hxxp://I love you virus

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://I love you virus
Sample260926-thy36afa32

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
221	raw.githubusercontent.com
222	raw.githubusercontent.com
223	raw.githubusercontent.com
224	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4456	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1508	chrome.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\ILOVEYOU.vbs:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
368	chrome.exe
368	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe
Token: SeShutdownPrivilege	368	chrome.exe
Token: SeCreatePagefilePrivilege	368	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe
368	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 3420	368	chrome.exe	87
PID 368 wrote to memory of 3424	368	chrome.exe	88
PID 368 wrote to memory of 3424	368	chrome.exe	88
PID 368 wrote to memory of 1508	368	chrome.exe	89
PID 368 wrote to memory of 1664	368	chrome.exe	90
PID 368 wrote to memory of 1664	368	chrome.exe	90
PID 368 wrote to memory of 2084	368	chrome.exe	91
PID 368 wrote to memory of 4356	368	chrome.exe	92
PID 368 wrote to memory of 2084	368	chrome.exe	91
PID 368 wrote to memory of 4356	368	chrome.exe	92
PID 368 wrote to memory of 1716	368	chrome.exe	94
PID 368 wrote to memory of 1716	368	chrome.exe	94
PID 368 wrote to memory of 4992	368	chrome.exe	95
PID 368 wrote to memory of 4992	368	chrome.exe	95
PID 368 wrote to memory of 3828	368	chrome.exe	98
PID 368 wrote to memory of 3828	368	chrome.exe	98
PID 368 wrote to memory of 2224	368	chrome.exe	99
PID 368 wrote to memory of 3844	368	chrome.exe	109
PID 368 wrote to memory of 3844	368	chrome.exe	109
PID 368 wrote to memory of 1036	368	chrome.exe	116
PID 368 wrote to memory of 1876	368	chrome.exe	117
PID 368 wrote to memory of 1688	368	chrome.exe	118
PID 4216 wrote to memory of 3768	4216	firefox.exe	123
PID 4216 wrote to memory of 3768	4216	firefox.exe	123
PID 3768 wrote to memory of 4360	3768	firefox.exe	124
PID 3768 wrote to memory of 4360	3768	firefox.exe	124
PID 3768 wrote to memory of 4360	3768	firefox.exe	124
PID 3768 wrote to memory of 448	3768	firefox.exe	125
PID 3768 wrote to memory of 448	3768	firefox.exe	125
PID 3768 wrote to memory of 448	3768	firefox.exe	125
PID 3768 wrote to memory of 448	3768	firefox.exe	125
PID 3768 wrote to memory of 2252	3768	firefox.exe	126
PID 3768 wrote to memory of 2252	3768	firefox.exe	126
PID 3768 wrote to memory of 2252	3768	firefox.exe	126
PID 3768 wrote to memory of 2252	3768	firefox.exe	126
PID 3768 wrote to memory of 1620	3768	firefox.exe	127
PID 3768 wrote to memory of 1620	3768	firefox.exe	127
PID 3768 wrote to memory of 1620	3768	firefox.exe	127
PID 3768 wrote to memory of 2336	3768	firefox.exe	128
PID 3768 wrote to memory of 2336	3768	firefox.exe	128
PID 3768 wrote to memory of 2336	3768	firefox.exe	128
PID 3768 wrote to memory of 2336	3768	firefox.exe	128
PID 3768 wrote to memory of 5956	3768	firefox.exe	129
PID 3768 wrote to memory of 5956	3768	firefox.exe	129
PID 3768 wrote to memory of 5956	3768	firefox.exe	129
PID 3768 wrote to memory of 5956	3768	firefox.exe	129
PID 3768 wrote to memory of 5988	3768	firefox.exe	130
PID 3768 wrote to memory of 5988	3768	firefox.exe	130
PID 3768 wrote to memory of 5988	3768	firefox.exe	130
PID 3768 wrote to memory of 5988	3768	firefox.exe	130
PID 3768 wrote to memory of 5996	3768	firefox.exe	131
PID 3768 wrote to memory of 5996	3768	firefox.exe	131
PID 3768 wrote to memory of 5996	3768	firefox.exe	131
PID 3768 wrote to memory of 5996	3768	firefox.exe	131
PID 3768 wrote to memory of 6008	3768	firefox.exe	132
PID 3768 wrote to memory of 6008	3768	firefox.exe	132
PID 3768 wrote to memory of 6008	3768	firefox.exe	132
PID 3768 wrote to memory of 6008	3768	firefox.exe	132
PID 3768 wrote to memory of 5540	3768	firefox.exe	133
PID 3768 wrote to memory of 5540	3768	firefox.exe	133
PID 3768 wrote to memory of 5540	3768	firefox.exe	133
PID 3768 wrote to memory of 5540	3768	firefox.exe	133
PID 3768 wrote to memory of 5684	3768	firefox.exe	134
PID 3768 wrote to memory of 5684	3768	firefox.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://I love you virus
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff5cb6c728,0x7fff5cb6c734,0x7fff5cb6c740
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,8768527748850283361,7508695757123458116,262144 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,12570020818877495869,9182553283103304607,524288 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,13245410887591734687,1031807224405071900,524288 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,11966555194902969347,1041832216454443321,2097152 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,17143656499227783605,13216332177626933747,2097152 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3952,i,13082204662342665500,1552037340855342891,2097152 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,7184360530131723702,4969507869752918953,2097152 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3284,i,14198010544600583885,9402758551592626254,2097152 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,9358584917928277731,14519218176561813057,524288 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,12616957841870460677,12798933416606995563,2097152 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,15949736033956503356,1348491629483210881,524288 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,987629887299985085,17732645919036608611,524288 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,10520941727441512659,9890376029786245034,524288 --field-trial-handle=1892,i,5822850914694568617,922467233125514495,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4928

