hxxp://0sdfoipsdnf23448n32520[.]org

Resubmissions

02/11/2026, 16:59

261102-vhgpjsvxgs3

02/11/2026, 16:56

02/11/2026, 16:56

02/11/2026, 16:53

02/11/2026, 16:48

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://0sdfoipsdnf23448n32520.org
Sample261102-vhgpjsvxgs

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3188	msedge.exe
5144	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{0E7BA4E8-D24B-4D7D-A2BF-22A6C7C74992}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
5880	chrome.exe
5880	chrome.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
5992	chrome.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe
3552	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	firefox.exe
Token: SeDebugPrivilege	3416	firefox.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe
Token: SeShutdownPrivilege	5880	chrome.exe
Token: SeCreatePagefilePrivilege	5880	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
4652	msedge.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe
5880	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3416	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4328	4652	msedge.exe	85
PID 4652 wrote to memory of 384	4652	msedge.exe	86
PID 4652 wrote to memory of 3188	4652	msedge.exe	87
PID 4652 wrote to memory of 384	4652	msedge.exe	86
PID 4652 wrote to memory of 384	4652	msedge.exe	86
PID 4652 wrote to memory of 732	4652	msedge.exe	88
PID 4652 wrote to memory of 732	4652	msedge.exe	88
PID 4652 wrote to memory of 4924	4652	msedge.exe	89
PID 4652 wrote to memory of 4924	4652	msedge.exe	89
PID 4652 wrote to memory of 4924	4652	msedge.exe	89
PID 4652 wrote to memory of 3304	4652	msedge.exe	90
PID 4652 wrote to memory of 3304	4652	msedge.exe	90
PID 4652 wrote to memory of 3304	4652	msedge.exe	90
PID 4652 wrote to memory of 644	4652	msedge.exe	91
PID 4652 wrote to memory of 3136	4652	msedge.exe	92
PID 4652 wrote to memory of 644	4652	msedge.exe	91
PID 4652 wrote to memory of 644	4652	msedge.exe	91
PID 4652 wrote to memory of 3136	4652	msedge.exe	92
PID 4652 wrote to memory of 3136	4652	msedge.exe	92
PID 4652 wrote to memory of 3948	4652	msedge.exe	96
PID 4652 wrote to memory of 3948	4652	msedge.exe	96
PID 4652 wrote to memory of 3948	4652	msedge.exe	96
PID 4652 wrote to memory of 4692	4652	msedge.exe	98
PID 4652 wrote to memory of 4692	4652	msedge.exe	98
PID 4652 wrote to memory of 4692	4652	msedge.exe	98
PID 4652 wrote to memory of 376	4652	msedge.exe	99
PID 4652 wrote to memory of 4900	4652	msedge.exe	100
PID 4652 wrote to memory of 4900	4652	msedge.exe	100
PID 4652 wrote to memory of 376	4652	msedge.exe	99
PID 4652 wrote to memory of 4152	4652	msedge.exe	102
PID 4652 wrote to memory of 2564	4652	msedge.exe	107
PID 4652 wrote to memory of 2564	4652	msedge.exe	107
PID 4652 wrote to memory of 2564	4652	msedge.exe	107
PID 624 wrote to memory of 3416	624	firefox.exe	113
PID 624 wrote to memory of 3416	624	firefox.exe	113
PID 3416 wrote to memory of 3056	3416	firefox.exe	114
PID 3416 wrote to memory of 3056	3416	firefox.exe	114
PID 3416 wrote to memory of 3056	3416	firefox.exe	114
PID 3416 wrote to memory of 3216	3416	firefox.exe	115
PID 3416 wrote to memory of 3216	3416	firefox.exe	115
PID 3416 wrote to memory of 3216	3416	firefox.exe	115
PID 3416 wrote to memory of 3216	3416	firefox.exe	115
PID 3416 wrote to memory of 2164	3416	firefox.exe	116
PID 3416 wrote to memory of 2164	3416	firefox.exe	116
PID 3416 wrote to memory of 2164	3416	firefox.exe	116
PID 3416 wrote to memory of 2164	3416	firefox.exe	116
PID 3416 wrote to memory of 4748	3416	firefox.exe	117
PID 3416 wrote to memory of 4748	3416	firefox.exe	117
PID 3416 wrote to memory of 4748	3416	firefox.exe	117
PID 3416 wrote to memory of 5216	3416	firefox.exe	118
PID 3416 wrote to memory of 5216	3416	firefox.exe	118
PID 3416 wrote to memory of 5216	3416	firefox.exe	118
PID 3416 wrote to memory of 5216	3416	firefox.exe	118
PID 3416 wrote to memory of 6564	3416	firefox.exe	119
PID 3416 wrote to memory of 6564	3416	firefox.exe	119
PID 3416 wrote to memory of 6564	3416	firefox.exe	119
PID 3416 wrote to memory of 6564	3416	firefox.exe	119
PID 3416 wrote to memory of 6576	3416	firefox.exe	120
PID 3416 wrote to memory of 6576	3416	firefox.exe	120
PID 3416 wrote to memory of 6576	3416	firefox.exe	120
PID 3416 wrote to memory of 6576	3416	firefox.exe	120
PID 3416 wrote to memory of 6584	3416	firefox.exe	121
PID 3416 wrote to memory of 6584	3416	firefox.exe	121
PID 3416 wrote to memory of 6584	3416	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://0sdfoipsdnf23448n32520.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffea3f1c188,0x7ffea3f1c194,0x7ffea3f1c1a0
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,3896154637739338487,18310963610646761902,262144 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,222279856703831925,2897575116528098530,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,12925816728802798320,18307136425406106722,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,12779243102128755679,14307304775523031649,2097152 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11640940342550126982,9658565018831402137,2097152 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,17304951797757805769,4334298143571286653,2097152 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,2088872688441379822,5419520109400519582,2097152 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3596,i,13849253889371172506,702856003206057880,2097152 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3532,i,18304117666225374892,17274237369642335835,2097152 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,13809968325801040664,13567658890853776310,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,17207700480540033980,1061451379238807090,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3018619401382764106,1419264582967353799,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3018619401382764106,1419264582967353799,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5180,i,11335708078039710067,251347918695930994,2097152 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,16851620101521588913,7138228571897172193,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,15915497040264584785,8510112028729603983,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,18183712234801470361,5075961662741758451,524288 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3540,i,481984647046430982,13767161900924072141,2097152 --field-trial-handle=2060,i,6782043752569011989,7179084731381013633,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {2bf5fb75-43f6-4ef2-84fd-60f1b20112d9} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27135 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {9aa8dc75-0f59-47fd-afce-4f17948fc87f} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27276 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {943a56be-271c-40fc-b8d6-7b54d2817a94} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27276 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {b33927da-e8c8-408f-b493-86ad65a8108c} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4372 -prefsLen 34775 -prefMapHandle 4376 -prefMapSize 270279 -jsInitHandle 4380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4388 -initialChannelId {f6efdb2d-9eec-4848-8aff-3a8000dde534} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3124 -prefsLen 35012 -prefMapHandle 2660 -prefMapSize 270279 -ipcHandle 2968 -initialChannelId {ce65f0ba-6991-4ae2-a6fa-2f88a4268997} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5008 -prefsLen 32952 -prefMapHandle 5012 -prefMapSize 270279 -jsInitHandle 5016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5024 -initialChannelId {c96f4bd5-37f6-443d-a6e5-a57cb6b86608} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32952 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {1da4b22c-0607-4c9d-a63d-8fbdbba70eee} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32952 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {8f885aaa-4fa7-4085-9c3a-960c398a6af4} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4284 -prefsLen 33031 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 6056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6096 -initialChannelId {fd62412b-d36e-408c-9fab-465ff38329f6} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeb05ec728,0x7ffeb05ec734,0x7ffeb05ec740
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --exception-pointers=97650377375744 --process=200 /prefetch:7 --thread=5256
    3⤵
    PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,11279444719201186091,7082386131203848828,524288 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,7043657769611156682,8176777277457605125,262144 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,12489378022274826284,3046627621374588875,524288 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,14994967626385193838,3797647323844928931,2097152 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:6220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3448,i,15341694299891729519,13020428952342999026,2097152 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:6208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,1409662910560259408,3515051503153874216,2097152 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:6280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,3798410324514202764,3548410844865192272,2097152 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,8540753022978590822,12288868165061892738,524288 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5544,i,8348770017451901580,10573902271717359781,2097152 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3116,i,16681977263012695814,7546732464092475287,524288 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:6564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,17961264360006341400,3131467014243328609,524288 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,13055339356817208630,1923635466972696420,524288 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4604,i,4162706469457394820,17764561346835385945,2097152 --field-trial-handle=2120,i,16601742079387582013,1561950874837917235,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:5672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6656

