ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc

Resubmissions

30/09/2026, 04:35

260930-e7phpaxeqh3

30/09/2026, 04:33

260930-e6vy3ss15k3

Analysis

user interaction
yes
max time kernel
56s
max time network
54s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno.exe
Size 164KB
Sample260930-e7phpaxeqh
SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
MD5 6156707c90644ea4edb71f3044d1c8d9
SHA1 237a4262696840719021a53e9322ca1fd0d6fb0d
SHA512 8fc14005a4ec1cc372e7be1d64c12899a9f304f6002ef1c87bf510697c3ee9fb8753a042e6d2ef5dde6805f349b96847f09a19ab0fa5385ea7e7ee915054d13d
SSDEEP 3072:520jWfVKLer59aSpfO9D/87jXEkeFZA4nsSyU3i4w:MIhSpfO9jC/44Uhw
TLSH
T189F34B07A6A840BEE1B7D679C9924941FB723C558B71A6CF03507AB60F777D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4312	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
5552	chrome.exe
5552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	taskmgr.exe
Token: SeSystemProfilePrivilege	1548	taskmgr.exe
Token: SeCreateGlobalPrivilege	1548	taskmgr.exe
Token: 33	1548	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1548	taskmgr.exe
Token: SeDebugPrivilege	5664	firefox.exe
Token: SeDebugPrivilege	5664	firefox.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5664	firefox.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
1548	taskmgr.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe
5552	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5664	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 5664	6084	firefox.exe	84
PID 6084 wrote to memory of 5664	6084	firefox.exe	84
PID 5664 wrote to memory of 836	5664	firefox.exe	85
PID 5664 wrote to memory of 836	5664	firefox.exe	85
PID 5664 wrote to memory of 836	5664	firefox.exe	85
PID 5664 wrote to memory of 468	5664	firefox.exe	86
PID 5664 wrote to memory of 468	5664	firefox.exe	86
PID 5664 wrote to memory of 468	5664	firefox.exe	86
PID 5664 wrote to memory of 468	5664	firefox.exe	86
PID 5664 wrote to memory of 1876	5664	firefox.exe	87
PID 5664 wrote to memory of 1876	5664	firefox.exe	87
PID 5664 wrote to memory of 1876	5664	firefox.exe	87
PID 5664 wrote to memory of 1876	5664	firefox.exe	87
PID 5664 wrote to memory of 2028	5664	firefox.exe	88
PID 5664 wrote to memory of 2028	5664	firefox.exe	88
PID 5664 wrote to memory of 2028	5664	firefox.exe	88
PID 5664 wrote to memory of 436	5664	firefox.exe	89
PID 5664 wrote to memory of 436	5664	firefox.exe	89
PID 5664 wrote to memory of 436	5664	firefox.exe	89
PID 5664 wrote to memory of 436	5664	firefox.exe	89
PID 5664 wrote to memory of 2136	5664	firefox.exe	90
PID 5664 wrote to memory of 2136	5664	firefox.exe	90
PID 5664 wrote to memory of 2136	5664	firefox.exe	90
PID 5664 wrote to memory of 2136	5664	firefox.exe	90
PID 5664 wrote to memory of 3204	5664	firefox.exe	91
PID 5664 wrote to memory of 3204	5664	firefox.exe	91
PID 5664 wrote to memory of 3204	5664	firefox.exe	91
PID 5664 wrote to memory of 3204	5664	firefox.exe	91
PID 5664 wrote to memory of 6072	5664	firefox.exe	92
PID 5664 wrote to memory of 6072	5664	firefox.exe	92
PID 5664 wrote to memory of 6072	5664	firefox.exe	92
PID 5664 wrote to memory of 6072	5664	firefox.exe	92
PID 5664 wrote to memory of 3872	5664	firefox.exe	93
PID 5664 wrote to memory of 3872	5664	firefox.exe	93
PID 5664 wrote to memory of 3872	5664	firefox.exe	93
PID 5664 wrote to memory of 3872	5664	firefox.exe	93
PID 5552 wrote to memory of 5472	5552	chrome.exe	98
PID 5552 wrote to memory of 4312	5552	chrome.exe	99
PID 5552 wrote to memory of 3716	5552	chrome.exe	100
PID 5552 wrote to memory of 3716	5552	chrome.exe	100
PID 5552 wrote to memory of 6052	5552	chrome.exe	101
PID 5552 wrote to memory of 6052	5552	chrome.exe	101
PID 5552 wrote to memory of 4888	5552	chrome.exe	102
PID 5552 wrote to memory of 5064	5552	chrome.exe	103
PID 5552 wrote to memory of 4888	5552	chrome.exe	102
PID 5552 wrote to memory of 5064	5552	chrome.exe	103
PID 5552 wrote to memory of 5424	5552	chrome.exe	106
PID 5552 wrote to memory of 5424	5552	chrome.exe	106
PID 5552 wrote to memory of 5704	5552	chrome.exe	107
PID 5552 wrote to memory of 5704	5552	chrome.exe	107
PID 5552 wrote to memory of 436	5552	chrome.exe	108
PID 5552 wrote to memory of 3424	5552	chrome.exe	109
PID 5552 wrote to memory of 3424	5552	chrome.exe	109
PID 5552 wrote to memory of 2064	5552	chrome.exe	111
PID 5552 wrote to memory of 2064	5552	chrome.exe	111
PID 5552 wrote to memory of 5284	5552	chrome.exe	112
PID 5552 wrote to memory of 5284	5552	chrome.exe	112
PID 5552 wrote to memory of 1364	5552	chrome.exe	114
PID 5552 wrote to memory of 1364	5552	chrome.exe	114
PID 5552 wrote to memory of 2628	5552	chrome.exe	113
PID 5552 wrote to memory of 2628	5552	chrome.exe	113
PID 5552 wrote to memory of 6116	5552	chrome.exe	115
PID 5552 wrote to memory of 6116	5552	chrome.exe	115
PID 5552 wrote to memory of 6032	5552	chrome.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
1⤵
PID:3624

