a9f6934a290bb6aba4596ce086948fafc8a9d9875573b871397c0ba6e6724b6b

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
749s
max time network
748s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Multiple ROBLOX.exe
Size 164KB
Sample261107-qf7qqsys2m
SHA256 a9f6934a290bb6aba4596ce086948fafc8a9d9875573b871397c0ba6e6724b6b
MD5 42b18993dcb3abae7deac66c5528b4aa
SHA1 55c586b449072dfacb56362c596fbab784014baf
SHA512 f4ce55fab3fb714808da7c2aa0d4315ce6956616fb301279ca5641d74ac56377ee54d1e2140e98c78b7734f9d7eb2ac8f835493ce6e085da3237f03a6dfcddb8
SSDEEP 3072:g20ttmteC5O5kjEj6469q6sefZC1BhrYi4OcEksl2bQGQ:gNtUUUFErVJWZC1Bh8i4OBfG
TLSH
T1A4F34B74ED84B4E6E1B3323EC997B022A0A668556633D35BD941EF5DF8E84C38B77402
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	LynxUI_v2.31.103.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	LynxUI_v2.31.103.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	LynxUI_v2.31.103.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	LynxUI_v2.31.103.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	LynxUI_v2.31.103.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	LynxUI_v2.31.103.exe
File opened (read-only)	\??\VBoxMiniRdrDN	LynxUI_v2.31.103.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Multiple ROBLOX.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
312	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	LynxUI_v2.31.103.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	LynxUI_v2.31.103.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	LynxUI_v2.31.103.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\3\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Bооtsехеc-64.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Bооtsехеc-64(1).zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\v2.31.103.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4808	Multiple ROBLOX.exe
4808	Multiple ROBLOX.exe
4808	Multiple ROBLOX.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
6280	chrome.exe
6280	chrome.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4636	chrome.exe
5568	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	Multiple ROBLOX.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeDebugPrivilege	5100	firefox.exe
Token: SeDebugPrivilege	5100	firefox.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe
Token: SeCreatePagefilePrivilege	3172	chrome.exe
Token: SeShutdownPrivilege	3172	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
7052	NOTEPAD.EXE
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
3172	chrome.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
4636	chrome.exe
4636	chrome.exe
4636	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4944	3172	chrome.exe	90
PID 3172 wrote to memory of 1816	3172	chrome.exe	91
PID 3172 wrote to memory of 1816	3172	chrome.exe	91
PID 3172 wrote to memory of 312	3172	chrome.exe	92
PID 3172 wrote to memory of 1864	3172	chrome.exe	93
PID 3172 wrote to memory of 1864	3172	chrome.exe	93
PID 3172 wrote to memory of 4724	3172	chrome.exe	95
PID 3172 wrote to memory of 4344	3172	chrome.exe	96
PID 3172 wrote to memory of 4724	3172	chrome.exe	95
PID 3172 wrote to memory of 4344	3172	chrome.exe	96
PID 3172 wrote to memory of 1944	3172	chrome.exe	97
PID 3172 wrote to memory of 1944	3172	chrome.exe	97
PID 3172 wrote to memory of 3164	3172	chrome.exe	98
PID 3172 wrote to memory of 3164	3172	chrome.exe	98
PID 3172 wrote to memory of 1264	3172	chrome.exe	100
PID 3172 wrote to memory of 4272	3172	chrome.exe	104
PID 3172 wrote to memory of 4272	3172	chrome.exe	104
PID 3288 wrote to memory of 5100	3288	firefox.exe	106
PID 3288 wrote to memory of 5100	3288	firefox.exe	106
PID 5100 wrote to memory of 5036	5100	firefox.exe	107
PID 5100 wrote to memory of 5036	5100	firefox.exe	107
PID 5100 wrote to memory of 5036	5100	firefox.exe	107
PID 5100 wrote to memory of 3836	5100	firefox.exe	108
PID 5100 wrote to memory of 3836	5100	firefox.exe	108
PID 5100 wrote to memory of 3836	5100	firefox.exe	108
PID 5100 wrote to memory of 3836	5100	firefox.exe	108
PID 5100 wrote to memory of 3168	5100	firefox.exe	109
PID 5100 wrote to memory of 3168	5100	firefox.exe	109
PID 5100 wrote to memory of 3168	5100	firefox.exe	109
PID 5100 wrote to memory of 3168	5100	firefox.exe	109
PID 5100 wrote to memory of 4408	5100	firefox.exe	110
PID 5100 wrote to memory of 4408	5100	firefox.exe	110
PID 5100 wrote to memory of 4408	5100	firefox.exe	110
PID 5100 wrote to memory of 5088	5100	firefox.exe	111
PID 5100 wrote to memory of 5088	5100	firefox.exe	111
PID 5100 wrote to memory of 5088	5100	firefox.exe	111
PID 5100 wrote to memory of 5088	5100	firefox.exe	111
PID 5100 wrote to memory of 6128	5100	firefox.exe	112
PID 5100 wrote to memory of 6128	5100	firefox.exe	112
PID 5100 wrote to memory of 6128	5100	firefox.exe	112
PID 5100 wrote to memory of 6128	5100	firefox.exe	112
PID 5100 wrote to memory of 1692	5100	firefox.exe	113
PID 5100 wrote to memory of 1692	5100	firefox.exe	113
PID 5100 wrote to memory of 1692	5100	firefox.exe	113
PID 5100 wrote to memory of 1692	5100	firefox.exe	113
PID 5100 wrote to memory of 2516	5100	firefox.exe	114
PID 5100 wrote to memory of 2516	5100	firefox.exe	114
PID 5100 wrote to memory of 2516	5100	firefox.exe	114
PID 5100 wrote to memory of 2516	5100	firefox.exe	114
PID 5100 wrote to memory of 516	5100	firefox.exe	115
PID 5100 wrote to memory of 516	5100	firefox.exe	115
PID 5100 wrote to memory of 516	5100	firefox.exe	115
PID 5100 wrote to memory of 516	5100	firefox.exe	115
PID 3172 wrote to memory of 5996	3172	chrome.exe	118
PID 3172 wrote to memory of 6008	3172	chrome.exe	119
PID 3172 wrote to memory of 5148	3172	chrome.exe	120
PID 5100 wrote to memory of 5312	5100	firefox.exe	121
PID 5100 wrote to memory of 5312	5100	firefox.exe	121
PID 5100 wrote to memory of 5312	5100	firefox.exe	121
PID 5100 wrote to memory of 5312	5100	firefox.exe	121
PID 5100 wrote to memory of 5920	5100	firefox.exe	122
PID 5100 wrote to memory of 5920	5100	firefox.exe	122
PID 5100 wrote to memory of 5920	5100	firefox.exe	122
PID 5100 wrote to memory of 5920	5100	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Multiple ROBLOX.exe
"C:\Users\Admin\AppData\Local\Temp\Multiple ROBLOX.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe7ae2c728,0x7ffe7ae2c734,0x7ffe7ae2c740
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,17774533586994380060,11585381866975022295,262144 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,14742833829604328552,2904807692690127307,524288 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,9410715873846271972,5737617984760696391,524288 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,16193782024530424685,4822258757458348971,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,12053501287737746562,16175279989479761235,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,16400676732227196220,2212633828479137360,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4796,i,9885193469107236414,14862205681309362409,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,6542052819630924388,12030678092407663773,524288 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,13863723928217921654,8845714162027665902,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3316,i,16501584384830054577,7924411709015705067,524288 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,7421076578861777277,3629836227130013940,524288 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,5339176575622278878,2575002281878240995,524288 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4504,i,8581753714983418969,4331708757583700226,262144 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1348,i,6266738891435303559,8112754585904952178,524288 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1344 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3344,i,17340676530358454288,8290197186539801707,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3452,i,11381793189288615296,6638297723086213344,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6064,i,6807213095568752630,9407689365933329870,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,6868598046970375189,1669052724546763431,524288 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5812,i,181623657941423076,10385533145412914918,2097152 --field-trial-handle=2020,i,18383091429966747108,17826854967040522001,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2588

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {9bfd29bd-d5af-4446-9974-d9576c62a7d2} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {937fb34e-a5d6-4a2d-ac6b-ed6fc2e3a066} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3696 -prefsLen 27276 -prefMapHandle 3700 -prefMapSize 270279 -jsInitHandle 3704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3712 -initialChannelId {328149ac-9180-464e-b579-c93ff7a62806} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27276 -prefMapHandle 3888 -prefMapSize 270279 -ipcHandle 3696 -initialChannelId {bb0cf653-63fb-4c0a-b954-06db42a05f78} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4316 -prefsLen 34775 -prefMapHandle 4320 -prefMapSize 270279 -jsInitHandle 4324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4332 -initialChannelId {aa409904-f807-4732-aa69-96cfd405837d} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2624 -prefsLen 35012 -prefMapHandle 4828 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {c792408a-6057-49aa-b8bf-10350c1b1410} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5136 -prefsLen 32952 -prefMapHandle 5140 -prefMapSize 270279 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5152 -initialChannelId {7b4679ff-c363-40cc-adbc-c26f04e17912} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4928 -initialChannelId {59839234-101a-4265-afb7-fcfef18e63ee} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4824 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {7a343aa7-e13c-456c-bf75-70c8f29246c1} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5996 -prefsLen 33071 -prefMapHandle 6152 -prefMapSize 270279 -jsInitHandle 6176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6184 -initialChannelId {4c9f5aac-071a-4ed3-96d7-0824579cfb3a} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6588 -prefsLen 33071 -prefMapHandle 6580 -prefMapSize 270279 -jsInitHandle 6576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4148 -initialChannelId {9f0e5b79-e286-42dc-a061-6b2666a54b5f} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 33071 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5380 -initialChannelId {cc888dc7-e0eb-456b-bec3-ab18a8041277} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5400 -prefsLen 35200 -prefMapHandle 6580 -prefMapSize 270279 -ipcHandle 4236 -initialChannelId {b955408d-010d-43d8-ac90-7813edd7f712} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:5896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 892 -prefsLen 35200 -prefMapHandle 7140 -prefMapSize 270279 -ipcHandle 7136 -initialChannelId {79fec4a9-ed2e-43a8-a932-4995cb496218} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:1460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7328 -prefsLen 33071 -prefMapHandle 7332 -prefMapSize 270279 -jsInitHandle 7336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 892 -initialChannelId {fbe919d0-9576-4dc5-aa96-5b90b686cf09} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7996 -prefsLen 36888 -prefMapHandle 4760 -prefMapSize 270279 -jsInitHandle 7656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7940 -initialChannelId {351e1ed2-7e9e-4f4d-b52c-622d9b1d6276} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6300 -prefsLen 37101 -prefMapHandle 6284 -prefMapSize 270279 -jsInitHandle 6288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6208 -initialChannelId {7254e3e6-962e-40ea-9792-fdbddbd2bb3b} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:4928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8088 -prefsLen 37101 -prefMapHandle 6336 -prefMapSize 270279 -jsInitHandle 7780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7144 -initialChannelId {c6381619-2e9b-4c9f-bfba-ea46e840484f} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7896 -prefsLen 37101 -prefMapHandle 7712 -prefMapSize 270279 -jsInitHandle 2984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8020 -initialChannelId {7f335700-d171-4cdd-b655-ef294ff86256} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4928 -prefsLen 37101 -prefMapHandle 5428 -prefMapSize 270279 -jsInitHandle 6844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8208 -initialChannelId {001083d5-b720-4a99-bd6f-aa82c20121ea} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7712 -prefsLen 37101 -prefMapHandle 7896 -prefMapSize 270279 -jsInitHandle 8252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8428 -initialChannelId {5872f1a9-b8cb-4ed3-9edb-a31a8e078e18} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:6064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 37261 -prefMapHandle 4776 -prefMapSize 270279 -jsInitHandle 1644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8184 -initialChannelId {2afdea5e-b482-4312-a2ab-6dfac95c685b} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8532 -prefsLen 37261 -prefMapHandle 6896 -prefMapSize 270279 -jsInitHandle 7852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8072 -initialChannelId {d36d43da-fd7f-4ae7-94bb-f13f1242df30} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:5976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6928

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Bооtsехеc-64.zip\ReadME.txt
1⤵
- Suspicious use of FindShellTrayWindow
PID:7052

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5568

C:\Windows\System32\wjpzq3.exe
"C:\Windows\System32\wjpzq3.exe"
1⤵
PID:6792

C:\Users\Admin\Downloads\v2.31.103\v2.31.103\LynxUI_v2.31.103.exe
"C:\Users\Admin\Downloads\v2.31.103\v2.31.103\LynxUI_v2.31.103.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
PID:6988

