f611196ae83dad900f8170db750781bb30419b5289fba66b883ee9d246c57cd4

Analysis

max time kernel
134s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
04/04/2024, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TuxlerChromeExtensionHelperApp.exe
Size 1.9MB
Sample240404-vj4kpsdb2x
SHA256 f611196ae83dad900f8170db750781bb30419b5289fba66b883ee9d246c57cd4
MD5 11141bbaef72f897f9e459580914f08a
SHA1 45143405288a4c043620d4fa5785fde29843e513
SHA512 c3d8c323c0bb4e736a6c3297bd109224462697e9cf554b25bb3bde39b1eaf8bba437ecf03b9ad8d81cd9dc934b6f682148a550bae73c41fa7d9bed67839a18f6
SSDEEP 49152:b75PqoYhnJUWNC3CSoCAZ2JzByqWcDebzbD:v5vYZJUWNC32BwfxGzbD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3488	TuxlerChromeExtensionHelperApp.tmp
3828	HelperAppEdge.exe
3208	ExtensionHelperAppManager.exe
3920	ExtensionHelperApp.exe

Loads dropped DLL 1 IoCs

pid	Process
3920	ExtensionHelperApp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\TuxlerChromeExtensionHelperApp = "\"C:\\Program Files (x86)\\TuxlerChromeExtensionHelperApp\\ExtensionHelperAppManager.exe\""	TuxlerChromeExtensionHelperApp.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\is-QOT25.tmp	TuxlerChromeExtensionHelperApp.tmp
File created	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\is-TLD0F.tmp	TuxlerChromeExtensionHelperApp.tmp
File created	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\is-8ABQ3.tmp	TuxlerChromeExtensionHelperApp.tmp
File opened for modification	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\ExtensionHelperApp.exe	TuxlerChromeExtensionHelperApp.tmp
File opened for modification	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\ExtensionHelperAppManager.exe	TuxlerChromeExtensionHelperApp.tmp
File created	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\unins000.dat	TuxlerChromeExtensionHelperApp.tmp
File created	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\is-QI1RQ.tmp	TuxlerChromeExtensionHelperApp.tmp
File opened for modification	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\unins000.dat	TuxlerChromeExtensionHelperApp.tmp
File opened for modification	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\dbghelp.dll	TuxlerChromeExtensionHelperApp.tmp
File opened for modification	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\TuxlerChromeExtensionHelperApp.exe	TuxlerChromeExtensionHelperApp.tmp
File created	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\is-9D5LI.tmp	TuxlerChromeExtensionHelperApp.tmp
File created	C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\is-LQU8E.tmp	TuxlerChromeExtensionHelperApp.tmp