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {34dcf0c0-8dfd-4c61-8339-bd34163f9512} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {7fdd1cf5-c273-49cf-a184-17feadbc694f} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27323 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {612d3cca-660d-40f9-8367-5b44fc37516e} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27323 -prefMapHandle 3928 -prefMapSize 270279 -ipcHandle 3944 -initialChannelId {559e041b-8a31-474e-9e41-c059862a1fa4} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2976 -prefsLen 34822 -prefMapHandle 2632 -prefMapSize 270279 -jsInitHandle 2868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {c25e348e-593a-441e-bdd3-4ef24567ed4e} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4928 -prefsLen 34929 -prefMapHandle 4936 -prefMapSize 270279 -ipcHandle 4948 -initialChannelId {6dc98bba-6cdd-4a39-84dd-8eaf79dba3ea} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32952 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2700 -initialChannelId {373f8de8-2453-48e3-87f0-387e8b188045} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {fdcc9789-1434-42b3-aff1-59ce39571712} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {46d3b29e-8e14-4c1e-81c0-0a7d61bfec62} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffabe8cc728,0x7ffabe8cc734,0x7ffabe8cc740
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,3354656684756533193,16628503442703926745,524288 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,884277255907022511,9687343380183337323,262144 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5287602301848881177,17542120177161539130,524288 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,16722402115999005455,16501420431983377594,2097152 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,18375764730103034070,13014185099949650732,2097152 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,1309654232753573010,17059738119801742114,2097152 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3204,i,17266369606459068698,9891762340714810014,524288 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,16101525363418374554,10428616285470100051,524288 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,6271432901586619430,9805973806689213979,524288 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,14843923869360572175,16832164351566862047,524288 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,8224120494751035898,18348212266179516848,524288 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5548,i,5518381698922845692,289126186171134922,2097152 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5656,i,46799334331660304,1215748423339621401,2097152 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5480 /prefetch:9
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4604,i,13747090063361076025,5660571798779783287,2097152 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5812,i,17896609938477433600,16342470396747430256,2097152 --field-trial-handle=2036,i,15037846292887107450,12066422464775256639,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:6032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a66b6fe76ef4cb460b0d857b7b0b1966f56f041e7160c67a6a451436e0343b1f