C:\Users\Admin\Downloads\v2.31.103\v2.31.103\LynxUI_v2.31.103.exe
"C:\Users\Admin\Downloads\v2.31.103\v2.31.103\LynxUI_v2.31.103.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a254fde-4cc5-4a7c-b683-d217e3491cd7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0a254fde-4cc5-4a7c-b683-d217e3491cd7.tmp
Size 275KB
SHA256 1fb160f8702aa9f945c0496fb9160b589d4fc06a5026fcb017e481a2aaeb02e0
MD5 3a0ade4b254423bbeae8db6579111c5f
SHA1 af4999fc96e62d98ef9e2773e76f71905176d8a6
SHA512 0ebff0f274383325f4e6590b355ea071988e8bdb122e4040ac73b595ab196aae3ca95716e8515a959b8ea84b4fab7a804e571495f2b5089f1889c3aa967a1c9d
SSDEEP 6144:eEKdDPJAmsdUei3wyxf0/JKMNM0Fym5j+hFD+7t56OD9ZfSApprK:eEKdDP2Uei3LRApjyIjyFSXD9ZfS4g
TLSH
T1F954133165E5A8BFC8FCA600A45B62194C7279DA969F5F8CC085AB8ED19FD080333D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d0174ed-3f5d-4f65-9a92-da4d101ea629.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0d0174ed-3f5d-4f65-9a92-da4d101ea629.tmp
Size 275KB
SHA256 2e513d9bf3c4ed731176cb89e6657f7bfcaa4bf746d7e689187d0c742b56ac4b
MD5 c2f0770fc231996244b1f3bbccec3776
SHA1 8e296b34de772ab89efd93799303a9554ded946b
SHA512 4c24521f2851e088854e050cd64c46b3bb805f1f1873d1b810cba8e26a053be90f42a55935875a8451fe5800920ac9a1a299ba255fc91600cbd52c3f8220a723
SSDEEP 6144:IEKdDPJAmsdUei3wyxf0/JKMNM0Fym5j+hFD+7t56OD9ZfSApprK:IEKdDP2Uei3LRApjyIjyFSXD9ZfS4g
TLSH
T1DF54133165E5A8BFC8FCA600A45B62194C7279DA969E5F8CC085AB8ED19FD080333D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5519cd14-ff49-4499-accc-c20b27e5bfff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5519cd14-ff49-4499-accc-c20b27e5bfff.tmp
Size 274KB
SHA256 3c70fe67e1888a8f932c773039d1c637f0650cda14acf6d8e9fdc6852828a71a
MD5 bc8117e517a009aadc3a03261a98ae85
SHA1 f7038081a0361e788bb469bd2fbdac167fc8f033
SHA512 5823c2b1100a2dbfc9c9999c79e1a8b0cfc80a17c4ceaa57a17d0673e26eaa87197ed0afb09dfa147315ba1751f1b08bf57769f0be459a5164584a5a6e1c324a
SSDEEP 6144:UEKdDPJAmsdUei3wyxf0/JKMNM0Fym5j+hFD+7t56OD9ZfSApprK:UEKdDP2Uei3LRApjyIjyFSXD9ZfS4g
TLSH
T15354123155E9A9BFC8FCA500A45B621948627DD896DF6F88C085AB8EC1DFD090333E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c355484-e821-4e5a-b3f1-aeea63fc5634.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7c355484-e821-4e5a-b3f1-aeea63fc5634.tmp
Size 274KB
SHA256 ff35027c9f0c155cbf21709bb2d18d7bd24b9fdbe7d9b689b360bb63dc6e2778
MD5 895991c74ad87cae8b5350c330555e06
SHA1 c08c8b78b399b679a552982b60446035b140159c
SHA512 53514d0a6ba82b6c477297c19aeb885462aff0dbfc3e3bb74a2bb95b8dca8fcd567bf329a7a9f987af5f53b19683bc101d4a1cc7494147df01e4ec9075aed1d7
SSDEEP 6144:XEKdDPJAmsdUei3wyxf0/JKMNM0Fym5j+hFD+7t56OD9ZfSApprK:XEKdDP2Uei3LRApjyIjyFSXD9ZfS4g
TLSH
T1D654123155E9A9BFC8FCA500A45B6219486279D896DF6F88C085AB8EC19FD090373E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93fceec4-208d-4551-a3b2-86ecbc34a0e7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\93fceec4-208d-4551-a3b2-86ecbc34a0e7.tmp
Size 275KB
SHA256 8dbb13891211261856d21bf944e309b85fb3661167e20cfaa5d4895109e63b32
MD5 26ee689667149fb32fb5d91935ba4b4a
SHA1 1f68703ea540e8114606b2aff1cb1a996f12f0bd
SHA512 6a8f094ef0870566a969b644412b2b19265f6de0c3d22a701eeb12275990ecb526dc409ea91fe02d61ce9813e7aadec4e0fb2b31317b0a60238934aa10d1a8c2
SSDEEP 6144:PEKdDPJAmsdUei3wyxf0/JKMNM0Fym5j+hFD+7t56OD9ZfSApprK:PEKdDP2Uei3LRApjyIjyFSXD9ZfS4g
TLSH
T14654133165E5A8BFC8FCA600A45B62194C7279DA969E5F8CC085AB8ED19FD080333D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b80c911-20ed-49c4-b086-be33dd3e4c6b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1b80c911-20ed-49c4-b086-be33dd3e4c6b.tmp
Size 14KB
SHA256 406e25062ae19a526776a5cfc3f2d046a902186d0b8ba1d1ba2a72a017528f56
MD5 b638b93f4270dab94f6238c58b67a194
SHA1 f4948267402e2d1afdc3cdad5e38926dce421dc4
SHA512 e090483706c1979046e4c2c8d1459756c48580abb52e006d094f2df5943b0e4a49ab1488e7acb65c5117678eba8732c250966d6467e73d97ab7d1dd485624940
SSDEEP 192:dRDILHoKGmHE3v7TI3PRpbWBV9WHsb+WNniBOv0gMkk1fseW2Ok3fmVyIsnAUgrK:dRDILafvUXKUwABgMt1fU2Ok3f+e
TLSH
T1D662A63AAE11793B6CDBD22AF9517B9BE7F9102221942E44E7FC893C15D79CD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39a0f362-66aa-4ef5-8917-7747dc0b1d60.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\39a0f362-66aa-4ef5-8917-7747dc0b1d60.tmp
Size 414B
SHA256 462610f866c69998a15f8dd6bdc10fdf2ba5a93661390696384703b8e7e7375e
MD5 b328cdafde7f84e6db18de76883814ac
SHA1 39c5dfaaaabc5399a6c7b209286b59b6244e67b8
SHA512 71fcaec466b1514322d9e42b34272014b3a109418b82a1efd26b0ec4203536fda02566f431c29fd88a691332dec0d9e24f93992881143d86176665c1e6455668
TLSH
T126E0E5AAC922BC2719FD1728149457C5EB9013662A95951A3B3CC1088FB163A098781C
MD5 SHA1 SHA512 TLSH

Submit Download

5535e2c5-40c9-4e4a-a121-bcca435dd719.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5535e2c5-40c9-4e4a-a121-bcca435dd719.tmp
Size 15KB
SHA256 b8bef3a7ffcc3a40f5cea3312fdf0f7bd8a1ec4946d94403d85ff299760a42e8
MD5 87ddc12c7b02a31160faf53ed7d0160f
SHA1 59064d719746000d98adb9b7dfea50854614eae4
SHA512 4ed0f76fb9dcd1be8fb09b629c7a0ca3e02ce638a01821a61a819ea93a79d53c8ff9593b9bd581f1eec71eea1adafdad91898ad6c319458374d900f3242c0741
SSDEEP 192:dRDILHoKGmHERv7TI3PRpbWB4X9WHsb+WN6uiBMVy+v0zH98Vkk1fseW2Ok3f9Vs:dRDILaBvUXbUwKnxh8Vt1fU2Ok3fLI
TLSH
T1F862A57AAE10693B6CDBC22AF8517B9BE7F9202261D41E44E7FC893C15E79CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55444aba-5068-4f48-9b60-987b6d7eb6c2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\55444aba-5068-4f48-9b60-987b6d7eb6c2.tmp
Size 14KB
SHA256 b5637b2748ba14f86e273d687b738244ffb58c713706c50f1f2e88c7a38196fd
MD5 ad3c8787b0f8ac0079c1c66b5808c34c
SHA1 4914d9ec8ed3ddd19e16a62fe1030a3a91eb3963
SHA512 8786fb14e1f55d3944f5b4b42fd67fc7d1962207a10f5e75152cfcb6812438532b3bcf608ef48536b2f11087ca8db0cf8c84743f358bcfbb207901ad73854fe6
SSDEEP 192:dRDILHoKGmHo3v7Th3PRpbWBV9WHsb+WNnjYBv0gqLk1fseW2Ok3fmVyIsnAUgrK:dRDILWfvRXKUwsWgqY1fU2Ok3f+e
TLSH
T14862A63AAE11793B6CDBD22AF9527B9BE7F9102221941E44E7FC893C15D79CD221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

598d6ff3-dca6-4f24-8ee2-466ccc3c0d99.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\598d6ff3-dca6-4f24-8ee2-466ccc3c0d99.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

63763db6-08b8-4c19-bcd7-31f8860407ad.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\63763db6-08b8-4c19-bcd7-31f8860407ad.tmp
Size 13KB
SHA256 b4ffbeae8fbf2c21466ed5a5f82503cba93bbfb82615db78084bc80142617fbf
MD5 55ef2bba4e81ea3b1db40cf6864cc524
SHA1 fb492421682fc771a362b213e3c4f28daea8c4a1
SHA512 455f5926c999ad2ac791ad7d82f9fe1adc47299f8f8df66a1f913a03db134d425569e168a1ff339ca93795a64e2bc2f2d9dbcc57d7ed39e86a4426eb96f7f864
SSDEEP 192:jRDILHoKGmHo3v7Tp3PRpbWBV9WHsb+WNnFj4w+e2k1fseW2Ok3fmVyIsnAUgraJ:jRDILWfvJXKUwROe/1fU2Ok3f+e
TLSH
T17A52B83AEE11793B6CDBD22AF9527B97E7F9102120942E44E6FC893C15D79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 78KB
SHA256 b93d7f00deab04d99b33a3ac1b70bb133fdc7aece2212ee3aa027ba4f74884ef
MD5 cca6490518a0e8683a1522fd4b1af6e0
SHA1 8b905e9449d0520632d59e9afd4e4be63c7d410f
SHA512 32da7e4f053ec21fbb4969d7793410b8afd0b91bfe3d68680b7e260f5709a0254a8961908682ecf607ea77b6df9894b503cbc542c0a20eced711b86451e5e0a5
SSDEEP 1536:4Sef/o6HZigxYDHRXMhfEnHv0AgzY0ZjTGXqCDVdB/+YVQiEo3EAtdguHHPY:96H86kOf0cAWY2jkhdBpVQzwJtnPY
TLSH
T1BF73121FFE694685F338149DC9D015DDBCE8B2826919D008D2DEC83AED51DFF8E582A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 347KB
SHA256 55a802124f008d2b631ff8977054930aad825cb251d3b036549216bb526f8489
MD5 0281f1670b831263670bd79eca878588
SHA1 55d9c22e17db5ebc7de11ed7b1d9d3fc6f8bedd7
SHA512 693515b304e0c487c7fa1b9c4e66b205c12423bbd09dcda9dace08f55bb774c32d0d13e731901414773e66a1dec0167a4be93bd80eba5c03669f8bec83217f35
SSDEEP 6144:lydQII9pOs9yUxtm8wdzKNt6tpTqH9qQSemZEQySrLOgSaKOywu5:cI92Uxad+XHlSemwOOg3u5
TLSH
T1477423E4793A842280F8D4E72E3927933050623578FF8BA156D8631ED2AD30D5796F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 618116a30813937243b9aaedfbaf848be283a1c1c5e1ee575779e1a2655d9ad4
MD5 01e783e437f633859f81f46fe6e20200
SHA1 7f1e8a9b5b853fa7f76ae37dbaa5f8adb7daed2f
SHA512 4de781ba8f5d6dab04471d9a3ce9a6989255bd7b5f1ed93437bf5ea57d0bfeb5457438abc03b0f6ca7f6218089bbed2ab516fd9b378799125f0bcee0eab8d0c5
TLSH
T1C9F0ABC4B7DC1800CF8E853298A558C0B571FA3009634B2781B81E46C1477FBC025628
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 624B
SHA256 33c2048593265f148bd2d465b9ee03db2cd2278613f9ad4ed04ea54addfacb30
MD5 83a0ad9373e2d1e8de78b39f4821e213
SHA1 bb447e207d94eb65ae390ebb4cee93714df8af97
SHA512 ad8b270329807670a5bca840b8cdcf5f58c3695c92ce1096ea499ce60e849702b48166aa85e34d5bf86d5464fd419e8bac085d2dd7782c2d0112ef99119a7ebe
TLSH
T111F0AB84B7EC2C40DF4E4533986D9CC4B471FA754963CB2B46B82E5AD2477FBC06A628
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 c5e25b5d60951d727a993cbeaf2aa792198ef73840665ebb2dc3ac51ddd69951
MD5 6236d4c8ccc6253319a3f4ba394a086f
SHA1 ce66919324154a6394c32074b6a865fdc808f0b2
SHA512 072aa04c46d6a89b40e5d210ac27a461a8343bd3095587448f44396af3e73bd93abb272ed7f5015bad27cb1ff24fcaa106f8070020d34a217140b3fd7c858989
TLSH
T170C0129C5CCD6401E778DBF2A9AD90CD22A4BCB34E67C7ED41F67948C407B730111480
MD5 SHA1 SHA512 TLSH

Submit Download

042e0611-224d-48f0-b7ff-9e109caf6a48.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\042e0611-224d-48f0-b7ff-9e109caf6a48.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

