 5440 wrote to memory of 4176	5440	chrome.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\HLS_Updated_FGD_File_v2.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {e141162c-768b-4b48-80f3-748c6317c1de} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {2a8eb155-fe54-44a7-9c6f-041f927e5b29} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27276 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {9728ceb0-db48-4023-98cd-fc6cdc87c7f2} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27276 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {1d8f0d5c-83a0-4ba4-8bd6-ecd517c91609} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3388 -prefsLen 34775 -prefMapHandle 1000 -prefMapSize 270279 -jsInitHandle 1352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2972 -initialChannelId {858c8ef4-3629-4179-9f38-6f6a91e3851d} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4844 -prefsLen 34931 -prefMapHandle 4848 -prefMapSize 270279 -ipcHandle 4828 -initialChannelId {893e7655-c430-40a0-a155-16b541c4f1f5} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32952 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {8947ac58-4136-4b4c-a21e-e0313f827632} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5388 -prefsLen 32952 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 5396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {fdc96e03-4204-42be-919d-91bf803a2be9} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2776 -initialChannelId {b8e88b0b-ae49-412d-8360-56b8407ca7cc} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3012 -prefsLen 33071 -prefMapHandle 6184 -prefMapSize 270279 -jsInitHandle 6188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6196 -initialChannelId {2e447cd5-8bfe-404b-b480-5a1e6a0109ce} -parentPid 4144 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4144" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff86452c728,0x7ff86452c734,0x7ff86452c740
  2⤵
  PID:6176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,12349874851773460183,14788536317266537597,262144 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,4213880216163754215,4699387166307665360,524288 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,14908809872696924426,17111953251956664415,524288 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:6444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,14852193159509443800,17130231503276385556,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,2952299664842384961,9126609998604730027,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:6924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,9920858844547474529,12193000335064365193,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,10965335872571931253,16443722593396993523,524288 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5364,i,11908777820283058154,9122534421297613231,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:6160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4432,i,14597990311948787192,706719566299522978,524288 