MD5 fbe72697c18194263ba805dfd7fc0987
SHA1 f16be5cbec2e686d56387fb3e99667e6a0da8eae
SHA512 29b480490a62333aae2b495182d21d11d0188bcf6f4085416fa7eff2244d04508635d11433babcc486ddc96805348e4fdeb47bc425a2170820130bbd453dc662
TLSH
T192F028A5CD22FC3718FC171960650B47F750136B2B81885B3A3D820C8FB4A3B468A86C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5aa3288754a2d5c6660019d88078478738499135d60647a26b8fa0803776eb55
MD5 ce2f0fc3ffe55f262e23b7fe81cef96e
SHA1 9956b32f5dda146160153bdc6b24403920df4687
SHA512 66fae5292090ec91bede6b95ae076a7573d133b7c6d78267888bba8cee9f008bd70de6ef59dd82de4ce8a5d5d34d768ca45356043f43fab3cc417dacf27d03ba
TLSH
T1BE11A60725087038CF9CC4744CB958890BF1160A050EB38CC1EC979ABF94AB3030D413
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 01fadca79ffc6ed1c32da5339421f2ea81da2cfdd6c8ac2845579bdea4d834b2
MD5 010e38101f82893447a57e926c0eb4a1
SHA1 16ea1ec91ed6389b6ee7ce2457df44412ef075d7
SHA512 26da8b8b0c6039aef0e24ef1303bf0335fc616a2c462b1e396d1486e6b0e7209562d53fd0a4e9417a5312df0c202cbd47c264fa8712f863d62e47c7295446e27
SSDEEP 192:DMbc4UFLyREVGPpssG32aPQvJyfPzIdIz1IlNPE0R:DMbc4UFLyREVGPpssG32aIhyf7IdIz1k
TLSH
T15CE18EF7C3D8C63D890156F89B25AF2FCE2D0A18432C3C66C8D8AE5B93E1871D25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 aa146aaaaaf55d5a6b6844cbdfcc1beca663b5ccce5a8c0acd0fb720499b7f0f
MD5 193d90a6669ed9948a9eb6c933d26998
SHA1 4b8809c55357db6caba977e8c6f954ac8f179886
SHA512 b4acfc25d0d2e557e4e60aa4467bc22e083900d9ae303c346984304e2a782f0d2f0eec2372c341ce06dd4581cfb7948e48cb43294368304159324f24e08d9d61
TLSH
T1C60199A79BAE74B310BE46B61D08B80E69BAA831139168F0DE5B427CA0914F74B12437
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ec5253920b6e50555a6bc374672d44945f92f2798a05efbfad941f851e92dd47
MD5 b4c2b1eea133db55a1d6f5a8e1e282e9
SHA1 826810edaadaeefae10a18fdbc963c73ffb6e192
SHA512 65887ea78d64e8b92fb9d0eeb59326cdb390f1603bb870bcbffbf6480d57544d8452836e9cf91410ea9dbad5e62bcceaaa7dffdf5e2be42e20b6d4bf9beb1ee6
SSDEEP 192:RR02QHJXv7qNvAPRp2UNFa9fHsb+WNnXE4la2YVQkw0VyIsnAUge:RR0Dp/m6X4dw0j2LQe
TLSH
T1CA42B52EAE24753B4DEAD259FA617797E7F6102120D02E88EAFC8D2C20E75CC3217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 28b993f4e4ae720d0aa54665def40d14114663d7c8242cee82d937ef358dd32c
MD5 2185d2d64a5f200f324d28979850d9e3
SHA1 58735a3b4a27f93e8e580b888dba6d59c595d94a
SHA512 adbdf3457625cdb6ae5cd241823bed308d0c9dd60e0d5566357f62bb0102193068a85ade77e83957302321dcea982180b8c49792378251597d070fe383807718
SSDEEP 192:RREcBz2QHJXv7qNvAPRp2UxR9fHsb+WNnXE4la2YVQkw0VyIsnAUge:RREmzDp/m6X9dw0j2LQe
TLSH
T16B42B52EAE64753B4DEAD219FA617797E7F6102120D42E88EAFC8D2C20E75CC3217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 ceb763f61412b1540c78431989044dd8af4e9a49427dc0591390b829f7420218
MD5 f9ce5359c1410c49f57066c6b7a6dfa8
SHA1 2e75c5edd2b383cf61e2e3dc861a17478fea96bb
SHA512 b9ae25efd7e3301b8eb858976c4668aa425f3c20634ab0c7c3f8ff4a36b562a2fe1d318caa33b99f56d111a4610a721ef7c3fa9b7d6b940a19941de79b3eb0f8