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {e03704f5-0f1a-453f-a59f-8a74b5fc3864} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {0b4a7f5b-abe7-4dac-a089-655e80786237} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27276 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {4ab93316-3b84-4258-afe2-88febda9dbf4} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27276 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {a4832540-70b7-4ee4-98d5-83b2913ac543} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4352 -prefsLen 34775 -prefMapHandle 4356 -prefMapSize 270279 -jsInitHandle 4360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4368 -initialChannelId {c33cb33c-74b2-49e1-be45-98e2e495913c} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 35012 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 4892 -initialChannelId {3d769b0c-330b-4f2b-b0f1-7ae81aea2318} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5136 -prefsLen 32900 -prefMapHandle 5140 -prefMapSize 270279 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5152 -initialChannelId {b7c8a078-8fc3-427e-ae73-e3b7b389ebb1} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32900 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {b59a3604-4311-433c-aa6d-06548b7fcdba} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {9da1ee8e-b7aa-432e-b44f-bb53ffada5f7} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6372 -prefsLen 33071 -prefMapHandle 6376 -prefMapSize 270279 -jsInitHandle 6380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6392 -initialChannelId {ab67986a-9756-4b16-b472-05e9f14c3e93} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3092 -prefsLen 33071 -prefMapHandle 6652 -prefMapSize 270279 -jsInitHandle 6660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6432 -initialChannelId {4811521c-7f8d-4b05-bfd8-a2928149ab07} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 33071 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5568 -initialChannelId {391d8149-4137-4a7c-b630-e50520dbdc69} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6836 -prefsLen 36885 -prefMapHandle 5184 -prefMapSize 270279 -jsInitHandle 3212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6696 -initialChannelId {377b9184-ba5a-4b82-9093-d3bfc9a4c672} -parentPid 3768 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3768" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:616