2df45215-3d17-4179-b163-d2ec6f7dafa5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2df45215-3d17-4179-b163-d2ec6f7dafa5.tmp
Size 6KB
SHA256 728922a9bf341f2d7cf62b717ecae66070be60dc1e845a569342a04f5fe2948d
MD5 77dce96143498fbcec78dd492f1e9fc4
SHA1 ad2f7abf7e5cb8dee941baa6cbf13077e176a8b9
SHA512 2a23cf735501a527e086608dce79692a0ca4e2301c85e0e2dc65c9c1caf2c7998e53dafd471701c267392308db86b74932aca996062524d06d1a8b5c20817dd2
SSDEEP 192:D01uwSEibOApaIH37udjhfGC97kHi+KYPQVRPW:D01uwSEibOApaIH37udpGC97kHi+KYP3
TLSH
T186E17AF7C3E4C66DC90156F49B256E1FCE2D0A69432C3C668CE4AE4B93E2872D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4185c94a-04e9-46a8-bdc8-db992af36603.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4185c94a-04e9-46a8-bdc8-db992af36603.tmp
Size 6KB
SHA256 4c302c937d71a9142d918e7dacb8efafcc9eebd5bb6777353808d127db78d9c4
MD5 70ee14f2f18988e7a9fd9adbd9c4fc74
SHA1 9203dfbe3e4e9764584ed318107a02fef3435dba
SHA512 a759f91975950a5b918ea65156fe217cda0008d5b139fa990969fac41fcbc4c3e964f3f6c33217c1a8cec5cb9c0257b9c1b9e0a624995c439b57749efd80c478
SSDEEP 192:D01uwWcibOApaIH37u3uXjhfGC97kXRZigVWkK:D01uwWcibOApaIH37u3uXpGC97kXRZiN
TLSH
T174E17BF7C3E4C66DC91156F49B256E1FCE2D0A68432C3C6788E4AE4B93E2872D24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

558112a3-221e-4ae8-b033-88e6ebee50b5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\558112a3-221e-4ae8-b033-88e6ebee50b5.tmp
Size 4KB
SHA256 f33c80cfa0b75f514d2131cf5b8b419122b2f0f364e2c6962ec5f59a0733bc7c
MD5 46d94b75fd7777d3a90f35803e564e67
SHA1 e3be5315a7583feec370ca9ab188f3af23b5610e
SHA512 9be68855e730633fbebec1a6205b401dbee257a85dda994fbc72e3e3524f097f338f5bf35df9158d83ab46c6b952ff54e1eaacb614b5c0365a02dffa04604018
SSDEEP 48:YALlqfqXh7hEh2qrNhiaXYfoKsggmzsGEdKsAqzsbuZN+skWmstWqs5jhhnONga:D0u1uwoNYaIHdEd67uZNhuXjhq
TLSH
T11F818CF7D3E4C66D891156F49B25AE1FCE2D0A24032C3C6688D4AE5B93F2872D21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabdc240-3895-44e8-8258-6ecd5d928072.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cabdc240-3895-44e8-8258-6ecd5d928072.tmp
Size 4KB
SHA256 8e2b8a5a4ece20befd00d57df882c03eae31cf79056bccb0ea513c44d2a01d6f
MD5 0b411886df953f21f3736666b9870ee3
SHA1 64c6353a06aa877c729d83ecce1fef755d0273b3
SHA512 d3900a6d599c7513cdaf053a6a3ef22df301bd59c09e6108543e1b4a76b5608e173b5c4d80dcf3af41579564f7c07423913a7cf5dc9170c786da978b0a5d0292
SSDEEP 48:YALlqiqSh7hGhPqrNhiaXYfoKsggmzsGfskosVKsAqzsbts+csK4sSW+skWmstWW:DJLRsZoNYaIHdNF67NmxhuW
TLSH
T164917CB7D3D8C56D881156F49B256E1FCE2D0A28432C3C66C8D8AE4B93F2872D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbdd27bd-4f0f-4a3f-8e6e-c4c909dbc1a9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cbdd27bd-4f0f-4a3f-8e6e-c4c909dbc1a9.tmp
Size 3KB
SHA256 42aea071472b5f80a19252d67162cbc8d0f7d21557d91900aa2e311ab74c7c80
MD5 7ca91869091e486ef35f91bca695c4eb
SHA1 40572a7d16a39a13843edf9105ca265f3887d992
SHA512 0eb5e916e75313eca22377fdcab46aaef776bf09da4022c8c393205531500948abaeb1c72b6dc967a39116cead53d4f36e35828767f944ad30c8950e8e0196fc
TLSH
T123719BB7D3E8C52D891156F49B216E1FCE2D0A28432C3C66C9D8AF5B93F2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

d6d30cb5-8be8-4848-8d55-4e7d9fdeafe8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d6d30cb5-8be8-4848-8d55-4e7d9fdeafe8.tmp
Size 4KB
SHA256 3a8340c5b5e62bbc50aa57d57419042e050577e5a513e65b7539cd713029c8b9
MD5 ebffebfe192e5d757d43a15355cdf6f0
SHA1 1f53c47224471d1ddfdadaea50b1e64e47cc74d0
SHA512 3d007fcb70bce4c95e705766de7421e2329501db3fd4da4db6952239d94741430f913aa886f7db9aab30c4d9a7bf2e650ed85e06b31c4e39e6ceed2b06a55823
SSDEEP 48:YALlqiqSh7hGhzaXYfoKsggmzsGfskosVKsAqzsbts+csK4s1+sKmsVja:DJLRshaIHdNF67Nm1gTW
TLSH
T12C918CB7D3E8C52D891156F49B256E1FCE2D0A28432C3C66C9D8AF5B93F2872D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0157244-92eb-4606-bbc4-9a8feaa43803.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f0157244-92eb-4606-bbc4-9a8feaa43803.tmp
Size 1KB
SHA256 604715a4582b6baadb7fd9b4318e47fba1c249a777e9555c981931a6d7b88e8b
MD5 bb917552ee6a3d2a9312d85ec94d7f52
SHA1 01e43d89888aad29653a756f20e55d29d3d7cd32
SHA512 7e0f26e61563543c3e6daf41b8d177cfa7d977636d4f401906b30fffd9adf6283e851cd7a2c22d5c3cd95860f85db729d281d3739c9b46fb71da3c06c05342bb
TLSH
T149219A779A7E7467503D49AB5F40BC0629BAA436028274F4CA6B817DA0D10E71B12857
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 c2fa2e7ca2f302b69d1f59f5478227cc870ff0bb845fdffcb24452c9d7ea34a5
MD5 b83c18a2985b58ad43ca5003a073dc92
SHA1 8b5f28845d0a57ddac24333a5b3b77841655f9c8
SHA512 32b04129ea0021828504e8b1c716481b3c041b9b147a33210fac0d029de43053ab997490df35da0b21d9c1c560b841b305980f8e889c437e7e54262527cbe17e
SSDEEP 192:dRDILHoKGmHEtv7TI3PRpbWB4X9WHsb+WN6uiBMVy+v0zSwockk1fseW2Ok3f9VK:dRDILaNvUXbUwKnxJoct1fU2Ok3fLe
TLSH
T14B62957AAE106A3B6CDBC22AF8557B9BE7F9102261D41E44E7FC893C15E79CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 955d0b7212e43988f34416f6c2cd4071b90a17a3ce03988903ca99ecca9c264c
MD5 3c0774aede31391f5adaf06514ff65d4
SHA1 56383d5e1b800992557b638fcab7a7fc205d8650
SHA512 9f0cb234cbf12a40c7320ff636acb8291cb03b3972e56e647ee20152c602d264c4861d9d3862907a8b0451eafd72b456a75bacfaa98b58c9ab4738374f1c8a5a
TLSH
T166B0124488419301C82203F4115158983564DF20A6052341C1F40D068837151D01B169
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 5973f85c1798e4eee81737a9fccb97dcf90bb2e735f482161333f68e5b04ddd4
MD5 47458143c5111274304e17885d47e511
SHA1 a06eaf103383b2c2d57f9deff751f4aebe87ea6b
SHA512 81f2ef8933405b7b2822197af392e1773f7ea2517e1a0af223bb45a57a8243e01a7a642975a1ee2c24c5f527f2c5fe725a0a4d283c0c388fc614a5e2e8de0288
TLSH
T159B02230C00A220AC00303F02AB0CAE83320CF2CC303A30382E00A22CC203E00030020
MD5 SHA1 SHA512 TLSH

Submit Download

a008a252-8fed-46c5-a39b-985ef8d8671a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a008a252-8fed-46c5-a39b-985ef8d8671a.tmp
Size 12KB
SHA256 7afa372087a6a70cc256eaa4e59adb8d48f556ec0c25adb6ff60a2acc64a2165
MD5 6eb52e80eaaecf9452023680c083692a
SHA1 1b48cb0820d6ebb5df2da1ee9ea7cdaca35f2bbd
SHA512 75caff984fadcf89fb6906b5cbaf569b7cb827b7e655e6374c80ff71c5f0fe250344bc198d324163a1fe40de364f7fe8f4a1a26a250d71d006101c9372cdc4dd
SSDEEP 192:jRDILNoKGmHo3v7TpAPRp2V9WHsb+WNnFj0Xk1fseW2Ok3fhVyIsnAUgtaJ:jRDILEfvUX6UwR0U1fU2Ok3fH8
TLSH
T1EE42A73EEE15B53B6CDBD22AE9527B97E7F9102121942E44EAFC893C15D79CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2bdb0b2-bc7a-4d84-8575-919a8c1d3f2b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b2bdb0b2-bc7a-4d84-8575-919a8c1d3f2b.tmp
Size 17KB
SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
MD5 472d61bcf21443a047dac261aad552e8
SHA1 608e068876727f4f676b88d75ee81c5361cbab00
SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a82076c3-1776-4b2e-bd6f-34ab0f309109.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a82076c3-1776-4b2e-bd6f-34ab0f309109.tmp
Size 330KB
SHA256 9d57511e601cd7bdb547c025bdd1d47491d92b753a81632657415ae49517ff9f
MD5 336549c6737bc5f03756bd9063f5b94f
SHA1 f3530047968dd962f44066f7b8999e75f4f984a2
SHA512 b79bd1de0a7b8d34e6909480a13301f71d1320756b30b9e4618f41d3fd428044656918c21348099de8cd6191c2ee5c9d96d96d3210d21483d057d5b004ad3ef9
SSDEEP 6144:ujrwH6BEKdDPJAmsdUei3wyxf0/JKMNM0Fym5j+hFD+7t56OD9ZfSApprK:ujc2EKdDP2Uei3LRApjyIjyFSXD9ZfSz
TLSH
T1A1742235A568E8BFC8FCB600A49B63094C617DDB869F5E9CC4455F8FC09BD090B6393A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caf9e3c0-2eaf-4782-999f-34b250b3ada7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\caf9e3c0-2eaf-4782-999f-34b250b3ada7.tmp
Size 130KB
SHA256 70f233bff565ca2c24e6ffe4a98c433b75d98865b5376cb0a040a2e9cd0b66c3
MD5 52eaaa4615dde3dc784081745abd2173
SHA1 941f84b0f0a1d46ce8d85a9cc173a00110ee17f5
SHA512 bdb975cac6686190f9f09dda8046527ed1574f93a4d9ba787a2cd29829dbe48c5822ec6e89cba89aef714e92b910c50e78594c36c4514ef8f7c040fb9d706163
SSDEEP 3072:x+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:x+hFD+7t56OD9ZfSApprU
TLSH
T198D31232AA91D87BC9FD5541B157A304DD766CED41DE2A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\activity-stream.contile.json
Size 4KB
SHA256 7f01e5095074f7587d8df8090f1d96b674ab1340043f8cdd897fcaf81b89d023
MD5 08873174a254ddf5cef6ea54a1a0eec9
SHA1 0f2947fc75a750e8871c6c2addf45bd2058dcf20
SHA512 1ef325eaf5e66d50281c93b55c275fa679b6f947c36a43c86aef8032475c245cc1ffc2777d3010b40973bdc0dc759a1c6566fd025d6a62a5795a8653cad623cf
SSDEEP 96:NS6vSN81HKvQB2OF1Tn4KYP1FXjt6Dnl13lz:NSHN2HKvOF1TsLXRwnl13F
TLSH
T14791E88B852D10060771BDF2281B369CF107B01956D4DCA4F28A6C75C679BE881AEAD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 8c2036733685e99c67bc435fac15fc1ba0eca5aea156d5b8189cd69f3d18286f
MD5 46ee9c2a32e60c9403e4008739d93f66
SHA1 900014365e6c86d7f20dd2ef0db605419001b9c5
SHA512 11625a7f4d90c4601d8f02847d95869f9cad07f859e93eb6553af1df8ec5bdb31d60dce0af05f7dbb2127c9383e96eacf945fdcaf6c859b4ed93205c8ed47cb8
SSDEEP 768:rByxTazb5e/SWpadjth7ZhEWI6Wn2cNMUWPP9tVIVKhJXX4pid72BbsKL/1mug:rw9aRe/SWwNthFhxW2m/WPPMzrLO
TLSH
T1E573F8B3A6A971BB1FA037CB2C0B795B52D50185E38502CDECEEC92C81CD394527A5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 6fd9f3cf514de206825b5d6c572e2fb07791a61356e8ac6670a7c6edb1b710aa
MD5 403e460fc7d4d14031ade1e49f64f50a
SHA1 c358098f5ec9ce4094bf06c550da18de1fcb23ff
SHA512 6c2010ba9095b8483ecf9ff7db4961b47ada602e6c4d89c2849df7767f873dad53e9190b7c3e29c6ffaa13de264c0f44a0088362d64f243049d577cdb1bb7e18
SSDEEP 768:rByri5tqQsDNYJmIsi+PCdNCmkOw51m7UikIdjFGKOOroRa7CXlDh+G/KrvKQ7d:rwrsC9CrCKwkUBIdjFGZOrG/0
TLSH
T1FB731AA396E9B2FB0B9177C72C0F796B56E14186E38502C8ECEDC91CC1DD654123A6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12650