SSDEEP 384:Dtjnu7KxkXqKf/pUZNCgVLH2HfgslFEXODnK+ErU3+SHGZZ8x6Q+WI:Dtnu7KxkXqKf/pUZNCgVLH2HfgsDWOr6
TLSH
T127520927688DAA3F0FD8D68DDC267F4F6CB5025661744D2492FB9C1803A5BCB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 aad1177753597ff333f86ce884f10ea8c78b07f2056071375ef7c7f2a9cc5527
MD5 940a345456f362c42ee663e33da8fdb8
SHA1 5d9bfd3f4f44c24e85acc9aa5a5db6392293d249
SHA512 16c572ff7dfb31c6d0aa38b92952cb4757515c1e903639f3afc334b5974d42c562a803e602179bf631aaf43b4b78a5ad44771aa9c0a5f2f8286175d57a1a86f1
TLSH
T165A0029545444341D9048172B7C302C553427EA4A7575B4690D015549F931535216200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1d932c5a112524d7d46cafb4c9dcdf3febff841e149b6e557f44c4bdb5d169f6
MD5 8e104f82ef0fa211edc1f7cd8aab9a09
SHA1 365d7a2292606b48fef329650ec85a996aaa7d05
SHA512 d9e7e4ddd67b1ccee3824ae16791eb00dcd0d28735395abfd212a6e9844fed9932c4206a60ba5ce1c10f9197273c4b6d7c3a38df95859618ea5311bc40993afb
TLSH
T1A0A0021281D0B612DD01C2B06EA916466A92581439B3974759974546FD5BAD0D101689
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59284e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59284e.TMP
Size 48B
SHA256 76d363330f64aebf95c8d32e4190f5be74310141e68fa8c0cd27114ee6b75bb3
MD5 c715c5aebf55e7590456a80f0e9c0d65
SHA1 70fe7e8384f9717d7b538687ae7cfcc46123bfae
SHA512 af79b0891f610faea5710abbca3ee3c6521860d5f3a9d4c23b9dae7a35ff22ac7b496393cdd160476eda1cfdf70e7a39082da34392e9f6cef7431165acba4b1a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe593994.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe593994.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 65b00286efe2ae6d076261253eafa4e38af7037b87a5eb5634559fbd4a6095f7
MD5 aeb78e6ed0075042dfd5a02b6fcf7d75
SHA1 8ea4e92b5f816f4f5908f2e538b4e4d1e4c44278
SHA512 7747e52319b192e1c32680cc628f93fdde4adaaaa6d509fd3fe17e067d8594064ba0b61e2a6ea61737bf89ea85605e3c98af0fb1b371e15641a514105f782161
SSDEEP 6144:sLooQrWMy4s+Je+Otv7eSOu6fxmX/B5UgKf2ne1utL4:scHiMJs+YlKSh6JOw2npL4
TLSH
T1E14423BB6DDBFFF37211A126681A155A4CF8FFD4A230CEA041F0114855EF1D586EAB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 7f97a11789e2cc5e32245800570d62a9fd290f043a7975bf8b2a6106d059e4a7
MD5 30edc178ac0c3205d89e319c2a724479
SHA1 530b6337d3c2cc6e8515a271ae9826ceb89d3838
SHA512 7e49251f7960a1191daa9dcd3125ef7b571b1d9fcbbbf03954d633ed9dfba504764ab28e405edf85baeb2cc6d04850bdb0c4724ba8166777387d47596cc156de
SSDEEP 3072:FLahgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:FLaxmX/B5UgKf2ne1utLV
TLSH
T193D302BB9DDDDFE36361B02669A91B6EC9F67FC8A060EA4040F41189005F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 106e2bfa381d02af512192041e7256e569c000373e071e9461f7e26d80b6e1a6
MD5 8b49b31bc4d732fc9bdc7cf7b53f12f5
SHA1 d638c18be139bf6bc72eb0c83f03f52542fe4f5e
SHA512 b62a0f5367dc1536932b41e4e1c81c81d925447a3b439b51063434487537a8a7585683df196dd20dbd1c9b586aaa9f479534c2ec0a3b0fe83dd4b6e9b72f4df3
SSDEEP 6144:sLxSQrWMy4s+Je+Otv7eSOu6fxmX/B5UgKf2ne1utL4:sNJiMJs+YlKSh6JOw2npL4
TLSH
T1FA4423BB6DDBFFF37211A126681A255A4CF8FFD4A230DEA041F0114855EF1D586EAB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_736075157\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