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b973dc41a3b79244db7889b8654ccbf3dae633db6cbed2438455cf21dd1961cd
MD5 6fea35ca3699c07ea45fe1a52dfa6536
SHA1 b6fb32a5d99db640e80fa1bc18b364458ed22c93
SHA512 f2fe6cfd03d10a5082f22db4c5302db702266c2d060b2fcbfbda8ff980e44ee5a769284db77a58003415b9e1e5da439825ae183400b6eae8d77b333e1cbe7578
TLSH
T19CF028A9DD62EC3B48FD072D60754B46F76113673B81595B3B3E820D4FB063B458685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 bd9272f5c2aa5fa79351c4db10ae00cae7ab9e6b8aedd9d24993d1e9f9051349
MD5 804a7f9b1806e23d17b1cce896876ad1
SHA1 09ddf4c21cc3e217cbf1933c93c71976ef8e3aa1
SHA512 0086faf3e67c6f4dad7e7bc95329b7978bb5337375792cf68d2bcf444a7559fc5672e7d6330fd04b1ea1d9321427ce6fc0a376f624b645ffe13f42bbf3341499
TLSH
T18CC09B558644B951F774357225F514082370ED6C468617C3C14047D4A65B76A4740555
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7d9a55c2cc98f13ba68e3f4ee95a44659424b39a945e6d73829155bf7467c00d
MD5 6c765ee7c6ce868b92cca2f368d955cd
SHA1 614e388ddd17d855604f9579a035acd5d6ed8a77
SHA512 a7c75772e97d1e67abf066558154cf2a938a233c06605942356d087cc68f0261198aa286f2f146ad5605e63f3402262c5f83da8441d5231bf97bff65ca5bf04d
SSDEEP 3:MsEllllkEthXllkl2zEklGuKX:/M/xT02znGF
TLSH
T1F84404147FF11C05CD1035304011C3500770D43407315753345104137CC5D415C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e8ee600abaa968d67e80de3c14e5f126ccfdbf6088958062d189b7a36a1968aa
MD5 db61ab28346e32d019757d7e924666ec
SHA1 79a97db505f34b3c638423a14eecf3563f432293
SHA512 f9a1add2f9947d9c99f33723b303426721f5053d9316851177adf48e7e5428e54b41609844eef4d30025fa9e36981c5a6cd0f2271d1e3e2fb871c2797db57f25
TLSH
T1A3819CF7C3D8C62DC95156F4A7256F1FCE290A24532C3D56C8D8AE5F93E28B1D21064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 73f8ddd36fca2777aa413621387ca5fd667a4fee3186de34eb8618fc57ae4925
MD5 bc50b69d0e9e88972dba3a7c798ad1c4
SHA1 87d455a1e6ffae13346fc41d9241a71951984392
SHA512 0bc164d788af549b93aff3c15f5766070fa6c26051553b29da919aa3da071e592b9d3a242281924b702b78727fa5530d16651c0b01ac43c8d23a141813460094
TLSH
T1C8F050E7EA6EB463A07989AB5D01780615F9B835014118F0CE96C27DE0E14E31F12413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 859d3cc1332d4812256e46ce6a128107b7df914f3733464fc704339254d227e1
MD5 019df0b9ca4f3077731b371f7b3aa188
SHA1 958caacc9ccd7ef67fb9d9cb8f97d5cec77d59d2
SHA512 5b049d0d3b4461a863116d64889cf1973e9473467d062603f82dbd7d3677de8a5f7b6bdd63e6b43d2d48220c3956e869cabe409decf5007faa5adb579545b50f
SSDEEP 192:NRTVmfH5Ti4z1v7VNDpAPRp2h4gc9QHsb+WN6xKXZiAEiNEkw0k0PyIsnAUgE:NRRmRpFZxUX9WwjrEhUTE
TLSH
T12052A42EAD20657F9CDBD22AFA667B53D3F5102160942EC4EAFD8A3C10E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c667f7d46bdbc201ff187223f99059337f1d1c62e932f90803d97d285758913b
MD5 fdcd26605655217abe5d9f5ba187e1a9
SHA1 362e3178939bcd4f23c982180f565fad3bb14820
SHA512 9bda99338257a06599d97568a9039bc018615de10d1f412141fcee1c3fbb009c16cea25d9012b03ba58abf094faf9ffe752800ec057084f7e3689821668c06d2
SSDEEP 192:NRTVmfH5Ti4zWv7VNDpAPRp2h4gc9QHsb+WNnKXZ172ZNEkw0kNVyIsnAUge:NRRmRpiZxUX9WwKL2IUGe
TLSH
T12B42922EAD10A57F5CDBD22AFA667B53D3F5002160942EC4EAFD8A6C14E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 b494e61f07372ec9c7e51cecb31e35f7b1764c9454464712d269b67764c84218
MD5 779b83eba2269d00b677242dea1e1e0d
SHA1 4c0eeebf4312622db708a61e247a5a2a742d6b5e
SHA512 a0dafae9dea8b578fc1e281968512282b6ec5965118828fb163155216d9e94f3cdfc5a61b7a4f5636d6bb5bcc89c2c71d8f6810856f0ed434ef44469c50837c0
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3Htb5w9:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pY
TLSH