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1496	taskkill.exe
2316	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133567238073795799"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	firefox.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3488	TuxlerChromeExtensionHelperApp.tmp
3488	TuxlerChromeExtensionHelperApp.tmp
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3208	ExtensionHelperAppManager.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
784	chrome.exe
784	chrome.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe
3920	ExtensionHelperApp.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
784	chrome.exe
784	chrome.exe
784	chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeDebugPrivilege	3496	firefox.exe
Token: SeDebugPrivilege	3496	firefox.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3488	TuxlerChromeExtensionHelperApp.tmp
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
3496	firefox.exe
3496	firefox.exe
3496	firefox.exe
3496	firefox.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
3496	firefox.exe
3496	firefox.exe
3496	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3496	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 3488	2436	TuxlerChromeExtensionHelperApp.exe	76
PID 2436 wrote to memory of 3488	2436	TuxlerChromeExtensionHelperApp.exe	76
PID 2436 wrote to memory of 3488	2436	TuxlerChromeExtensionHelperApp.exe	76
PID 3488 wrote to memory of 2316	3488	TuxlerChromeExtensionHelperApp.tmp	77
PID 3488 wrote to memory of 2316	3488	TuxlerChromeExtensionHelperApp.tmp	77
PID 3488 wrote to memory of 2316	3488	TuxlerChromeExtensionHelperApp.tmp	77
PID 3488 wrote to memory of 1496	3488	TuxlerChromeExtensionHelperApp.tmp	80
PID 3488 wrote to memory of 1496	3488	TuxlerChromeExtensionHelperApp.tmp	80
PID 3488 wrote to memory of 1496	3488	TuxlerChromeExtensionHelperApp.tmp	80
PID 3488 wrote to memory of 3828	3488	TuxlerChromeExtensionHelperApp.tmp	82
PID 3488 wrote to memory of 3828	3488	TuxlerChromeExtensionHelperApp.tmp	82
PID 3488 wrote to memory of 3828	3488	TuxlerChromeExtensionHelperApp.tmp	82
PID 3488 wrote to memory of 4624	3488	TuxlerChromeExtensionHelperApp.tmp	83
PID 3488 wrote to memory of 4624	3488	TuxlerChromeExtensionHelperApp.tmp	83
PID 3488 wrote to memory of 4624	3488	TuxlerChromeExtensionHelperApp.tmp	83
PID 3488 wrote to memory of 3208	3488	TuxlerChromeExtensionHelperApp.tmp	85
PID 3488 wrote to memory of 3208	3488	TuxlerChromeExtensionHelperApp.tmp	85
PID 3488 wrote to memory of 3208	3488	TuxlerChromeExtensionHelperApp.tmp	85
PID 3208 wrote to memory of 3920	3208	ExtensionHelperAppManager.exe	86
PID 3208 wrote to memory of 3920	3208	ExtensionHelperAppManager.exe	86
PID 3208 wrote to memory of 3920	3208	ExtensionHelperAppManager.exe	86
PID 784 wrote to memory of 2240	784	chrome.exe	90
PID 784 wrote to memory of 2240	784	chrome.exe	90
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 2684	784	chrome.exe	91
PID 784 wrote to memory of 4448	784	chrome.exe	92
PID 784 wrote to memory of 4448	784	chrome.exe	92
PID 784 wrote to memory of 868	784	chrome.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TuxlerChromeExtensionHelperApp.exe
"C:\Users\Admin\AppData\Local\Temp\TuxlerChromeExtensionHelperApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\is-G8QRH.tmp\TuxlerChromeExtensionHelperApp.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G8QRH.tmp\TuxlerChromeExtensionHelperApp.tmp" /SL5="$6024C,1638018,184832,C:\Users\Admin\AppData\Local\Temp\TuxlerChromeExtensionHelperApp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im ExtensionHelperAppManager.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im ExtensionHelperApp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\is-DPF2U.tmp\HelperAppEdge.exe
    "C:\Users\Admin\AppData\Local\Temp\is-DPF2U.tmp\HelperAppEdge.exe"
    3⤵
    - Executes dropped EXE
    PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /f /tn TuxlerChromeExtensionHelperApp
    3⤵
    PID:4624
- - C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\ExtensionHelperAppManager.exe
    "C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\ExtensionHelperAppManager.exe" --install "--UNIQUE_ID=C:\Users\Admin\AppData\Local\Temp\TuxlerChromeExtensionHelperApp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\ExtensionHelperApp.exe
      "C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\ExtensionHelperApp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffa03619758,0x7ffa03619768,0x7ffa03619778
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:8
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4464 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:8
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 --field-trial-handle=1844,i,11316223908661902359,18073610795992088109,131072 /prefetch:8
  2⤵
  PID:2404

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2132

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1064
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.0.1931580107\1012485398" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fb31e20-e7ae-40d1-8e32-85861bc4bf18} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 1928 1f561dd6458 gpu
    3⤵
    PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.1.719114014\778224047" -parentBuildID 20221007134813 -prefsHandle 2280 -prefMapHandle 2276 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a949216-faf9-4052-958c-f1cd8d3b30cf} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 2292 1f56153a158 socket
    3⤵
    - Checks processor information in registry
    PID:228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.2.1003179998\1615501267" -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3116 -prefsLen 20886 -prefMapSize 233444 -jsInitHandle 1008 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ca2af7f-a3cb-4835-8a59-7143f6256313} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 2832 1f561d5bc58 tab
    3⤵
    PID:2324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.3.647332997\1881131174" -childID 2 -isForBrowser -prefsHandle 3476 -prefMapHandle 3472 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1008 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1050127-4639-4c7f-a842-10c1f3099b56} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 3488 1f567a25e58 tab
    3⤵
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.4.1237857842\1630245222" -childID 3 -isForBrowser -prefsHandle 4528 -prefMapHandle 4524 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1008 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3318500-01c3-4c2d-8ff0-e8addb88df9c} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 4540 1f5688edd58 tab
    3⤵
    PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.5.585311805\849265574" -childID 4 -isForBrowser -prefsHandle 5068 -prefMapHandle 5092 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1008 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {234230bc-0b5f-41c4-b65e-c0e71f718b2a} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 5076 1f569005d58 tab
    3⤵
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.6.366916993\1369428317" -childID 5 -isForBrowser -prefsHandle 5248 -prefMapHandle 5252 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1008 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e66b0a65-07c1-4e9f-bfd2-fe93cc34e4af} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 5240 1f5690a5e58 tab
    3⤵
    PID:1532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.7.561497686\860629652" -childID 6 -isForBrowser -prefsHandle 5444 -prefMapHandle 5136 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1008 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84f8d4ab-9093-4300-ae4c-80b4ba2a61db} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 5432 1f5690a8b58 tab
    3⤵
    PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ExtensionHelperApp.exe