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0080940b-ece7-4c40-95b2-599d38687e37.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0080940b-ece7-4c40-95b2-599d38687e37.tmp
Size 269KB
SHA256 b4d6ceb9f10932752b08c9999adee3e9e9881fa53dc7fa91e575a95d0b8baa86
MD5 2b770dec00096393e806a50f7b9d16ed
SHA1 7363aa590ae0d42e8958cbfaa87bbec05050f5ab
SHA512 30e520b3593a4321cf0d4487d835d16175a9e3b1b5056d6d1591fbe7bf45826c2db6f04d6bac4888e5eb46c6502a77694042d035af2bddb111ce3d4f5f9891ea
SSDEEP 6144:MvHWe40m3otUf+8Wp53EX9pxsNTp+hFD+7t56OD9ZfSAppr8M:A493obX3ETxsPyFSXD9ZfS4+M
TLSH
T1B244222589C59C7BCEFC5197750BF7059E6889D992DADA0408A23F8F710FC9E0673632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1acdfa42-436a-4f6f-8cf2-c53fbfea71cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1acdfa42-436a-4f6f-8cf2-c53fbfea71cf.tmp
Size 269KB
SHA256 fe3081592934ac73f002ec4136a7cce1dd4af3959938d40144af6eb547875da6
MD5 631da14074de8b72bca44387738c91fd
SHA1 154150858ab319f21aa4a9920c9d898d0867d2d2
SHA512 75a81911314bd69ba6707dc6b449db040d84dd6f61af8c0ce900455ef591752349d8ccce891cdafd0050114bc87bba43df6f4c5eb16d8b506850cda7181089e8
SSDEEP 6144:7vHWe40m3otUf+8Wp53EX9pxsNTp+hFD+7t56OD9ZfSAppr8M:1493obX3ETxsPyFSXD9ZfS4+M
TLSH
T1D84422258AC59C7BCEFC5197750BF7059E6889D992DADA0408A23F8F710FC9E0673632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b87f638b-2143-4e7a-a9cd-5374048e82f0.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\b87f638b-2143-4e7a-a9cd-5374048e82f0.dmp
Size 759KB
SHA256 53aced0d1dec572e9724196141b6b4b416bbfbf0fd42c30a5317da5316158f9c
MD5 33d9201fe90b37ca9d0481ff849cad28
SHA1 3a0bedbe8d05b06cf16ba5833fce516247f52621
SHA512 15c24b6cd36a863c7f8657f1837695a66af0e0865872e00eef5c48db799762948fb11cf61be6ed9fff828b4ad7670478d4a52ea4114545ce2ecf5d009a343fa8
SSDEEP 3072:YsYO8Puy5Ypl5FnDyoO7zFV8uAGIC+PsJ4Tv6uT0iCX1vedq:YPO8Puy5Ypl5FnDyoNQusJ4Tv6uT0tZ
TLSH
T1A3F4FC57BB4609A7F83A4F7106D6AB1CFBB6D4171FA3071636D1B2E62D373049BA1A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 84e6fd027ea8e630687c4c70bb82f9993501345987298d008342ed16c054e189
MD5 b5895b80e7b4ec0bb8ce6ce0ed94f3dd
SHA1 e30684cd30b0cb2fbadb4f33700176e6fab77891
SHA512 7c99eacfe79e250ff4709334c7bb377f65291285b37c43c38e01f4fc82527726ee313e66efefa9ac1c34bb21eb29386a5d07369c031cad2b1786f544460e257b
MD5 SHA1 SHA512

Submit Download

511743ba-73ca-49b5-b4d8-799978f32b43.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\511743ba-73ca-49b5-b4d8-799978f32b43.tmp
Size 414B
SHA256 e76a41b3cf0660897554fef280204780ece68465b07ab70f64d1353053900e72
MD5 d9320f062ce51564d6cddd32044c58c3
SHA1 b4b126fdea6cca52e2aa9745774028eff7ce843e
SHA512 dfea8cdabb8f103806f477b3e74bfa9409d65f1fbda8d4c86d9235d03c4e8120bcf64855406bb6691df502f0cf3a1030fe3e3901934eef30955fcb9ecc676698
TLSH
T1F0E02BDDC920EC371CFD576D54540749E740034B6680950F3A3DD41D8FB163B45C695C
MD5 SHA1 SHA512 TLSH

Submit Download

56018132-6996-4b48-92d9-16af031043ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56018132-6996-4b48-92d9-16af031043ce.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

57949cce-81df-4c16-827a-f23fe49ebd50.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\57949cce-81df-4c16-827a-f23fe49ebd50.tmp
Size 13KB
SHA256 b8422b6ad8d78e3a0e8eb639b54d46a94d0f1a8d9914a11dc130584a2431f4d8
MD5 7a5cd3c113890cb1884ae91bca79b8eb
SHA1 c8b2e50773cf3d588292998a576713abb1d8cbc7
SHA512 cce6eff3f03ef4fa9239f2c7a8d420dc686f8e6541565951f0325fe7d26a010df4b86c506f2c95cfe455e35df9cf97f85f62fc4d40fe8294b2d836de5b06227e
SSDEEP 192:2RzXDnjI/A7Qsxv7D0spAPRp2Wf9+HoCHb+WNn/bw3r2neH3RxJKkwsJVyIsnAUp:2RzXDjbhvjUXTUzzE2nIhfKse
TLSH
T16052C66DFD10653B9CDBD229F962775BE7F6102620D02E84DAFD892C19E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