T1E562F867AC4C9E3B0FD4D649CC177A4FEDB4025621AE886482FB982503E4BCE110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0d3e96dbd010e7ab7c129484bcbd3dd925f26079a470c13302fa13630a7aa87c
MD5 4cea2d0d11da490ce8b9a6763a1b9eef
SHA1 e8889e3f80a9c8e5320b1a23a655f77c68659fc4
SHA512 021573d3d60e1b593a10a61be54b8247d501963a81948fd45fa75ff7790a31f0eb2df5eddcaa0fa42e47ffea7311cf3fd4ae5c3221de5be15e452b541dee23c4
TLSH
T1D6B0121480426701C0C302B41150148835549F14E605230143F00D01CC392E2811B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58faa7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58faa7.TMP
Size 96B
SHA256 7cbae7cdd77bdfe3d6a7c02ec5d8daa3ff896248f714c445f00da21ce0def73a
MD5 5c8886f608ddef723a8e7c32270d4da8
SHA1 da9c3b5fc48ebdec937305ee3b03a2af78260cfe
SHA512 16e46edfadc7152a2aa5e2925ca7973ac4af9914a31d11a57af5232f683105b8c1809d140a732847ddde45e7b3da42814f8e8261900a74ee1743c83058f5362f
TLSH
T10EB00295C2127232D04A03B125A5D5D87260DF29C60B1A1292E01A66ED25AB2C52D372
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 1f8bd2102c562ed8d2d5bbe88a23a23abcc0de26a1786c1d0b23fcddbf19bc2c
MD5 a29baace6c4dc2936ca17a0c6965cc6b
SHA1 6aed1b0f2d35101ec340f47ee159549bf3b9f314
SHA512 e8ab64ed6222047dea3d0bcba749692b2352ee7b73c4e06b7e9694dbcaf4efd746d5ac7cacacd71d236cb8f2ae04de02ce24fa2f8490b05b89743af2590877db
SSDEEP 3072:F+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:F+hFD+7t56OD9ZfSApprr
TLSH
T1F0D30232AA95D8BB89BD6541F157A300CD72A8ED41DE2A0984465F8EE09FD4C03B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 e50b22fb34c72df773c20b1186312ad5e315ce25943fd173e07a312374e96c7c
MD5 43ab876c4cb8ec67711173bc58910368
SHA1 aa67a7f9b0c38a1a106cadd3027b5319b4dc682a
SHA512 578b7f45db48eab385674c0d54d03e965c4ff4759d56074eff701899df07db7a6c0565d2911f4f818a293298252ee5cba3bafef666dece2e990fcbd41b05bdd5
SSDEEP 3072:x+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:x+hFD+7t56OD9ZfSApprr
TLSH
T11DD31232AA95D8BBC9BC6541B157A300DD76ACED41DE3A49444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 d7801a33a862bfb220f54af651eb91d539c8ba3248f2f59771767876535e808f
MD5 5829e12a32455b1471c32e225462494f
SHA1 d42ee4e427a2c97a5721d2251da1211062f57767
SHA512 d001f317f35b302b3714387a9c97912c3c328aec72dc3523ff68d471b1286d2d3f1a91a377c8d6b8d9e5c2c6d92ca9b1c8bbdb541fabce111efc4b8dada0f6bc
SSDEEP 3072:H+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:H+hFD+7t56OD9ZfSApprr
TLSH
T174D30233AA95D8BB89BD6541F157A300CD76A8ED41DE3A4984465F8EE09FD4C03B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 97940ffd1178c516e1d5076ed3410f1bdf7cb12a537fc56499a5702e39529c43
MD5 d9008f5a81633ecff354d449018f7116
SHA1 f3414208037b375b14be69e9c0220d7e20dfa62a
SHA512 d135678a76d06c61601c411ab37e7af657b6cf2896cdfb0cc90253a3850c0e224fd5f102be31bcafc2f1b409f15f6bde50baaa01a2e22570793260f4cd3e40d1
SSDEEP 384:HalwSiO024YpWWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA9L+XS+8:6l8ZYpWWTToXJWTTogB7S/AmVAf+hRM+
TLSH
T122728E7D8F013CAC265790E8C8BA43558D1CB3A7DFF5C06D22983E0DCA84A5A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\AlternateServices.bin
Size 16KB
SHA256 77448a4ef37493e885d00368dc843dd1e1bcbb77c38cafcf6a475d0d3eb43824
MD5 a52a2f4e15883d79eac308ee0b0ead05
SHA1 f048e2b039ff99926a909133bc1dbe1e901e6aab
SHA512 d058964eaaee27770ea65c1aea2082279ebabdbbcf9fb6c3ca3cadc550c68080ff3e4c5c1477c57d90744704d5f12d51b722b7e8610b3aad957bde58c6358259
SSDEEP 96:JO3Prz9B3AI56c9Va2a0M/pYcyx2agyuZafy8trf4X:yQv22rZZ+Ft
TLSH
T1057274F76BBA6462F0628FB04458708C9C730325856DA2C8C74590B713D6AE9D1BFBB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\AlternateServices.bin
Size 16KB
