6ac5428d7bb2133541edeeb763eff6e0096bd838c40867704151d4a724f72e79

Analysis

user interaction
yes
max time kernel
78s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14.jpg
Size 209KB
Sample261011-vbamnadf56
SHA256 6ac5428d7bb2133541edeeb763eff6e0096bd838c40867704151d4a724f72e79
MD5 da64089b30f1472712f6a630ee6f45bc
SHA1 ac7046a560d6677701419728da8e73d9eee1a166
SHA512 0cf25ab33e32055d1528b15b52577016dcdf54011643486b94f5eff1a8be161a2d53548cb5436f7afffbacfdae811fe1a8eeaae63c5516b230110581a5935887
SSDEEP 3072:wEbUzdNgc2a3nFXkMlUD+L7pRqpd7PX0fSWNZCkhwAYus4HZbucWMx9GO/N8k:ydNl2Ksy4djXuSDk+AMiZCcW0QO/Wk
TLSH
T11D2413757D885027F9728A3E2A0F618C7854DCB5F6347EAF09C864E9CC418BFA0506FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5680	chrome.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{B174063F-1041-4F85-A203-BC6CEC66533C}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4540	mspaint.exe
4540	mspaint.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe
Token: SeShutdownPrivilege	3056	chrome.exe
Token: SeCreatePagefilePrivilege	3056	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3248	firefox.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3248	firefox.exe
3248	firefox.exe
3248	firefox.exe
3056	chrome.exe
3248	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4540	mspaint.exe
4540	mspaint.exe
4540	mspaint.exe
4540	mspaint.exe
3248	firefox.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 3248	424	firefox.exe	100
PID 424 wrote to memory of 3248	424	firefox.exe	100
PID 3248 wrote to memory of 5048	3248	firefox.exe	101
PID 3248 wrote to memory of 5048	3248	firefox.exe	101
PID 3248 wrote to memory of 5048	3248	firefox.exe	101
PID 3248 wrote to memory of 5796	3248	firefox.exe	102
PID 3248 wrote to memory of 5796	3248	firefox.exe	102
PID 3248 wrote to memory of 5796	3248	firefox.exe	102
PID 3248 wrote to memory of 5796	3248	firefox.exe	102
PID 3056 wrote to memory of 3820	3056	chrome.exe	104
PID 3056 wrote to memory of 5680	3056	chrome.exe	105
PID 3056 wrote to memory of 4472	3056	chrome.exe	107
PID 3056 wrote to memory of 4472	3056	chrome.exe	107
PID 3056 wrote to memory of 3228	3056	chrome.exe	106
PID 3056 wrote to memory of 3228	3056	chrome.exe	106
PID 3056 wrote to memory of 1044	3056	chrome.exe	109
PID 3056 wrote to memory of 396	3056	chrome.exe	110
PID 3056 wrote to memory of 1044	3056	chrome.exe	109
PID 3056 wrote to memory of 396	3056	chrome.exe	110
PID 3056 wrote to memory of 3216	3056	chrome.exe	111
PID 3056 wrote to memory of 3216	3056	chrome.exe	111
PID 3248 wrote to memory of 2380	3248	firefox.exe	112
PID 3248 wrote to memory of 2380	3248	firefox.exe	112
PID 3248 wrote to memory of 2380	3248	firefox.exe	112
PID 3248 wrote to memory of 2380	3248	firefox.exe	112
PID 3248 wrote to memory of 388	3248	firefox.exe	113
PID 3248 wrote to memory of 388	3248	firefox.exe	113
PID 3248 wrote to memory of 388	3248	firefox.exe	113
PID 3056 wrote to memory of 5172	3056	chrome.exe	114
PID 3056 wrote to memory of 5172	3056	chrome.exe	114
PID 3248 wrote to memory of 5124	3248	firefox.exe	118
PID 3248 wrote to memory of 5124	3248	firefox.exe	118
PID 3248 wrote to memory of 5124	3248	firefox.exe	118