662c081a-540c-472c-8e9b-7268248a33f0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\662c081a-540c-472c-8e9b-7268248a33f0.tmp
Size 13KB
SHA256 e23fb6829ff2f22a0dd8f09d165ac76b34881609a8507fb3dbbc86ab0aa65649
MD5 5f1ca7cf504b0f020207cf33cc17fefb
SHA1 26019f4b9eac263269f2b6982edea4693bbcc757
SHA512 9f5e314f4f7ad177bc50b809009352e2982acaae7e11009092d3e32a1e45a014706b89b71bfa361e86d2ad81cd3ad6614bd3a0d48179bc7a2f22273b497f2cc5
SSDEEP 192:2RzXDnjI/A7Qsxv7D0spAPRp2Wu9+HoQb+WNn/bw3r2xeH3RxJKkwsJVyIsnAUg8:2RzXDjZhvjUX6UHzE2xIhfKs8
TLSH
T12052C52DFD10653B9CDBD229F962775BE7F6102621D02E84DAFD892C19EB9CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92b0f177-8382-4a3a-a7b4-a7d23ededb27.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\92b0f177-8382-4a3a-a7b4-a7d23ededb27.tmp
Size 13KB
SHA256 c91947ef25795b5d094619b0c8b39ab4d4e3c76b9f99f420da0e31168d7ea1e1
MD5 605a3a1a8b37b417e81ce31b0b8ef41d
SHA1 a003db50b6511397406d6fd7e649d59ddc95db24
SHA512 c09a82462df94dda10f2db1103698a3198a73dbf340d50992018e01c24ca91613da890e42ddf2e0cc6472f5adf535e298b46db2ca1105dd6bacdf30bf46ec615
SSDEEP 192:2RzXDnjI/A7Qwxv7D0spAPRp2Wi9+HoEb+WNn/bw3r2neH3RxJKkwsIVyIsnAUge:2RzXDjPhvjUX2UDzE2nIhfKfe
TLSH
T15352C56EFD10657B9CDBD229F962771BE7F6102620D02E84DAFD892C19E79CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b34fed98-2560-48b9-8479-0da542cc87a9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b34fed98-2560-48b9-8479-0da542cc87a9.tmp
Size 2KB
SHA256 ff82abc1bf7cdc9e748ee3b3fb9b444869774cfbcdb1df9557a6712d0f2ffb23
MD5 145b20e35720fc9ccab2405befc18517
SHA1 b166e8e2afa0cf42f7b3b429de67d6c372166980
SHA512 a4da1749e15c7a7ae052f7825851c78db8b967188224d64935c138878168af67f75db56082d171cccde3f3d5e60a3a0acb6e954109711c354f49211caa470bf2
TLSH
T139518BF3C7E48A6D851156F49B207E1FCE2D0A24031C3C62C9D8AE4B53F2972D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 1963ebfcd40ea8bcc94ea807b36cc5a35d5e7ab7b78b0b80fb2f201197c37c16
MD5 a12a03a6d2c3ae71feac28a6cd6acdc2
SHA1 234206bc4fa7187a0bde6244c31ead67dc36755e
SHA512 11298470f8d35c6d815224ca29e202d0c5d8f094ae885edf9e78d21987f66f68349b439ac13a285619489177b99d1cb81cd46cc5706b0fb6c61649e6c57628de
TLSH
T138B01205C0822322C021037012D0905477608F3AD212138757E00E168C31164511B208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f7a47a70cb1f271b82e3b1f4c2c962ee22ad2d481d6a2b97f731f5db8fc6979b
MD5 18a5f626c99ea6ba72a02a65b727a1d2
SHA1 b28a0f47f7386b910e482ada563b5295fb544c28
SHA512 f4978cf3c9c38c4ebd254f426b1686c2866f1e79b68db93a204bac7651c876002c74a2d7b8857f22581811c5933e635d18d4dd59f8dd177f6fd8b15af64940dd
TLSH
T122B02220C0022203C08303F022CA80E83220CF2AC2032B228AF00A3ACCA22320222830
MD5 SHA1 SHA512 TLSH

Submit Download

b74c6276-d97b-4cea-8425-0444ee77eadd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b74c6276-d97b-4cea-8425-0444ee77eadd.tmp
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eedeef61-7aa3-4f5d-b8be-9ba5f2ca36cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eedeef61-7aa3-4f5d-b8be-9ba5f2ca36cd.tmp
Size 13KB
SHA256 95f315bf0cfd40e95d5b79a8add61373122e1a6355480823f32de16b25396ace
MD5 8e6d5b61333086fe3f0e1138bfe56423
SHA1 7006f80f809520b23647d2474344785620ca33fa
SHA512 8bb74dc9627dff7ef793ec948160efc0ec813c6cc55531fb7e8788fba63a56ad1dea1dc9a3c49f6f22e9727da4d61bc4eb02cbba0ddea7841fcc159acd0dd0da
SSDEEP 192:2Rz+DnjI/A7QYRv7D0spAPRp2Wv9+Howb+WNn/bw3r2neH3RxJKkwsIVyIsnAUge:2Rz+DjLBvjUXzU3zE2nIhfKfe
TLSH
T1FD52C62EFD10653B9CDBD229F952775BE3F5102621D02E84EAFD892C19E79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f142256c-6878-45c1-b97f-47876e0ad587.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f142256c-6878-45c1-b97f-47876e0ad587.tmp
Size 13KB
SHA256 4ea5ac2fb2288d87fe32cd402da78f8dd8ae3a7006176c47525b016604f737a0
MD5 26b5c90de1c403893db8fc21e0fe2a5c
SHA1 9427753ef57f49e358e47d942771607b7444f7f0
SHA512 fe406b5dbbcc1a5be5491587d8ae60d9bfa8ff3adea6881cc88f39b6875aff56ff107abafa67c65a0f0553a22fdb24ce85f5d6baac9ca5a146b3300470fcc2c2
SSDEEP 192:2RzXDnjI/A7Q1xv7D0spAPRp2WG9+HoEb+WNn/bw3r2xeH3RxJKkwsJVyIsnAUg8:2RzXDjShvjUXCUTzE2xIhfKs8
TLSH
T13952C52DFD10653B9CDBD229F962775BE7F6102620D02E84EAFD892C19E79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eea449e2-1a74-48b8-a412-4fd83b21c21a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eea449e2-1a74-48b8-a412-4fd83b21c21a.tmp
Size 130KB
SHA256 4524364bb615504100cd26f6d68d15678e2449dcfad475f0601221cfceb4092a
MD5 a6c326645978ed7068e57b4fe3ec761d
SHA1 945800b7245d690e59b24dcc0604551d4426c4fc
SHA512 4820558b71753baff7970725779c9e301e97e63442e43d9639e8f8d3e0127aabacece2c6285de6f4bf81b2f226bc9151b12d0e43d8ae5322c369f21d611bbdc7
SSDEEP 3072:D+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:D+hFD+7t56OD9ZfSAppry
TLSH
T1ACD31232AA51D8BBC9BC6541B157A304DE666CED41EE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f21faf9-eba9-4b1f-8986-07b438366729.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f21faf9-eba9-4b1f-8986-07b438366729.tmp
Size 8KB
SHA256 2093a03ba3b72514e83e11cdf6b8b680dc3e45549bde2c100f3a58321ae8d4b7
MD5 319ca0ec8d36c68e4111ab3d39d1a3c0
SHA1 da87edcde160e7f491f33f13cd0e12afc01b839c
SHA512 25b4b5dd96b93f67acf19dc0ba8cf3454c1e6150a34625ec0fb88b2953873862cb06381e001c96b7c635f9dbccc3bebc7b41ec64bf5090aa3d87ed4bfbf3c2a2
SSDEEP 192:1ONJ6nnHdQmiUyi05YcX5hQDP1xjzor9RzX1x+2Zg3Rq53U6:1ONJ6n7U5NX5+DtN8zX3+2eS3U6
TLSH
T1D2120B31E4A8AC6B5DE3A595B0873113AFE51127EA85AFC0DAEC1F1C01DF65C634AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