SHA256 62fad66210dcc64202e4e2d31e9e08d53fa2fa8911f71471626ded0eed6fb323
MD5 9039eb1fd592d58f5082f2c0eb05619b
SHA1 ed291d4e7f432b98babdc10a072970bff552a3c6
SHA512 bbc9d7774946e7361bfb5543d604c7f5f2b2120149cd691534516b7091cab5adcc894d87ac71166e8b19f55a3ac96c222ce316415dc8a19f6f5b36eb074a86ee
SSDEEP 96:y4LO/3Prz9B3AI56c9Va2LM/pgcyx2YNzAyuZYNTy8trkl4:aQn22/ZZaFt
TLSH
T1087265F72BBB6462F1628FB14458708C9C730339946D9288C75690B712C2BA991BFF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\AlternateServices.bin
Size 10KB
SHA256 00f9ded22b559ced2c687406f1991f812e5b220fb9d67cf6db8831e3f4b28eca
MD5 e32acedf9ff90d29b63204e49e070007
SHA1 ef824d30067c1cf598cde935e7aca1d494e1afc2
SHA512 7275a390e28db5c69e86f9486c5ba54c68809d2cbf6182158a3d4462e0d47d504b2a525f6dbcafa1bf7eb95eb9068dec6ba8d66aa08d197c4ecc71df5bfd012f
SSDEEP 24:cuhMZx091Kv9xvNS9BUFQ9VveFf5q9F55A5PFM9lmFk9BbM:nQVdS2aBKhI56d+EG9M
TLSH
T1BB22A2F36B7AA472F0628FB08058719C9C331325447DA288CB0590F712D2AE9917EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 822215743792a620de8ebd51716bb9f277db86e1bc4b238a7dba0b27b82f2332
MD5 edfcf094f378349cc73c9e78189db2b5
SHA1 134a69463936b0ad15fdfdb885c2f9fd1064409e
SHA512 a00363a3fb64ffa29c750dbbd73154fa48c6dedc01d96cb79eadf37eba8a6af8e7d82040b996202eefcd4c2c820642dad76e7ff543f59b9936966c9d7bd87920
SSDEEP 192:eJ1d66JozGzgCl6mc0d4X9Ov5zbo2ZOVZyjifMN:od66JozGzgC1jlbo2ZO7yjp
TLSH
T112E10164EA29863FC004527BCDA21F450F35399AD84E7F29319C65082D6B3DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 599ea04c51d8b36b391ad2ecdc0b121e5c5312b0d3bab7ab3b7abb38e20aa531
MD5 63c3f12432bf6e3570d73da19a908010
SHA1 aea0d5fa0c78b353c9372e7d35aa783efcd74a52
SHA512 3533a7700a8020281dcfdbe26485de340f0109b030a29ca6ec3a7457b464d57e5ba4312fecfb9758d0e3d93cd39845893c191af95a07cde8549f8238c658be8b
TLSH
T1CD21DC5E3AB94D6A5C8BE66C7881028E53E54E0A44871D439D03CE8CDDC26D932AE43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
Size 5KB
SHA256 bddf17d0df11a8f61a9ba3dd8a3a3dee33f68b7ae7c49b39ca9f3f5524d07574
MD5 020ff8e5e7996130eb178c26125e75b0
SHA1 0ca77b691e6988995ce1549d257bddb754ffb803
SHA512 5c3e940a594b3ef8bc1aeebe7cd541ba15e5828d7506872864d0eac989ba6b818975e7576ac7c7fa230b3da1b6460c177c3725151b919aabefbf29179a8f04ce
SSDEEP 96:5hDKoLOF44w4dQZ0XBadD1d3t0Z070P0h0R/0R70j0I09:5LmgauiBcD73tK0M8s/s7its
TLSH
T1D2B10E2E36654C7F28A7D62C7881438E43FD4B13908B190BDD8BDE4DDDD6789318C12A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22bfbd2b-10c9-4818-a709-278de44c0bd9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\22bfbd2b-10c9-4818-a709-278de44c0bd9
Size 15KB
SHA256 cb75492298216c79eb33a9e615b8bbedd587104bf9af2c2c167afc339bda135d
MD5 1bdb66d37f9fced74692ffb020a99f7e
SHA1 8eabd15b9005929560936fbecb57e4760dd81976
SHA512 4e17e902acd06eb452143b52eed3635222253c7f2b7d9960b6931552fde53adb8dfdb4ae71b711c0277ea3089fa64221a3cd3a5bc427175973fa441e5424b38d
SSDEEP 192:oUubu7zxS8SQ5qYXInDMrmGOkOdNRC1R42G5aEzGxFyHJusbg1Cwj85tdld+1PtJ:RuC7lS8S6qYahMEJJU1Cwj85XjuCyP
TLSH
T14F72EA562860497A8251E36994ECBFC3E5F538CF4C419FCA8BE4BD085DEE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2341bccb-88fd-4ecb-8e6d-e246f47b07c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\2341bccb-88fd-4ecb-8e6d-e246f47b07c4
Size 883B
SHA256 dca2df2adf404c73d1dff0b235465e603d6ca34d871ad2188a5e28c3d790d00f
MD5 d2f2e4b9c0a868ff271a48711c89dfae
SHA1 2e2e73bf21a0806c5bc240d206d4991a20a72888
SHA512 94eaa7355f9c22123693f9c4c776f806832afcef97230c041fe596aec6b950f3ce3931edfd8ace570238f5adf613d4e015333a7ac2ac618d963a5111b85a154b
TLSH
T106112340E6767972CCBCD24FC95137028BE4793380CA94183EA59E080D7EB0D536A68B
MD5 SHA1 SHA512 TLSH