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\12650
Size 251KB
SHA256 6f8f233ecc9c0ce2345da2314cf415fe6bc43a0a7b2565fb25b51b375477395c
MD5 addc08610088f354b64d115798a3cb4d
SHA1 c465156c9302bee817b6278a52d1788322ffd689
SHA512 d5a782cb70f19aa532b899f27a81437382f462d543635a58eb3728d3f8bab5b274bf8bab58abcd6a32c13b63bc72c46651db2c4248edd33fdaa17b9b3549affb
SSDEEP 1536:yYCYFs/6Y6H1SPrAvkcIeEFMjQomvbXzLfoAApIBFyfrLOf8et9yBqAAgM1Sxum1:K4HqcZfejAAApIBFyTyyBVrH
TLSH
T18C44E7F3D6AC30FB175287DC2C0D72CF62AF8139DB5209DAFC688158D389AA51076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18669

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\18669
Size 126B
SHA256 3c98b39a8b988efec48740a4b0086f0e8fc7baf9093cd8d6559c77d481be70c3
MD5 78fc1750f1f6c13cc59a1eae96bcd096
SHA1 fd6daec2554a63abc1a3ce15607d8152b99dcce0
SHA512 73e12448e7c0bb4784fc809a7018806782b5323a3c584f92a906f766d2aeac6c198aa905a2c30605dd9334f2a9252d4146d10e5269c1c087c70924b9025faa8a
TLSH
T1C1B092AB1A85E886E317BCFC14A8E88D94079528CC80C6B3EA9A524E127CB70951A750
MD5 SHA1 SHA512 TLSH

Submit Download

22450

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\22450
Size 251KB
SHA256 dc2867b3611f81392b73be625f10bde596bead7b23cd1c8534c353cc8164683e
MD5 66f5d673c24f3ec25f2af59eb063005d
SHA1 065ad63ce3b8b8b8f1f2e70a6872b7770654257f
SHA512 94836f30d1e9d6281f3a1110fbebcf99d7ffaa7cba2ab441dc84b14f1b978a2203a5cc8be8caaadc2cc9de2dd158dc56ce77a658baa1c250f51639c94cecdd74
SSDEEP 1536:rYCYFs/6Y6H1SPrAvkcIeEFMjQomvbXzLfoAApIBFyfrLOf8et9yBqAAgM1Sxumc:54HqcZfejAAApIBFyTyyBVrm
TLSH
T18444E7F3D6AC30FB175287DC2C0D72CF62AF8139DB5209DAFC688158D389AA51076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25505

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\25505
Size 256KB
SHA256 2e85e838a262b3b7e8ce55181c4070a382a1e8aa70bc836cea07548c4eb9962a
MD5 19a5b8dfc1c893bcb136f754437ce780
SHA1 76982863904be8381b79b367112a438e8373657c
SHA512 9ff03b4371a7ce94ac6521ff0d4a15c57374bd78cf730d955d813f5aa4048d8f470c64805c44308e11ba3bbb61213e6dd77029c9355cd0405b8927dccae097e6
SSDEEP 1536:jYCYPs/6Y6H1SPrevkcIeEFMjQomvbXzLfoAApIBFyfrLOK8Ct92ZFZWkM1SCumH:n4HYcZfejAAApIBFyTL2Zj30
TLSH
T15D44F7F3D6AC30FB075287DC2C0D72CF62AF4179DB5209DAF8688158D3C9AA5107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29904

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\29904
Size 354B
SHA256 192f685eee2d9f0472a212988cf835fdc1cfedbc4b864b4a1edec2d368e24bdd
MD5 b83ab7a9303dd291aee0857bae33ccb2
SHA1 8f421bc7dabc9abe0596ba5b3af3f0bac2a2e0fc
SHA512 83a8285be9dd2428649ae1d160b388a92aaa2466c1741edbb2318728f6f2e969f82a59e2666f76e51c2546a5799ebf49ea8941ab88e6b4d5cf41e418ea64216b
TLSH
T136E0C0A20E9AAC30FA272CBC545CAE4D25034A186F0890FFE3A4244116B1B0D525B7F2
MD5 SHA1 SHA512 TLSH

Submit Download

30551

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\30551
Size 46KB
SHA256 90e46d3bc4fbb57a8f14b8d1ff404b1429733989a44cc84312bf34bc60322776
MD5 3945452c53a5844baf759a2ddc356693
SHA1 6881b37c5843573ecf9ec34a62e91ad11040a4ff
SHA512 46eb3cf797b2066cde660d9764605c8c0d405432743413e956def9aaca5e610424a5d74b9392cc04ace0a00f5bcce6761aed5021df74fbdcc7c4d325dedece83
SSDEEP 768:Vc2c+iJsc1EDsWD5uymiz4hK95VhfLNP47xmVimiz4hKn5PhfLNP47xmVW:5wWeEoWpqK1hfLp47qiqKJhfLp47qW
TLSH
T16023C3F33904811B43D1C7C5E168FB1DEA37978EEDDCA5E6C210487A2A84EFB4094AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31658

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\31658
Size 251KB
SHA256 9d21d8d8162eaeea1e3005e8b60bb170c6ebe18201ff8f40c39ab679926b0040
MD5 57b9540d1aebf47e48706d6650b3d7cc
SHA1 a43a6c3bb8b0d4587697908419495ebe23ed0172
SHA512 7139ab54552f2bd0544994b92b9be33755db0ef455cedd4cb20dbf4e562c6ee4428bfe0ecfaad0511c242e090b75f4f4e0db46bf92498b67a1de6be828f96667
SSDEEP 1536:GYCYFs/6Y6H1SPrAvkcIeEFMjQomvbXzLfoAApIBFyfrLOf8et9yBqAAgM1SxumB:G4HqcZfejAAApIBFyTyyBVr/j
TLSH
T12444E7F3D6AC30FB175287DC2C0D72CF62AF8139DB5209DAFC688158D389AA51076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6557

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\6557
Size 52B
SHA256 b9c7816047f5d0700938740e9e11e2c90533e2555c4248719420ae8da2e63b47
MD5 f5e1642e0a8a95e17fc86a1e2e504f6a
SHA1 5279c9975514c2e564589a26865bcfc0e41b95d0
SHA512 6b7d2b6f2a03799f8064f12ea762603ae88ea113b2ad55f09d8964517588a3122c4348ec8a9d4dc8e5ecc8f2756e7384416b7552b643765cd0eacde487fab77b
TLSH
T13C90024442D29901D01691B18D4085B4143439604880126378912B5508150D20504450
MD5 SHA1 SHA512 TLSH

Submit Download

9577

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\doomed\9577
Size 129B
SHA256 659a26c4ef8320bd05ba96bd0adb4c9460cffb09c88827b2e1ed27aadf6ab392
MD5 7ecf0e8ac6d7d8359961661f910e452f
SHA1 bad1c37a21e596d3e55776544f822942b63c420c
SHA512 aff73c6af4d56ab6505c25fa2c9216342fa404de8e70f051af193ceacba74b475804b348bc49abbe681a075216a7c8bbf5527601a40849744230a380285e45ee
TLSH
T1A3B092B74A46FBB3FA5A5C7909FABA8C9B192A41DB104E82AB261604043D37658AD704
MD5 SHA1 SHA512 TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 35a6eb14c20dcf11e7ce8e5df8a37a9723c41b9671612fade868c184ac24340f
MD5 af2e37cacf1c7cb19ad28bede7d8c53d
SHA1 6d53e35e5be07c2ba82203a503f23c56c920d7a3
SHA512 c8a39e6c10965491c8a4705dc837af8ef9b4b6b63092af2c4b4fda37630d3a24796af7ef55a4f87eefdb80cd04d443440f295737036eba88134b6d81b95bd830
SSDEEP 384:HXwIiO024YSWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAvua:36ZYSWTToXJWTTogB7S/AmVAf+hRMwua
TLSH
T11E728E7D9F413CAC275780E8C8B983598D1CB6A7DFB5C02D159C3E09CA8861A70F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0AAA8127F6C70BDCCE94DD3D31DEB22471782D23

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\entries\0AAA8127F6C70BDCCE94DD3D31DEB22471782D23
Size 51KB
SHA256 4ab2ee678a1d2f03fe0e83e4f387cbe58941dd43d94248c1c86ab997835da65f
MD5 08fa7a08e36835a50bfd4da1c2652999
SHA1 779250674dba8c0eb06550b2e9356cf9f4dd3ada
SHA512 d5e895ef2ee2dda05ac78abfdae2bd3a848455509fdb4bea9bf8f0c47c76ddc16151ecbed233852aea2b5785125148ec1a9ba0bbc00b91cfa57f7636230f70bd
SSDEEP 768:1K2BRrR4XIVak13goSJqmpurWdw+DwwpLwZrPbZMJGD4uxVDzzTIAxnwNI:jrr4ybcwQ5pLkrrVrfVoI
TLSH
T1AF33F1BB9909194E1DCA36D3CD1EE3583D10FDA3D451B4B9B45E4049F9887A8C3A06AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86B8F30D4775B9361BA4278D8AE851200B4C2BE3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\entries\86B8F30D4775B9361BA4278D8AE851200B4C2BE3
Size 69KB
SHA256 cb3fc5fbf69965783c28b1aeb2aa67a6e34e6232a137a3e3da3ef191cf186528
MD5 6faa419df2240b9d8561b0da6f8005d4
SHA1 8349fb70ede15c9c1602dacfde9a73d3a534633e
SHA512 8fd18148c5745dbb11348321928c86508380a5dc98713ebeb37908f20837b6f8b097e93ce81d99ae0fbe68ee1234e7350f33bfcec7b868ec61d47edd050f8e2d
SSDEEP 1536:YxcZaYuL9YnMDrZao0ViGARgVpx8zpxn8q07iAMoWn:gpLdrZapVLwnS+
TLSH
T14863F17BDDDD968D6D43D68B9382F44CAF602523C5F7E24C848C01C70AB6690A1FB769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8F125B441051EC977329A60587C44831F05D452F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\cache2\entries\8F125B441051EC977329A60587C44831F05D452F
Size 15KB
SHA256 8519e9735372ba90e8a32653de1dde76b74ec4b43ec8ba0969e70a2d0fd23cd7
MD5 ec1f486554dc8e4b666689890bbe989e
SHA1 a9aac3912a672bea9f54ae4b00256308e1604852
SHA512 5b6ee8340371ba3418cfb08413049714937324e113f16f720ad34a3813a01f769694d31a9121a8e24d662ce3e6fced500b0814eb3f108020cf9044d06932c5fa
SSDEEP 192:hqXUM3xbRn/kh1/IdZRi+TVCcOpPckmqgOD17Msj1OMsXsn15WeAouYKpS6Ez4yU:ejMn/aCcucNShjFIs159PmlEz+u5sRAO
TLSH
T19172CFB95FA019310150409083568FAA5DCDF9D383F9E2D7FC241283DB873B7E68B9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R_XgxAr5Aom3HQTYleR+v4IN9hBh5+yJpNeubPj1ZuM=.ico