a5290ec9-ae97-44b8-b4b8-7a2700d65604.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_736075157\a5290ec9-ae97-44b8-b4b8-7a2700d65604.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 afa40fe0daefdc10ee94b4f38ce3d6a47d4d235fbee5baccbe0558009428d3bb
MD5 2a5a73768b64a3adb66a99cc551933c1
SHA1 e8283a004232079d1d50484b9a94dccd01ec2993
SHA512 3f19b0a649c507648435f86d919caf330948df26087c0ae5530d6c34ba6d01c99ebfa08531269eb295ca7abcecca9a9e45340a7d8a7f34270bb25d9818062c12
SSDEEP 192:iOv5zbo5ZOZyjs881d66Joz0dzgCl6mc0d:Bbo5ZOZyjcd66JozQzgC1j
TLSH
T17BE12EA4F629867FC405027BCCA61B550F36398B984E3F2935AC74082D572DDBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4a5cf5a641b2959213f91e31aa80bee8d9ac64e9cd66923d1fc9c22d423c5dbd
MD5 7036c469e27bfd3b7cbc6f559cc13144
SHA1 05d848c2e9ae8f0457324c096593588c10e15e03
SHA512 ec768fe2720cb83d065db4e4097ebac3225144eb8033ebc56e64c06ce46b817a8294678fd325c727c1c7cddaff467023996ff13c0eb97219269b28c5c217cf36
SSDEEP 192:POv5zboHAZOZyjs881d66Joz0dzgCl6mc0d:gbogZOZyjcd66JozQzgC1j
TLSH
T1B7E12EA4F629867FC404027BCCA61B550F36398A984E3F19359C74182D572DDBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 436a8ae9b3ff6d6baaf9f0585bfc4f232601c75b8c7452519c402cfdc6436acd
MD5 6c0d881f279243baa239754e926231ae
SHA1 fb0e800c1cef64970e1ff686537002d9c132c663
SHA512 c5ebd8f496355982cdec627edbb668a468e7782b2393cc90aa255bd0913c4bb32f107419627764f02fee95ddd6b95380b82db1228d006ce02a3d4d6120ea77b7
TLSH
T11A213A5C3AF84D6A5CCBE65C745002CF57A58A0A188B1D431D02DF8DCD95ADA32BA83D
MD5 SHA1 SHA512 TLSH