464c0f05-013a-4f62-9a36-d7f261eb7ecd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\464c0f05-013a-4f62-9a36-d7f261eb7ecd.tmp
Size 18KB
SHA256 ffba77e3066d478e3cb7df02c63cf5fee1a1c9be068ef91670a93b4d0b0343fc
MD5 6e12000606a452a970c4bc8d56275d36
SHA1 cae8d85e91401207952d6c9894fd8a0aa0add0a3
SHA512 53f7284588285e09402d3a93ba4a1905affe680877e7fee495978f48468052370f288e2529cd2e0a3329fdc896a16c94422fd4f5d8f6d051470c5dc8154bfe55
SSDEEP 384:3QkUSv0sNo/MigrbQX5+DtN8zX3+2YS3H7vBEOpVIIlG:J0kHMkD03lYS3H75EwVLY
TLSH
T109827E31A8A86D3B4EF3E611F14A3113FFB45117DAC55B80DADD5F2C01CA69D234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53d6f6bb-9f3e-4602-82c8-79df7d8cac50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53d6f6bb-9f3e-4602-82c8-79df7d8cac50.tmp
Size 18KB
SHA256 0422e9c75193564d3f4bf6dc9a6da28ea289a8f17594936a73de7589372b3dc7
MD5 2b9b93a442c09253161b7fdf25fd121f
SHA1 403ec01eb4b7d54eb90b668c40ffcba022534a2e
SHA512 f6a4b4c9f767d1e603ea78fee16a4523762be6583e213eac9eb75a11ef449715de41cf4bae69d64dffb6e17d3fac92023eae54f933042e11658ce969286b89b7
SSDEEP 384:5QkUSvSsNoGMigwbQX5+DtN8zX3+2YS3H7vBEOpVIIlG:bSdsMkD03lYS3H75EwVLY
TLSH
T1DA827E31A8A8AD3B4DF3E610F14A3113FFB49117DAC95B80DADD5F2C01CA69D234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b31ca90-87d6-4574-8942-30a55b10b9e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b31ca90-87d6-4574-8942-30a55b10b9e4.tmp
Size 18KB
SHA256 0c1046fd95fe5e451b597463eadacc53bcf3c5492e7bffcc9f3a8b9f4f801db8
MD5 77b5427e56be41aafe97d989da601238
SHA1 1dac3d370810484b4f24dafaf3f96fef504db377
SHA512 adba8fbe7c70350154aa61a3b4fafcd8208441f06fa4f9fde17840106d4c10379374e4035c3469e07cb6bc07183b0b7a5f481988637acd90d6d1a9b30476bb34
SSDEEP 384:aQkUSvSsNobMigwbQX5+DtN8zX3+2YS3H7vBEOpVIIlG:CSAsMkD03lYS3H75EwVLY
TLSH
T15D827E31A8A8AD3B4EF3E611F04A3153FFB49117DAC55B80DADD5F2C01CA69D234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b1c68c9-521a-4148-b371-b42d74bf9e30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b1c68c9-521a-4148-b371-b42d74bf9e30.tmp
Size 8KB
SHA256 e04fcf4b7e3016406f86ed75e112cc10fe243f9a6b9a7b400d36a1616d1e8ba9
MD5 0fc2462914da90719ab56f883c305963
SHA1 f3c5f0c99658a29a6e9f9276607aff0dcd34f193
SHA512 76143c40342bcf4b20c33be13a0fcaa98ee8f7d96910769ca8b0e7211e5fd676a0e13d0daa0e0408561c2042d99be8d2c385ab9e58a46edc3df7400a47082658
SSDEEP 192:EONh6nnHGQmiUyO0QYcX5hQDP1xjzor9RfMcbwU6:EONh6nCGQNX5+DtN8DEU6
TLSH
T14E02ED35A8A46C7B9EF3AE45B4873313AFD4217BA5956B80DAE81F1C00D765C2306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 008fe2bd4df1b5274500da9bc5ca2d0078b4c67299e5a59b07ba0ea59b15fa5c
MD5 ea4defc91533177d9419b56a904c3169
SHA1 03ace1db6d747cfe7c45b8741b11a55e039422e5
SHA512 4e2f45b8ce5ef686f67c65748b87b688c9bcc0843d3b1966e31695e359582622844f65a940e7236c2aa296f7c07697173eb1a70054c3666de4f4461e1d475fe2
TLSH
T14ED0C002FD173EFCC0EE1470002CC0040A44FA134600114006131D198C24101386CEDC
MD5 SHA1 SHA512 TLSH

Submit Download

18f78ba0-28ee-4480-a9ab-15c38c2f153d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\18f78ba0-28ee-4480-a9ab-15c38c2f153d.tmp
Size 9KB
SHA256 422a3252994ee0ead30b42fe2b080ce871b7257e3371e16e06715ae0722b2bc2
MD5 fe20183a3f609a6ba392c86bf75dc9e3
SHA1 aa5a2eda36905c467a623369b6b39f5de6c1de17
SHA512 823114705aa2d9127752ac0a7d4fecd07eda63c8c4df0ead5511f039f728a5435046f09ed465b91363e13149081792f2a0cee4575e8fc4ecbc55760f18d5b12d
SSDEEP 192:sxZIRFWe/fxst1PIdppYH/Q6+WNGYYB1z40OkIgrJ:sxZIGe/fxs/gGHxGfVOI9
TLSH
T19D22B7526E28B57B8CCBD219BB65BF53E6F9503291D01E48EAFC861C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3487f716-0916-4e02-9fa2-0cb2a3bf365b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3487f716-0916-4e02-9fa2-0cb2a3bf365b.tmp
Size 10KB
SHA256 abc9a0b6abb8674b229b99042e67fc3e0c8f695651efeb34852c91b25b368737
MD5 dacebcd4c0549eb771c059b99e1964d8
SHA1 5def62e0bc702325327e3f88f157e45d7a298bd7
SHA512 30a1c2707b103f0e739a9efd886fb2abaa090247395b8698f6ea4d4dd1114f7467d1b16312822717095d62ea594000453602e966a23fabba535c5d9108249b65
SSDEEP 192:sxZIRFWe/fxsFpPIdppYH/Q6+WNGYYBz340OkIg5iTJ:sxZIGe/fxs/gGHxGfPOI0
TLSH
T1EF22C7116E28657B9CCBE219BB65BF53E6F9503251D00E44AAFCC61C05E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