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3996,i,10637574983192082867,16711523913905063717,524288 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,33547882032059699,16516619089036514,524288 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5764,i,14980284197700441196,9934246794443385653,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5548,i,4557094555774052970,8230209290162927158,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5888,i,15191132446853416559,7876038028890692640,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3252,i,4840269091180284850,17671662325938010810,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3536,i,12752346414448239346,10510829494006712887,2097152 --field-trial-handle=1908,i,9952448675070017161,4232791343530714435,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4720121d4085dd8edd4635b4bc743faaef0494877eb2296d81b1f35f8f5c30f7
MD5 be9a5ddc7b0511f5407abbe1a0907866
SHA1 2cd9b6d525521f1096c81016f94a791eecef8a4d
SHA512 fe32780316b3c5cc1bf70cc9db93ccd8ce87ce978f0355be0b08ddfbb95a22a4001c19580000e10e3a3cf45a0b0c14fc6c20e026c81277a9dd979975ed46bff8
TLSH
T182F078A5CD21AC7B18FC0B2D20A80B47F791136B2780899B3B3C950D8FF563B428682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 8973f7dfadd43a59cc9a3e42aec789c5321b2fcd79fe3f95033289b9c9ffdbd6
MD5 bbfc78f86754589c35851565e7bef694
SHA1 abdd481033d863e721d7dfded30a730a53438ace
SHA512 26694138ae56dbcfc2ce11dacb21e2cc1c410102ccb04d28b3633c7ba81c148d7c7fa7c9d907ccbb23f1498ca6da936fabbcff41e80664e66652bb3e293af505
TLSH
T16EC09208AB601805FBA93D7452C2B68121A41E3D050AEAB7C2C8116CA8A36F18A00003
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e31a052f6112dff679447317ee40d303b52a5d9d9ebfd02ab13056da8202fc58
MD5 db35f24943408e1a791b56f7d764dcdf
SHA1 3d7b5212c9ba2aeac15232d65158f4b1fe159775
SHA512 34deaefa273159ce684a0933eff7ecbd109bbf71febfcf30884c2069ea50e5a04a4e5a6783dc8d94ef47656641552c9447d9b86e1c95b0d02edd5285c2857818
TLSH
T17231E735EFAF8824FB19BD3107A11827A98800FD416EE90F11725C84AD832B85E06BE3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e4f225df0b8b006b3b4c5bcd39cc71d9182d471bff7388723a1656aee2282f60
MD5 2eae06b5bec9c7efa50a1f34e9e596fe
SHA1 f491cb5b0295bbbdacb5126883d27d85b8a23e48
SHA512 d495923d1e7f476c5972d5c4c17051b421a93c022e80fabee44d2a50b6980d012187130d07f97542d504628e3cd86cb8d6bdac3901e64a223d5ba9305f241f87
SSDEEP 192:DO4ZoWjTu7uagWJmJakykAUNs9/UpRVSaPcvwfPDNPgIegfZN5LsE:DO4ZoWjTu7unWJmJakykAUNs9/UpRVSs
TLSH
T17402AFF7C3D8C62DC85556F49B25AF1ECE290A18422C3C27C8D9AF4B93E18B2D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 bafff850a00f379da0a52f9bb5885c7d4611754d4f8bcf39d1b06ca619d70485
MD5 5971c1f42134d18b0da5382354e944bc
SHA1 cd74d06fff127a106a732873f6b347ef5a4de9de