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\jumpListCache\R_XgxAr5Aom3HQTYleR+v4IN9hBh5+yJpNeubPj1ZuM=.ico
Size 543B
SHA256 019a042efde931f9493b857fef59d9009bd00d4d70c8412cbac6155eabebf479
MD5 8ab624faa5e98ad253f43a50c6d77acf
SHA1 15a28ea873256a93f6a1879a268d3e2497740865
SHA512 d6ff4667ad5877c816cbadbb5e8483810eabe19b0c959cf41100f8799497b2be244bafc020dcc3933da57fe78eeb6f98a7f1707887fe0edc73ff0017276fbb88
TLSH
T194F020CAA334051FF9222F231DBE27425A1B5E841071A32818DDB6EC36046619A82F5A
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 b421bb21ff050d2fa33798027cbccb650fcd6eceab1d56b6e6e1edc6b192a573
MD5 56509c74f51b6f39d36f12e968545ff7
SHA1 c0c604590827cf052fa0b4920e4ec79842bcd4a9
SHA512 5db38bc5e5b269a0e8e4cfffbd6e0a81a0bd642cac266f885677cd288b9c7b769416d877eedbf9bfe0e3a0fa6572cfdc493ff9a886f1213ace756693b57c76fd
SSDEEP 3072:X3lcMj8AciklHBEHNrVtD+cASVLUUF2yeMgcIuV/qwA:FcM4lhEtrVtKzSKmIuJqx
TLSH
T113B3AFF6DBA3897D68FFD42DAAC2843EFD266404B397341DC863271462C6B787675208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 77208f4f66550668681380e0fd7053b8cd30aa625533375417ed35e66c2fabcd
MD5 fea1d95dab16e0b669b50819bcbfbee5
SHA1 7f06058b054ac30ee02923876d8d038ee3e87c84
SHA512 1f5f67b11c8c948a8fc51f2489a57251711eaeca4ec3d363c8dda92fb425dc99d7085a665720ed159bc95dc140edb3b2a2f743629fc1b2cc9903009149a8e473
SSDEEP 3072:j3lcMj8A7JfaBEH8rVtD+cASVLUUF2yeMgcIuV/qwr:pcMNfWEcrVtKzSKmIuJqE
TLSH
T1E8B3AFF6DBA3897D54FFD42D9AC2843EFD266404B3A7340DC863671462C6BB87675208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 19KB
SHA256 9ab4008af0bc07cec6fbbdbb864be111f08147a7d1814709dd95101fb35bab73
MD5 2326ca3c02dfb3e66298fbc1c74d9955
SHA1 2a255792e1f069be515fd3c6e867c5c51359e091
SHA512 cd3926abacc69e616741f0a3088ed12d0ef3198648dc7b200e77b27b4d329bf0a702666ca4c9fb6d3726d9ccef2d2a8ec9504dbe8327afdcd0cf34b4164ed6ae
SSDEEP 96:hiD/TZ/djPugbjz9TjjzlPWV3WZAPVzPgStgtxVunZdZPWV9O+mv3dkgHO+9aE:hg1/dPHjtjj83CA9zPl6VO389Y/d5H7B
TLSH
T13B9222011BFB0955F7F35DB07A72F642AB73FD03970B421E8285524A4933B908969FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79SOS6A4SP1SP86MBXR6.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\79SOS6A4SP1SP86MBXR6.temp
Size 20KB
SHA256 34393f225db6456fbc57fca8bd0f811ff4b470ae8654af6cffa86c5aa96ca49d
MD5 a663b24dd6a30530423e67f6cfb22a89
SHA1 c7c89fc865beaecec14763f62c435307a8f598c8
SHA512 4d836853c675525658342e66eada28a7bfea70104ec71e5431bc2a241c083eff2b7f3ca9c6c6e7b00b79a7889dd80c688f1150e3bd2996ff026d7d71cad7c66e
SSDEEP 192:+3O/dtGNSASjbCZhW1C9d5Lk4Jq4s5/rOSTg:+3OltGOFu3TsMv
TLSH
T11492EE010BF71955F7F38DB13A72F642AB73FD036A07860E8281524E4973B50896AF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6GU056BOJRY8EJVU6US.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F6GU056BOJRY8EJVU6US.temp
Size 20KB
SHA256 cb15a0db01e1ea4a0af7850d6175383767094b604e49a92fa208bd611cef368e
MD5 3003f24a396eeebdb3fb7416b0ab8bba
SHA1 72ff22ea279cfc1dd779e0800bb4871e4a6f5279
SHA512 66568a36a1517e6e6f3052ad13a295d632d0477365515bbe2da7a2ad7bd72c88a1686f3518d453435a4ca1736e45e4721e71be61b9c821c7b95eea0cec150362
SSDEEP 192:azi/d9SNSASTbCZhC1C9d1Lk4Jq485/rqSTg:azil9SqhK3T8cv
TLSH
T14F92FE010BF70955F7F38DB07A72F646AB73FD036A07861E8281524E4933B50896AF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QNWOCSEBOEUWMG6ZWS0S.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QNWOCSEBOEUWMG6ZWS0S.temp
Size 20KB
SHA256 8c0c8d0e1cc8f247142c8d1cce6f55c2245f2cec3f4b1d7f27bba434eec38d5b
MD5 9816d8f1361fc0344226af50d3c5151f
SHA1 0132e2a7e1beeccd4e5ccf2c5c0761c9ba558ea5
SHA512 c5033b7f7830f81e71de7c0ceb5afbfa01fbf9429f32454540301377210a74facbb572fae6f913b32e7d5ac440691cc4d01a1bb629bb4ea4508c55c27c9bebc0
SSDEEP 192:jqv/dAXNSASCbCZhH1C9dkLk4Jq4B5/rfSTg:jqvlAXfY/3TBhv
TLSH
T18A92ED011BFB1955F7F38DB13A72F642AB73FD036A0B460E8281524E4973B50896AF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RGZ26LVJQEA84YA0KPA0.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RGZ26LVJQEA84YA0KPA0.temp
Size 19KB
SHA256 aef4e8d6b77e30d8928c390dd05c6998d70c8608afcd6adcb5f7fce65959d4fa
MD5 9ec40f231992935d4061130811e6554c
SHA1 35823425ac21024f816990890ee9a7e8fa2b7b1a
SHA512 71cc8f8003193f81f6387363615ade2edd7945ce32280b52b4209a0fd5834bdb74332454ff64e140f95f450b9126856da6411f958e703ed67f8db79882a0ef24
SSDEEP 192:9c1/dSlbCZhV1C9diLk4Jq4L5/rtSTpDLN:9c1lSlGN3TLrIt
TLSH
T1CA92FF010BFB1995F7F39DB13A72F646AB73FD036A0B420E8181524A4973B50897AF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\AlternateServices.bin
Size 41KB
SHA256 b33f2bf61b8473291d110eec64d1d85567158f649f4a564904986617dc99299d
MD5 75b228840c15b90db9919f62bb31e759
SHA1 25aa69bb3554e7e8d29aaabc2e36aeadb1845480
SHA512 afb723a8644e3d90a75cff2bf196de835b21230b39c2b751092cf3cdc155a09b5ca5c885c25e574267f36eea48d2943c153fb756b015094ec3b6bbb938a6c944
SSDEEP 96:YZsEP3lBD59II56Q2oRNTPZ1n7Eyx22QyuZ2Zy8ttVebOJTlbJbVbIgbgzObKb6C:B22fZZAFt/WVVvUg7Fnss+bGJ0sKQ
TLSH
T1E813C2F75FB16053F0A28FF580AC759D9C330229589881E8CA05A0E746AA7F4D17FF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\AlternateServices.bin
Size 8KB
SHA256 e78ada5b57b8a5af545cd163b1c01acf916a141531c2144b0125ca3ae3940ad4
MD5 e5b746d58b93190be5b463bdb40969f9
SHA1 3d047a7cb7c9857b75852cd7e61d45addf8d1306
SHA512 f62f100078a91b9ef361a1a2d63ae855676593d7e7f28a5495a85d99e62f639d988bc9db77fd88bb6c06be6353770d080fae0d26db85dec1cf9c2c37ca158007
SSDEEP 24:7RuhMZvNs91/K9x+N9Bhb9Vv7r9Fvq5q9F55A5w:vNeto8Hn5B7JRYI56w
TLSH
T1070264F76B76A022F0E28FF19069719C9C33072515A891D8C74590F246C6AE9917BFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\addonStartup.json.lz4
Size 4KB
SHA256 335b56b15268bb08cb268b0c37896d690fda5ebd3ae16b9c91e59e1f129ed52c
MD5 ed22915ad2425215fe1713e2d01b2f0a
SHA1 b2d89cbf6ebf784c35f12612e49e2e22e60ccaeb
SHA512 5258d421fccd02a595280e57c242f45f85268c399cc7a56f1f3f88289d5e1039a476cbb6f3992486073ad1c538eb44a7d96c670affe6bc4deb9682c6a88b94db
SSDEEP 96:NC04sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:Nu52xxhD8rGvm6ApwnHUuhN
TLSH
T19FA17DBAD141EFA2FE32C04798D57FB2EAAA9B7420A9C4D4F1AA71294C24A735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\broadcast-listeners.json
Size 221B
SHA256 1c3acb0074f2843bedd33fcc4c019fc20d2bc3f482d4dd39fedecde46b2c21ca
MD5 dbd68c921620db01fe9d15f30e886243
SHA1 8b851928a8e9466757e81aefa0cc0a293ecc7e73
SHA512 1253924d938a137e7dec19e92fd7ff3442f57b9f2b30c3cce6362a71cd47b63879c974beecc3d3a234c809a6e1f68aba9aa630d4dc85b1ccf0e47c17f4d1b066
TLSH
T1D8D0221E90173C7F4B8D6A2EF40827920BDA200A3270913DD3AE30940A2AAEC40081D0
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.bin
Size 148KB
SHA256 6ff383908c847186cae8cdd28e9fa162786c3690382d718e5c2b66722a81c237
MD5 e2f082146094e1062d99d68dff88752e
SHA1 6c42966c0f30a45f19a2b2d7323e20c0eb1f55d3
SHA512 cba535e90111b1fed68def148376c951390f965221d14513a508726c312c347f0eadd96a83585715f816b783116f9cbe80f987ac52f5d03d23da3821234455a1
SSDEEP 3072:AL7vDXC6ktLtRKKqQOMYzs3ANco1KBc/KMNsakFOv6+94eWrp:ALLTC6ktLbKKqQOpzs3ANcgKBc/KMNsr
TLSH
T10FE3D084DF1A407BFD2485BFB495173C2735F4654A599B0B2AAC00722DCB3BF2D0E66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.bin
Size 150KB
SHA256 2fa0ee39228c2407d10c1210fee9baaf62d8dc061e6efe23f24954671a67c15a
MD5 3cd161c520fbc9047256bd292a35b9cf
SHA1 88fc3e17198d9f5758b0360481e70fd4f4c02d78
SHA512 8a62f32532c3519c3c46c31fdb13534bb64271eba9c6e0f686d71aab3e9ab268e52a0043f54fbbb3402544ffd83ab172e67a29ab6a0f64989901d4c92619ad23
SSDEEP 3072:rhPXrwrit7F0EMMzhMj+kRTP8w473c/KMNsakFOv6+94eW+S:rhfMrit7F0EMMzh6+kRTP8773c/KMNsZ
TLSH
T118E3D084DF1A407BED2485BFB495173C3735F4644A599B0B2AAC00722DCB3BF2D4A76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d64a76a3b50ca668082c85a177dc1778759b69393317efad5ae1ea488bd4ad1e
MD5 537c5f014f1fb473595d31f1b95dfec4
SHA1 37df5b3ab2f5b51031b7905d137305f63cefd46c
SHA512 e25375c3acc7a98283a78194d489e3af582242317f416da6bf2188ac6f9a33ae9846339d989c1d0af64cbd197da10565f3b08b3a97ec8d69039a6a592eda12c2
SSDEEP 192:gwkT1d66JozGzgCl6mc0dPOv5zboPdtWYyjLdW:Cd66JozGzgC1j2bo1tWYyjE
TLSH
T1B4E11064F628467BC804027BCCA61B904F39399ADC4E7F1935AD640C2C4B2DD7A9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 63KB
SHA256 15627bdf9faf630270f33e3560325652ea5d80c044759a7a6da843f219f13fa5
MD5 eb649d0ef434d25861ff725a8e685df8
SHA1 8c098133ce30ab3a43a385f56eccbbe6525c7c63
SHA512 f252093584431082a8910d1c8f50e840b755e0e5d384e8f282378bf4ae93da35622cbe08923342dda1f127b3da45bf843ddde3fbd350b7a8e4cf1f9104b5ba07
SSDEEP 768:J2lemjU53UBO//jWlGcmhu21QJKOOieq83pbjb+bibfbp3//Giy6794eWXvHHM3J:AAmjU53x//31EuWiy6794eWsJ
TLSH
T1E153CE94DB1B403BE91095BFF4942B7C1625B42049999F0B36EC04662DCB3FF2D0EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 148KB
SHA256 fd75ac0d4cb10f47f19da24ce400cb2ca645e99cd1d37d62e5d820a0902e3a47
MD5 39f94f5428f67be4a49dc3d5628597cd
SHA1 4ee9d656407c81da6bbf3e4d65668279b8fedd25
SHA512 5b7d02b3852f926876aca729ec195d2d5f6a70998adfc59ad5b5cd8033bdda8bbfe186d7a3b6b6c4880be0e6b42f2e349371514961a2b99beaee4025288217db
SSDEEP 3072:lL7vDXC6ktLtRKKqQOMYzs3ANco1KBc/KMNsakFOv6+94eWrt:lLLTC6ktLbKKqQOpzs3ANcgKBc/KMNsr
TLSH
T1BCE3D084DF1A407BFD2485BFB495173C2735F4654A599B0B2AAC00722DCB3BF2D0E66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 150KB
SHA256 a3875b0b4ec6199ac1257a209d37744815007ee42185aa082c171525de5cf6f4
MD5 adda8a1c1932a0c46d3936334879fe45
SHA1 30fb06eccd319dd07276e95c1014004dff527f3d
SHA512 e420e858bf88400864b11f1d6cf5cc0747097172190a7a1072882a6f18ee2b929f7018e046669f6077afbf831406ba1aab7d434be7b30b0ccbaa60c99c5e1fab
SSDEEP 3072:6feprwrlLbFoLBBvIyH+kRTP8w473c/KMNsakFOv6+94eW+t:6faMrlLbFoLBBvIY+kRTP8773c/KMNsY
TLSH
T1B7E3E084DF1A407BED2485BFB495173C2735F4644A599B0B2AAC00722DCB3BF2D0A76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 3108405573b22f3a57548c976d2ca52ecc8313e8611f5674eb11092105c3f871
MD5 4d2b2ca046a1fe0f01b35a7a280b9e48
SHA1 aa92a3eb2780b2ad4f809f8e2c1ae0a5aa8f8178
SHA512 4c87fa9df1ef46837f386bdce1cf977845d845b3e94c4a6dba4f88f35c669ac994d2a9c4edd4b340f93ac6deb0d5790b2eb07ed82b5fa295ad87ea063709d92b
TLSH
T1EF61C958F229463FE444413ACC9A1B412F743462A8AF7F2A35ACA14D1E5B3CE768D47E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c74d3c540e6479819037f251546ae452055c79cf2045c58df78375f999e48569
MD5 2b76ca2bbd3c610486ba8fe1a0f5530b
SHA1 a318ad7731e6f82b54b5408997df24411f6588fa
SHA512 8cc2b79e5f1b07bec49ead60dee99c7b20ff77a0d51fa3c3e1675a9dc079528f78a6baf2f756fa10b6bb2a21489c88f0ff61797f0851d2f4b9981e5ad68b1f73
SSDEEP 192:JOv5zbowZWYyj1jwkT1d66JozGzgCl6mc0dGI:GbowZWYyjnd66JozGzgC1j7
TLSH
T147D1ED68F729467BC808023BCCBA1B900F75399A984E7F6931DC640D2C572DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\events\events
Size 3KB
SHA256 09fef80a85d11d1fb6184944f93b704db89bfab5e76d0280a6c714de6a2dcf50
MD5 d2683edd506ad4a7b69f6732350a4621
SHA1 0f25fa0fcc3ddbda344e7379540b85dde33acf3c
SHA512 e6487bb2d0964f25a751edd914cebdf0dba4c069f28424af69baf436e7ee3e8aa90f8495e5b6db34e5cb74413c186dfe8f95440f91006d4ccd0e3c02e972186c
TLSH
T15571353C25B90C7F69DBD69EB441028D839D460684C72D8B4DE7EF49CC46A99329F03D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\events\events
Size 4KB
SHA256 608efbc45166436f68fc6a73bd5e2e066ef76759a36f5bbd375b92d4504aac39
MD5 90c58d8276b71352a70ce99631b0bcdf
SHA1 1fbf1d849b62c340c5bfdaefd88480ee0c008bd5
SHA512 2d98e6d84709d7940f2b7b7c3b1f44c48f095e28c3b3ac382f591db5f05bd88bd6ecdfea5569a83a43045d8d6b74bf31e9a6fabf0fb0982b086dd66c1933e71c
SSDEEP 48:Yp4pb3QRGxf7deKG8ah/E9mj6764BY56wgoa44XpAYjX+x7l9+aP9ySNSBCZZllk:VxT1U+JBlh44X+Cy9lP9fS8ujkI
TLSH
T13791213C66A90C7F2DDBD69EB841028D43DD470784C72D8B4CEAEE49CC4669A329F439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d4a1bb815c43e2f40d06a5f4233db1d6f3693147054383d959f7c479f18fe4a6
MD5 2a09d6bd0754c51c3e06c3e22f95417e
SHA1 4d8a854de4297b35750abfb98c9d5690fe6c0c35
SHA512 7dc7bd80d045d29ce70099cba0ccbc47559d585653bda23e6c8920d83bc73a2b34306f1dfc7274ba39de05ec34e7c61c383538c0f5c7a69d017560c952ac1d66
TLSH
T1A9217F7C39B84D2A58C7EA5D7541128E53994E0A08872D874D22EF8DCD816D931AF43D
MD5 SHA1 SHA512 TLSH