Path C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\ExtensionHelperApp.exe
Size 2.3MB
SHA256 ea371b7b78f7a82d8333359355a59912424c639c0e25bf443d32aa07e63c389e
MD5 13ab8cd94350985a7f5e28e84bb2b025
SHA1 3e1f7e50788382423030658030db40da90543943
SHA512 2d75fc951d12727dff0c911b7a03b6ea01bebcc5629343c5ce4bf85a0d2dc6e03dcdf79c4384edaa073b18ae9295e9f44a11bd6e1bd66f15065ce86cc2d6fa6a
SSDEEP 49152:qV1CQa6ocRPLkfz8QyWBJHF5FM6KBMXqp+lngjk179J8jOla1C6BpzN4MpF/jXsA:h0ocRPLkfz8QyWBJHF5FM6KBMXqp8hUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExtensionHelperAppManager.exe

Path C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\ExtensionHelperAppManager.exe
Size 1.8MB
SHA256 56d8827f9a9f7afcf4ed8eb9b85054d0206d376aa584a78ed7388fdcc83bca1e
MD5 4b0ed7efaeace6b6f5ece57e2cbe4932
SHA1 365fafd2df3bd13667e6c05ef997ff505ad1b47c
SHA512 de88c2af714f29f2d422754b5776dcd51c23c5ad348b254fc46d6bb7681da0a27ec6e2aefb7ea5a107ffb75bda90468b09bb68964735ae91cedb1b5f50642007
SSDEEP 49152:WK+oecXXvOGvsovw2JndgUNPFj7HtqPzeBUbcOFoeE:WKzr0oY0nSUrjz0z+J
MD5 SHA1 SHA512 SSDEEP

Submit Download

TuxlerChromeExtensionHelperApp.exe

Path C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\TuxlerChromeExtensionHelperApp.exe
Size 1.9MB
SHA256 f611196ae83dad900f8170db750781bb30419b5289fba66b883ee9d246c57cd4
MD5 11141bbaef72f897f9e459580914f08a
SHA1 45143405288a4c043620d4fa5785fde29843e513
SHA512 c3d8c323c0bb4e736a6c3297bd109224462697e9cf554b25bb3bde39b1eaf8bba437ecf03b9ad8d81cd9dc934b6f682148a550bae73c41fa7d9bed67839a18f6
SSDEEP 49152:b75PqoYhnJUWNC3CSoCAZ2JzByqWcDebzbD:v5vYZJUWNC32BwfxGzbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbghelp.dll