SHA512 e0a0214cdd05d19c337df0779099a9f4944f88982579efc6e68dcf712e0926a5ede96800128e055de126a4cf780515128513b0e46c0b835bde01798a284b34aa
TLSH
T124012BA7D6AF743750B989AF1E14B84516FABC39015164F6CF66826CB0C64FB0F26413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 018b34d971cb42c3c3745619684284461970927071dca55db7dc7de89c82bf46
MD5 b4a0f74942d91f0e137af4e95cc2ae74
SHA1 8eb6283f16679b8f12ed2128560420f1c5978ffa
SHA512 ff04b96eb54774ba91f729fcf666a17bc81b098f7ad6cea2f77d4b54fb29eb4fbf8906e6f29cb28abb33bd02077de43c2f6e497ab57588c8dbf2b108769e9918
SSDEEP 192:mR+8w8jpv7UpAPRp2v9/Hsb+WNnYUd+CEkwcVyIsnAUgtaJ:mR+81pAUXchwndEY8
TLSH
T13132832DAD24753B5CDBC22AFA263B52D7F5103160942E84EAFC8D7C19D79CC621B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8cb651eefe1dae69cc3e7c92f41bb07b78622dc8344e7541e08ec281b90a2b44
MD5 7655ffffd1bbdd3aec87a0e644a16db9
SHA1 0a71c6f2fc4c33b2dfa5309df6f59dd32607f4c0
SHA512 2cc6728c44c9f4afd2286e77247b500b5247f69cff1c113aaf8bc2d3da38cb70337e11f60294ce69b9c9dd70b5fd7186eb945e54ad7f09855641045cad293f50
SSDEEP 192:mRmcBh8w8jpv7UptPRp1cUB9/Hsb+WNnYU7l5E+CEkwmVyIsnAUgraJ:mRmmh81pAnXFhwnXEEee
TLSH
T11E42932EED14753B5CD7C62AFA267B52D3F1102160942E84E6FC8E3C29E7ACC621B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 144B
SHA256 8ecad523857c47b5e409ee7d776ca24ce2e97d8408467acc0b91b2f581a9b0ec
MD5 286b4c64b977635f0fa3fe9176357e73
SHA1 9677dd86d343d9e1ee886d9917d69eb502c43ffc
SHA512 0016b2a1d8477601e172a0725ef9540dbca322400b70eb83f7a56b5ba49a86ff07c52074cca0bf66c56ae78f5282bd03ccb816b0c862dee8f6f67fbef822d5b9
TLSH
T1FBC012C123C04808C44C413013C320C20391DA1B031E880F80A206D4F5371D3CA50241
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b1fcdb4a8975c3e4a0a5e59312486d2bf03961be6bf5e9f111624a14a56b4968
MD5 e0064e6330aedee8f1b8d1f833dcd875
SHA1 f4b737a8dd4449aa631568d8b429d97769e00208
SHA512 1433f94a6810c2bcf3f61eea87d1093d8d073537639a83b57894f5ebb500134fbb1a84b5b2feb89f63c4aeb1c35dc56b4e9d0fb9b62e5be3ba5491eb33a27f00
SSDEEP 3:MsEllllkEthXllkl2zE/l/Mbl:/M/xT02zQMB
TLSH
T1954402046FC1840AC900223180A183602371D51406165B43245104225C87A404C01004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 2ece402739a9e5074d5440b11689a8a85ac7be04c533c8295693250958532654
MD5 3368271bfcff791d9f59e501d4aa87a2
SHA1 3b373cad1f5200850e86a3934a5bf0f6416fb74d
SHA512 c3b1731438939835bad23c84b37b71bfd1a026c3d99a97258c6040fa72c8ab675209985f4ee971c505e19508b370f4534cc584b9dc58df0e4237c458cc3ff544
SSDEEP 6144:Xx9q//E9GyiFtodcMTWP/Bp+W47dtocew+hFD+7t56OD9ZfSApprh:Xvq30GT62NPppD4JtnyFSXD9ZfS4r
TLSH
T185442320AE70BC8749FD5902A00767119CF39EEA86ED754CD0DAEF86E1CF95E0B53612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 303KB
SHA256 88a87c32b4be03a31ae434363954f3cdfdc2281ea53184b1c6d018090a5a88c8
MD5 6cb0ec85d618b4e4d6fad2320af5e78a
SHA1 1bd152f98bbb45aa0c5dc4c460d1888932e3fbaa
SHA512 0b872d1ac09adaee16e46165160d085c246cc527ea1e9d9c9089acd3acb62d73cc12c81e47c76529a971f0134e16dd6111a70cf5245641e5b92d408a1a81d221