Submit Download

a8d53b1b-54df-4f6c-99cc-b77e3b49b0b9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\a8d53b1b-54df-4f6c-99cc-b77e3b49b0b9
Size 886B
SHA256 7178ef57b44441fa7234ea5fbeeb6bf48598d94281d50bf0f7bc940fdce41e0b
MD5 302732746ba748a716400c32bc7cb84e
SHA1 72680704c6930c6ea1f1622cfc1aaa4d0976fe9e
SHA512 ada018cfea3c05313d068232c14be07aa18eef346430fecae390b6bc183903213c9e65ea2e13792eb772b74c5633ebc66246b19b0fd67d2e8e6ca342813df116
TLSH
T1A4110051AA7979B28C68D24BC6917B434BE0343380CA5D147F546E180DBE31EA2A6747
MD5 SHA1 SHA512 TLSH

Submit Download

de397c00-606e-463d-b1fa-cd946d77e921

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\de397c00-606e-463d-b1fa-cd946d77e921
Size 235B
SHA256 b8404c744ec4ae49231179df9f93d440b349c934badea8317fff91f316041cc9
MD5 9e6362431af454e7c5b7b6bda0912b18
SHA1 6e14fc9c8a8eb07383d49fae0c865b764586367e
SHA512 5e4d210c3febb4082106a3b082401cd1e8f88830c9c04f45a3dc52c4161146603f676e01e93ab4f333a453d06cf668c85e606e18476fcdc6d119eb6b412673bf
TLSH
T192D097C154A8B79D08040F0BF0A56AE2708C8C3399A468A4A5A10038DEFADC68362C17
MD5 SHA1 SHA512 TLSH

Submit Download

e24d44b3-2610-4551-b5a2-0beea7377c05

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\e24d44b3-2610-4551-b5a2-0beea7377c05
Size 235B
SHA256 fd81f0680d2ae4bd08deaf24580b59ab2ed0d56c2ffc139ac8ce035217c20167
MD5 adf9f60c98721c70ad66169a7b7a1ec7
SHA1 de7589bf599a250d6ab58dacb13b9938841440c3
SHA512 932782e2141200403d164c61cbd4b4899308271fe997bc3f66be6f8887601ecb78f31969daa2dab6b8633f1844bfbb1b3f542e8e5350e2eb4cbaf2c681446e50
TLSH
T1F7D09782B888AB2C08049F0BF0E06AC730984C3714605C21CAA05578DABEEC5412180B
MD5 SHA1 SHA512 TLSH