PID 3248 wrote to memory of 5124	3248	firefox.exe	118
PID 3248 wrote to memory of 5384	3248	firefox.exe	119
PID 3248 wrote to memory of 5384	3248	firefox.exe	119
PID 3248 wrote to memory of 5384	3248	firefox.exe	119
PID 3248 wrote to memory of 5384	3248	firefox.exe	119
PID 3248 wrote to memory of 3972	3248	firefox.exe	120
PID 3248 wrote to memory of 3972	3248	firefox.exe	120
PID 3248 wrote to memory of 3972	3248	firefox.exe	120
PID 3248 wrote to memory of 3972	3248	firefox.exe	120
PID 3056 wrote to memory of 5612	3056	chrome.exe	121
PID 3056 wrote to memory of 1776	3056	chrome.exe	123
PID 3056 wrote to memory of 1776	3056	chrome.exe	123
PID 3056 wrote to memory of 4056	3056	chrome.exe	126
PID 3056 wrote to memory of 4056	3056	chrome.exe	126
PID 3056 wrote to memory of 3876	3056	chrome.exe	127
PID 3056 wrote to memory of 3876	3056	chrome.exe	127
PID 3056 wrote to memory of 6088	3056	chrome.exe	128
PID 3056 wrote to memory of 5228	3056	chrome.exe	129
PID 3056 wrote to memory of 6088	3056	chrome.exe	128
PID 3056 wrote to memory of 752	3056	chrome.exe	131
PID 3056 wrote to memory of 3196	3056	chrome.exe	132
PID 3056 wrote to memory of 3624	3056	chrome.exe	133

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\14.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:424
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {306eed13-445e-429e-9408-6b68c84439fd} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {a0078060-890f-4172-898f-31974b10727f} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 27325 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {f0921f68-a602-4d31-9a4c-d4db743f4784} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27325 -prefMapHandle 3632 -prefMapSize 270279 -ipcHandle 4200 -initialChannelId {a0152ce6-e791-45f2-b835-3289deea54bc} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25213 -prefMapHandle 1628 -prefMapSize 270279 -jsInitHandle 1640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {bb553fd2-7e4c-4f11-a986-f15b9f372985} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25213 -prefMapHandle 2916 -prefMapSize 270279 -jsInitHandle 2820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2900 -initialChannelId {e639f726-f69e-4448-86e9-eac9c9ddae90} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4528 -prefsLen 25213 -prefMapHandle 4532 -prefMapSize 270279 -jsInitHandle 4536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4544 -initialChannelId {fa85d086-e771-45c7-95e8-57038498ec2b} -parentPid 3248 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3248" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeefaac728,0x7ffeefaac734,0x7ffeefaac740
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,18290448036486762773,17699692246388405303,524288 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,9641470459693712216,141550163678253878,262144 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,8341448861663936502,6398731010913152741,524288 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2332 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,17843149164667711031,12747842306966495793,2097152 