SSDEEP 6144:z/yiDlcq//E9GyiFtodcMTWP/Bp+W47dtocew+hFD+7t56OD9ZfSApprh:z/F+q30GT62NPppD4JtnyFSXD9ZfS4r
TLSH
T155642361AE70BCC349FA9503900B77159CB3AEEA82ED7149C45BBF47A1CF85E0653B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 cb8207870bd4c04daf840e68db94a731d6fed514d3d1e23cd0e7f0b3d001cef9
MD5 658a38abd9d6c351ccacda241443828c
SHA1 95aad87a2ce107f81f5153c08a14eea4535eb4db
SHA512 3ee5f06e98c1149d61969c3bb4efb61dd141e2ebd8a5f0658c73af1dc126a48db7d415099cde6cac8e2d720d12873f8557eba8266514bb106dbfcba0375022e4
SSDEEP 6144:U/Jq//E9GyiFtodcMTWP/Bp+W47dtocew+hFD+7t56OD9ZfSApprh:Uhq30GT62NPppD4JtnyFSXD9ZfS4r
TLSH
T16E4423206E70BC8749F95902A00B67119CF39EEB86ED754CD0DAEF86E1CF95E0B53612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 f9424053953def5829c1c6784f8d0a553f74b869cee4034c0042edd62169beb4
MD5 dd5635bccfbe6c752ea636a5c92b26ed
SHA1 64ef34f60fc6a9bd4c59851a60d94b63469eb5ba
SHA512 e1c2b21123c3832d2965c74c50d30ad90f94f698b9aa291233cd8cc00b513e8b712c64b2b8308333d02a35cff14f5314d4b116ee4aa020f3673595f30932d94e
SSDEEP 3072:x3O+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:VO+hFD+7t56OD9ZfSApprE
TLSH
T1F5D31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 c63341185d432f8e275dffd3b36184e3613ae078c5acf629e92c0a27f98cf113
MD5 e094930579c91511756df831df2843dd
SHA1 746d7972426748edcc0b05459fa50192d52a635c
SHA512 947ab01dce034dcc4670016887a72e3d9f02802bd5df6dd2cab0119b9ad1c2c9d299b1ffa117318d2d95e1696aba166a092e670261d0b3869013d1b487733ad5
SSDEEP 6144:z0q//E9GyiFtodcMTWP/Bp+W47dtocew+hFD+7t56OD9ZfSApprh:z0q30GT62NPppD4JtnyFSXD9ZfS4r
TLSH
T11B442310AEB0BC874AFD5502B10B5711A8B39DEA46ED364980D7EF8AE1CB95F0753B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 fe07988d5b6b1531b3f068c9bb0cdf03673f1b0eb0e1b4ed98d6f7314e9e695b
MD5 1779da63c9954544558b0fbd12d597fb
SHA1 6f8cb50806f69e09a2fe7ee9d90c47760a50dea2
SHA512 bbd9c700b139e0e69eb9ee9e66c29df6d3465946715ef18dfb6201b39541b9a88fd99ab7f7101e48fd79171d025d4e44f4ac7c901ae17b2f5b6cdfcdd9f8c069
SSDEEP 384:HalwSiO024Y7ZDL84KKDL849B7SOEAd9KVRaAcP+AWRMAHL+mS+v:6l8ZYNDL8lKDL8CB7S/AmVAf+hRM+LXP
TLSH
T170728E794F003CFC2597C0E8C4B942A58D08B7A7DFEA806D21683D0DDB94A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\AlternateServices.bin
Size 6KB
SHA256 140cefa1af9caf154d617c5a1182319ef9a899da474cdccc48b16b7807e9bba2
MD5 c6cc732aa4233178ccf56b9bc3c9782d
SHA1 5c8656669fd7a635d1de3fd86c936154cdb102be
SHA512 bb25bd11808e45224f8788db873cad1094b6624cd26724aed0b311e4ef24fa9100ac9b94b34bdeaca118767435959a75605d0573ecb680aebc33d44dc9bb6e4d
SSDEEP 12:i38MQphMQSQrg8b4qnc3Xw1b4pG4GEc3Xwxi/I8fjnc3XwBf6ItEc3Xwxi/gC8fO:iMMuhMZ6P91liu79BNiLRO9xZixz+lz
TLSH
T1D4D14CF717B69463F4918FB0885E309C8C37063A6569D0DA864590F342D2BB990BEF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 45ee3ffb72c8d2e85b5fb4cc7e1bc1ae53609de4ad1023b2aace33a18c9b0ec7
MD5 ed8523ace243416f674b298aca4e1b1f
SHA1 da2ee26fff1ddef5e2dd2a720ee69eaacd6ccdf2