Submit Download

421e856a-fbc3-4e1b-8c01-674e33b01129

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\421e856a-fbc3-4e1b-8c01-674e33b01129
Size 886B
SHA256 336887b3ebaa43628fb151bf99ef08d462f08e81f01e787d538bdbb692678abc
MD5 b867c8b13bf0e4f97c1a8be6a79673e9
SHA1 237b4edab7c906d83961970bc809b5bd4ae8d7fb
SHA512 f100eaf46a43ad9fdc18b73c74b66c3828a225e5afa1467500f2625b6819a51472d3496f815041d64edc12e289c5283da4983909e37ea15b1292f0719bfabc5a
TLSH
T11F1163409B3978F3CC28D28BD4A977928BF47123C0CD89187D908F1C0CEA42EA32720B
MD5 SHA1 SHA512 TLSH

Submit Download

57df2189-3edd-4135-9fdd-4056e57b0231

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\57df2189-3edd-4135-9fdd-4056e57b0231
Size 16KB
SHA256 6b560fd61616b65d9e41938f049e856a618de8f9b1c0f98087633d95cd0ed757
MD5 79959e9c2245b3ff59a3993aecd7e8a7
SHA1 c2d26cb4e82b61248b4fcc527c8d92d21ea60f6d
SHA512 60ec5afc33b59a8641c9a1d43475ab71971f0e3df0d68b827f18e239e83099607a5d2ae0009579e4a00f3669c620151e29a5123e335df8561b748d09a0d694a3
SSDEEP 384:vrUbFGWhroY6vFxoY+kDdf7G5bSKZd5aPr41T:ob8KX6PUaPM1T
TLSH
T1B972CA56286045BBC391E36994ECBFC3E6F528CF4C419FCA87E4BD0469DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d897b26-de8c-41a7-8ffd-af36871ddccb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\6d897b26-de8c-41a7-8ffd-af36871ddccb
Size 883B
SHA256 b5831edbbcb7de603a817d36448ed43d0b76949e33f161ba50ea63d1ac1d0601
MD5 6131ceb85cc65466a720271ab90e7e3a
SHA1 34aa7ea06d6da9a13a8885cb95ae8d0fc94fe96e
SHA512 7389f2d1e8e0e1d10514b3b3fee894f4e74cb28a8ea028c295640fb727040d4b7d767f4042f404a3c5b02e4e4281f2c93df29a0efc08d92765960c6f45b2776c
TLSH
T188114040A67979F2CD68D28B88A537428BE43923C0C9C4083DA54E080CAE61E936A24F
MD5 SHA1 SHA512 TLSH

Submit Download

93911bbb-419a-463f-958f-3f60e9d5ed60

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\93911bbb-419a-463f-958f-3f60e9d5ed60
Size 2KB
SHA256 5559d79becfafd660541a97c6cccd6ce3eb712d9c1f9ebd100b0bb8c57c17d60
MD5 066f7a978a4e3b29f173fcdcb41e5f8a
SHA1 22571ef586e86e41d72d66f11cb9d614cd4c1871
SHA512 178d2894ce68887e54ac965a9e27efcd9dcc85401e0b74d878c4d855fd8e24817341d8f256d320cab2ab526fa95e645aba3a346895fe193eb1ed64fdf7ebc65e
TLSH
T11D41615879B84C77ACCAF24D9482338E57788E43408A18436D52DF4CCDB2A9D636A42B
MD5 SHA1 SHA512 TLSH

Submit Download

b681dd45-fb20-4bbc-9f2e-af690c982453

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\b681dd45-fb20-4bbc-9f2e-af690c982453
Size 235B
SHA256 4f77d948c8740c529337c4ebfb80b752f28a743c60890009809b5bbbacce7bc7
MD5 777d7f9d8d49869179db565b9dc3d9f6
SHA1 618454565883a7ab6f5a1d22d6dc5c95847e53c1
SHA512 71767c6ca129778a6c5ef32d8ae8fe208697051a7fb2bc991adadb4db6f3b2b74a279619c2aeaf157b4c016b0f34b4568afed1a7d081071286c9741a2e6a380a
TLSH
T18BD097D624A8B3AC08140F23F0E0A9C630498C3314A55820955A4579D9FDBE4416182B
MD5 SHA1 SHA512 TLSH

Submit Download

d54b984f-c476-4a3b-b5bb-9beb5abd8507

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\d54b984f-c476-4a3b-b5bb-9beb5abd8507
Size 235B
SHA256 8f98df2c4f608b78d7834f797311ea71146760f3dc00304544a6efc016652213
MD5 12a74b519db81cd1a52d4e0f82e0ceea
SHA1 7aec23f596b7c240a0a9d7975492784f6951000a
SHA512 b2a0964320000c4e583678b72bfb24bbc73829dce7166e7d9b1dc3208010917c98e8fde412fce03a8c541d308f7eec1eacf152336c9d38c5afc1ca3997441193
TLSH
T1F4D097C8649C237C08005F03F0A0B9D730988C3354A098209590407CABFDAC40152997
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\downloads.json
Size 755B
SHA256 acd72ee4759ee895c95a18681f9c455e68fb54b01ec3957f00757aef8a4f6d71
MD5 9abafbb3a43cc613b0da3ca969b30f2c
SHA1 b4082c58c79ae833763b7e8102d854164dcb142a
SHA512 29199fc06502062824ebfe1a90eddb79258eecb1dbca22a1fc5f110978a760b808deaca45703b27ddff695583b00e778a175d039290067a931b8f69962c47ce4
TLSH
T1430144F332C3CE9567321AA1C43D7F0B1D77722B60C08478B9C6698260F903A113A86B
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\downloads.json
Size 749B
SHA256 f87efb04878a2b30eebabab4ac04e9a5fda3b67cacb7e47991d1afbd7abb207c
MD5 84464ddf17c21b09e1f8c4c414047c68
SHA1 4843233800d6dd6dc39c53d1d4343d5a0dc37afa
SHA512 1dcd04e66ea3e913da52c29083c93fc5dcf9639e7c3719f49a11a644bb01961eba1541150ba0d884ad4d9e62a456c8e83dbb236abff9a7532805fd19e766c5bb
TLSH
T19C0110F20547DDEA7A300E815529B7474F39A113B580C42CBED98D4849584B77C7C96B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\extension-preferences.json
Size 942B
SHA256 56d9dfe54a41438ec90ae6cdeacdbfadb3e3b04f5403a220e844a1775e1ba21f
MD5 f7cfb3ac426cfb2cc708ae6cc3faaafa
SHA1 2d612ef73543a5018e08bc1760d7931ed03feb4f
SHA512 31095c5be304f0cedf7eaaa2efde632f3f6a67bb26b8ae31a6069af8a60b0c659edebaab99a7719d09aa1640d2d9e080555f4f79253c13f4050840649c968534
TLSH
T15A11F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\extensions.json
Size 14KB
SHA256 70ed936a9e4c2275d7ada6e5fdbbc08595cc162c8e4a54f5ea40fccae590acde
MD5 bb333c03c39258a5b1afb64789dc1ed5
SHA1 53f8ce71439deced5cce51ff2ee259a29ab79a91
SHA512 6f2ac6623df5e32e6fb56c11cd12e22b7c2374c4719d7dcd0efc776925a29855f3c64764ad648e74bfb681523a359491dc43d8e51d9aeeae8a3f707cc22a6994
SSDEEP 384:EkI4vgXUmldvc8dhW+94zh96oOL4H3AL4PZ5L4HiiL4H8iL4HC:LI4aRfVXj4D6/4Xi4hx4CQ4cQ4i
TLSH
T18962521545049EB8298FA78BAA367E01C37D473B60845C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs-1.js
Size 7KB
SHA256 263c4dcbdfc5e1fd90c9965044b62031b9346b693e961a1f1550a84696441d61
MD5 adc49efce5c2bb39330ae2d7224e276d
SHA1 0e73251319fdc4909e9c72e0a1a2c012a1080b94
SHA512 77eb2ab09facaa9ab7a625db56af42e81ac676b9caf37b7442f99eaa1ccb33c96f75d9b942e7f6335cf5b9c0a29ff550e632fb0d66d45019968ab528b9ede4d8
SSDEEP 96:xH3pTUJqGq4Lfq6vP1NbzSAGSSlSdv9j6nnH5mrpBw88Pg8L4cnG5EoGS:NBR4Lfq6vP1PGSSd5CBw88+
TLSH
T104F10C789004CB6F65B6766DBC2488315A72013BBBBF68C650B964D4051CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs-1.js
Size 12KB
SHA256 640908a17b80d64c7b670a425ba3da4ef6f1a1d2208e62e8e0b92ca903c2f26a
MD5 a35d410bf211bd8b94722ad20c3a8bdf
SHA1 d28f7582929b5d8705ff1efb7900efcfe4648f95
SHA512 541fd4830be0bde7a81f304638aaeb7df3115b91b4a25d030f0b335c2afb8a65e76214d057cdd3e4192ff82f8d7dd7678457e33e01156cd30483122b007b13d3
SSDEEP 192:OJCR4Lfq6vP1PGSS3LR1ECO6w88lUHz27Li:UNiRdwKau
TLSH
T19242FF3852018F7F25B6327E7D214A7059694127BABFBCD741F8A8E2041CF6441E7AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 1d841e5fb4686a3cbf779922cf16a0cfe061c8c06b80c5a6002a11ec198bc2b2
MD5 f71688457f9828b3a2068c0c0eac5cda
SHA1 d6f0d2e077b23e2855828e17d2c44eee793d965d
SHA512 106d763f27f0d14cd6d090ada4b98d726398b2049d098ca7b8101230fbdd22651185fc0eef16e24195731ab20962329c3bdb14b1607ac3a416cfbfc83f07853f
SSDEEP 96:xH3UTUJqGq4LfiP1kzSAGSSlSdv9j6nnH5mrUBw88n8L4cnG5EoGS:NkR4LfiP1yGSSd5vBw88Z
TLSH
T1B8E1307890088B7F65B6776C6C688C316AB2013BB7BF68C750B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 0a2d998800a288ca39848cec3a569183069f3d5615b0a9cd39ec1d9461e83888
MD5 cec9b7dccd59512ab50251c55bd0ee40
SHA1 f9a412a74fa8da75bdb3ba0c69eb1b7686c27bc7
SHA512 cf827d85d17b61b868c775f99764e89489a646a5a03adcc221c03005d7ea42616f06cee06b3cabd04d54139dc0f6605c8172e267a3758ec5791ea85acaaf90e2
SSDEEP 96:xH3UTUJqGq4Lfiy51zSzSSlSdv9j1nnH5mrUBw88n8L4cnG5Et:NkR4Lfiy5iSSW5vBw88q
TLSH
T1D6E13F7890488B7F65B6776CAC688C316AB2013BB7BF68C750B954C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 7KB
SHA256 1f6efcdba8c3e1a5cf233e7036e828e7576929c9887742ab47191be6a7016adf
MD5 e01d97c29294d34dd5d1335783a746e2
SHA1 52118b8285fa6ca024060e9e8628ae669f44da1d
SHA512 5f169041531d0bc33bfeba8e8e0fdc283eaa171124b42bb96ec4a15eefb43990397e841197c21376e804b24c453448e15e86e822680e6e7803e4702d6735bea1
SSDEEP 96:xH3UTUJqGq4LfiP1NbzSAGSSlSdv9j6nnH5mrUBw88n8L4cnG5EoGS:NkR4LfiP1PGSSd5vBw88Z
TLSH
T164E1217891088B7F69B6776C6C688C315AB2013BB7BF68C750B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 0740b4c284b1a2c6b4149366adbe5f05fb5e64bc4f076613f6ff76dfa616838b
MD5 a414101c694feafa4499ffb8b225d0dd
SHA1 170b597782df2f1c97228c202bffa02f1651e549
SHA512 0146a2e8d70665f6cb5d7d3d6c04a568f875c5b2db045357cca1080e02d86b751ad6fd9f3927a95e4b8b4ac89c73720d069e91d47c6d0e7eaff742bb00d14ee9
SSDEEP 96:xH3UTUJqGq4LfiP11zSAGSSlSdv9j1nnH5mrUBw88n8L4cnG5EoGS:NkR4LfiP1bGSSW5vBw88Z
TLSH
T1E1E1307890088B7F65B6776CAC688C316AB2013BB7BF68C750B554C8055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 12KB
SHA256 668df231dfe90f16ad64307941ce32b1e4b80459afb49dc93bed4ecb6ac0f8a8
MD5 80c3a4c2f47c0b201fe8fcb28fd71c29
SHA1 ef90611c6226c0bfb7f8e17822ec16bde56a2acd
SHA512 24e0397ffad5e6049bc3c7f0ef7d2a96b337654da5acbdd492926083f7be92cccfe3129b0772e558e23d4524912c1818f49f488208b3ec905477a4da2616c084
SSDEEP 192:NJCR4Lfq6vP1PGSS3LR1EiO6w88lUHz27Li:nNiRZwKau
TLSH
T1C942FF3852018F7F25B6327EBD214A7059694127BABFBCD641FCA8D2045CF2441E7AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serviceworker-1.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\serviceworker-1.txt
Size 164B
SHA256 75730c129f8637798e7a6e431a16a0d0c66eddf88018bb9004f2be5f0006685a
MD5 d8644fbc50ba4a1d6e46bcc740dc70d0
SHA1 347518ff87885157a4bda3b531a2d475ff420a52
SHA512 8b76ea96b98f766a77c14a6bc4be26914ed290728ef68a1d712c878195ad18002864a70bbc7a8130f28e0a2481574d97c4e7b7745a24c03b13192ab2d2d9bffe
TLSH
T1B8C08CBB0800A0972E50589F3AA3670D522F792C06C28AF8A74AA9311468123B6C2092
MD5 SHA1 SHA512 TLSH