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,5275575441128666433,3697864760355113559,2097152 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,5244650221678116061,4293198340098874317,2097152 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4804,i,14822191915717304833,4197017792699535751,2097152 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,12389024718746139187,12781088094454153203,524288 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5828,i,5012837538682514317,9407182776493135855,2097152 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5980,i,8662048071291337742,17302307282863361065,2097152 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3460,i,16617602066265698217,13259445465358212785,2097152 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3448,i,8738392081730743995,3677466803182529847,524288 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,10361960167166967784,10834895932487868835,524288 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,16814231152713594532,10004045141711584465,524288 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,12486213522094903838,4254210496976422950,524288 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,13399398096229496779,2404933288302128686,524288 --field-trial-handle=2096,i,7590192403850503359,12665974582459261873,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

237abeee-1f31-4328-a34d-438224d92a69.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\237abeee-1f31-4328-a34d-438224d92a69.tmp
Size 268KB
SHA256 caffb1ee4783f87ead0b83dca8b37e1ae375d4179ded91a3938737bf65ee0ab7
MD5 b7f0fb2a97f6b62102d635dc3e272bb3
SHA1 c0f08fc1a5003aecc366849768aa137c5693194b
SHA512 d3d955fb83931240d3a8c2cad587c1afc595d2f1d82d24bc2322215acf42730bdc78992c78e1dee1f2bbf0539148076cb157174900fd879333c7cb13b35d40d8
SSDEEP 6144:rVQGSGkEZ2rJDyOqrKjbB+hFD+7t56OD9ZfSApprc:SxxJr9bByFSXD9ZfS4K
TLSH
T13E4422236D868DB78EFE5206C1FBA705C9B579F78A99690540528F8B524FD4A0333E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28ea8f05-4fe2-407d-afaf-3356bd777464.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\28ea8f05-4fe2-407d-afaf-3356bd777464.tmp
Size 269KB
SHA256 ab27e0f5db2c428f264d2c07620d3b5d45a4c96ffd86204126682cf5d8102ab1
MD5 ab28fdc457c72a8cc08684ba8892a752
SHA1 3aa64968e4bb869cf4342c3d83c0f75dc53058c5
SHA512 9ff1cead5e0bad594de713fc6647463b2501b8141e67bda638ce5273e5d92f96872ddf1552883d1f9208b632d87cef9617124919cb2b224b61362c870071390e
SSDEEP 6144:44VQGSGkEZ2rJDyOqrKjbB+hFD+7t56OD9ZfSApprc:AxxJr9bByFSXD9ZfS4K
TLSH
T14F4422336D464DB38EFE5609C1BB7705CDF57AF78A99A90580528F87A24FC4A0733A21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30c533ad-69a8-4926-a348-e3506d25ed77.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\30c533ad-69a8-4926-a348-e3506d25ed77.tmp
Size 268KB
SHA256 f790f8592a1bd5f60e5834ee59c97d71a3871c7c32932cefe7a6b96bb97c522b
MD5 f272cd4071b031117eb529703f7fccdd
SHA1 0dcbf18f63f6bacbe99f644e3a90a88264c311d1
SHA512 4730acac9df7b5abb20b6f233b4b969c81cfa56d6db8ed52797ab7a0d22805859c236ebbf103bea1715d9864b2110be76b69bfbc1d4abe9d9aa58213c9982e96
SSDEEP 6144:YVQGSGkEZ2rJDyOqrKjbB+hFD+7t56OD9ZfSApprc:vxxJr9bByFSXD9ZfS4K
TLSH