SHA512 790673c82c1c3bca7be2e9e802c88c1021b814af281960436dd2d208a1ddc00dc8c605890826811f009070b311fdeef70876aabe142d277947e4a3d77e0a2e79
SSDEEP 768:WLsBMfn9Gcmhus4vYURc7Z0IkbUb/bzbd1EmB2:WLsBMf65Uk+
TLSH
T196D2F084EB1A953FD42912BBDCA54B002F79B88958092F673A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 4ea7c817f47f6c44605c15eac65a9b9a0ff845b1e9046e629dd7a771b8c0ef0b
MD5 c2991f17430ea9f7a184a940d255c948
SHA1 2329074a54619ee14ea25bc0fcb291416ffddca4
SHA512 20052a541ee0a6a7c876108f87b7c4a1c68e7f63357425b6ac3118fe259e60bcf1896666d0dd263fda9693439ee70aed7da5691f73c03fc7ac4fe1449e02a798
SSDEEP 768:WLsBMfn9Gcmhus4vYURc7Z0IkbUb/bzbd1E3e2:WLsBMf65Ukc
TLSH
T10DD2F084EB1A953FD42912BBDCA54B002F79B88958092F673A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 d8e53a614170991e31a2b9d983d8029b67628d6b1528e61160c3d42460764aef
MD5 c82e9609176fec704152a0695929d3b2
SHA1 d3650e0ef31f5ed1b439d04055627e45a5289e2a
SHA512 37e82b20acbf899a3e24ec0b9eceed0017aadc9e0c12956059e00b040439109dfc4b5526a99d5f15e03b73f827194724cb37fe64ba6222e4258514152c4d2532
SSDEEP 768:XElLsBMfn9Gcmhus4vYURc7Z0IkbUb/bzbdbP2:OLsBMf65Uki
TLSH
T1D6D2F084EB2E953FD42912BBDCA54B002F79B88958092F573A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 08be705a229a2a963d1c8c2bcbdec5d95a053d5e59efb65d41d55d53a8851017
MD5 4a8554be57d40ac44d7becbc00b26641
SHA1 362ce0027886a70bb2bf82af31c5564252d6e542
SHA512 4575dfa88d5983dd89a43b451faf27e9acca0a06698586e9627395ba3c59908b347588b0c1df6256f81a5cdb2e12a574202bbae23edbaa3079cdd57016a157f8
SSDEEP 768:WLsBMfn9Gcmhus4vYURc7Z0IkbUb/bzbdfEY32:WLsBMf65UkI
TLSH
T10BD2F084EB2A953FD42912BBDCA54B002F79B88958092F573A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9d390fe5d814a1796d2d0639caac6782b6d01f89dce73f95b1947c07fd7a5aed
MD5 003bb25ac644ae1de8682bf1dc1fef1d
SHA1 ca524e98fc900c38c81fdfff7c1545dbc0322565
SHA512 5d7376d8facc6f6027b92d5160f5a004726a9cca7007e0a9222f594eb89633f05bb25e9d2551326beef9c6631bcdcd07b4dd2f399f201a6eba952a33b93fc9ae
TLSH
T1A1216A5C3AF84D2BA8CBEA9C795412CE53958E0E05871C475D12DF8DCCD1BE932AE478
MD5 SHA1 SHA512 TLSH

Submit Download

041b3dc8-d0ed-4aa9-9b54-b921512f92e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\041b3dc8-d0ed-4aa9-9b54-b921512f92e2
Size 871B
SHA256 b27d2237468f1f694319577575f0b2330690f594c53187cdc61fe016662c12bb
MD5 3bf99edab51cabd489af7a36a8f9ba6b
SHA1 7eaa47c1893673cd76301a3070065e799b05c433
SHA512 dcc5c845d349fbc95a54cf604a7777518344ec264c7473f2a42866c1ce725f25d04b6dcdd7073de3f9318d334732cdfd63bfb8bd7e92abac3872543b0e6b29aa
TLSH
T175112381F770B5A2CC79929BC592770197E47513D0CA92083DA58E180C7E91EA3AE24B
MD5 SHA1 SHA512 TLSH

Submit Download

2376b1f0-eb4a-404c-9fd2-075c8746ee35

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\2376b1f0-eb4a-404c-9fd2-075c8746ee35
Size 235B
SHA256 034d80041e98652ac833944e900d6b993ebced476e0ab87236c22829c408be41
MD5 45b4fedc20af082e220c665e33ed3d2e
SHA1 655c8a92cae78a6256edccb1ba2981fc73add7c1