762d7668-4e64-4f00-a517-0cee355f2382.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\762d7668-4e64-4f00-a517-0cee355f2382.tmp
Size 10KB
SHA256 51fc7d1de615f50d229b029a6d82e777b3642845719233058ac5cc916ad07c76
MD5 01b6f201636554f0b9ef54831f41345b
SHA1 697bd3698f70a02394166183955ed008652e03f5
SHA512 087ad9e40ef7d4c4bada6fba3c972a85080e69b7a946753bcfc421288b42cc6ff5931239815ef024330792c6d2cd37afb96024bd52a522fab6c8a94387e3fd94
SSDEEP 192:sxZIRFWe/fxsF1PIdppYH/Q6+WNGYYB1z40OkIg5ipJ:sxZIGe/fxsXgGHxGfVOI2
TLSH
T12022B7526E38B57B8CCBD219BB65BF53E6F9503291D01E48EAFC861C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d8b5ed0-1b59-4175-b082-de3a9008a2ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d8b5ed0-1b59-4175-b082-de3a9008a2ae.tmp
Size 27KB
SHA256 89819b1c77c6f31f2c3b90c2e516c45050a7cd9fb5528586f79d3d1947e15dc2
MD5 4f24e7e17211640f917ab4ce79298c88
SHA1 59b34b826d0d4c7f4f61cb5a694711b56d88bf80
SHA512 ce18caadede9bfc1fd657a23dd7d3abe597829f3f7b49fdf08bd2a488bdfe5fd8c2afcc06db19c566783db6f11745f24d04cb16d5e57871bd2d4c4d7d77d8ea8
SSDEEP 768:FyyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXrrop45i:FyyYR7jWv3NpBu1ja/CL8OXYH
TLSH
T1DCC2E93B640DCB7E4FC01E9DDC5A6F9B7E9802C796548D4047FA984C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 89c186c3aa42bbed60525060ac1bbcbc58f8da2826b11bb7eced2eee16553fb3
MD5 5fa944f1dac828a2ecb19aaa8209ef4d
SHA1 fa106adfc3105665c17745314f7bb7a04a5e2006
SHA512 0631cf01a3d5bec2f8be1ce7c6cfec428262cecaf8f2e2d00d8ec8ac3f24d8834ed04db0efaa4b50c99866d6524b2e77af564680f49b6d6376437537a2531f5a
TLSH
T1BA6192B490434157FB9840F0E9D8118B3EF0A5BD98838E16A5A6D277A86EF3BBC40CC0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e5777735039a3d755327ca285b58806cbf64e6d9299f798424502937d1743387
MD5 85d1ca4f78de8c7f9e7bc216c4a484e6
SHA1 3b5570880eb02c3b179ea8e6eb08e036a5318dc1
SHA512 ea43dc10cae43b351d9f01fdca267c4c3cc9b1ab85428488c6527e1a03e5a78717221d9cf9baf5951b1b6d83fa9f65c813a4a5bf0bc4992b665f80c462f6aa45
TLSH
T1BD6195B495434157FB9840F0E9D811CB3EF0A5BD98935E16A5A6D277986EF3BBC40CC0
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 c4d04e72c6a5b4c1e944eabaa7cca63cb889cc96e39060f566f4c3377855ef8c
MD5 3aa4d4d82edde48f2c8c3cb7f9a9ec44
SHA1 c969ccb97e97e49b3dcbbf9e1558c3be3f1f0f50
SHA512 0677c7631d153f0b2c41e3004c895d5fec40ddafc729798dbe0b0183c1f54e395690ea2fccbfd99ed41be1e66e6cbc18766d429f3f782ecf0b78e1c53d8ecc87
SSDEEP 3:MsEllllkEthXllkl2zEklZ6Nll:/M/xT02znZSl
TLSH
T17C4404147FC10407C5007D304071C3500374D4300D115F43745104335CCD5400F00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6042c3b1-895f-4be8-a7dc-f5afa1a9331f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6042c3b1-895f-4be8-a7dc-f5afa1a9331f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5d140bc5-e9c7-4292-860c-e409426faec9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d140bc5-e9c7-4292-860c-e409426faec9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

67b2ccb4-9809-4b85-84b7-eebae14336e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\67b2ccb4-9809-4b85-84b7-eebae14336e8.tmp
Size 1KB
SHA256 c8f2eec8427d200ca2ad4dfdf230657253d27d8a93b1bf7461234b6fdf1738b0
MD5 35e56ab4465d2abcaebd7ce8b4cbe691
SHA1 eb6f017a599ee8968687aef03522b01d01b2a332
SHA512 cf66b5acc0f19d5078014f80598cf71b9da9a768600f7d24ae529486924afb5e05656453713250972b19b6b2d8ce0f754abef33c21931510f12f132c62e6ac13
TLSH
T1D821A0F3C7D5916EC91516F05A24BE2BCE2D054582183C1999D4EF5793E3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

80dd9c38-c77a-4c47-a1fc-4060e4d30d9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\80dd9c38-c77a-4c47-a1fc-4060e4d30d9c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2dd710de50caba0c40aafbb20a2ac77a1bde167dba02c83891b058a683bd1420
MD5 58353cc84d30431dcf03deb8a9e0dbbc
SHA1 d002f7c37c1b7d288fd1bc1cd84b8381bb4b623b
SHA512 263389035ee8b498846ea5069c2fdc3dfc1615599922224948777288f27773a8d91b96d550691aa496ca6f6987243bf0e11c51be10b854b0278606f20ce7b9f9
SSDEEP 96:K40xCGMWyb5CXqjubK7ijIb30cPqSoqWP0geM8l5odYjIlK7Uj2UwKJGa2B:otl774
TLSH
T194912C91317E024079BE694942B4861B124231F33479EE3B7BB8C6E15E6BE145EFD8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aab4019a-e35e-41df-88da-53bf2efd0c80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aab4019a-e35e-41df-88da-53bf2efd0c80.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e33e7bc4-8e08-4666-9c3d-b725f752c47b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e33e7bc4-8e08-4666-9c3d-b725f752c47b.tmp
Size 11KB
SHA256 b46293293333bc57beda6b94acb20c3c1fda2f118681f7e83daf911255393fa4
MD5 eafb10321e1b7cf6c919699e01224706
SHA1 9cd02113850252f880c8850aaa4ce6e0404c00df
SHA512 e37a0296abc7303a39c685ee05fc3ba1cc28138190f21455f093f8a1337115c702e0bfa695f59ae15b0e69442893572ec955f9cbc31ea5ecc88e2401b78944d8
SSDEEP 192:sxZIR/We/fxsFtWpVKPIdppYH/86+WNzOj/YwBHeQSOkIgbiTJ:sxZIwe/fxs7WvKgGHFQ/j8OIq
TLSH
T13332D8116E28B97B9CC7E21DBB65BF27E6F9103251D11E44AAFC8A1C05E76CD234780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b61e8e7c-daab-48b2-9239-6666c596754a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b61e8e7c-daab-48b2-9239-6666c596754a.tmp
Size 22KB
SHA256 97bc34c2aa6ae587c124ad7ecc7361ffc90db9973aba7a36f638f91cd357f92f
MD5 b1f69c26d129f9c235b7deaf139af641
SHA1 8f62048f8fb2f27ef9622e7b4dc99f0303147993
SHA512 a57f7529e4c200d29cd4bee5cb76deb6fc5815a420001c358f17471f7e3a8218c45fd8d38f7479c49c678dad7b240c80e3517603a14fe788ee9e9bf0e8e3caad
SSDEEP 384:3QkUSvUsNpGMia6bQX5+DtN8zX3+23s8A8t/eKdoLMKwIr+UH7vBEOpVIIlG:JUksMkD03l3y8Y4KwIr+UH75EwVLY
TLSH
T17AA24A71D4A46CEB45A2E5C0A146F113BEA45137D68C1B8CD6FDBE3C308F6F82396962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb04f1de-4ebf-455b-8405-3c6bd9099b90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fb04f1de-4ebf-455b-8405-3c6bd9099b90.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 df834803af0b3ad5523832d232e31f1eb0a5d1695d51caa90063db8a2ac3d1e8
MD5 ead84e9ce0d80bb08c6777e6f8e4bd54
SHA1 16f2af102d739a1d1e1c153ab8ace1270a69f2b7
SHA512 7d00e8e8fdd2a059728a50894b1967e36883abc8e12b5cb61ad992a46afe5f66bd84b16d02f91d4d14312da66593e5ee94a6b9fd2a6313a29b709649907c80ad
TLSH
T199412868AAEE1148B3B77E5A5BF7682D487BBD732E06C45E10110D5F0622F40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\activity-stream.contile.json
Size 4KB
SHA256 9765f2cd606550dd239009cc55d3378e8c224582ff3719f060247b68055904eb
MD5 0bba07cbf8deb6d20da3cf9ec5e67183
SHA1 43e7ea1d33b8b274eb41b057de26e0a1612902a5
SHA512 d01ee5d851f95cdc57624f6de9dbdec45ac37842e26a26abe6f899c7fb0a6c6e10135de3d097f98cba108388581244d11abaa0e4adfe430e65c683dfd81cf0f6
SSDEEP 96:TiLMhzimD3gwcT+mRulon4KYyyf+06DrYolz:iMxiBwdmRuaxZ0wrYoF
TLSH
T1EF91D89F887444521B32FAE67C8B2B98F103B406EDF08E6C712ADC21C59C7EE51CB694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 57cf94bd69fec50bd88e3b4649810ab0e68940f6cd0f827401ecc8cf9736c3c1
MD5 fc70f5ce329b368929fc2ca63c3e3cde
SHA1 2abc1997ec4c6866ce94822c88fc20b71380cdc5
SHA512 16dfbbdc782c8bbd4487bc6905c451cfaa6f10a420a2c3b692b2c7f985f40d48cb991dd55760f661617867734821f1da5b59492de8ef1898ad7f01530c77d9dc
SSDEEP 768:ry6sfQsD5XVL2yNi+Lbgrim5051PZxVXilJnJn1uL7Kd+G2OOrB2oK7TEL:W6s1ZhLm5cVZvmJnJnYXrG2eTS
TLSH
T1B473FAA396E8B1BF0BD037C72C0F796B56E10185E38606C9ECEDCA1D81DD694123E5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 9491bf92a07c8d463379aaa1ec46d300735e53a3e0d260fd00e1c7de80b49fda
MD5 20f870b0376c4ebda535488321b170f2
SHA1 892a168b85f500536b9a4ae936f65eb028745026
SHA512 3f36e818f3b85532cae4800a26b49fff60dc33e28fb12b807b9b53d4c2c17bf737d1ec0eacbeaa1eb9d3d9f76d638fea06fbebfb5056860042fad89e8da4900c
SSDEEP 1536:W3tXk08lTO4fhU53yCZhoMU0Gygk/k7law2QgmWnyMMMQMMU:W3t0lK4G53nmbGelaw3mgU
TLSH
T18A732AA3A6A971BB0B913BD72C0F795B66E5414AE34401CDECEECA1CC1CD790427A5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