T12B4422236D868DB78EFE5206C1FBA705C9B579F78A99690540528F8B524FD4E0333E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2527d9a8-f544-469a-852a-2bcad1252356.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2527d9a8-f544-469a-852a-2bcad1252356.tmp
Size 13KB
SHA256 0c6a942539225a88be770b724678958fc0f2a67879fbbb566939f5a171d4a6ad
MD5 12d6b9f9a7f8feae9415c1cbbeb39c44
SHA1 b84e8ec8ee041f71b8d55fac7bac742bd419c501
SHA512 034f04b8341209a3c64008ffcd710bf59cec73ada2b4d7452c1d47f3414821ff85616931ec6912e216f5cb19f7e2a73811167e196f63f91b50c600d591b7a81e
SSDEEP 192:WRncBz3LcheLH5L+v7thAPRp27I8H9THsb+WN4WVd7NNeeK+7rfokwEaQAAVyIsH:WRnmz3p6h8XKJw7zeeV7LokaFE8
TLSH
T13852A32AED50353B4DDBD71AF961B627D7F5102170942E84EAF88D3C14EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

296e445d-d9ce-4350-bb2f-df5a42e9b97b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\296e445d-d9ce-4350-bb2f-df5a42e9b97b.tmp
Size 12KB
SHA256 d364a01b36e965a9b840a575f86c64b46adf56073e1bf10ba1d39f15cad29b22
MD5 56568483bd8694761174f624e635963f
SHA1 98b41efe8732d0eccf03a64416c7a612edd6b203
SHA512 b65c582745f803f8935e7bbfbb56dbcd4dd0601bc77fcb5445fcf5b5d9ea9b24df9df775b7f8f5366284cb51d4e85ecd4f21dd5d583ce1471309efa612947210
SSDEEP 192:WR73LcheLH5L+v78hAPRp2Y479THsb+WNnVd7Pb2e8+7rfokwEaQAAVyIsnAUgtK:WR73p648X4Jwff2e77LokaFE8
TLSH
T12152B22AED50753B5CDBD72AEA72B627D7F5102170942E84EAF8893C14EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b66c6cf-bcea-49cc-94e9-65b4f2cbf845.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7b66c6cf-bcea-49cc-94e9-65b4f2cbf845.tmp
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 a1ceb3df9fb44cafac57aa6814112f415b31d062f45029b84330a4c8b6ee2223
MD5 807f8ed795ff77a6c52f008ff70e789e
SHA1 d2c5b378d4c9e95c777a2b2767248cc4ad57eb05
SHA512 9ab714adadd47d5e4124250693f0bc2366fb520fa9148d5980bc80be30880fe9d42b57c815be020acbbdaff434bd0209888b1050bb269ea06030c9dd97638703
SSDEEP 6144:gK5i8M8Z3iE2CPijzOflx7Dcya48kFcUl0hFvpBuEHAWwuIySTPxtBJyS4Nmir+R:gKA83iEF7nFzlk5uZuIySTDBJyJLrFiT
TLSH
T1707423104324319ED4DF2DBD4C016ACABAF2899E18D3E6DD0CB1F1E69257C1FA626B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9c2ccd5-3ea7-4bb0-888a-07299a55d1f4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f9c2ccd5-3ea7-4bb0-888a-07299a55d1f4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 a9273efd97a3fe363aa83f25251561619f8f4b41af51a884e89f865a6e840ed5
MD5 8031cb197dbd7d316029df17810e489f
SHA1 f70625e0f143a6d010b6a67df068ae92186041d8
SHA512 c6fc6e0df8deca4b346f7b84cc0af0b0b06f2013f319c4fac2d67ffa7547c2a8fdb0ca787f4013ad971308dcfd793982fca6d5bb98fa08438772aeb82a4b997e
TLSH
T182B0120681812301C40503711194A45533E49F34D3131386A2F01E428835160C12F118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 353958a94445d729030fbf7c8bfd43297028f2b4d485a15ff885633370c89d03
MD5 b4521cf4735b018b9eedeebc6f85a959
SHA1 525eb39cacd5cc5ae09b5cae00b9edb186c3be2f
SHA512 757cadb456349004382eb30af3d538c3249ad5d8fe5a41de87ff93b264e6ecd1f8229e90296a1cf8bce158888cd8fb2ed5b353ade0ff41b69aa628b9951e166b
TLSH
T19AB02228C0822203C08203F022A88EE83828CF28CA03020282F00AA2EC20B33A0380B0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 a05b41dfdacd1709b8217579ed71432028a479bd82bf6f276203c11027ecb872