SHA512 da5dca28a9306c02b502c20388624db0bbd67099cf520be4fc7a9b88330b0bc5ece4b3f27d82854270a4e8b6129b33184be4e2c2f54056e9c2c64f20c41033ed
TLSH
T1B8D097A0648C7B5C1C185F13B0A06CC2B0844C3310E16820DBA005B48EB9AC84161C17
MD5 SHA1 SHA512 TLSH

Submit Download

7e7672e9-5147-4500-a294-09c1907d262c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\7e7672e9-5147-4500-a294-09c1907d262c
Size 886B
SHA256 67c1a2de531a3014a4662b0a47d5f8ab47039f35fc3e0bb86412a0ce15eec032
MD5 a6f6c0c24a5d47aeabacb3b91c61ce75
SHA1 9a78684945f8d0a7c0c1d02a2c9e413089b89557
SHA512 f9a008661a9cc21cf91868bcdc0bc0940ce0e95c652f69723e5f5bf8f95e377ea6bb0f3bbe0986a4ea892ab12b135ca36b4dd4c8dbd73bbfa95946ade597893d
TLSH
T1AE1140419770B5B28C29E28BD5A137424BD07123D0CA9A043DA88B180CBB41E67AE207
MD5 SHA1 SHA512 TLSH

Submit Download

81296117-3b70-41aa-84a0-cf9ea36ab5e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\81296117-3b70-41aa-84a0-cf9ea36ab5e0
Size 2KB
SHA256 82141874738a262541bf99ff82970e3cfc6c7fd4aee1e19f08209b3122aecac1
MD5 7ddb3c642c8a74758ac8c5d33679dbd9
SHA1 1c50f5fe6de3145d3345ab190ea9a803439433b7
SHA512 8636b808abd06545dff578ad427804345cb2006e65314061de595734e267068df8a187e9c86123fcd5495c5d692fb7889995aaaf5ff3ea463a2f8452f36ce07c
TLSH
T1CC41105C76B84C3A98DBF59D9482234D57B08E43108A2C432E91DE4CCDB66AA336E11B
MD5 SHA1 SHA512 TLSH

Submit Download

b4f261c1-c72b-41c5-a8f5-4f6892c577cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\b4f261c1-c72b-41c5-a8f5-4f6892c577cc
Size 235B
SHA256 7b24387d44d6be34a563aa12b342d34821f4b871c3f26b080cb634177f4e6cf9
MD5 df501302bd2875deecd8710c285da37f
SHA1 fdceb3f46504a4723bc704f9edd7d9cadba083ea
SHA512 9d219401a4bdb822df4bbc3055641670d80604a0fbdf182b9c7050752587988faf78d97ba1cd95596204d0b4ce7087088ef8d8586c20a809f5cb0e547060774c
TLSH
T1AFD0979028A8A31C0A080F06F0E06AC330898C33246868109D754AB5C9FEAC80252846
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\extensions.json
Size 16KB
SHA256 f9c123936894248660e6d0a73e309647129209b54a19badaf67e66bb1e7f237f
MD5 c4865e817378a3ee008ff93a141d8d5f
SHA1 2fde870d9ffd25d804d014e319c650e2df19a1bd
SHA512 e91b8bc49bffdcda3dffab581db7a35df1b48c0c487e2b018539e987b0170a1ed8e62200ce885f8fa39f42f24c60ad06c46291db7d4f9bbd218947370ff350a9
SSDEEP 384:6kI4vuUmldvr8dhWC94zn96o5L4HLL4PNL4HZL4HAL4HB34hpU:9I4WRfYXL4x62434l4x4C4l4zU
TLSH
T19072531545048EB8294FA79BAA367E02C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
Size 8KB
SHA256 91970692a41f3be373f6b16d9a773001e01a452358ca20e544f5bfe875cd2e40
MD5 fa4d9b972ab84f8e23084926f797963e
SHA1 225982078801b2853b53d456c21f5652247e541c
SHA512 25183f0d70e0d6494cbaa6270f5abedca5708c5bd58acba810da1dd5097cee06b55907df354e3a170e3ebc6036f393501489a179349c1cc7f98ca0b10bb27392
SSDEEP 96:xH6tTUBqGqgXfLHuNbzS0SSlSdv9jGnzRWRzV2tUyCvBw88Ill8L4cnpV1pbGS:kxRgXfLHuBSSF8RktYBw88JpR
TLSH
T18C021D385144CB7F64F676BCAC284D715AA2013BBABF68D750B994C4011CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
Size 6KB