Submit Download

serviceworker.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\serviceworker.txt
Size 149B
SHA256 4b5038e31df9d8dae32dd00fb15a6ff985195f34fd3ecfa8b3c6f70b914ac62f
MD5 78121071d8581b7d5e4db407de5a2c21
SHA1 04915b56b691b58a1e4b42c27655d059bf7a849a
SHA512 f760bb1a62fd6c96a2f35049ee7c3a5dddb749b50309f59b7009a42c329cca05afb97c6189ee095dcf94ceb579df456bb370edc099758cae585e1e92b7244462
TLSH
T14BC02BF70800E4572F1018DF3BA3574C432F741C06C2C9F8954D9D71106417376C1093
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 15KB
SHA256 73b5c95ad107fcbbd1d58763cb5eada993cce239579ae227a49f60b71f88d151
MD5 41239cd1a1cd139c834229dc1ec84070
SHA1 67781aafe9f3f955624ec8653a05e79b1d2e2d52
SHA512 23894fb6e6dd7c63e4e2c02a7a189e831335ee341cda210d1671478aa594745fd44df6c355d84435232327b502bb16155b0c8468525b89a5f8544b1d456757f4
SSDEEP 384:dX0n/L6QHV4iMKpZx3PERPOv/zogQYanJfGn:w/WQHVTZx3PeWFuIn
TLSH
T14872AF9B6CE499840FBD20468CB72E2A18ED4D1353B74B89C60AB3771CB4B415B2F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 17KB
SHA256 8372b23632a37d17d8fb2055dfebbba918f6e8fee872d1822afe956356d357e5
MD5 0605e968c3961b39e765a0db78a2faaf
SHA1 54e63aa896ff082f2570b4c9e119a3fcf8c2b536
SHA512 ff464e6a14817b69c7667cae3d8f4c007ad8c620379c3587c06fe38f5e0ad78788882ed4c0553d7c777acce992ed10db9935c941e6830a341a604be5f2cc3616
SSDEEP 384:1X0n/L6QHV4iMKpIwyiNrpIPAdluB/QcK25jcHs:4/WQHVTIPk8B7Ms
TLSH
T19582BFD7BDB049904FBD508789AA1E0A0CE65D0B63BB4B44D21972BB1878B81672F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 19KB
SHA256 215c5c4f040ab6dd7131825f30a679e4be6646ef3af2eae337369ec4444f72da
MD5 3c0dfc841dd95dc9dfd49708e4fffa77
SHA1 d70a883092efcbe49a4fec215d5337b5c3867994
SHA512 9813a9dffd3b9c3ac1804a599e9e934159397a174919f6844d2c69984f1dd5dfa0bd80b104aab9bbc6037bf77aa94d401bf59c11be1bd91e34afaa7c465c94cd
SSDEEP 384:1X0n/L6QHV4iMKpIwyp4DKhjXxrA3CMY84ir3z3J/m:4/WQHVTIn9+xYoc
TLSH
T13592BFE3B9E089908FBC604648AB1E0A1CEA0D5756BB4B54D21D71FB28747805B3F7BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 20KB
SHA256 577d3c420b7cf5efd437609e5bb512cda68ea0971df2cdcb1677b4b98df1225b
MD5 7e236b56f650a67ec441e9db8fc3c8b0
SHA1 ecbdf0b97b4263be7958a13dc9646ee77ea0ea0f
SHA512 1f7cadba075a4936c33d50a017cdbda8e8f333c92ca3c1e3783e9bedde7edfd288e8b7a154ca7b8e224d4d1dd97c4084f4e23197fbfdbdf565aef2d0213ab816
SSDEEP 384:xX0n/L6QHV4iMKpIwyp4DKhjXxrz3CKTQi6+lSc0DQ6J:0/WQHVTIn9TNc9Dn
TLSH
T1B792BFE3B9E089A44FBC60464CE71E161CEA5D4796BB4B44C21D72BB18747805B3F6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 24KB
SHA256 8e2d18421e8c7e3dfe427e08d9144609fb0724858e06943d5c7cef667c1e55a9
MD5 3461bbb87f26d0bbf483d7ed5c8bf700
SHA1 28315b3144dacc7e655d34f987f06f8d28f543c7
SHA512 e0bacbee839cde51f0c3022b9377ae1a0fcd1b903865570db352367e80fcae47b870a6653669a1d14822208334893356e379156a24a58d67bd87a79d6b76b67b
SSDEEP 384:0X0n/L6QHV4iMKpIwyp4DKhjXxrz3CKTQiFGYISu0hHPQLHIRoX:1/WQHVTIn9TNc9mhIMs
TLSH
T1C8B2CFF378F499A48FB8604649A62E150CEA0D4BD6FB4754D208B1BB54317849B3FB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 24KB
SHA256 5ae7230e481163657eae10c143dfd47f7a400b2660da9ed9b77df3c2802d4a91
MD5 4412becccaf9d316e86dadb8697a210e
SHA1 e35b4863568e2d10b1f91847dc33ccc051c9f774
SHA512 486486e523a7e6bec739b9df8e4035a2378e6addac0746c3bfdcb845649b5b85d6b39c9bf4d6e82b99daac956b924693973d66dca05136953adda53a00bb934c
SSDEEP 384:1X0n/L6QHV4iMKpIwyp4DKhjXxrz3CKTQiFGYISu0NefHGML1jvuiX:4/WQHVTIn9TNc9mNefhtmc
TLSH
T172B2D0F379F09D948BB8604649972E150CEA0D4BD6BB0748D208B0BB54323859B3FAAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 25KB
SHA256 27fc8725342718aec856336a8c78b5c1e374bd0e5d76291b8f5476edd5ee1f0d
MD5 ade5895627a75742640438d59d2db90c
SHA1 67bc6fed078b84ff066b9afe7ea504116d06640c
SHA512 852c8767ed7b18c564cf086ec9547a65c4ef7fdfb2bf03b7b39f14bc20ef3ef76caaf99f726e126f560fb0f4a7fab7682dcaa2528ae9e3b6ff46b6fa84df3e85
SSDEEP 384:WX0n/L6QHV4iMKpIwyp4DKhjzx+r0KWPj14nJAi9lJmUgsfH1ZLItoKL:L/WQHVTInAr0KWqJA8csfbyD
TLSH
T189C2D0E3B9F09D948FB8200649561F060CF60D8BD7BB0698D60971BB04326405F2F5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 b783ba9f21f38a12ad99271237bda85700f2be938852f35d19a65af3df989e79
MD5 586a9b70dca8c463d8e0feea96d6e762
SHA1 3d7c27501ed2da8d2957bde86a997470feaa92ad
SHA512 fc03ac8a5d9607544fc62e814d630ab7e5b276046cbd9e4c4296743e651e05471bce80b257da4b8f04e38a2ccee7a2c024a62e1f6b19e9120a09ad6ae73972b7
TLSH
T17A515DA72C1B6CFB3472C2AB6CDF0FC08963242044954075FD59F96101ED109A985EBF
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 408264e47efb98965ab436c5b1f7ece01847040981be5d150d7a99e60d667926
MD5 3241109554226e734f79d8e1c0b274f7
SHA1 9b17dfde98b653013ac4117b772f77fbfef29b58
SHA512 ef1e26fe031b5f9d85c2ed3c4ce6f0c4f00303389838ebd30708f5fca0fdd25fec7c8922c63e42912eeb164202ec8fe42c2475a2863c488e39ab3b1c85188359
SSDEEP 192:Csbk9uuNbDcKez61tm+qi0ZVcftsQcy8Ymm7h6ujQ52csdoGVuKD6N:XbkYuCjq3mZAsQYvm1kB3GVuQq
TLSH
T12C12AF93ECC04EE3437451838CC567E926F35F4652F006048D06723A07BDFD9BA6A986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 25KB
SHA256 a0a159de5e19c2a6ac59892b69fcfbffd8364cbc97891a2e52662ccdf65bce47
MD5 8f2c20367366f57df7f797b1842d166d
SHA1 72ae372f009ff0e8a35ab26c4b2ef2da7572ad4c
SHA512 6c7b522ff8c3bdd2e11bf031e9a151d460b3b626e3fac2018e050cc4142b5aa43666a4757ff1f0934030e66bed8d4a77d66a6fc442b6064d840cbe9cf4c670d3
SSDEEP 384:CX0n/L6QHV4iMKpIwyp4DKhjzx+rYf7es14K4AwlUw2mfH1ZLkZoKL:H/WQHVTInArYf7n14P2mfbSD
TLSH
T1EAC2D0E379F09D948FB9200649571E160CF60D4FD7BB0698D60971BB0432A855F2FABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 25KB
SHA256 b6e1e3eb8b44d842fee7b8a8a251bc9976aa5057204141e97f60de21e8c02f79
MD5 ecbbdcf8d1d815d454548412e04fbadd
SHA1 bb63d4fa128f91f6a8dcdb955a76092d16367d16
SHA512 79eea09e14d5984848cda9f3749db59307a30d8e590bda41c001fc84b118bc46e5f600b6023f587425571af86df4ee2b533212b83505b602d9e008b7bf7614c1
SSDEEP 384:KX0n/L6QHV4iMKpIwyp4DKhjzx+rYf7es14K4AwlUw2uHFILw20aOd:f/WQHVTInArYf7n14P2uWs2q
TLSH
T122C2D0E378F49D948FB960468A971F160CF60D4BD3BB0658D60D71BB0432A455B2FABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore-backups\recovery.jsonlz4
Size 10KB
SHA256 4163c01c404d3a2621f5559ade56abf86a03a29777719cfbf5426adf4c3ee87b
MD5 846a44f7c4f50066463120744dc8672a
SHA1 a2f2c1a4579e5ff50474ad2462ff3267eec80242
SHA512 db65db0eb3743af975b89b9bb8d189887f77bf5507249b177a1f9df5521fbce8ad9d580277d3c1cce681f4c7c0af0aca241df6c23d72c6687397258c08e7bdf4
SSDEEP 192:Iu9hf09zXWN5obJUk9LT/limM7tGQwJM0BohJTVeURHxkliD:BX0C4pPW7fDPkWRis
TLSH
T1AA22AEA76C6080E10B3D20454CC6AF2919E94D67A3370214D636F27A11B8B45773F3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\default\https+++challenges.cloudflare.com^partitionKey=%28https%2Cwhuskalc.lol%29\ls\data.sqlite
Size 6KB
SHA256 1cef2f024664431c2b99bbdaecb882ff902eb6060e38b1956448c238ea05c33a
MD5 e6e6c1b1a6b8f443c3c9aac1325baada
SHA1 34ea188ae5dcc9e907c353c2cedaaa4282a7caf7
SHA512 9e8f51cbb5d36c5a9ada88a57f3ce03d3f58bdf7dcb7ed726f3f5260837d43a1223bcd53bb4a71860f5207427cfe73540d86bbc77bfb18d52937b18ba0627f18
SSDEEP 12:HLytEdkNGdi6EreqJckULybIHwqeGbeOgynZ/RANc3iZIEeNFuCQagYulP:ry+/6iiEjEVdyZ/cZNe3uCKl
TLSH
T12EC19C8D2F607701D0F155B298F097AA7E3CB01D471A64414DA404E2E9B6293796A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e6f56b44-16f3-4b64-84ad-4533d8656d7f}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\default\https+++www.youtube.com\cache\morgue\127\{e6f56b44-16f3-4b64-84ad-4533d8656d7f}.final
Size 6KB
SHA256 3d3cbc76c42efede31c39f1d2f934ec750d26e219c5bbe64a39a1f6415674572
MD5 61ab578aeeebddc49ae68099458317a9
SHA1 592787e48151a006efe381beb24d5a5414324876
SHA512 3ba4428537ac813220a0762d51c5de9eb78c42c35bdcf75a3aa8ca55e3f89f578166a3323f285b1d98b2e69a58dbb8f21ba0c16e6f2a0a8dc8bb53b21cde6155
SSDEEP 96:XjggM4U2kQO4Bto9IexaN1KO/6zztJKJpctNfcJh5ax043ikT2YwT:zCcb/2EF/IXUpMqFMi
TLSH
T100D1AF72D8ACB98F84D199C3751ABF293B301C05FE6D5808B6AF4D28138425E7A48C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{dee00a23-237d-462a-bc6d-b5fe05278d3e}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\default\https+++www.youtube.com\cache\morgue\62\{dee00a23-237d-462a-bc6d-b5fe05278d3e}.final
Size 103KB
SHA256 f7eda0c4a88f9572a3ef9f019292a3d56c9826992e0a2fc6b9ec0e5f62e5c2e0
MD5 4e589ada533f66a8bde48f5d84c6c12d
SHA1 10f243209e261774fe738e2c2f125a6743a1b7fa
SHA512 aaedf64b3bccce10b8bfb0c10da4e3a8aa19863672503b735fe5ed74d74af2d1be5c1bbb986285988e566d789562d473a5ef6ef2f06b04a48ce685ae8678445c
SSDEEP 1536:6w3E1mqBywiOQH9dbp8zfloyf+j9chdX07fIW/batQZjgnkr1axe1cCkSi:64Ew4MOyna9Tf+jWX07fIWSQ4WcCJi
TLSH
T14AA302E2E136258BF96192FA7861748179B2C620BD5CDBF1C79C520D72DBF40CA63314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1302509390PCe7r%sCi7s%t5ean1t8E.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\default\https+++www.youtube.com\idb\1302509390PCe7r%sCi7s%t5ean1t8E.sqlite
Size 48KB
SHA256 a10c5ae3547b97b89998d6f0ca36be891390012b6926dcf48793ad45dd130ac5
MD5 090785d5d6e47865ac173420cf480610
SHA1 72d8a526dce2b8c81af28303e126576022df2037
SHA512 80b966716750556226cb84b6083509c84ebcc92bfca343c4804604704afd9ee1d14b71b271f40790183d6e4902674c62df845d8d3d51e588b8191b4035dc86dd
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEsK:Oa16S6CKnqlizbxV+2xVeU7X2B0sK
TLSH
T192237F8E3F07E511C53AF0B178A08D51FC5E321E07222AD57990DAE4C8F215AEE1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3211250388sbwdpsunsohintoatciif.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal
Size 40KB
SHA256 c47aa34c7440ef322db215b1cac69ea556b2e75c4aee56dc4ea1bc047b699ec0
MD5 82d2dec4ab0895a1d086a0844591fdd9
SHA1 bf044e87e8629293471b74267f1c2a117c8594a2
SHA512 a575e5d32baeef523931f2105b3284f978f75a3093514ad9992bde71383145926924bd415acba0056bf9c3baabc19a1c2ac33720db8acccffbb99607b096322b
SSDEEP 192:y3IoRNATNRNzcTNRN4yBOcTNRNE5PBOcTNRNOT5PBOcTNRN1:/yGPUPV
TLSH
T1BB038A1C7424D50BCBB484F742BFD4E101AAF49E3AED92FB3283539F4C16B119AA7914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\default\https+++www.youtube.com\ls\usage
Size 12B
SHA256 5e0dcacc968ed9849bbac6da8e6d692b2523610bb3f586d39c38769056c4a542
MD5 85aaee5f24582b9020a430dbda339e04
SHA1 0367de445f6b6154c15daeb6cc8684a6c4f41c25
SHA512 6ad751743396b1d0884c5780a91501ffc3faef04d03b70295eeb930e7373a98ea40db7a043eeb1c87d39417ffb70d47b2ee67429fbbae43e7112e8f2eceee7ca
MD5 SHA1 SHA512