MD5 45044cecb8bcf8ed498a8c0112d31794
SHA1 61480eda37ec4a108e2db84a9d4e0a6986527816
SHA512 495d8b0ae4bd28e64172a3170ae87ece30a5dc04e34509bf4d175d106074fb77a459ffe834fc089e60acd12913e1cf581e87fcee99d78dd527a1aab26484c4a6
TLSH
T1BEB022EC828A2803E800833CE3CB80C03B320C0B330BC03B20E000A2C2A330302C022A
MD5 SHA1 SHA512 TLSH

Submit Download

f400d350-9627-48aa-9ba7-4574e2800660.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f400d350-9627-48aa-9ba7-4574e2800660.tmp
Size 414B
SHA256 2f4c3fffb5cffa7a492c482527e13d9c420df39bf7d2074d0f9d3850dceefc1f
MD5 80a909bce00668d9af6700de10a3561e
SHA1 79c7f3db6fe9ad8e8e4937e2e931c7a4460c4dce
SHA512 75348ebe34b949f207e25d8abce8743c114e40e9418502b1596f71e52b7b7f3e0df828a6e2c2eb453bb776877218348ef8b851514842a32a5e34045a8abcb2b3
TLSH
T1C3E02BF6C8619C274CFE172921A5C649FB54236B7B408D4B3A3D801C8F752368699D6C
MD5 SHA1 SHA512 TLSH

Submit Download

f5807b30-6557-4c73-88fb-8d9ba4d4d30d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f5807b30-6557-4c73-88fb-8d9ba4d4d30d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a9ab4db2-d795-46bb-9659-762169209c8b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a9ab4db2-d795-46bb-9659-762169209c8b.tmp
Size 130KB
SHA256 93574878fb34c320ac0ab58cba4b809dbe54dfb85ab3aff9aa4d65bcf3297df7
MD5 3dacb99ec52dcd818aa4db69a097f978
SHA1 da014eb875ccdceab18422724c8554cccaa0103b
SHA512 317ecca5924fcf5ad61ec15a908d6671ab5e2c2e792f08916c2510689de7e40395f31388af8576fc9c25ac5f4332401250626fa2443ed97a42e1646bde6c23d8
SSDEEP 3072:T+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:T+hFD+7t56OD9ZfSAppry
TLSH
T127D31232AA91C8BBC9BC6541B297A304DE766CED41DE3A09444A5F8EE05FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 b44b1b8cf4df2b065e3512fb516bd7d6e145c0896334816f5e2a6e4dcd4e6a80
MD5 ceb6564d2cb0b44c44faefe503234844
SHA1 f2d5d3bc1065b4c16137aecdccda5cd261fdb35d
SHA512 e76d1ee32c5fbd556d47763905b23cbdbeff7d0a51dce0aeb25a8c74e45d622f8079159b5e734e6acef6454ad53e670a6c2df4f0e5e8b1ea1d97ca4806bff17c
SSDEEP 384:HGNQiO024YJWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA9:mDZYJWTToXJWTTogB7S/AmVAf+hRMQ
TLSH
T1C8729E7D8F013CAD2B5780E8C8B583598D18B7A7DFB6C02D269C3D09C988A2671F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 d42abede677e6209ff94f2cba8cd74066d92e8743273f46ea34cac7041744aa3
MD5 16e5a7d3164c4f75dd66506accc1088b
SHA1 bafe46dc60410cbaca999f024e0ac7519feab8da
SHA512 6a62543dea90f909799b07c03cefaa94bc8fa1f3f8e06d9fb2bdcf24ecae52841d0c2f2b847d377e15203cebb678646638b8fd8f3cb315d7e159ecfbaf328d3b
SSDEEP 1536:jTrliqN4iDSaLPUl9/Oj8cyXWz9pDlCmXDO42v423PQneSOm7HjVndOdMg0s1jPg:j3ljPUl9v/Qn02hu7fQeKR1cj+L
TLSH
T1F1B3AEF6DBA3CD3D69FFD01DAA82C83EFD222444B3A32009C953635561C6FB86675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 01d1e475b5b0c38418004c60780067eb1ef693432755efcd1fc19a39efc52c6c
MD5 397bc910e1cee60c41fc7aefb75f4767
SHA1 3cb87c332a449725ddeccaeb73feaefeaccba335
SHA512 d5a9203545fb0941e6721b54ae53649e01d86cd60e57b4fec4ba4ff71884467c8bc6ce53119828e1d32932e529fdfbc008952d5b4fdf82738bae2bf7a9704ef2
SSDEEP 1536:XTrliqN4iDSaLPUl93VHiHIcZYCN3MDlJmXDO42v423PQneSOm7HjVndOdMg0s1h:X3ljPUl9pyZYS8X2hu7fQeKR1cj+i