SHA256 7f05f3d779f96caf6e1f4cb3eda0956558daf663724470a385ac7e7b6703ffa2
MD5 b576b867557bfe44c76153ec18939c48
SHA1 8d540fbe59cd743c0b532da37b601cb750e98c3c
SHA512 e6b89b3a0fb817e0544353bf6c2b6b5a5daa193ef415cb6c0fa13ecc7e74cefcda2c0ab648cc07680a71f91e09245e0020d272a624451e13afe43f462155371b
SSDEEP 96:xH6UTUBqGqgXf6WJ1zS0SSlSdv9jqnzRHytUyCYBw88n8L4cnpV1pS:ksRgXf6WJVSSJ9ytPBw88EpS
TLSH
T196E13C7895088B7F64B6776CAC688C316AB2013BBBBF68D750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
Size 6KB
SHA256 43e8d83a959366ed1c09026131d3ada8a4f2f6ff08b53db08f3f602987be24d9
MD5 2e188cf5f99d21c5cf94c2d1be2c098a
SHA1 85775bbbba47116c1505484a228d51a30b05e9a0
SHA512 85d47d0571fdabedba8d4fdc52887c515478d2cdb2213504e055597027361ca9bf3f95d40f30b034c9dd815cac44cb1341edb264121f7570d28e877938e21a76
SSDEEP 96:xH6UTUBqGqgXf6WJ1zSXSSlSdv9jqnzRHytUyCYBw88n8L4cnpV1pS:ksRgXf6WJCSSJ9ytPBw88EpS
TLSH
T17DE11D7894088B7F64B6776CAC6888316AB2413BBBBF68D750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
Size 6KB
SHA256 2353f479d9d1f0ef4ffb3cd45400c659162f056ff937ccaf4bd15db04d968d54
MD5 10f3e862aaf9d4835266375d16a943a5
SHA1 16859e28d45eededdb68109f948752fc21600513
SHA512 6e91e5195046efb3d13f1880d33fff0c3c682975648f9189724246560ca35f53ce45a0bf241ab14365086cc1c6902f06c1b39bfee682eb9c7755b53274295c6a
SSDEEP 96:xH6UTUBqGqgXf6Hu1zS0SSlSdv9jGnzRHytUyCYBw88n8L4cnpV1pS:ksRgXf6HuVSSF9ytPBw88EpS
TLSH
T182E11F7895088B6F74B6776CAC688C315AB2413BBBBF28D750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 b6db418050fc94a9b909769215d037823df12a10dba39c433750d72dbde9d911
MD5 8635e8d19e5edf72c3786bd5a5df94e9
SHA1 0b3a087328033f2a887fb9feb5ad48b134c79e62
SHA512 23632d18fd6432f64df30612cdef42e102fee82169b6f178af9b6cbcb059c43f6a22f06b92076ca66f226b65f1d82a6f117afe63bc480a0c5911e8d6b0781703
TLSH
T1CF816C75C95C9C86F8F8A7FA40D648E3D77F600047EAC865F8151539C0872C927D4776
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 4265db0228bfe506ab165a35ad41c98cca9e338761d4f649f85ec806ded0e0e7
MD5 8506bfc9f16546f035a8ab7dec10ffea
SHA1 cb9293ad0293bfba6e69f7274d2aead9c30f79d4
SHA512 fefcc182dca5c77cee0e09cbb725cf6dcd0e62a425e70a6a066d1a3c5f38f4f828e31f09dcb07779de01d47d95e19c78edaf8e2844e87b27c81ee3c52cea34a0
SSDEEP 24576:qwpGlu4DBXpSOjyADYBveY4sGtcr6ILWrQOYYaQLuw8BBBjZNTWII:BpPkdGCYIN/QOYzQLuRdjjTWV
TLSH
T13E362AF820D1A257F3414033764593EF21EFD00C6027DA085BA95AE9A5B8CEF9E16B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 9b0f9f846f72685ac3370cba524195f34cef7dfaee97987b1735e223c5e7e65e
MD5 e8b2925d3eeff3458c28cac604acf076
SHA1 a0c8c48e6a27ad32ca1c600e9d367dcd36a377f0
SHA512 0af73332a4054be5e6aac2c670051ed0092baf4891d1beefdcec793d4260dfd3bcffaf80e7c7c97698401e0fe5de8ac66ddefea4baa6279631ac87986ec982b3
SSDEEP 24576:obhSeUfl9QjyNEYkGW1PEAZVZcrE5LWHQO4Yaa0uw8BBBjZNTRwWay:obna9QGGYUhgQO4za0uRdjjTRH
TLSH
T11C4619E820D1A257F3824033724593EB21EFD00D5037DA085BA99AE9A575CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download