Submit Download

ef16679c-4108-4ba8-bfbd-32bf59d11dba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\ef16679c-4108-4ba8-bfbd-32bf59d11dba
Size 2KB
SHA256 46a9a445bb192e289ce68d72fac228e832510716c04d0074a32e15cfb1bf58d7
MD5 fd2baa7a40a86e6df1806eb352e61533
SHA1 1f3a4342529ff807fce98a6929ccc354ca55df40
SHA512 a558fbdc93cf467a792c9101767eea3c2e2e43d59b0837f0769c7ce9189df8177a1766f8d2d7739825a39e66d2995625730c0765771da83f85c2c448158486ad
TLSH
T1BF41536C75B84C3B9CCBF14D9581238E43B48E9300C668836E41DF0C8DA679D236B56B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extensions.json
Size 16KB
SHA256 20361ea9f1339bf5b1a335c0e05606ccb853624bde21e6835047c0b54b4564dc
MD5 358111af2ea1f3a48210b4ae7c45e7c9
SHA1 84369655674556a8f52173d25e45fb8e31e518d3
SHA512 1f365d54ce4e0172c9f7c1b470b96170130668c776c094c8180e0d257513f713f606ea53b262d83afc5aaacce0184b898b9be44cf94cb0707b92cbf281200fae
SSDEEP 384:mkI4vfUmldvBM8dhW+94zO96otXL4HpL4P1L4HDL4HTL4HDK4hh:pI4XRfbXT4e6Yb4h4d4P4/4W43
TLSH
T10372411545448EB8298EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
Size 6KB
SHA256 c169e53627034a5ac26f45e38e30bb24f080ddc71d4c177d1f58cd82fe23c7fe
MD5 5b0c21373eb37d257d2e24a283f08159
SHA1 66dd7209ba7d0c45bc314508db683a716f178185
SHA512 bbb35cf55b6648e90cc213d7b5af551d98c959687ecc910db1be3b0f99d970c8d490538b734b6aab61339db5ff56f1d061831b23d4a2bd4eaa701525274087b1
SSDEEP 96:xHYUTUzqGqZEfUea1zSTSSlSdv9jvnvHhW/YBw88n8L4cntGUI6:KORZEfUeaGSSso/YBw88n6
TLSH
T17FE1307891088B7F64B6776CAC688C316AB2413B7BBF28C750B984C5055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
Size 6KB
SHA256 4f729fef61103634013a2576c4be0dcfa45f6a9c93b5c555995b5f162d30c69e
MD5 d24821a31b8a0f0c761c50efe1b49de3
SHA1 11855a418a268365e656bbb4092ece06251872fe
SHA512 3f2506dc6242dc5de02825528950da3c55b69bf837500e1d2b57861efee98ddf1a3c63a2624f9249a529ed6b39a2e8336eed65d8cae700cdbc21ba432505894c
SSDEEP 96:xHYUTUzqGqZEfUeakzSTSSlSdv9jvnvHhW/YBw88n8L4cntGUITGS:KORZEfUea1SSso/YBw88np
TLSH
T1FAE1317891088B7F64B6776C6C688C316AB2413B7BBF68C750B984C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
Size 8KB
SHA256 f98ca2624204b675af33356075dc24669ba7994b16f9bb9f0c60846649b0a817
MD5 b675aaef8031d398fec6edf095de13c3
SHA1 e7d6ebf23dccb90b5b4fca46d5b8ee77aec3dc7f
SHA512 41d5db6fa50e35dc41381ab27724b85adb016cd79e0486625669bbeea40d860ff73b192cb8fe9459f9fa01e1fb51cbbdaf6aed9609836424ef28b10b684b8379
SSDEEP 96:xHYpTUzqGqZEfieaNbzSTSSlSdv9jvnvWRv9W/qmBw88fahCz8L4cntGUITGS:KvRZEfieaSSSZRc/fBw88TLp
TLSH
T1B502FD3C9105CB6F64F2366CAC244D715AB2013BBABF68D790B984C5055CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
Size 12KB
SHA256 3fd0b9e151e515afb7d128afa6164b59ed75d98f32aacaf6dffa205fb363c6de
MD5 e3490077662f57fe5a022c49af659178
SHA1 d8925f1384c6f075bb1fc2170d74a04b884e761b
SHA512 afe365cdee42e0c7f90d9e66206a9fb2a9ae20ab3250feaa62d5ff9f123d2188075a566853d6678ad913998fb8b08101895ef523604171cbaa1ee3dc249445f8
SSDEEP 192:HHCRZEfieaSSSwLRc/EOBw88DMUeHo34p:vKR2wguA
TLSH
T1E142DD3D62468B3F20F2327DBC20596519A14137BA7FBCD281F984D2145DF6442F6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 12KB
SHA256 be0467538fb9369fbc1a239f53fda220e44a04e198664746cfd74da14b7cc04c
MD5 a7a25dcd0973212b7c46955142d46a90
SHA1 66c04a66709038a70753f3fb061b3321c338d3f5