Path C:\Program Files (x86)\TuxlerChromeExtensionHelperApp\dbghelp.dll
Size 1.2MB
SHA256 c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
MD5 4003e34416ebd25e4c115d49dc15e1a7
SHA1 faf95ec65cde5bd833ce610bb8523363310ec4ad
SHA512 88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
SSDEEP 24576:9AkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9T:9WiOuRg/iyFzb2QN83XfeYaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 943B
SHA256 c2c4202d022568d544a5117726947c8dc5d83027a2694f10fae88cba9af011fe
MD5 142b1831d97db32c82b475faa7003e49
SHA1 97b1a05592ef8aa0d9a54aa467e01da6901b6837
SHA512 7aeb33226642b9981e63877ab1ce3043a2243193975e51180eb12589b6ba1a09d9b6be9fb14d83f29095cec81c99b75181acfead46f7201019e37c13b7da6955
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 d10863a034cdb2f5fbbeee3fe62febc8a42f8f3156fbe92093c04f9d1465b9cb
MD5 b9977555cf7f380a325494a44c98bf8c
SHA1 c724dc861336b4456b4cdf753c4e8359e9aa62c7
SHA512 25c5156da73bce8be9dedb444e888a17af9ed3d69de26f08b3dabeda37dd151648dcd6ace912a8bd52703a94b6331e64f336cbe595dc99e60d6bc574e1228d2f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 c1ff93d407165461457f8a30e3e95b0df5f545fbe919bee956062169cb18ca50
MD5 98c5062719d2a53cf281bacbb5545c56
SHA1 8cb9495f01d2ac9e52c3cb00fc6d32b929b07ce6
SHA512 5f54862cfdde46587cfc4cb88d3cdd2aa7b16130ae58500c2b517617435f2b22abc2e90cee4d0934a44c5e0ca043f25e2db256c4d5bcf05d0a0cb9c6db240f83
SSDEEP 192:oLSArpgOGf8syy+FSeg9h2zl2tjEsXtScPS:oLSA6hyxSeOh2zYtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 7dfdc85d1852740461f9c53a5d815751f8a7bb93943820c61157f3be3a955c75
MD5 88f1aff9409a5734eb8767a4e8ade6b6
SHA1 6f9c7a4c852ca391f0d8210c00e11eff21a522af
SHA512 9e131d28bf42c0bee6f3584b7f393be824b830513fa4640f246f984014cbf2ba61bfb07627f7840a744409c44c606de5d39c3956f1e637a6330b31144fabe6e2
SSDEEP 384:NgxsLPLeFhXSj1kXqKf/pUZNCgVLH2HfkRhrUuNHGo6lglzMzCHVqj:fLPL0c1kXqKf/pUZNCgVLH2HfsrUEGtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 8c284746a9214780f5ab88a30ece20c6ae79cdad98b1ada2f28cf4ea5542e707
MD5 6af39c6e0ac5f1be3d632fe8121bb5ed
SHA1 67a4e1e2d84ebc05f6dbf3cbf99b72a861988d14
SHA512 d5fcf0a4191d137b6490878dbe1d1beb469c047ba7678ae597f2f024b8c35fc7585bf44077d861dab40e94fbc76d878cd4528660c5dd344dc5fff63fcde86c80
SSDEEP 6144:4uGzAA/g41jZKVmZbIu7Z+/J6d7Yj3Ua9jHThM8fNHK9K5g:4umAAg4DKVu8u7Z+xIsbUYHTqwNqo5g
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HelperAppEdge.exe

Path C:\Users\Admin\AppData\Local\Temp\is-DPF2U.tmp\HelperAppEdge.exe
Size 226KB
SHA256 c1bf1836cf743eb1f2f77c83f41df60d5528b32a85c9a5a6e1a6ad240336cac9
MD5 5cc648e415768e443665c2bf15fd252f
SHA1 eb101b8a786f0fdb57c1bb1b6c384254b06b08a5
SHA512 076da8018467c61543f0b33172e448dafa5f59cbc6075a748e01c384d8fdaef62e5c80fbf8f2e7b7086da69ed5f9c465ad9b5823882208d450ece38af0381de9
SSDEEP 3072:mR35UIpoVX6KOoqR/i2TI7EmOyjQQdVaice8KLw5QJpza0fO:EKIpoVV53MQdGALw54I02
MD5 SHA1 SHA512 SSDEEP

Submit Download

TuxlerChromeExtensionHelperApp.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G8QRH.tmp\TuxlerChromeExtensionHelperApp.tmp
Size 821KB
SHA256 f50e379d35c7a6f4530ee1ad74bc55cce0851bcee15986da4d30ccce54a2c19c
MD5 805bfbce579cd210bd8f130a0d95d47c
SHA1 c677fc6fd9fc799e2fb5134b87f7892918667453
SHA512 af751e40c7b830f64b5a597e5c9bbc1a68ab0ce2a3aefcb71d211d6337e933cfa0495e5bdb4f731dc048f0372ba9f78f40f6aa83ab657977bc40d5689699b59d
SSDEEP 24576:iMcMoi3rPR37dzHRA6G7WbuSEmK50+NsPyx92F:iMrPR37dzHRA6GCbB80+qCS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 0bcd3982c726d49dba4d6497705082ad928f733025d49be41d24b28548c49afe
MD5 b3ea48457d62f1d011b0f418a8432fa4
SHA1 8f83fd564200d55b8afc26335a4b0fbfdf651683
SHA512 d5a1efd6b5f84f4978d37cf9a11d23cb5e12ebbb2451cb489ab230cd56ba871b95d5a97839543cafefb2bfcadae3567d97486c752ff78dfa39e5808ec2f03c07
MD5 SHA1 SHA512