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\default\https+++www.youtube.com\ls\usage
Size 12B
SHA256 e894a1e5b732cecc46f955816893a7460db3ab9c386062a5fe9fc2fd19a75d0b
MD5 34e3b384754a782204861ec3b323143b
SHA1 b6b7eb04acf1136c386821b019eaefad60a8a6c5
SHA512 ce029fa7ea360e7993f9bd1e8e6f3dbf993fbb31eee88eefb66b82317b0d942ac673023a827a844ecef3162b0ce36ceab81d6850c7c0adf37069b3e0f8bdbf74
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.8MB
SHA256 0656ab58d5c9326a319870847037212105363b8cff213a4149055f2b194bcece
MD5 1adf1b50ac0456d2d6dd6357293d870e
SHA1 97e4b7c9246333a1c8c9b66746e65f1bf321ad2a
SHA512 03e2da3e118daec717f9eb5f19c7daf9db62cd93520433f40fd8041677408d0f3f489cd735338b19a1ffb78e2b9b113bfb0f33310bf1bf68b664bd6ca0591a55
SSDEEP 49152:CEQg5pcFvdCCntdJ6DctVW66Kw52iTj27A:XQFCCntdJ6DWsvJh
TLSH
T1F3763BE860D09243F3428073718993EB21EFD01D607BDA4857A45BE9A5748EF8E277BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.6MB
SHA256 b4dfdb28f505975ef64701e7e41715b465f49b2a76af529b4ad107fb5bd6343c
MD5 8125bbe3d51920799cc59f2808266a74
SHA1 642a577330bc297990bba959d78d90f6c50c8b8e
SHA512 b64db79b3585aad0f4e5ecbb4306adf1f7a90f7742af6882fe3a4b0d69f0c569e0e8d60939c1513a2f5681ae2f0c7735036f0ed0dfbc69e103526c3cdc09851f
SSDEEP 49152:WeCBWkvKV2q5OkD2D3/Y0SXN4k7TQdzxkspIyAS3VHXKglW9wSWg5HgFkdgMr3vZ:cRwFr3vdHiDIsUy
TLSH
T1AC864BE820E19253F34240B3719993EB21EFD01C6036CE48579497FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.6MB
SHA256 685f14a6b15aa436627c973c3ff33a7bfdf89a22b7aa6f15eafc541b09d9ead6
MD5 2a905516be227411c88ee5f26f3db57f
SHA1 056867115e9547a0e684269295f1b203498a5df5
SHA512 53c97330c702751daaf26dc3f06e11e02a78046d0df09e68760ffd18f6ce08b428c608b850803907287ebbd470d95ad7751f55650a6476851ff1bc448971c983
SSDEEP 49152:49yWkwn/X1oeOy2D3/YhVSXN4l/QdzxkspIyAS3VHXKglW9wSWg5BHFk+gjr3hdT:/RY2r3hdHiDIsUy
TLSH
T13A865BE820E19253F34240B3719993FB21EFD01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.6MB
SHA256 3e2eda9bdc8489bdcb4e93d188fffc03c86fa1594f1faf109937855dcc7d5910
MD5 fd2f9a6336f2f7c5b46f364bbee940b8
SHA1 48502fdf9d5589a6fd72aa2f15f82eb7ffb11aa8
SHA512 a046dbdd400d0ab53a2d9743a97b6d925fecec1dede4be60129672a62220b10e2e75463fa4416e0f3c163a315154bd12b47341c531d03d796e0936710b01fdfd
SSDEEP 49152:/9yWkwn/X1oeOy2D3/YhVSXN4l/QdzxksRIyAS3VHXhglW9wSfg5BHFk+mjr3hdz:spYgr3hdHiDIsUy
TLSH
T1FD865BE820E19253F34240B3719993FB21EFD01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 4d8eb28924d7b359504f534cb8b85d44cc32e500a995aab7b690bdd568dc6611
MD5 cbac39e2ebc9023019c0949c0790fb25
SHA1 c41498a14c2d17e2cca8682719d03978bfd16e2e
SHA512 3eb431adf5bd64ec910a534eea4d89116e29ad1a86983d03c57329d2a5a36dbac6e01db28a1550b1f00da320f65c569049f7ac53a4518c744b53e7066670c82d
SSDEEP 24576:OpjKlu4DBXCSOjyADYBv0dass2BPSY60A9f3YtQswc1biAYOOboaaKD:YjjvdGCY2/608P21WAYXboaag
TLSH
T19C4629F820D1A257F3414033764593EF21EFD00C6027DA085BA95AE9A5B8CEF9E16B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\targeting.snapshot.json
Size 3KB
SHA256 95585a782053c4e2f6a15755dbfb01a0a72386d5c08bc216b1237cd69b353cd5
MD5 ec71e4139b8c924fe5b623004e42be3a
SHA1 1f181f87a74b017b86984d03f80634eef8f3ef29
SHA512 63b35e1843470bde7470de365038dc6e1fe852f78c77e09275d686b3425da9d404455b02c59a83438a53068924bdd8d1580928e105cb512ffaae94a516cc49f0
TLSH
T1A871710C951CA4BEA66BC3C0E685BF978BBD053370446458DAFE460C55FB5FB123621B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\xulstore.json
Size 167B
SHA256 c1bed5f53e44f988d50469fe36ee52ab0bfe2215cc126514ad06b5c0c28dfd87
MD5 2ad8b3c13995ae985a912f3297c6103d
SHA1 45b786fb55ccbb948a89c9a233fdab1fd3c82eb9
SHA512 c9853c003b0c9fe66ae2cd849dcf17fe1e3646520a5d2d5cf5ec1bdc1308ba504f58a248ff4b5fda487d7fd97318899e2c41ce1c628a5895aa75648d10a34ac3
TLSH
T109C08CB0216FD8487D27CBCF128D22983D3A8A54A1D0529A69EA94E018C570F9D18388
MD5 SHA1 SHA512 TLSH

Submit Download

Bооtsехеc-64.H03aWXZI.zip.part

Path C:\Users\Admin\Downloads\Bооtsехеc-64.H03aWXZI.zip.part
Size 6.1MB
SHA256 eb3eecf165e73d0d4743d0daa7f64b1af661e2b1d8226251701f4e148d30b574
MD5 ff2e57f878b7a8ee7ff02675822d2bab
SHA1 1ee68068d92aee4fd227b42997d27becf6e8519a
SHA512 2ebed9827ef8ab2fe39f0de190520c6fcfebb0577e18684a28536870718c335943b22685c03f34ffceeaba45b0f5c19a5346f57fcb52d73cf1d14a47a69ce079
SSDEEP 196608:ULRqqeZrM4AmmsLKKLjTQG29kjyAKVYZqhT:K4qfdajkGUKo
TLSH
T1505633EC4FBD581BDF31AB01D21A7991987CFBC2CA4B78E0195755BCF6CD0B48A88A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bооtsехеc-64.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Bооtsехеc-64.zip:Zone.Identifier
Size 159B
SHA256 3ffbf6fe6ef945c51c1a4c2a4ec524c4ffd09ddcbff59f6d5c54db28ab27fbcc
MD5 1d7047ebb0597b89cf91e8dc4d29fa56
SHA1 add24fedab28ee5172cc9ce78449010e9d5d26e5
SHA512 cbbc281540fd3eb4d8e9edd627b422d0fd6cba96afac2eb728622decb54c7722f9baf224c74527a46eb7590fbe87aab9dfcb813d88ecaa0f4a060e195c327862
TLSH
T16DC08C6302004923161E32E481A9F24BA1073F010AA8C4A7EA8030E3E8B8078C1BAF8B
MD5 SHA1 SHA512 TLSH

Submit Download

n7XCXeu_.zip.part

Path C:\Users\Admin\Downloads\n7XCXeu_.zip.part
Size 4KB
SHA256 86f3b02c9b4b4fbd2105948fb7af794eb12ad2f04f9316dd548a85cbbb492d55
MD5 de7eaff2ef9e87536c5fb8b5f11159d7
SHA1 2c8788e36694e799026954fc3cb3a18edf94331d
SHA512 63635ea924c243fc5d0bcb7c4e6ecc40c72dcd846a9d1d18391c4192f5b7b65a948f8f6f756b847df61a28c01ad0eb53dc2156740ab6d5ac444d7ed42e185608
SSDEEP 96:+YxZO0Sq9IHLEoCjAiTwARsSthFeOSu1u+05+fOkzfOgYNJ:5xZO030qGSgOSu0hzmvW
TLSH
T1C3814B09D5FD3C64362863CC2E9647B4B698BABB320729DE2B91E1AA3748019CCB1403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4808-4-0x00000000053B0000-0x00000000053BA000-memory.dmp

Download

memory/4808-0-0x0000000000AD0000-0x0000000000B00000-memory.dmp

Download

memory/4808-1-0x0000000005990000-0x0000000005F34000-memory.dmp

Download

memory/4808-2-0x00000000053E0000-0x0000000005472000-memory.dmp

Download

memory/4808-3-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/4936-3246-0x000000014E640000-0x000000014E722000-memory.dmp

Download

memory/4936-3245-0x000000014E640000-0x000000014E722000-memory.dmp

Download

memory/5568-2798-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2788-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2794-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2793-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2787-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2795-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2799-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2797-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2789-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/5568-2796-0x000001F068700000-0x000001F068701000-memory.dmp

Download

memory/6988-3212-0x000000014E640000-0x000000014E722000-memory.dmp

Download

memory/6988-3213-0x000000014E640000-0x000000014E722000-memory.dmp

Download