Submit Download

34ce13ab-c3f1-4f0a-af4e-d1a645d9a939

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\34ce13ab-c3f1-4f0a-af4e-d1a645d9a939
Size 235B
SHA256 4221799ad8392905a8ed769ef8467590a3cd4126833539a80604d60047df758b
MD5 23e092f0057adc143401e88e9f52e6b6
SHA1 2606324ff6c9c2c7462d85740bfffdbc3c2bdd5f
SHA512 a0bbad3fdc7fb52c118ac3a63667e13512c6655e824a72358b5a6737aef6350f7fd35106d945766a9ab7827b4446f7f6f5a1ff28f8a00544414220d55b349aa4
TLSH
T10DD0978868986B9C48042F06F0E029C230994C33E0799820C9B2453AEDBEAC502A286B
MD5 SHA1 SHA512 TLSH

Submit Download

36ca4e62-15af-4a22-852f-6d148220de55

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\36ca4e62-15af-4a22-852f-6d148220de55
Size 883B
SHA256 01ff70d7a9fd2a622da4bf243e633f276335e21892c70b6a0c1cfc4929f9464d
MD5 d96c3c9691ae3d958f8218458fb36fd5
SHA1 704ea5a126606fc39d9e63439548a436754b8e75
SHA512 374956c8f9cb6ac23edec26f8820f9d94acdab981e9f2afe85597ec45252db44dd190ec20c84f17c92411c4d91eec6de5b279a57344db22cf21e5846741bd9c4
TLSH
T1591140C0A52279F69D68A28B85A6774687A43123C0CA84103DF06E044C7F50EE3A6207
MD5 SHA1 SHA512 TLSH

Submit Download

39725307-c310-47b0-95a5-02603003cc38

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\39725307-c310-47b0-95a5-02603003cc38
Size 886B
SHA256 a0af70240e2de0ab11216e86f5d24a218bbf875a23649f17952e68ed3d929049
MD5 5e104edbe222e1252249dd3ee337b699
SHA1 a55d8fc0898445aecfd76596c772268d74d6339c
SHA512 143b81a6943e58a450b1f5c7a54d3aca395217402e138d0b96ff20269180b625a5a7466fdeee1239758f7ded97221774bb08f5264afc48a1371b0951c67850e6
TLSH
T1AD1123D09A3575F29D69A28BC5F2774687D03123C0CB4D147EA46F144DAA81DEBB3307
MD5 SHA1 SHA512 TLSH

Submit Download

48adf642-69d0-4263-b198-293f176be9b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\48adf642-69d0-4263-b198-293f176be9b1
Size 2KB
SHA256 43f2affecfd2ca6f3810c1abcaafa113cc69b36cbefac7e35bae6f7d981c2af0
MD5 7f40a4e48752cb82bb9e16fa09b98551
SHA1 f3bef64ede8c002dc6108943a7f26a877a3f82d8
SHA512 c8ea4999093869bdd10c0a80005d758052e0f1995a99d77d147b6d95ad4c58b340ae943fef4927bb97a5f4da4c5619774999f6e07402d0c174a625e887b92ad0
TLSH
T10941669C75B85DB7ACCBF18DD092238E47208A4300C62C836D61EF0C8D9269D73BE42B
MD5 SHA1 SHA512 TLSH