Submit Download

450ac7c0-6bfa-4c9a-b7c5-a3bb432e1d94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\datareporting\glean\pending_pings\450ac7c0-6bfa-4c9a-b7c5-a3bb432e1d94
Size 746B
SHA256 ade53d6161347b26cca84cd51f1b8f953bd6a2d99f59780d4900d1e07c42ace1
MD5 d4e308af5a17621cd946b188cc00f095
SHA1 e979dbec60b001936c29eb2260423c44ff1145cb
SHA512 81c815ff4cf3c26008539ca8c950e63bbcc919fc78eed659c6e998c838a82a7ab373af786bf295c47305eff823bc038caf1f1e585888826bc31f36b272130229
MD5 SHA1 SHA512

Submit Download

d1df7e6e-4391-4923-87d1-a36ed71169fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\datareporting\glean\pending_pings\d1df7e6e-4391-4923-87d1-a36ed71169fc
Size 10KB
SHA256 fff0fecdc8dd7ecd9677bd7ebd57414f5012dfadc3aeb797ab1dc6bd80b6c7f3
MD5 1aa292e447fac5e4c91eed253bd2219a
SHA1 a53d0c4420a3afa6b664daffdfe2ae394c221772
SHA512 ebb19581b9cc2a4b4b0bf86c7216aae15870ae49bb14116ec5fdcc3af07342891731a7c934ad0f1cc98049004df82c36994c337611200ea33706cefd7756a0f9
SSDEEP 192:LFXsEm53G0w8yqw+LHuF5x96uPiPMKjhtGI5TpKYzN39/iOKwPrR1NM+d:LPb/Ybrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs-1.js
Size 6KB
SHA256 83d31051403d4de688c0d452c97dee56bd8308baa371b1aed6f769428934505a
MD5 e0f0a88f2a2965f3a9dad471a6a6b052
SHA1 bdaaeea9c77f66fa26cb99c6d1cedf201a1ee6c0
SHA512 2e1fcfef4cbd195edfcfa9d3733376fa0d78bf856570601f0ef229ead64a9ff4079c60ba1ee0057ffdbf406673bd11422f4d0bf91e77987fd9f3e1ee967ad2a7
SSDEEP 96:xHyqnUTeqGq1TduZ3CeOTzSEPXAnpjjHjBdEbPBw8VvR:IqnIR1TduZCe6PXsjrEbPBw8V5
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 bb8eaae9b89daaaa5be4273f0a982a40c88a76fafa005f61f14eb0d3a83eb51b
MD5 cc97589a2cc7800b91fb6ed413549996
SHA1 a463f0493388f064e3ea61ebf48cc2e8237d4409
SHA512 da2b4a3829bc5a8fb8b292fa56e587c992dbb0990b181de04e0ceafc0ec28506c9d1e216a2d52d4f2973529aa4a38e5dd8a8d5973e5bdfbbadb32952d93878b8
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\sessionstore.jsonlz4
Size 892B
SHA256 a772dd2bb0f66d9c30accd5707589eddcfbefa9348e9cd0492a35f5b77c2da9d
MD5 80c4f9112a1bb2e0c5f492aadce4b771
SHA1 999523300c466ffd9ee7c71565117c58ccbb38e7
SHA512 e646399844ac6af5e63d73f08d2dd8028dadab8317c29342e464538c536ca71cbb1c36b45e27932abe02bb69f810b2c9ca96a8c986fc679afa74b16c1f610776
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 4488d7e333fb1e3b4f981576f37b5fbd3fc32b88d465bf2356dbf5ee3d008641
MD5 a6e2c0d6b59075fff94c66f804c74cbd
SHA1 56a81d3bc20afb57fcc4eb43f6862b4ee9a0ccaa
SHA512 54594421b00052ae2fb0b4adadcd9ec8a89be1c56ee623f21f7793e6c648084073b548e18b11f38d17fd15efd2ed291fa94ae5413a261ea056173d4b243a4fbf
SSDEEP 3072:3GcHzPRuFPF3y3O6g39636uacM1eHtxS979:3GcHzPR093y3O636uacM1eHy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2436-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2436-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2436-7-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3488-5-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3488-33-0x0000000000400000-0x00000000004DD000-memory.dmp

Download

memory/3488-8-0x0000000000400000-0x00000000004DD000-memory.dmp

Download