TLSH
T1FBB39EF6DBA3CD6D69FFD01DAA82C83EFD222404B3A3200DC953635461C6FB86675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\addonStartup.json.lz4
Size 4KB
SHA256 8a9543ea41b6e6eadede2fbc236538dc646963d3729da78414e0e63e89df6a17
MD5 f47766d625a56f4ed1c198d52de92d86
SHA1 197aaf1cb66bb771e2dc0d995eef8a0c37382548
SHA512 10304a7752ac934ba0d40566a51f560a593b423d725e2f125ee0f2c9fb93acec61bffb83a5287edd52eed4574ba457bed460347a75adb6eb2eb53cee7b47eed9
SSDEEP 96:Nbun64sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NbI52xxhD8rGvm6ApwnHUuhN
TLSH
T123A17D7AD541EFB2FD32C04358D97FB2EAA5AB7414A9C4D0F1ABB1190D74A735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\extensions.json
Size 14KB
SHA256 0acc10790033cd2500356283104aec1f6fb9d136f03b3a28188ff08122d976c9
MD5 fefa1934a6bc305995a5c0bfeea10c4f
SHA1 7151986a3dd03d2c7a7f79ea6b8d2ab899a21462
SHA512 365ed8a2fb345ed081b5cceda94b1893680cde1be29d42ddd1266739bc4bb848e71a4de42e58de63595ae9d9a914b3ca8ea5839eaba56dd68f54452380f261ab
SSDEEP 384:xkI4vDUmldvmC8dhW294zK96oSL4HgL4PYL4HtL4H7L4HC:CI4bRfuXP4C6v4i4i4N4H4i
TLSH
T13362421545049EB8298EA79BAA36BD01C37D473B60845C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs-1.js
Size 7KB
SHA256 2a2a2f1ab31c7b818f9889a00a53d82d23feb13e4e15c351a87aae94a51741ba
MD5 e755914e11d6d44ae28fe5bc87070699
SHA1 96cb92a494887f2a66411934640e46eb01af0bd7
SHA512 43c5655d258bd8ffd5a6678f42bda85f974424047d7d5c5cda0bd5ecc4b6fcfb0270721a33846bb3720c259b444dc393f7b4dd008168b75496e1a26e4e3e5bd7
SSDEEP 96:xHrJXTUdGLqGq8fW/2ObzS+SSlSdv9jvnWWRT4dHQW4Bw8898L4cnuVCLM:RJEGGR8fW/28SSiRwQNBw88NUo
TLSH
T12DF1FA789404CF7F64B6766CAC6488705AB2013BBABF68C650BA94C4055CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 0f5d8949fa7c178c05b19403605735dde9518bef89245924e8f2c3d121a85114
MD5 e357f0e0ef4bb592a2fdf19b1fa5bf43
SHA1 87b0577bfcd630d50d06a4546db49924db808e4f
SHA512 e7529acbe2139e26907db1976b05273067a0fd345a930dd9a84536f39ac54e15560625debfb98489b083c929e64949895643ddcdb65eb7e1dda0e99573119ffc
SSDEEP 96:xHrJUTUdGLqGq8f3/21zS+SSlSdv9jvnWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3/27SSrbQuBw88jUo
TLSH
T1C6E13F789408CB6F74B6776CAC6888719AB2013B77BF68C750BA54C4051CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 92b57765c11ca36806647d3140c0faaff623e2b783f9c983fd3013d6103df181
MD5 3a419700c00335ae49f657b22999fba1
SHA1 8f2b1aa5d804cbdebf64fbb5c4e304e82992ef27
SHA512 4cca7ee7bdcc5aedd5437539e4af485246ec0172a4261455e41a325cc4e5a82bd482b72ac9b42a462e9e2d1810e62e87e7080090cd7ca94f48e58b213e9fbdd5
SSDEEP 96:xHrJUTUdGLqGq8f3/2ObzS+SSlSdv9jvnWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3/28SSrbQuBw88jUo
TLSH
T143E13F7894088B6F74B6776CAC6888719AB2013B77BF68C750B994C4051CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.jsonlz4
Size 293B
SHA256 04ae1f69287b489834b6cfd8aef2088f25c76fc080ffa06cf2d7a1406cec59a9
MD5 5dc11fb9ef89e577d122e2c71126a2a3
SHA1 d6deccfea8edcebf2c25b4985354ead237c1e2dd
SHA512 30c480d5d39610d0496c753c2421528185ac846e90567fe28276c95c0c3e7efa765310aa824873dd2872c0b3b9b39967202959d7a8f3653ca97005f17cc7bd65
TLSH
T13CE0EB48BA8880322B92824F800023F3C7E1214044AC5A88A83CB7C40BB90CFA34A142
MD5 SHA1 SHA512 TLSH

Submit Download