31338

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\doomed\31338
Size 52B
SHA256 08315c52f61d1662cf609dbe1a0f1bfeb08079b15783ba93c506db77fb81c84b
MD5 8738f8b818fe79a9e0e229adf427ad41
SHA1 d4825d5e938fdbc81a3a9eaa7458681dbbea1744
SHA512 7f61af71fd7790cc6e43b258a6895d989d9261ffcf20487ecc5db315e26b5fc372d4be6148b9fa6127d1950df0dd4c57b2c5f9a3fb722f97daddc1bc546576a3
TLSH
T14F9002049261D504D03481310C8090F448A83D0044D00A973E920B5145110D29010141
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 1deb8a9686a1360cba0338cb8bb67b2e2dd7963272b3a0d47b1e987a4a29518c
MD5 b06421209cfd4eb8e7c3610a2f716244
SHA1 7970e08883d356d8a9df64a9c39cad8fbf202534
SHA512 96e2199d77d0c9e9b0e652350c9f22d1806c49fffa0db1cd0b3b75b2d4c17f5d90dbaa87b00e7c852064577d48ca4cd896f639cf3d0dcd28cfdaaea0ae80b717
SSDEEP 3072:j3lfB2qUUfM5DBl7LVs6mmXGkDGP4psO/:pfYeM5DBl7LS6mdBgF
TLSH
T191B3BFF6DBA28D3D65FFD42D6BC2C43EFD222404B3A72019C863631166C6BB82675748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.bin
Size 7KB
SHA256 26d4889580529c5f3a21856dd63e1f1a3370b8ced67654a6910fe1801687a39c
MD5 24e25877c10d676f3fbdcfa6c67ed87b
SHA1 26cd6adc562b159ee0e7097da6401fc32523c40c
SHA512 d6bd33dfbbea434c0acdda5a64f4edd86c97537dce06907f8392bbfa7193674ce9175798c623925aba6ecefe908d1ab303fcdaae7a3f9fdefcff0385c78aa5b9
SSDEEP 192:2Ov5zboP2Coyjb+SZ1d66JozGzgCl6mc0d:NboOCoyjbd66JozGzgC1j
TLSH
T1ADF162A4F728867FC408027BCCA60B454F35348A9C8E3F1934AC640C2D5B6DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3c33fab2c7e8fc61d75283e0c0dfdeedb87e0ee4f1a19a527e1707f626fcffb4
MD5 b65b0adaa3aa50592cf2a5d3ac40e14c
SHA1 ba4894cecf8e82e81ac85e644084a16f0f68ac69
SHA512 65d58f58b4b65a4e8f9f4ac65bb2e29eed2b18f0ec91d2fdd7350571baf14e41641455dfb290f7ad4b8ebff1cb4390242770d56a6a83e02f1be7d9f1497e64cb
SSDEEP 192:IO1d66JozGzgCl6mc0dTOv5zboP2Coyjb+:Dd66JozGzgC1jyboOCoyj
TLSH
T179F162A4F728867FC408027BCCA60B454F35348A9C8E3F1935AC640C2D576DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 50fbaaa6d91dae95c7f00fbe2a0945f53d184aecf727c65a12fb6b743a1b59a8
MD5 511e5bbbd99a901e32196d7994b27f63
SHA1 3f8407f6aaff1f505b76cc4322b7a63627634400
SHA512 49729210962a51e38752844779eb6b28c5e3b0cc0a356367c2471a3c301d8223452b4b5d09e957e08d5c375c61d7f219de15ccb1ca630a829ddc26ca5326cee9
SSDEEP 192:yr1d66JozGzgCl6mc0drOv5zbowbCoyjb+:wd66JozGzgC1j6bowbCoyj
TLSH
T184D12FA4E728867FC408023BCCA60B454F36349A9C8E3F19359D640C2D5B6DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a4fa62c1683dc424f9328afddc0a6e9f0624e9f1ead6aac166e884d80de02ab8
MD5 e5bc759db6e78e19dbc15a420f58d148
SHA1 2ba4fceedcbcc426d76072360eac07a68d0ccd89
SHA512 c3726e16cdc215ff11f30d0953d20c8fc7906c9c32655dcedab4694a39baa0482dcd71d2b1d84071c8b6d2826ee5064d965e32815be74bd34b33a574e696bc21
SSDEEP 192:JOv5zboP2ZCoyjb+Vr1d66JozGzgCl6mc0dz:GboeZCoyjgd66JozGzgC1jd
TLSH
T1F2E131A4E728867FC408027BDCB61B454F35388A9C8E3F19359D640C2D576DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 abae3284a91840ae4592610e588c5e599705af66add99968bd3eb5222cfe958d
MD5 69f684b4510dd43156f2471dc82b2242
SHA1 9df152a0f8dc690d1523f5459e592daf487c31e3
SHA512 5b251b63e5ca3e6958d8ab7ac973df166124c3515c14d02b3cf5991c3960d11add440bd6ff26d64953ad06648b7f54669054785bdac74c155d7cd98c4cd4be3e
TLSH
T1E8116A9C39B98E6AADC6EABC7450168E93554A0B04871C034D12EE8CCDD1BDA72ED47D
MD5 SHA1 SHA512 TLSH