Submit Download

db3d4d8d-91cf-4547-8039-5afa542e102a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\db3d4d8d-91cf-4547-8039-5afa542e102a
Size 16KB
SHA256 16ed2c5065d70dcfcf5e96daf248c022f6ce3034e49f506b5e88cd9baf6d28d1
MD5 d46d3da3b602b0485e27d11b6862b9c1
SHA1 7021e57c040700245e0eabcdf28b7158273767c9
SHA512 99813a30dbfabd95a47bf22e46bd9fa74561771633dee670054bc2915e2ea9d0b89d53186dcb990e3fdac99ad4783ed2814b07982410d3ffac6c139ed3a70579
SSDEEP 192:ZI68SiQLzxBsPy7BTk1LAoO+iXMHX5wAYmIoBpE3kupSL+Ts95oC1mLEIdEEgA3:ZIDSiQLlB+y76Ov8pwAhIoXE3kMmJA3
TLSH
T11272DA56286055BA9251E3A884EC7FC3E2F538CF4C419FCA9BE47D086DEE06D512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8a7e510-abbb-43a4-86f7-b2c9b4af60c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\f8a7e510-abbb-43a4-86f7-b2c9b4af60c7
Size 235B
SHA256 9872d417f9acfd7956b22abe8213757ae2e63f52d91d4abb98737ad177d512a1
MD5 f270173a4157347c6aa211a9c10da66f
SHA1 5855c108ba1f7dbb212f491250b034116d517d46
SHA512 9aa91fd8077dc84d2146205e0b2c3ce26d783f2c08b290bdd95fab83ee527749c5405502503218a862eb0f67a05f7dcafced7b8cb7035d2b2ce373a956bd86b9
TLSH
T19BD097802888A36D08100F07B0E17AC731484C3364B27820D69206B4A9F9EC8016180B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs-1.js
Size 6KB
SHA256 45ec918b9f84be8caf42f13c322d28151a9d508c3c5115ee9a5792109254c340
MD5 a78fd9945b7f742b4368a91c910231a1
SHA1 7bc77291ba387cc41674cb9db7fc6eaab0b52cf5
SHA512 3b5ebcb2163be262664d1a229e28e8bb97cf628c9e0c7b352692668de1b143c89bb9c02d177fe6d378da2d2dc8672385eb679e33ed5c1c22e371c8ebf518c513
SSDEEP 96:xHAmUTUJgqGq4fypkObzS+SSlcdv9jxnIHGAvzE3KF7Bw8OH8L4cnh1VZx:hRR4fypk0SSJG/KF7Bw8OmN
TLSH
T10BE13F7895088F7F68B6776CAC6888716AB2013B77BF28D750B554C4054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs-1.js
Size 6KB
SHA256 f2a7af62c33e7e4e8506d31f45e792c90a346560df45880df2e47bf7070effdb
MD5 9cac37fe73b13e4279944242f81cbebb
SHA1 07ea0463a22f07a61b345462ba56ddc8c9d9d465
SHA512 d37752006204e857d44f9871c8eb3fecdd4c19d97d95815e196cac3f644ed0830cdb63b85a6cd26f517564bf50ec897632594762ba9387f7aaf1ed89c364760c
SSDEEP 96:xHAmUTUJgqGq4fypk1zS+SSlcdv9jxnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fypk3SSJG/KF7Bw88mV
TLSH
T1BCE12F7895088F7F68B677ACAC6888316AB2013B77BF28D650B554C5054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 6KB
SHA256 8a40d6ca23fffa9312477812c6b3a367712b2536521f447ee369d36d3d502577
MD5 f4f9fe6b411374d04b8eef76ebd1e66e
SHA1 1959bf43d0d475092192ea591743a6e998d5e0fc
SHA512 5edac0b65347b49f1a2dce24318d604a4d294c8fe60a3c89392a4df6701f1be5d6344ec59a02bccb8239f874cce15efa06ba105b4bbe6297231994aa842b23dc
SSDEEP 96:xHAmUTUJgqGq4fywj1zSISSlcdv9jSnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fywjNSS2G/KF7Bw88mV
TLSH
T196E11F7895088F7F78B6776CAC6888315AB2013BB7BF68D750B95485050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1548-7-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-10-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-11-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-12-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-9-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-8-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-0-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-1-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-2-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download

memory/1548-6-0x000001DFCBBB0000-0x000001DFCBBB1000-memory.dmp

Download