SHA512 99813fc59dee0bccfaea3796ede9ee5bf3f0be9e1fb2ff2ae4f2f0e4ad928145eb4bd5385f594dd0e8bded7bd8258b5c33da8a1cdd3f77e89565b03f930718ae
SSDEEP 192:KHCRZEfieaSSSwLRc/YOBw88miKeHo3up:KKR+wP8+
TLSH
T17B42DC3D62028B3F20F2327DBC215DA519A10137BA7FBCD281F984C2545DF6442E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 4e64db69447428035e6940e43a0907a0701858b97bea3569081454c8f9498046
MD5 d60d58bcd6303899c94ec3476b6803cb
SHA1 eef6e17f692996ccb0da92f289ffcc6395975582
SHA512 d1278eb958c081bbb9c140a1d17f205aef048e031f00b860d3208f5bf29512dce46d202b5e36656d08cee8171069ee1eee4c74f3509798d7c027b37e37989fef
SSDEEP 192:Umnw4pE149LEZkf3/8Kw5pD8gdTOm9CSqZqf2Gyq/yYPN1CbW47XFOSF:zGexEUPf6p5rUDZy55P+7ASF
TLSH
T160129E7EE67B7D9B4D1C70C948CCAF0D97994802DDF319918A2875D980F4F28A68837E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d009b711ff6f8a14f872813a450b49f779883f5b9519ab52ca69672f5b3db16c
MD5 2ba8d57db2906e0bc0abd5343fc56be2
SHA1 1ff1eac174df09397f71cfb2b8ed571fd81e7b2f
SHA512 c5b7ce77f3e2f2b6c04ca28955acbd9b384ead07f7facf6d48df23f4b9f69e0da96106ea450f10bcc84572d0572f6e75a2252893a31224aacbb78b07db30e28d
TLSH
T13321A793EC3B2EF26A519191D08C4FE2C6692131C83D58F0D46A4507B6DD6093B8B119
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 d6e85513675e9348f55be02f0988892bbcc59a615d44fa6905bf0e046ba8eade
MD5 abbcae89d6a4374f61d36d7782cfddf7
SHA1 d084c56a86dc24a3e329a744da45dfd4afd19911
SHA512 e10d6181e8c46534b01931c2eddbbbdfe47ec89276c54062da2e792aeb5fc32aaf9e0a6b30a3294c124cdd8d11c3966dea865351b920985b7130716150a98b34
SSDEEP 192:Smnw4pE149LEZkf3/8rl8gV/sOPFZSXEABX6lhS:hGexEUP67VriXtBQhS
TLSH
T10AE19E3BFA2A7DF2495C74C500CC9F4C23C15442E6F215918E288AAEA090F943B9832E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 527b376ce488e8e417ba2af7475e89e07cc13bccf96f3b386f124ad42240225e
MD5 e5594914f30a7abf9c121117c4f1c5c8
SHA1 438129f897b2f8d22cae4633a83708c7da4339c6
SHA512 67eee95798c51f13ee052e0ff6b589657411d68071468bdc7ad0dc57028079d810fd002d4e1e364fcdf957e097e84100ada9209d371066142836ec8751df2a54
SSDEEP 192:Xmnw4pE149LEZkf3/858knkIR6L9qlOi0v/4m:2GexEUPMbRiqopgm
TLSH
T1CCE18E7FAC27BDFA54ACE48404DC0F9407922401D6FA61A25E2D86AA71FCF55658831E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 a959ab7a68166e5532b67796a467bf9455befc8511e69bbf150f258778a9a209
MD5 2b1265c6e67a25698381f9e81dad63fc
SHA1 f7f0dfd9a9046ef9a8a3466eb26cec76cc421a56
SHA512 19ae502924641a0348969d4b26d8bb0a058322e220278583c3abad39f5a323b0b7051ae5479955de49e4086351b51000b7019491a68cd676ee37c3af4eea6e89
SSDEEP 192:1mnw4pE149LEZkf3/8Kw5pD8gdTOm9CSqZqf2Gyq/yYPN1CbLL3XGWiyY:MGexEUPf6p5rUDZy55PW3AyY
TLSH
T1E4128E7EEA6B7D9B4D1C70C948CC6F0D97995842DDA209818A2879D550F4F28A28837E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZpXgbInC.txt.part

Path C:\Users\Admin\Downloads\ZpXgbInC.txt.part
Size 10KB
SHA256 0f229fc818832674422a7c898645c35295821bbcab4c1c09d51d6559ab5c6ce6
MD5 6e1dd3693b56da7ef1e8b4232841cae0
SHA1 a4ddd95e0b91782a9a1e4df8a79aec62a25e22b6
SHA512 65a8e4e6dc8203378bdfc338fe17caf2a47bf780d92e7dfc68cbf66e5d5f411c00d4169d4db0c36ace5603684f260d9311901012cd6af1ac9b00bfa9c244b8a0
SSDEEP 192:wBXDFKIv3c6JuT30y4geMMM+M+MvMsM0MLMsMeMXMMcTMS6PhxSoMiPbZWI4COnC:wBzoo3c6YT30y4Ztr7on1inv45cTP6Zp
TLSH
T1FF22B8127B89D663C6A2B2713205544EF2B044F0C467D7D87C989BC438BAE5D87BDCB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download