Submit Download

2a424a19-87c5-42e3-95d7-f02ab254c0ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\2a424a19-87c5-42e3-95d7-f02ab254c0ec
Size 15KB
SHA256 992fdbe4c204dfd989d783d15789a524b3dfd0914ea34ce2217947a0ad7c07dd
MD5 c9466c7cc51f2d33d5e6ec0ebc125c9e
SHA1 07bb9bbea8080dd4647e1a06e6093d96621b522f
SHA512 d87838a6bfa22317d2020777e1bbce5ffccdbb45a183e9b59baf2a8e6c2837f8de91e43c843df40fad4d61960d70655a928da656f108d94be8dc82e8e1b99490
SSDEEP 192:OzDwbDj11KvKzjUim+zctmjVB+1bZGv0HTN77hK5QzaKKPj5JLVroj:vbEKe+AgeE2TN77c5QOKKPjDLVrC
TLSH
T10662D75564205A7E8691E368D8ED7FC3E2F118CF4C019FCA9BE4BD4869EA0AD1127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e8fbe58-fa79-4498-9f3f-458561687a67

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\5e8fbe58-fa79-4498-9f3f-458561687a67
Size 883B
SHA256 da69cd83c213c54a3ac0748140c11c19024662eaffed8fbf4fe1a6ace239b6c0
MD5 7f0a9bd1dd0e84d5244b86dd4864e43b
SHA1 09aca3fcef856c0753eacce6e6c8082464a9b48a
SHA512 072ecfb531d4404ecfecf19175c84dfecb8a05aefc824edc0bf372b8d728f97261ffc134bb9b655c458db3007baf88ff29909f2732d8deb6fd4981d40508282e
TLSH
T1B9112380E73179F2CCBCD24BC5A577068BE8616380CA89183D715D1C0DBE91E9327307
MD5 SHA1 SHA512 TLSH

Submit Download

638744c8-6ae1-4392-a4cb-b252b1690f14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\638744c8-6ae1-4392-a4cb-b252b1690f14
Size 235B
SHA256 f82cf6d61d66fd1b6773099ea073d5640b5c5dcdc87f9d11d322396486bc5dcd
MD5 0cf1da59b5219742b75a62a0f45d006b
SHA1 fac2b3cb82118aa6baec1799c51320a595d47a1c
SHA512 234f301fff958a0d6d3f8fbad384584e8bd2af837af3d97dc478a220962f8c67bf701fe63653d07bc54ddce7cf37eec966533ef118a5455ef078baf10ba101a5
TLSH
T109D09784549833AE08144F02F0A228CA30D88C3310706820EA6185748AF9AC44162816
MD5 SHA1 SHA512 TLSH

Submit Download

cca49f4a-014b-4e3d-b423-5f8d2bb76bd7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\cca49f4a-014b-4e3d-b423-5f8d2bb76bd7
Size 886B
SHA256 c96f441ff7ea76ef0996fa5614fdd179bb477a4b04d329c6df10ffe1d6d43088
MD5 b46efe78d805255f16b386648495d5e9
SHA1 b7296e7f21af2a580d94453f66121c3536be5647
SHA512 1b4b5ca854bd65d27633e8f8311c1ade7b4c0bcba8001cb5a09be5d58f24b85ebda863060e1dad4a5d352abbca7ff4ed87216fced0003ac9ab9f65f4ee2083db
TLSH
T10F110081D77079B2CD3CD24BA4A5B746C7A4616380CA4D183D624E180DFF51E5317707
MD5 SHA1 SHA512 TLSH

Submit Download

dae68fad-8916-4a6b-9e49-ab368bb9f5c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\dae68fad-8916-4a6b-9e49-ab368bb9f5c9
Size 235B
SHA256 3ccf48a8609b7aa6728707380d5367da3ab9a3733cc68f7963fe197b7ce53b3e
MD5 fea7f067b153dd238df38464155717e4
SHA1 e8a494400b76ffa3e13478209f7f63be789f5a81
SHA512 ba1822a7f21811dd2a749bd1065b66bedee8cd3758fe2183faf5698f090007eac328eab4ad6411e20d11114ff10694ddc126c2c15366bd5e078773ff857374cb
TLSH
T163D097C05498276C08110F0BB2E039C630588C3728B86820D5A001749EF9DC89361A16
MD5 SHA1 SHA512 TLSH

Submit Download

e845f16c-3850-495f-89db-b51cf27043f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\e845f16c-3850-495f-89db-b51cf27043f0
Size 921B
SHA256 8f15eebe625e206877b10a661457a8001345d08f0cf3152e2ec506ffdeea122c
MD5 b46aa35688a79285fd1a1cba5584eb5d
SHA1 fafd7922f8fa3524fedf3ed062d90acd7930f2b5
SHA512 1b45e54650a9b7c1b24e714f460fa734ef09ebcddd085bb52ed0c9a2e105e7540e9f1ffe1b36f3236acdb5155ff61ed735726dbd7fe92bdb63d05fb31823a1e8
TLSH
T10511D0E186222453AC78D20BF565B31F5256943284CA42193EFC48360EFB43F9263306
MD5 SHA1 SHA512 TLSH

Submit Download

e88d97ff-0a6d-476b-9b5c-6f3e55a60004

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\e88d97ff-0a6d-476b-9b5c-6f3e55a60004
Size 2KB
SHA256 dce602870cef2f894f7d9dce9a092ed5cbc0657bf2670d58f7c11f9ff1e51344
MD5 4e22a35c466dea1cee04f0acb8fdfd13
SHA1 d02f2f3ea55c3dc0a50ecb95348cf6380e656555
SHA512 103e3dbc81a9d4a3f0510e22daffb37cfa0f081817d5c1f2a50cc9699351e736ab9c9d711c731caa69a678e059dacaebefb99077c2d06312e23fee2b7273ac3a
TLSH
T1D641615876B84C779C8AE14D919223CE43748A4300C61C536E51EE0C8DF669D337B96B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 7KB
SHA256 dc71de0cd48323ff9aad17f30aa0a300c328725d5c68560ad595476d625c6607
MD5 1e9091e4339c7ad1a839aedd074e9206
SHA1 7c56e722e0bacc0a125ab191be126d15c4a61851
SHA512 e2bd6e0dfed8decff8f9b190e90022fb7bfa5196c91c95b2795e53ff58458bd99f885654b88b3ee033dd8b12379164bf5b822f2847c3be67679bbf5185a44548
SSDEEP 96:xH2UTU7qGqEvfnkgObzSveSSlSdv9jc4nPHEBDBw88n8L4cnlu8pGS:EmRafnkgZeSSYEBDBw88C
TLSH
T1E0E13E7894088B7F65B677BC6C6888316AB2013BBBBF28C750B554C5015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 6KB
SHA256 d6574a981537b15412cecc61768136842f4f55447304cbed279956c3f6438b37
MD5 4c9b0a54fda71f4b08024d97a1161015
SHA1 60606d184308b4ff6f98a77d07b1afb69e25ee91
SHA512 b5f57e33c10a1a7b4a911a690dfc774deb3c55f4ee9eeeebb9deb73aa31501923dd717e28273e78e5a296356abafed14faa0f26eea73dc83003bdf812fab5b58
SSDEEP 96:xH2UTU7qGqEvfnQ01zSZ9NSSlSdv9jNnPHEBDBw88n8L4cnlu88:EmRafnQ0i9NSSWEBDBw88J
TLSH
T1DCE12D789548CB6F64B6776CAC6888315AB2023BB7BF28D750B554C4051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 6KB
SHA256 d2e1e8305b931f8d7522ffe5f61e671bf0c44bf601dab8fde468651a5266c736
MD5 1ff2f793ca06e875a564127c81f5160a
SHA1 bd8ad270fdda8342cdc0577a6c880ba4761621b9
SHA512 20cdc97b39a899dcc4be62c4aeecad780a3fd2c28711ff7f8c6d8cd69f614b5ba6901a1a6770daaaba64dedade12229a9d46f2e8b19e873dcc12ee7b389eb157
SSDEEP 96:xH2UTU7qGqEvfnQ01zSveSSlSdv9jNnPHEBDBw88n8L4cnlu88:EmRafnQ0qeSSWEBDBw88J
TLSH
T146E12D789508CB7F64B6766CAC6888316AB2013BBBBF28C750B554C5015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 6KB
SHA256 1e9f6586dd5bc6d7a5d3e8973ee55c1f352d811d40ee5156e6921bfb76f12e17
MD5 2d6e49b9ab076b26065047b1c6fa03de
SHA1 41f2a1731d1ea97d3e9209a34aeaea270ab00f2f
SHA512 f7019a5c70f67da1ac6dcabf25aa3d2e8d8a15966cfd3ff42f631286acc94e773bf9bc4f78304fed7a707a6ce5bb2dff780cc12e2cde5e1afa3c336bec7a4881
SSDEEP 96:xH2UTU7qGqEvfnkg1zSveSSlSdv9jc4nPHEBDBw88n8L4cnlu88:EmRafnkgqeSSYEBDBw88J
TLSH
T1CDE12D789448CB7F64B677AC6C6888316AB2013BBBBF28C750B554C5015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 e0111dd8e56669e08013dff0be3a7f763d2511440b7363982648b66192961726
MD5 316dfba1ae095000687715eb028fc9d7
SHA1 d28e8345fd9bcdaff196fc55b302df6273db931e
SHA512 4cd0f66be76bebffdee48055ab338884d3749c6da342ba80ed43ce819a167f177bec59aa5c8c75892739c17b49ca0166070198cf5ed6a48f1afc2c1dbf9850a7
TLSH
T14A210A81BCAF0CF537B6914AD0C99FD5DB99501641949CE0DCE8D90045CCE05BFDA37A
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore.jsonlz4
Size 5KB
SHA256 a0bd0591bd7781b77befe951f448c90b4cf7400f8fa8f7e717a7dbcfd69606f2
MD5 866e667bcf45024c8a74b83b5a20c7fe
SHA1 447b62c72f9226a505c341e6ec2576afdddc9e00
SHA512 653789b55139b0334f176a3243c87922baf6024549ab72f91fd013d1ffc1eabbea1fbae2e94d812aa129bb293bf8bb60fe2edf1813f2ff7f70f23b18251f2930
SSDEEP 48:GpqIiI6i2Kl4Zl4QvuoGRL5Mezn/UKljzRx:9imvuNL5Me7/UY
TLSH
T153C1A741ED09E47B2B288416C0CF7769DAAC6C36429058E0867DBF0245BCE7A7212253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 8fd2530a73a7d03d5c5860c1ef28f788a057cf744b80f9e24a069c21ba33d8ea
MD5 d048aa2a557d0cfa5fff376ab15a3c98
SHA1 c02e0e27472e9d11d9ab74bca24488aa412c1354
SHA512 cdf4bbfe9e23137dead45639493612c8d3df2120b27194299773c038b8d3a150e155c8d1152520a4626dc4ea81d0dcc14835b6dea65b80ef62824d44ace3d2a2
SSDEEP 24576:1NJwu7DmsTOPjPh5YoMkhjQbDQWsP3QPhTSxK9Z15P7UBqs8Ahe3QNoK:1Nx/kDbYQhh0SxmT5P75ghsqo
TLSH
T1FD362AF820D1A257F3414033764593EF21EFD00C6027DA085BA99AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 af32eb5db68b9b56286ada4d92a9f2322abaec4351297e97f0ae46635145f4a8
MD5 cbe26614be262cc8fd950f9c3fef5376
SHA1 f0c1d6991f625ed00a5587e2651437734c30abca
SHA512 460cf09ef9c19cb99ffc86bc616e3bb299b6570fdfdff21b21e2f15c76a533e41d8749a275ac022f491757a2683cf53bc0083655a3bde35886124336626690c5
SSDEEP 24576:pNJKq7imi+fOPjPt5YoELhTOAD9DWqbtQPhTFxK9Z15P7UNqsTAhe3QNowWv29:pN3akkD/YbhJ0FxmT5P7xxhsqoNO
TLSH
T1AF4619E820D1A297F3814033724593EB21EFD00D5037DA085BA99AE9A575CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\targeting.snapshot.json
Size 3KB
SHA256 0cd0fd987af484b90f24ade7b4858a274da81bb74cc593b80dc01c3c661323b7
MD5 ae4a10f6985e3b8e5227dfcede632a85
SHA1 af37a3206aaf3bff5f3028cdbbb7d211c85b4838
SHA512 df2be74f4e25e5f7fc3bd36ded5d1796936747c761b0179d542b39d187b113739299bae71bb9a3d7040ed2ab7eb4eb0352176e6622ea84d96bb6c8629f773ff5
TLSH
T11871830C961CA4BEA66BC3C0D684BFA78BBD0533B0447458DAFE460C45FB5FB122621B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\xulstore.json
Size 90B
SHA256 8802476c9b9bb36764d926f17fc94abb740e66bbe8b71c7f5c81d9c65df49059
MD5 6b1abbde5eb612679e310f9bf6dcf134
SHA1 1ed898bc8781215b8192b0056f25e6a29c376ac8
SHA512 ca60ec231b121143cf811ce43ade237bd8dc499095976474dc6eba63f4df1826f8fb83df85da1fe0c3e9486f95a97c6599e769fe73f69e90eb48a148c9edbb40
TLSH
T196B012F4411F94083F38CD8A01C633823821000040C1622674531C64118030B8D0C20D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3552-930-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-938-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-937-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-936-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-939-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-940-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-941-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-942-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-931-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download

memory/3552-932-0x0000023D8F330000-0x0000023D8F331000-memory.dmp

Download